Who is responsible for your data

CorDees, spol. s r.o., IČO 09425331, Myslíkova 171/31, Nové Město, 110 00 Praha 1 (“CorDees BJJ”, “we”) is the data controller — the academy decides what is kept and why, and is your point of contact for anything in this notice.

If you request a trial class

When you fill in the trial form we store, with your consent:

• your name, date of birth, email address and (optionally) phone number;
• how you heard about us and, if a member recommended you, their name;
• the date you sent the request and the trial class we book for you;
• short notes the coach makes while arranging the trial (for example “prefers evenings”).

We use this only to arrange and follow up your trial. You can withdraw your consent at any time — we then delete the request.

If you become a member

Once you join, we keep what we need to run your membership. This is based on the membership agreement between us (for a child, the agreement is with the parent or guardian):

• your name, date of birth, contact details and address;
• your membership type, start date and whether each month is paid, prepaid, paused or unpaid — not how you paid;
• your attendance: each class you check in to with the QR code at the gym, and any extra sessions above your plan;
• classes you are enrolled in and spots you reserve for specific sessions;
• your belt and stripe promotions, CorDees awards and Student-of-the-Month awards, with their dates;
• who referred you, or whom you referred, and any referral credit;
• short training notes the coach keeps about you — never health information (see below).

Children and young people

For members under 18:

• the parent or guardian is our contact, signs the child up, and holds the app account — the app works with the parent’s email address, and one parent account can cover several children;
• we keep the parent or guardian’s name, email and phone number, and an emergency contact, so we can reach someone quickly if a child is hurt or unwell during training — this is in the child’s safety interest;
• a child never signs in to the app themselves; the parent checks the child in at the gym and sees the child’s attendance, belt history and timetable.

What we do not collect

We do not record health or medical information, and we do not record gender. A paused membership is only a payment status, not a diagnosis. If there is something the coach should know for your safety, please tell them in person — it is not written into the app. Please do not put medical details in messages to us.

Who can see your data

Only the coach (the academy owner) has access to member records in the app. Beyond that:

• the app runs on servers in the European Union (Hetzner, Germany) and sends its emails through Amazon Web Services in Frankfurt (EU). These providers store and transmit data for us under contract and act only on our instructions;
• software maintenance is done without access to real member data — test systems only ever hold made-up or anonymised records;
• other members do not see your details. If you reserve a spot, the coach is notified; nobody else is;
• we do not sell, rent or share your data with anyone for marketing. Emails you receive from the app are about your trial, your reservations, or important academy announcements — nothing else.

How long we keep your data

We keep personal details only as long as we need them:

• a trial request that does not lead to a membership is deleted 2 months after it is closed. A child marked “not ready yet” stays on the waiting list until you ask us to remove them;
• when a membership ends — you leave, or it lapses after a month unpaid without agreement — your record is kept for 90 days in case you return or something still needs settling. After that, your personal details are erased: your name is replaced, and your email, phone, address, date of birth, emergency and parent contacts and notes are removed. Your login is deleted;
• attendance counts, belt history and awards are kept afterwards without any link to you, so the academy’s statistics stay correct — they no longer identify you;
• server backups are kept for up to 30 days and then overwritten, so erased data disappears from backups within that time.

Your rights

Under the GDPR you can ask us at any time to:

• see what we hold about you, and receive a copy of it (we can export everything about you as a file);
• correct anything that is wrong — most details you can also check on your profile in the app;
• erase your data — we erase it straight away, without the 90-day wait, in the same way described above;
• restrict or object to how we use your data;
• withdraw consent you gave for a trial request;
• receive your data in a form you can take elsewhere.

Write to us at the address below and we will respond within one month. If you feel we have not handled your data properly, you can complain to the Czech data protection authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

Cookies

The app sets only the cookies it needs to work: one that keeps you signed in after you use a sign-in link, and one that remembers which child you are viewing if you have several. There are no tracking or advertising cookies and no analytics.

Changes to this notice

If we change how we handle your data, we will update this page and the date at the top. For a change that matters to you, we will also tell you by email.