👤 1. Data controller
The controller of your personal data is Jaroslav Lauermann, registered office Zahořany 111, 411 48 Křešice, Czech Republic, Company ID (IČO) 03365204 (the “controller”), operator of the Bubbles Football brand and the website www.bubblesfootball.com.
📋 2. What data we process
- Booking and payment: first and last name, e-mail, phone, selected venue, date, number of players, language and details of the deposit paid. Card payments are processed by Stripe – we never see or store your card number.
- Enquiries and contact form: name, e-mail, phone, company name (for corporate events) and your message.
- Communication: e-mails, phone calls and WhatsApp messages you send us.
- Technical data: IP address, browser and device type, pages visited (server and Cloudflare logs, necessary to run and secure the website).
- Browser settings: chosen language and cookie consent status (localStorage). See our Cookie Policy for details.
🎯 3. Purposes and legal bases
- Handling your booking and payment and providing the service (including adding the date to our calendar and sending a confirmation e-mail) – performance of a contract, Art. 6(1)(b) GDPR.
- Accounting and tax obligations – legal obligation, Art. 6(1)(c) GDPR.
- Answering enquiries and questions – steps prior to entering into a contract, Art. 6(1)(b) GDPR.
- A one-off review request the day after the event, protection of legal claims, website security and abuse prevention – legitimate interest, Art. 6(1)(f) GDPR. You may object to this processing at any time.
- Non-essential cookies and similar technologies – only with your consent, Art. 6(1)(a) GDPR.
We do not use your data for automated decision-making or profiling, and we do not sell it to third parties.
⏳ 4. How long we keep your data
- Accounting and tax documents (invoices, payment records): for the period required by law, generally 10 years.
- Booking records and customer contacts: for as long as necessary to perform the contract and handle any claims, at most 3 years after the last event.
- Non-binding enquiries not followed by an order: at most 12 months.
- Technical logs: at most 12 months.
🤝 5. Who we share data with
Your data is processed only by the processors we need to run the service:
- Stripe Payments Europe, Ltd. – online card payments and Apple Pay / Google Pay.
- Google Ireland Ltd. – booking calendar (Google Calendar / Apps Script) and maps linked from the website.
- Webglobe, s.r.o. – website and e-mail hosting.
- Cloudflare, Inc. – website security and acceleration (CDN).
- Meta Platforms Ireland Ltd. (WhatsApp) – only if you contact us via WhatsApp.
- Our accountant and tax adviser, and public authorities where required by law.
Some providers (Stripe, Google, Cloudflare, Meta) may transfer data to the USA. This takes place on the basis of the European Commission’s adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
⚖️ 6. Your rights
Under the GDPR you have the right to:
- access your personal data and obtain a copy,
- have inaccurate data rectified,
- erasure (“right to be forgotten”) unless the law requires us to keep the data,
- restriction of processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time (without affecting processing carried out before withdrawal).
To exercise your rights, e-mail [email protected]. You also have the right to lodge a complaint with the supervisory authority: the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
🔐 7. Security and further information
The website uses an encrypted connection (HTTPS). You enter payment details directly on Stripe’s secure payment page. Only people who need the data have access to it.
Online bookings are intended for persons over 18; minors may take part only with the consent and under the responsibility of a legal guardian.
We may update this policy. The current version is always published on this page. Booking conditions are set out in our Terms & Conditions.