Privacy Policy - 4climbing
Privacy Policy – Rozlomity app
This policy explains what personal data the Rozlomity mobile app for Android and iOS (the “app”) processes, what we use it for, who we share it with, how long we keep it and what rights you have. Processing is governed by Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on the Protection of Personal Data.
1. Data controller
Rozlomity s.r.o.
Študentská 1, 040 01 Košice, Slovakia
Company ID (IČO): 48 027 413
Registered in the Commercial Register of the Municipal Court Košice, Section Sro, Insert No. 36830/V
Email for personal data enquiries: info@rozlomitysport.sk
2. What data we process
Data you provide
| Data | Required | Purpose |
|---|---|---|
| First and last name | yes | account management, membership card |
| Nickname | yes | shown in the leaderboard and to your friends |
| Email address | yes | sign-in, account verification, password reset, important notices |
| Password | yes | sign-in; stored only in encrypted (hashed) form |
| App language | yes | showing content in your chosen language |
| Phone number | no | contact detail in your profile, if you add it |
Data created as you use the app
- Customer code – an identifier shown as a QR code on your membership card, used by reception to recognise you at entry.
- Climbing activity – logged rope and boulder ascents, completed challenges, points earned and rewards.
- Visits and passes – history of your visits to the climbing wall and the status of your passes.
- Friends – the list of users you add as friends.
- Notifications and their settings – messages we send you and which types of notifications you want to receive.
- Device identifier for push notifications (Firebase Cloud Messaging token) – so we can send notifications to your phone.
- Usage statistics (Firebase Analytics) – e.g. app installation, completed registration, display of the rating prompt, together with technical device data (model, OS version, approximate country). They are linked to a random installation identifier, not to your name or email, and are not used for advertising.
What we do not process
- Location – the app does not determine your location.
- Camera – used only to read QR codes on the wall. The image is processed on your phone, is not stored and is not sent anywhere.
- Contacts, photos, payment cards – the app does not access them. The app contains no ads and no payments.
3. What we use data for and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account, membership card, records of visits and passes | performance of a contract – Art. 6(1)(b) |
| Logging ascents, challenges, points, rewards, leaderboard, friends | performance of a contract – Art. 6(1)(b) |
| Push notifications | your consent given in your phone’s system settings – Art. 6(1)(a); you can withdraw it at any time in your phone or app settings |
| Usage statistics to improve the app | legitimate interest – Art. 6(1)(f) |
| Security and prevention of account misuse | legitimate interest – Art. 6(1)(f) |
| Accounting records (orders, invoices) | legal obligation – Art. 6(1)(c) |
| Handling your questions and requests | performance of a contract or legitimate interest – Art. 6(1)(b) and (f) |
4. What other users can see
- The leaderboard shows your nickname and number of points.
- Friends you add can see your nickname and your logged ascents.
We do not show your name, email or phone number to other users.
5. Who we share data with
We do not sell your data and do not use it for advertising. We share it only with processors who run the app on our behalf, and with public authorities where required by law.
| Recipient | Purpose |
|---|---|
| JPsoftware s.r.o., Študentská 1, 040 01 Košice, Company ID: 36 602 175 (Slovakia, EU) | development and operation of the app and of the server where the data is stored |
| Google Ireland Ltd. – Firebase Authentication | sign-in (email and encrypted password) |
| Google Ireland Ltd. – Firebase Cloud Messaging | delivery of push notifications |
| Google Ireland Ltd. – Firebase Analytics | usage statistics |
| Google Ireland Ltd. – Google Wallet | only if you add your membership card to Google Wallet yourself: name and customer code |
6. Transfers outside the EU
Google services may also process data outside the EU/EEA (mainly in the USA). Such transfers are protected by the European Commission’s Standard Contractual Clauses and the EU–US Data Privacy Framework.
7. How long we keep data
- Account data and climbing activity – until you delete your account.
- Orders, invoices and accounting records – 10 years under Slovak Act No. 431/2002 Coll. on Accounting. After account deletion they are disconnected from it.
- Usage statistics – 14 months, then deleted automatically.
- Push notification token – until you sign out of the app or delete your account.
- Customer support correspondence – up to 24 months after the request is resolved.
8. Deleting your account
You can delete your account and the personal data associated with it at any time.
In the app (immediately)
- Open the Rozlomity app and sign in.
- Go to the Profil (Profile) tab.
- Tap the gear icon in the top right corner (Nastavenia – Settings).
- Tap Zmazať účet (Delete account) and confirm.
Your account is deleted immediately and cannot be restored.
Without the app
If you no longer have the app or cannot sign in, email info@rozlomitysport.sk from the email address registered to your account with the subject “Account deletion”.
We will delete your account within 30 days at the latest and confirm it by email. Requests sent from a different email address will be handled only after we verify that the account belongs to you.
What is deleted
- account data: first name, last name, nickname, email, phone, language, customer code and sign-in credentials including your password
- logged rope and boulder ascents
- challenges, points and rewards earned
- visit history
- friends and your place in the leaderboard
- notifications, their settings and device identifiers for push notifications
What we keep
| Data | How long | Why |
|---|---|---|
| Orders, invoices and payment records | 10 years | required by Slovak Act No. 431/2002 Coll. on Accounting; disconnected from the deleted account |
| Valid passes | until they expire | so you can use the service you paid for |
| Anonymous usage statistics (Firebase Analytics) | 14 months | they contain no name or email and are deleted automatically after this period |
A card you added to Google Wallet can be removed directly in the Google Wallet app.
9. Your rights
You have the right to:
- access your data and obtain a copy,
- rectify inaccurate data (most of it can be edited directly in your profile),
- erasure of your data (see Deleting your account),
- restrict processing,
- data portability,
- object to processing based on legitimate interest (e.g. statistics),
- withdraw consent to push notifications at any time.
Send your request to info@rozlomitysport.sk. We will respond within 30 days.
If you believe we are handling your data improperly, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk.
10. Security
Communication between the app and the server is encrypted (HTTPS). Sign-in tokens are stored on your phone in the system’s secure storage (Android Keystore / iOS Keychain). We never store your password in readable form. Only authorised persons have access to data on the server.
11. Automated decision-making
We do not carry out any automated decision-making or profiling that would have legal or similarly significant effects on you.
12. Children
The app is intended for persons aged 16 and over. Younger users may use an account only with the consent of a parent or legal guardian.
13. Changes to this policy
We may update this policy, e.g. when we add a new feature. The current version is always available on this page. We will inform you about significant changes in the app.