Privacy Policy

KickBooker is operated by Planesta s. r. o., company ID 57050376, with its registered office at Tomášikova 12573/50E, 831 04 Bratislava – Nové Mesto, Slovakia. Planesta is responsible for the personal data it processes to operate the platform, manage accounts, respond to enquiries and protect the service. Contact us at info@planesta.sk.

The business or independent provider organising your activity also determines how it uses information to provide its own services. For data entered and managed on a business’s behalf, Planesta provides the platform under that business’s instructions. This notice does not replace the organiser’s own privacy information. We can help identify the relevant organiser when you contact us.

Account information includes your identifier, email, name, profile image when provided, language preference, business memberships and authentication/session information. We receive it from you, an authorised inviter or, if you choose that method, Google.

Bookings and participant records contain the information supplied in the relevant form: names, email, phone, activity, room, date, duration, attendance and registration status. Participant administration can also include date of birth and municipality. Provider profiles and uploaded images contain the information their authors choose to provide. Public profiles and activities are visible according to their publishing settings. Do not put diagnoses or other sensitive information into general booking or contact fields.

We also process orders, credit movements, payment identifiers and statuses, enquiries, transactional email contents and delivery records. Operational and security records can include the acting user, time, action, browser/device information and technical identifiers. IP addresses and email addresses may be processed to limit abusive requests. Where door access is configured, attempts to open a door and their results are recorded.

Using Google is optional and has two separate flows. On a public activity page, Google sends KickBooker a short-lived identity token containing your Google account identifier, email and its verification status, and name and profile-image information where available. KickBooker validates the token on the server and uses it to create or link a participant record and create the requested activity registration; a paid registration then continues to Stripe. This public-activity flow does not create a KickBooker account, an authenticated portal session or a business membership.

Google sign-in to the KickBooker portal is a separate flow. Google supplies Supabase, our authentication provider, with the same basic identity information. Supabase creates or reuses a KickBooker account and starts an authenticated session. Portal and business access still depend on the applicable permissions, and signing in does not by itself publish your profile.

Both flows request only the basic identity scopes openid, email and profile. They do not request access to your Gmail messages, Google Drive files, contacts or Google Calendar. You enter your Google password with Google, not KickBooker. The public identity credential is used to verify the registration and prevent replay; portal session credentials maintain the authenticated session. Google identity data are not used by KickBooker for advertising or sold to third parties.

You can remove the connection in your Google Account settings. Removing it stops future use of that connection but does not automatically erase participant records, activity registrations, an existing KickBooker account, bookings or financial history. Contact us to request a review of deletion or to arrange another available way to access an account.

We use data needed to create and operate your account, provide requested bookings and business services, process payments and send related confirmations. Where you are a party to the relevant service agreement, this processing is necessary to perform it or take steps you request before entering it (GDPR Article 6(1)(b)).

Protecting accounts, preventing abuse, investigating errors, maintaining an audit trail and responding to ordinary enquiries serve our legitimate interests in running a reliable, secure service (Article 6(1)(f)), balanced against your rights. Records required by applicable accounting, tax or other laws are processed to meet those obligations (Article 6(1)(c)). If a separate optional use requires consent, we request it for that use; choosing Google sign-in is not blanket consent to unrelated processing.

Without the information needed for a particular account, booking or payment, we may be unable to provide that function. Availability, capacity and payment status are handled using the service’s booking rules. We do not use Google profile data to make solely automated decisions producing legal or similarly significant effects about you.

We record limited, server-confirmed setup milestones, including account and email verification, owner onboarding, business or space creation, optional live Stripe setup, activity drafting or publication and the first confirmed booking. These operational records support our legitimate interest in operating, improving and troubleshooting a reliable platform; they do not record every click. Stripe remains optional, and the absence of a booking alone does not mean an account is stuck. Detailed progress is restricted to authorised platform administrators.

For an account created on or after the effective time of the current Terms of Use, which explicitly accepted that current version and has a verified email address, we may send at most one operational, non-promotional setup-help email after at least 72 hours without meaningful progress in self-service owner onboarding. It may ask for feedback and explain how to continue setup. Accounts created before the effective time (grandfathered accounts), invited members and staff or test accounts are excluded. We use no tracking pixels and do not measure email opens.

While the account exists, we retain the current minimal milestone snapshot and its timing, evidence of Terms acceptance, any administrative suppression record, and the minimal status and scheduling, attempt and delivery timestamps needed to prevent a second setup-help email. After 12 months, queued email content, the recipient address, provider message identifier and delivery-error details are removed or anonymised; the minimal one-email evidence remains. This feature does not retain a detailed click or editing history. These limits do not change the retention of bookings, payments or other records described below.

Information is available to Planesta personnel and authorised business administrators or providers as needed for their roles. Service suppliers process data needed for their functions: Supabase for authentication, the database and file storage; Vercel for hosting and running the website; configured email-delivery providers for transactional messages; and Google when you choose Google sign-in.

If you pay online, Stripe receives payment and order information such as customer email, amount, currency and booking identifiers. Some checkout items include the participant’s name. KickBooker records transaction results and may receive payment-event payloads; it is not a service for storing your full card number or card security code. Stripe also processes information under its own applicable terms.

Optional door integrations communicate with the configured device service, such as Nuki or SwitchBot, to carry out authorised access actions. Not every business uses every integration. Data may also be disclosed when required by law or necessary to establish, exercise or defend legal claims. The privacy information of the main service providers is linked below.

Cloud hosting, authentication, payments and email delivery can involve processing outside the European Economic Area, including by providers and their subprocessors. Selecting a European database region does not mean that all support, payment or other processing occurs only in the EEA.

Applicable provider data-processing terms govern those services and provide transfer safeguards, including European Commission standard contractual clauses where required, or an applicable adequacy decision. Ask info@planesta.sk for information about the safeguards relevant to your data or how to obtain a copy. We do not describe the service as EU-only storage.

Account information is kept while needed to provide and manage the account. For bookings, credits, payments, enquiries and related history, the relevant criteria are completion of the service, settlement of payments or refunds, applicable accounting and other legal obligations, and the period needed to resolve an outstanding complaint or legal claim. These criteria can require keeping specific records after access to a business ends.

The separate business operational-history records are assigned a 12-month expiry and scheduled for cleanup. This is not a 12-month deadline for every business, financial or door-access record. Limited technical cleanup also exists for expired guest-verification records and old payment-event payloads; it does not erase the related bookings or financial ledger. Provider logs and backups have their own applicable retention and replacement cycles.

Cancelling a booking, archiving a participant or disabling membership is not account erasure and does not remove all personal fields. Deletion requests are assessed individually against the purposes and obligations above. We remove or anonymise data when there is no continuing reason to retain it; this is not a promise of instant deletion from every system or backup. Contact us for the retention criteria applying to a specific record.

KickBooker uses browser storage for sign-in sessions, your language, the selected business and temporary return or verification information. Some values persist between visits; others last for a browser tab or a particular flow. Clearing this storage may sign you out, reset preferences or interrupt verification. External services you visit, such as Google or Stripe, use their own technologies under their privacy information.

Access controls, authenticated requests and role checks limit access to platform data. Operational events support security and troubleshooting; they are not a promise that no activity is logged. No method of transmission or storage can guarantee absolute security. Keep your credentials private and contact us if you suspect unauthorised access.

Subject to applicable law, you can request access, correction, erasure, restriction or portability of your personal data. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. These rights are not absolute; for example, a legal record-keeping obligation can prevent immediate erasure of a particular transaction.

You may complain to your competent supervisory authority. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic; its information and complaint procedure are linked below. You do not have to contact us before exercising that right.

Email info@planesta.sk from the address associated with your account where possible. Tell us what you need and identify the relevant business or booking if the request concerns one. Do not send passwords, sign-in codes or full payment-card details. We may need proportionate information to verify your identity before disclosing or changing protected data.

We respond within the periods required by applicable law, normally within one month for GDPR rights requests. If a lawful extension is needed, we explain it. If another business or provider is responsible for the processing concerned, we identify that party or help route your request appropriately. Removing a Google connection and requesting deletion from KickBooker are separate actions.

We update this notice when the service or relevant processing changes and show the updated date on this page. If a change requires a separate notice or consent, we provide it as required. This page describes KickBooker and does not change an activity’s booking, payment, cancellation or door-access rules.