Privacy policy
Privacy policy (GDPR)
Information on the processing of personal data
pursuant to Articles 12, 13 and 14 of the GDPR (the “Information”)
This Information describes how the controller LForP s. r. o., with its registered office at Námestie slobody 7440/13, 811 06 Bratislava, Slovak Republic, Company ID: 55 723 080, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No. 172781/B (the “controller”), processes personal data. If anything in this Information is unclear to you, we will gladly explain any term or part of it. We process personal data in accordance with the requirements of the GDPR, Act No. 18/2018 Coll. on the Protection of Personal Data and on amendments to certain acts, as amended, and other generally binding legislation.
1. Basic terms
- Personal data – any information relating to an identified or identifiable natural person, for example first name, surname, date of birth, birth number, telephone number, e-mail address, IP address and similar.
- GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- Data subject – the natural person to whom the personal data relate.
- Processing of personal data – an activity or processing operations that the controller or the processor carries out with personal data.
- Controller – a natural person or legal entity that determines the purposes and means of processing personal data.
- Purpose of processing personal data – a clearly defined or specified intention to process personal data, determined in advance and linked to a particular activity.
- Legitimate interest – an interest of the controller or of a third party from which the need to process personal data arises, where it overrides the interests or fundamental rights and freedoms of the data subject.
- Recipient – a natural person or legal entity, public authority, agency or other body to which personal data are disclosed.
2. Controller of personal data
The controller of personal data is:
| Controller: | LForP s. r. o. |
| Legal form: | limited liability company |
| Registered office: | Námestie slobody 7440/13, 811 06 Bratislava, Slovak Republic |
| E-mail: | info@lounge4padel.sk |
| Phone number: | +421 910 276 558 |
When operating company profiles on the social networks Facebook and Instagram, the controller acts, to the extent of the profile traffic statistics, as a joint controller with Meta Platforms Ireland Limited (Dublin, Ireland). The essence of the joint controllership arrangement is available on the website of the operator of the relevant social network. The data subject may exercise their rights with either of the joint controllers.
When using the Cloudflare Bot Management service on our website, which serves to detect and protect against bots, we act as a joint controller with X Internet Unlimited Company (Dublin, Ireland) at the stage of obtaining and transferring a visitor’s personal data.
3. Purposes and legal bases of processing
| purpose | legal basis |
|---|---|
| Bookkeeping Fulfilling obligations arising from accounting and tax legislation, keeping accounting records and managing accounting documents. |
Art. 6(1)(c) GDPR – compliance with a legal obligation (Act No. 431/2002 Coll. on Accounting, Act No. 222/2004 Coll. on VAT, Act No. 595/2003 Coll. on Income Tax) |
| Internal personal data protection agenda Records of personal data necessary to fulfil the obligations laid down by the GDPR and other data protection legislation, in particular records and handling of data subject requests and records of security incidents. |
Art. 6(1)(c) GDPR – compliance with a legal obligation under Art. 12 to 22, Art. 30, 33 and 34 GDPR |
| Supplier and customer contracts Concluding contracts and performing the rights and obligations arising from contractual relationships with suppliers and customers, including pre-contractual relationships. |
Art. 6(1)(b) GDPR – performance of a contract Art. 6(1)(f) GDPR – legitimate interest Art. 6(1)(c) GDPR – compliance with related legal obligations |
| Orders and purchase handling (e-shop) Receiving and processing orders for goods through our online store, communicating with the customer, invoicing, payment and arranging delivery of the goods. |
Art. 6(1)(b) GDPR – performance of the purchase contract concluded on the basis of the order Art. 6(1)(c) GDPR – compliance with related accounting and tax obligations |
| Registration and management of customer accounts Creating and managing a customer account on the e-shop website, which allows the customer to track their orders and makes repeat purchases easier. |
Art. 6(1)(b) GDPR – steps taken at the request of the data subject prior to entering into a contract, and performance of the contract |
| Website (cookies and similar technologies) Ensuring the functionality of the website and e-shop www.lounge4padel.com, analysing its traffic and using the data obtained for marketing and advertising purposes through cookies and similar technologies. |
Art. 6(1)(a) GDPR – consent of the data subject for analytical, marketing and advertising cookies, in conjunction with Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications |
| Profiles on the social networks Facebook and Instagram Marketing – presentation of the controller and the products and services it provides, communication with interested parties. |
Art. 6(1)(f) GDPR – legitimate interest |
| Direct marketing Sending the e-mail newsletter and marketing offers relating to the controller’s products and services. |
Art. 6(1)(a) GDPR – consent of the data subject without consent under the conditions set out in Section 116 of Act No. 452/2021 Coll. on Electronic Communications |
| Loyalty and rewards programme Operating the loyalty (rewards) programme for customers, keeping records of points and rewards collected, and providing benefits to regular customers. |
Art. 6(1)(b) GDPR – fulfilling the terms of the loyalty programme at the customer’s request |
| Brand ambassadors – records Cooperation with brand ambassadors and use of their photographs, names and likenesses for marketing and promotional purposes on the website and on the controller’s social media profiles. |
Art. 6(1)(a) GDPR – consent of the data subject |
| Customer references and reviews Obtaining, displaying and publishing customer reviews, references and recommendations on the website and on the controller’s social media profiles |
Art. 6(1)(a) GDPR – consent of the data subject for references provided directly to the controller Art. 6(1)(f) GDPR – legitimate interest where reviews published by the data subject themselves on a third-party platform are displayed |
| Consumer competitions Organising, evaluating and promoting consumer competitions, contacting the winner and handing over the prize. |
Art. 6(1)(a) GDPR – consent for publishing the winner’s name Art. 6(1)(b) GDPR – participation in the competition under its rules Art. 6(1)(c) GDPR – compliance with tax and reporting obligations for taxable prizes |
| Communication with interested parties and customers Handling enquiries, questions and suggestions received by phone, e-mail or through the WhatsApp and Messenger applications. | Art. 6(1)(b) GDPR – steps taken prior to entering into a contract at the request of the data subject Art. 6(1)(f) GDPR – legitimate interest where the communication does not lead to a contract |
| Complaints and legal claims Handling complaints and establishing, exercising and defending legal claims. |
Art. 6(1)(b) GDPR – performance of a contract Art. 6(1)(c) GDPR – compliance with legal obligations Art. 6(1)(f) GDPR – establishing, exercising and defending legal claims |
4. Legitimate interests of the controller
| purpose | description |
|---|---|
| Supplier and customer contracts | the legitimate interest of the controller and its contractual partners in the proper performance of contracts; this legal basis applies to the personal data of contact persons of contractual partners that are legal entities and are not themselves a party to the contract |
| Profiles on the social networks Facebook and Instagram | the controller’s legitimate interest in promoting its products and services, in communicating with interested parties and in processing personal data that users themselves publish when interacting with the controller’s profile |
| Customer references and reviews | the controller’s legitimate interest in promoting its products and services through reviews that customers themselves have published on a publicly accessible platform |
| Communication with interested parties and customers | the controller’s legitimate interest in handling an enquiry or suggestion where the communication does not lead to a contract |
| Complaints and legal claims | the controller’s legitimate interest in protecting its rights and property, in particular in proceedings before a court or another authority |
5. Recipients
A recipient is any person to whom the controller discloses personal data, regardless of whether they are a third party. Depending on the individual processing purposes, the data processed by the controller are disclosed to the following recipients:
- processors (accounting service provider, e-shop platform provider, payment gateway provider, web hosting provider);
- joint controllers: Meta Platforms Ireland Limited, X Internet Unlimited Company;
- state authorities (tax office, social insurance institution);
- health insurance company, pension asset management company;
- a recipient may also be another authorised entity.
6. Transfer to a third country or an international organisation
A transfer to a third country may occur in particular when using the controller’s company profiles on the social networks Facebook and Instagram, when communicating through the Messenger and WhatsApp applications, when using the e-mail service and cloud storage, and with the tools deployed on the website. In these cases personal data may be transferred to the United States of America.
The transfer takes place on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU–U.S. Data Privacy Framework, where the recipient is certified under that framework. Where the recipient is not certified, the transfer takes place on the basis of standard contractual clauses under Art. 46(2)(c) GDPR. We will provide a copy of the appropriate safeguards on request.
7. Retention period
We retain personal data in a form that permits identification for no longer than is necessary to achieve the purpose for which the personal data are processed, or for the period laid down by law. We retain personal data as follows:
| purpose | retention period (or the criteria used to determine it) |
|---|---|
| Bookkeeping | 10 years following the year to which they relate: financial statements, accounting documents, accounting books, the depreciation plan, inventory lists, inventory records and the chart of accounts 10 years following the year to which they relate: invoices and records kept for value added tax purposes |
| Internal personal data protection agenda | 5 years – the objective time limit for imposing a fine in proceedings before the Office for Personal Data Protection of the Slovak Republic |
| Supplier and customer contracts | for the duration of the contractual relationship and for 10 years after it ends; the period reflects the archiving period for accounting documents and the limitation periods for claims under the contract |
| Orders and purchase handling (e-shop) | data relating to a completed order are further processed under the purpose “Bookkeeping” for the period stated there unfulfilled order – 1 year from the last communication with the customer |
| Registration and management of customer accounts | for as long as the customer account exists; if the account is inactive for 3 years the data will be erased, unless they need to be retained for another purpose (e.g. bookkeeping) |
| Website (cookies and similar technologies) | according to the expiry period of each cookie stated in the cookie list; consent given is retained for 12 months from the date it was given |
| Profiles on the social networks Facebook and Instagram | for as long as the controller’s profile on the social network exists; comments, reviews and messages for as long as they remain on the profile, or until they are deleted |
| Direct marketing | until consent is withdrawn, or until unsubscribing from the newsletter |
| Loyalty and rewards programme | for the duration of the customer’s participation in the loyalty programme; 1 year after participation ends, unless longer retention is needed for another purpose |
| Brand ambassadors – records | for the duration of the cooperation and the validity of the consent, at most 5 years from the date it was given; after consent is withdrawn the record will be removed within 30 days |
| Customer references and reviews | reviews published by the data subject on a third-party platform – for as long as the data subject keeps them published on that platform references provided directly to the controller – until the data subject withdraws consent, at most 5 years from the date it was given |
| Consumer competitions | data of unsuccessful entrants – 3 months from the evaluation of the competition winner’s data – 10 years where an obligation arose to keep an accounting or tax document for the prize, otherwise 3 months from handing over the prize |
| Communication with interested parties and customers | 1 year from the last communication, where the communication did not lead to a contract |
| Complaints and legal claims | 4 years from settling the complaint, or from the date the damage occurred; where a claim is brought, until the proceedings have concluded with final effect and the period for enforcing the decision has expired |
8. Rights of the data subject
Data subjects have the following rights:
Information on the processing of personal data
This information covers in particular the identity and contact details of the controller, the purposes of processing, the legal basis for processing, the categories of personal data concerned, the recipient or categories of recipients of the personal data, information on transfers of personal data to third countries, the retention period, a list of your rights, the option of contacting the Office for Personal Data Protection of the Slovak Republic, the source of the personal data processed, and information on whether and how automated decision-making and profiling take place.
Right of access to personal data
You have the right to obtain confirmation as to whether or not personal data are being processed and, if they are, you have the right of access to information on the purposes of processing, the categories of personal data concerned, the recipients or categories of recipients, the retention period, information on your rights, on the right to lodge a petition to initiate proceedings with the Office for Personal Data Protection of the Slovak Republic, information on the source of the personal data, information on whether automated decision-making and profiling take place, and information and safeguards in the case of a transfer of personal data to a third country or an international organisation. You have the right to be provided with a copy of the personal data processed, which must not adversely affect the rights and freedoms of others.
Right to rectification
The data subject has the right to have inaccurate personal data rectified without undue delay. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (right to be forgotten)
In the cases set out in Art. 17 GDPR we are obliged to erase the data subject’s personal data. However, each such request is assessed individually to determine whether the conditions are met, because as a controller we may be bound by a legal obligation to retain the personal data, or we may process the personal data on the basis of a legitimate interest. Where our legitimate interest (or that of a third party) overrides the interests of the data subject, we are entitled to continue processing the personal data for that purpose.
Right to restriction of processing
The data subject may ask the controller to restrict the processing of personal data where one of the following situations arises:
- the data subject has contested the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
- the processing of the personal data is unlawful, but the data subject opposes the erasure of the data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims;
- the data subject has objected to the processing of personal data in the specific situations set out in the GDPR (a task carried out in the public interest, the legitimate interest of the controller, or profiling), pending verification of whether the legitimate grounds of the controller override those of the data subject.
Right to data portability
The data subject has the right to receive the personal data concerning them in a structured, commonly used and machine-readable format, and the right to request that those data be transmitted to another controller. Under Art. 20(1) GDPR this right applies only to personal data that the data subject has provided to the controller, that are processed by automated means, and whose processing is based on consent or on the performance of a contract. This right does not apply to personal data processed on the basis of a legal obligation or a legitimate interest.
Right to object and automated individual decision-making
The data subject has the right to object at any time to the processing of personal data concerning them that is carried out on the legal basis of the public interest or of a legitimate interest. Where the data subject objects, the controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims.
The data subject may at any time object to the processing of personal data by the controller for direct marketing purposes. If the data subject objects to processing for direct marketing purposes, and that direct marketing is based on the controller’s legitimate interest, the personal data will no longer be processed for such purposes.
Processing based on consent (right to withdraw consent)
Where processing is based on the consent of the data subject under Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, data subjects have the right to withdraw their consent at any time, and to do so as easily as it was given. Such withdrawal of consent does not affect the lawfulness of processing based on consent before it was withdrawn.
Right to lodge a petition, suggestion or complaint with the supervisory authority
Data subjects may at any time submit a petition, suggestion or complaint concerning the processing of personal data to the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic, tel. no.: +421/2/3231 3220, website: https://dataprotection.gov.sk/sk/. A petition to initiate personal data protection proceedings may be submitted under Section 100 of Act No. 18/2018 Coll. The data subject also has the right to bring their claim before a court.
Time limit for a response
We will provide our response and, where applicable, information on the measures taken as soon as possible, and no later than one month from the date the request is received. Where necessary, and taking into account the complexity and number of requests, we are entitled to extend this period by a further two months. We will inform the data subject of any extension, including the reasons for it, within one month of receiving the request.
Point of contact
Data subjects may exercise their individual rights with the controller by e-mail at: info@lounge4padel.sk or by post to LForP s. r. o., Námestie slobody 7440/13, 811 06 Bratislava – Staré Mesto, Slovak Republic.
The controller is entitled to verify the identity of the applicant where it has reasonable doubts about their identity.
All communications and responses relating to the exercise of rights are provided free of charge. However, where a request is manifestly unfounded or excessive, in particular because it is repetitive, we are entitled to charge a reasonable fee reflecting the administrative costs, or to refuse to act on the request. Where a request for copies of the personal data processed is made repeatedly, we reserve the right to charge a reasonable fee for the administrative costs.
9. Provision of personal data
If you wish to buy goods from us through our online store, providing the personal data listed in the order form is a requirement necessary to conclude the purchase contract. You are not obliged to provide these data, but without them we are unable to accept or fulfil your order.
For bookkeeping and for meeting tax obligations, the provision of personal data is a statutory requirement; failure to provide them would prevent us from meeting the obligations imposed on us by law.
Providing personal data for purposes where the legal basis is consent (in particular the publication of photographs and references, and marketing cookies) is entirely voluntary. Neither withholding nor withdrawing consent has any negative consequences for you and it does not affect the provision of our services.
10. Automated decision-making and profiling
The controller does not use automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR that would produce legal effects concerning the data subject or similarly significantly affect them.
11. Processing for a further purpose
In processing personal data we respect the principle of purpose limitation, meaning that we process data only on the basis of a specified, explicit and legitimate purpose, except where the processing is for a compatible purpose. Processing for another purpose may also be based on the consent of the data subject or on European Union or Slovak law. To determine whether another purpose is compatible with the purpose for which the personal data were originally collected, we carry out a compatibility test before processing begins, in which we take into account:
- any link between the purposes for which the personal data were collected and the purposes of the intended further processing;
- the circumstances in which the personal data were collected, in particular regarding the relationship between the data subjects and the controller;
- the nature of the personal data, in particular whether special categories of personal data under Article 9 GDPR or personal data relating to criminal convictions and offences under Article 10 GDPR are processed;
- the possible consequences of the intended further processing for the data subjects;
- the existence of appropriate safeguards, which may include encryption or pseudonymisation.
Where we intend to process personal data for a purpose other than that for which they were collected, we will provide you, prior to that further processing, with information on that other purpose in accordance with Art. 13(3) GDPR.
12. Overview of selected personal data protection legislation
- Charter of Fundamental Rights of the European Union (Article 8),
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
- Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (consolidated version),
- Act No. 452/2021 Coll. on Electronic Communications, as amended,
- Constitution of the Slovak Republic (published under No. 460/1992 Coll.),
- Act No. 18/2018 Coll. on the Protection of Personal Data and on amendments to certain acts, as amended,
- Act No. 40/1964 Coll., the Civil Code, as amended (Sections 11 to 13 – protection of personality, including protection of a person’s likeness),
- Act No. 431/2002 Coll. on Accounting, as amended,
- Decree No. 158/2018 Coll. of the Office for Personal Data Protection of the Slovak Republic on the procedure for carrying out a data protection impact assessment.
13. Use of cookies
The website https://www.lounge4padel.com uses cookies, which collect and store information while it is being browsed. Cookies are used for various purposes, for example to record a choice the user made while browsing the website, or to record the user’s activity while browsing the website. They can also be used to remember any information the user previously entered into forms on the website. Their use can be disabled in most internet browsers. Under the GDPR (Recital 30), cookies are defined as online identifiers which, combined with unique identifiers and other information received by servers, may be used to create profiles of natural persons and identify them, and are therefore regarded as personal data under the GDPR.
We use technically necessary cookies, without which the website cannot function, without the user’s consent (Section 109(8) of Act No. 452/2021 Coll.). All other cookies, in particular analytical, marketing and advertising cookies, are used only on the basis of the user’s consent. The user may withdraw consent to cookies at any time. Every user can give or refuse consent to the use of cookies when visiting the website through the consent management tool (banner, CMP, bar). If the user does not consent to the use of cookies, those cookies are not activated on the website; this does not apply to technically necessary cookies.
A detailed list of the cookies used, including their provider, purpose and expiry period, is set out in the Cookie Policy published on the controller’s website.
We use the following cookies:
Necessary cookies: These are required for the usability of the site. They help to build web pages by enabling basic functions such as page navigation and access to protected areas of the website. The website cannot function properly without these cookies. No consent is required for their use.
Statistical cookies: These help the controller understand how visitors use the website by collecting and evaluating traffic information. We use them only on the basis of your consent.
Marketing and advertising cookies: These are used to display content and advertising tailored to the user’s interests, including on third-party websites. We use them only on the basis of your consent.
| cookie name | provider | type | validity | purpose |
|---|---|---|---|---|
| cf_bm | twitter.com (X / Cloudflare) | http cookie | 1 day | Distinguishes human visitors from automated programs (bots) and serves to protect against malicious bot traffic. |
| CookieConsent | lounge4padel.com | necessary HTTP | 1 year | Stores the user’s cookie consent state for the current domain |
| language | lounge4padel.com | HTTP cookie | 1 year | Stores the website language chosen by the user. |
| PHPSESSID | lounge4padel.com | HTTP cookie | session | Preserves the user’s session state across page requests. |
| i/jot/embeds | twitter.com (X) | pixel | session | Assigns a unique identifier to the visitor that allows third parties – advertisers – to display relevant advertising to them; the matching is carried out by real-time bidding advertising platforms. |
| l4pAutoLang | lounge4padel.com | HTML | persistent | Automatic language detection. |
| l4pEshop | lounge4padel.com | HTML | session | Remembers that the visitor is browsing the e-shop so that the legal and information pages are displayed in the same form as the rest of the e-shop. It is stored in the browser storage (sessionStorage) and expires when the tab is closed. Technically necessary, no consent required. |
14. Changes to these personal data processing rules
We are entitled to change the wording of these personal data processing rules, in particular where legislative changes or changes to the purposes and means of processing need to be incorporated. Should changes be made to the personal data processing rules that are capable of affecting the rights of data subjects, we will notify data subjects of them in an appropriate manner and sufficiently in advance.
This document is updated regularly.
Last updated: 24 September 2026