Controller

The controller within the meaning of the GDPR is the service provider named in the legal notice: Raykast IT & Consulting, owner Matthias Guntrum. The full address and contact options can be found in the legal notice.

What data we process

On registration: email address, display name and a password (stored only as a hash). For duty-roster sign-ups: name, optional contact details and an optional public display name. For clubhouse bookings and requests: name, contact details (phone, email, address), club and purpose, plus rent, utility costs and payment status for the club's billing. Only the club's managers can see these details. Technically necessary access data (e.g. IP addresses in server logs) is also processed.

Purpose and legal basis

Data is processed exclusively to organise club duties and room bookings (Art. 6(1)(b) and (f) GDPR). Data is never sold or used for advertising.

Public display of names

Helpers' names are only shown publicly if they explicitly consented during sign-up (Art. 6(1)(a) GDPR). Alternatively a nickname can be provided, or public display declined entirely. Consent can be revoked at any time; the entry is then removed or anonymised.

Public clubhouse availability calendars show only the date and "Booked" or a public title set by the club – no names, contact details or amounts. If a club sets up the optional transfer into an existing Google calendar, it uses its own Google API access from its Google Cloud project and connects its Google account; Klubplan stores the client ID, the encrypted client secret, that account's email address and an encrypted access key. Exactly the details named above (date and title) are sent to Google, nothing else. The connection can be removed at any time in the booking calendar or in the Google account settings.

Storage and hosting

Data is stored in Microsoft Azure (West Europe region). A data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft. All transfers are encrypted via HTTPS. Account and club data is retained for as long as the account or club exists; technically necessary server logs are kept only briefly.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 - 21 GDPR), as well as the right to lodge a complaint with a data protection supervisory authority.

Contact for privacy requests

For privacy requests an informal message to the email address in the legal notice or via the contact form is sufficient.