Pitland.cz Privacy Policy

This English translation is provided for convenience only. The Czech version is the legally binding text.

Controller:
Happy Garage s.r.o.
Company ID (IČO): 07322623
VAT ID (DIČ): CZ07322623
Registered office: Ovocný trh 572/11, Staré Město, 110 00 Prague 1
Registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 299122
Managing Director: Jiří Matela
Contact e-mail for GDPR matters: info@pitland.cz
GDPR contact person: Jiří Novák

Business premises (the Pitland Arena):
Ringhofferova 1 (former PSN complex), Zličín – Třebonice, 155 21 Prague 5

Effective date: 15 May 2026

1. Introduction

1.1 This Privacy Policy (the “Policy”) describes how Happy Garage s.r.o. (the “Controller” or “Pitland”) processes the personal data of its customers, visitors to the Arena and users of the www.pitland.cz website.

1.2 The Controller processes personal data in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Councilof 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation, the “GDPR”);
• Act No. 110/2019 Coll., on Personal Data Processing;
• Act No. 480/2004 Coll., on Certain Information Society Services;
• Act No. 127/2005 Coll., on Electronic Communications (cookies and similar technologies).

1.3 This Policy supplements the Terms and Conditions (pitland.cz/en/terms) and the Arena Operating Rules (pitland.cz/en/track-rules).

2. What personal data we process

The data we process depend on how you interact with Pitland.

2.1 When you visit the www.pitland.cz website

• IP address, device identifier;
• data from cookies and similar technologies (see Section 8).

2.2 When you order a voucher or service in the e-shop

• first name and surname;
• e-mail address;
• phone number;
• for business orders: company name, Company ID (IČO), VAT ID (DIČ), registered office (billing details);
• order details (product purchased, price, date, order number, voucher code);
• payment details are processed by the payment gateway (ComGate); the Controller itself does not store or process payment details.

2.3 When you register at the Arena before your first ride (Participant)

• first name and surname;
• nickname (displayed in the booking and lap-timing system);
• e-mail address;
• phone number;
• name and phone number of a close person to contact in case of an accident;
• a photograph of the Participant (for identification in the internal system).

2.4 When you book a specific ride slot

• first name and surname;
• phone number;
• e-mail address;
• selected product and time slot.

2.5 Children and minors

• first name, surname and date of birth of the minor;
• for children aged 6–11 and minors aged 12–17, the name and contact details (phone, e-mail) of the legal guardian;
• the legal guardian's signature on the participation consent form (paper records).

2.6 Accompanying persons (people at the Arena who do not take part in the riding)

The Controller does not process any personal data about these persons other than possible recordings made by the CCTV system (see Section 9).

2.7 CCTV footage

• video recordings from 7 cameras located exclusively in the operational areas of the hall (track, pit area, reception, entrance areas);
• no CCTV system is installed in the back-of-house areas (changing rooms, toilets, office).

2.8 When you communicate with Pitland (e-mail, phone, contact form, social media)

• name (if you provide it);
• contact details (e-mail, phone);
• content of the communication.

3. Why we process personal data (purposes and legal bases)

For each processing purpose the Controller relies on a specific legal basis under Art. 6 GDPR. The table below maps purpose → legal basis:

4. Who we share personal data with (processors)

When processing personal data, the Controller uses the following categories of processors. A data processing agreement (DPA) under Art. 28 GDPR is in place with all of them.

4.1 Infrastructure and hosting

4.2 Payments and invoicing

4.3 Customer communication

4.4 Web analytics and marketing

These tools are activated only with your consent to marketing / analytics cookies given via the cookie banner (see Section 8).

4.5 Internal AI tools

For internal analysis of operational data, team support and knowledge base maintenance, the Controller uses artificial intelligence tools (in particular Claude by Anthropic Inc., USA). These tools are not used for automated decision-making about customers within the meaning of Art. 22 GDPR. Data transfers take place under a concluded data processing agreement (DPA) and Standard Contractual Clauses under Art. 46 GDPR.

4.6 Disclosure to public authorities

Where required by law (e.g. a request from the Police of the Czech Republic, a court or the tax office), the Controller will disclose the necessary personal data to the competent public authority.

5. How long we keep the data

If court, administrative, enforcement, insolvency, complaint, tax or other similar proceedings in which the data are necessary are pending, the retention period is extended until their final conclusion (including any remedies and proceedings before international institutions, e.g. the European Court of Human Rights).

6. Transfers to third countries (outside the EU/EEA)

Most of the Controller's processors are based in the Czech Republic or in the EU. Some tools (in particular Google and Meta) also process data outside the EU/EEA, typically in the USA. In such cases the transfer is safeguarded by Standard Contractual Clauses (SCC) approved by the European Commission under Art. 46 GDPR, or by other appropriate safeguards (the Data Privacy Framework, where relevant).

Specifically, this concerns the following processors:

• Google (Google Workspace, Google Drive, Google Analytics, Google Tag Manager, Firebase) — primary data stored in the EU; secondary processing may take place in the USA under SCC.
• Meta Platforms (Facebook Pixel) — processing in the USA under SCC.
• Anthropic Inc. (Claude AI assistants for internal use) — processing in the USA under SCC.

In all other cases, personal data are transferred exclusively within the EU/EEA.

7. Your rights

As a data subject, you have the following rights under the GDPR:

• Right of access (Art. 15 GDPR) — to know what data we process about you and to obtain a copy of them.
• Right to rectification (Art. 16 GDPR) — to have inaccurate or incomplete data corrected.
• Right to erasure(“right to be forgotten”, Art. 17 GDPR) — to request the deletion of data that are no longer needed.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR) — to receive your data in a structured, machine-readable format.
• Right to object to processing based on legitimate interest (Art. 21 GDPR), including an objection to direct marketing.
• Right to withdraw consent at any time, where the processing is based on consent (Art. 7(3) GDPR). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint with the supervisory authority (Art. 77 GDPR) — the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz).

How to exercise your rights: Simply send an e-mail to info@pitland.cz describing your request. To verify your identity, we may ask for additional information (e.g. your order number). We will handle your request free of charge and within 1 month of receiving it (Art. 12(3) GDPR); in justified cases this period may be extended by up to 2 further months, of which we will inform you.

Requests for a data extract or erasure — in writing. We accept requests for an extract or erasure of your personal data on the basis of a written requestsent to info@pitland.cz or to the address of the Controller's registered office.

Erasure specifics for data in APEX Timing: If you request erasure and your riding results (lap times, history) are recorded in the APEX Timing system, we will anonymise the record — your name will be replaced with an anonymous code, but we will keep the anonymised ride data (lap times, lap counts) for the purpose of maintaining operating statistics and leaderboards on the basis of legitimate interest.

8. Cookies and similar technologies

8.1 The www.pitland.cz website uses cookies and similar technologies. We divide cookies into the following categories:

• Functional (strictly necessary) cookies — without which the website cannot work properly (login, cart, language). They cannot be refused and serve solely to provide the service requested by the user.
• Preference cookies — remember your choices (e.g. your preferred display mode).
• Analytics / statistics cookies — measuring traffic and behaviour on the website (Google Analytics). Activated only with consent.
• Marketing cookies — remarketing and targeted advertising (Google Ads, Facebook Pixel). Activated only with consent.

8.2 Cookie banner. On your first visit, an informational cookie banner is displayed offering the following options: accept all cookies, refuse optional cookies, or select categories individually. We remember your decision for 6 months; after that the banner is shown again.

8.3 Changing your settings.You can change your settings at any time by clicking the “Cookie settings” link in the website footer. You can also delete and block cookies at any time in your browser settings.

9. CCTV system

9.1 The Pitland Arena operates a CCTV system of 7 cameras located exclusively in the operational areas of the hall (track, pit area, reception, entrance areas). There are no cameras in the back-of-house areas (changing rooms, toilets, offices).

9.2 Purpose of monitoring: protection of the property of the Controller and the Participants, ensuring the safety of people at the Arena, and prevention and investigation of potential damage incidents.

9.3 Legal basis:the Controller's legitimate interest under Art. 6(1)(f) GDPR.

9.4 Information about monitoring:A visible sign at the entrance to the Arena informs about the operation of the CCTV system, the purpose of monitoring and the Controller's contact details.

9.5 Retention period: 14 days. After this period, the recordings are automatically overwritten.

9.6 Access to the footage: CCTV footage is accessible only to the Controller's Managing Director. The footage may be handed over to a third party only where required by law (a request from the Police of the Czech Republic, a court, etc.).

10. Competitions, events and marketing activities

10.1 When organising competitions, races and marketing events (e.g. the Pitland Cup, corporate events, leaderboards), the Controller processes the participants' personal data to the extent necessary to evaluate the event and communicate about it.

10.2 For these purposes the Controller relies on legitimate interest (running the operation, keeping records of results) and, where relevant, consent (e.g. public publication of the results under your full name).

10.3 The rules of a specific competition or event may set out additional information on the processing of personal data, which we always publish together with the competition rules.

11. Photo and video recordings at the Arena

11.1 Photographs and video recordings may occasionally be taken at the Arena for the Controller's marketing and promotional purposes (website, social media, printed materials).

11.2 By entering the Arena, the Participant consents to the taking and use of such recordings for the stated purposes. Information about the recording is visibly displayed at the entrance to the Arena.

11.3 Withdrawal of consent: The Participant has the right to withdraw their consent at any time by e-mail to info@pitland.cz. In that case the Controller will, within 30 days, remove the existing recordings of that Participant from its marketing libraries and will not publicly use recordings taken in the future. The withdrawal of consent does not apply to CCTV footage, which is processed on the basis of legitimate interest (see Section 9).

11.4 For children under 15, the Controller does not use marketing recordings for public publication without the express consent of the child's legal guardian (Art. 8 GDPR).

12. Personal data security

12.1 The Controller takes appropriate technical and organisational measures to ensure the security of the personal data processed:

• access to the personal data is limited to authorised employees, external collaborators and processors who are bound by confidentiality;
• electronic data are stored on secured servers operated within the EU (or outside the EU under SCC, see Section 6);
• paper records (e.g. legal guardian consents) are stored in locked areas of the business premises;
• we regularly review access permissions and security measures.

12.2 In the event of a personal data breach likely to result in a high risk to the rights and freedoms of data subjects, the Controller will inform you without undue delay and report the incident to the supervisory authority (Art. 33 and 34 GDPR).

13. Final provisions

13.1 Changes to the Policy. The Controller may unilaterally amend and supplement this Policy. The current wording is always published at pitland.cz/en/privacy (the legally binding Czech version at pitland.cz/gdpr), stating its effective date. Existing customers will be informed of substantial changes by e-mail.

13.2 Governing law. This Policy is governed by the laws of the Czech Republic.

13.3 Effective date. This Policy takes effect on 15 May 2026 and replaces the previous version of the Pitland privacy policy.

Contact

If you have any questions about the protection of your personal data, contact us:

Happy Garage s.r.o.
Ovocný trh 572/11, 110 00 Prague 1
E-mail: info@pitland.cz
GDPR contact person: Jiří Novák

Supervisory authority for personal data protection:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27, 170 00 Prague 7
www.uoou.cz

End of document.