Privacy Policy

Teniški Klub Krško

Effective date: 2026-11-14

1. Introduction

This Privacy Policy explains how Teniški Klub Krško, operating as Teniški Klub Krško ("Club", "we", "us"), collects, uses, and protects your personal data when you create an account, purchase a membership, make a booking, or otherwise use our services, including through the SportyPlus platform ("Platform"). It is intended to comply with the EU General Data Protection Regulation (GDPR) and applicable local data protection law.

2. Data Controller

For personal data collected in connection with your membership and bookings with the Club, the data controller is:

Teniški Klub Krško
Cesta krških žrtev 130b, Krško, Slovenia
Email: info@tenis-krsko.si
Phone: +38670901000
Website: moj.tenis-krsko.si

SportyPlus, the software platform used by the Club to operate its booking, membership, and payment services, acts as a data processor on the Club's behalf and does not independently determine the purposes of processing your data.

3. What Data We Collect

• Account data: name, email address, phone number, date of birth (where required for age-restricted memberships), and password.
• Membership and booking data: membership plan, booking history, attendance, and any preferences you provide.
• Payment data: billing details and transaction records processed via the Platform's payment processor. The Club does not store full card details; these are handled directly by the payment processor.
• Health data: medical certificates, sports physicals and similar documents you, your guardian or Club staff file with the Club, with any notes about them. This is a special category of personal data under Article 9 GDPR.
• Communications: messages you send to the Club or its staff through the Platform, and support requests.
• Technical data: IP address, device and browser information, and usage data collected automatically when you use the Platform.

4. How We Use Your Data

We process your personal data for the following purposes and legal bases under Article 6 GDPR:

• To create and manage your account, memberships, and bookings (performance of a contract).
• To process payments and issue invoices (performance of a contract and compliance with legal obligations).
• To communicate with you about bookings, membership status, and service changes (performance of a contract and legitimate interest).
• To send marketing communications, where you have opted in (consent, which you may withdraw at any time).
• To maintain the safety and proper functioning of our facilities, and to prevent fraud or misuse (legitimate interest).
• To comply with tax, accounting, and other legal obligations (legal obligation).

Health data is processed only to confirm that you are fit to take part in training and competition where the law or a sports federation requires it, or where you have given your explicit consent by handing a document in (Article 9(2)(a) GDPR). You may withdraw that consent by deleting the document. Health data is visible only to you, your guardians, the Club's administrators and, for support, SportyPlus as our processor; it is encrypted at rest and every opening of a document by someone other than you is logged. It is never used for marketing.

5. Sharing Your Data

We share personal data only with:

• SportyPlus, as the data processor providing the booking, membership, and payment infrastructure used by the Club.
• Payment processors, to the extent necessary to process your payments.
• Coaches, trainers, or staff directly involved in delivering the services you have booked.
• Public authorities, where required by law.

We do not sell your personal data to third parties.

6. International Data Transfers

The Club's data is stored and processed in the European Union. Where a service provider transfers personal data outside the European Economic Area (EEA), we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework) or on the European Commission's Standard Contractual Clauses, in accordance with Chapter V GDPR. The list of SportyPlus's sub-processors and where they process data is published at moj.tenis-krsko.si/legal/sub-processors.

7. Data Retention

We retain your personal data for as long as your account or membership is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations, or to resolve disputes. Data no longer needed for these purposes is deleted or anonymized. A deleted medical document can be restored for 30 days and is then permanently erased, together with its file. An expired medical document is permanently erased one year after its expiry date.

8. Cookies and Third-Party Content

Our website uses only cookies that are strictly necessary for it to work: to keep you signed in, to remember your language and display preferences, and to keep sign-in secure. We do not use analytics or advertising cookies, and no tracking tools are loaded on our pages.

Maps on our website are provided by Google Maps (Google Ireland Limited / Google LLC). A map is loaded only when you choose to show it; at that point Google receives your IP address and may set its own cookies, under Google's privacy policy. Without showing the map you can still open our location in Google Maps through a plain link. Your choice to show maps is remembered in your browser and can be cleared by deleting this site's stored data.

9. Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data, subject to legal retention requirements;
• Request restriction of processing in certain circumstances;
• Receive your data in a portable format;
• Object to processing based on legitimate interest or for direct marketing;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with a data protection supervisory authority , in particular in the EU member state where you live or work.

To exercise any of these rights, contact us at info@tenis-krsko.si.

10. Children's Data

Where a Member is a minor, their account is registered and managed by a parent or legal guardian, who is responsible for the accuracy of the data provided and for exercising the minor's data protection rights on their behalf.

11. Data Security

We implement appropriate technical and organizational measures, together with SportyPlus as our processor, to protect your personal data against unauthorized access, loss, or misuse.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or by email with reasonable prior notice. Continued use of our services after changes take effect constitutes acceptance of the updated policy.

13. Contact

Teniški Klub Krško
Cesta krških žrtev 130b, Krško, Slovenia
Email: info@tenis-krsko.si
Phone: +38670901000
Website: moj.tenis-krsko.si