Skip to content

Privacy policy

Last updated

Groopla is booking software for people who run group classes. This policy explains what personal data we handle, why, on what legal basis, for how long, who else sees it and what rights you have under the EU General Data Protection Regulation (GDPR). Words like “organization”, “client” and “team member” mean what they mean in our terms of service.

1. Who is responsible

Groopla is provided by Piotr Okoński, a sole trader, ul. Romana Dmowskiego 19C/60, 50-203 Wrocław, Poland, NIP 7393733618 (“we”, “us”). For questions about your data or to use your rights, write to [email protected] or to that address. We haven’t appointed a data protection officer, because the law doesn’t require one for us; we answer data protection questions ourselves.

2. Our two roles

  • We are the controller for our own relationship with you: owners’ and team members’ accounts, billing, our websites and the directory, signing clients in to the portal, security, and messages you send us. This policy describes that processing in full.
  • We are a processor for the records each organization keeps about its clients: contact details, bookings, waitlist places, passes, payments and attendance. The organization decides what it keeps and why, and is the controller. We process those records only on its instructions, under the data processing agreement in Annex 1 of our terms. If you book classes, the organization you book with is the first place to ask about them; its own privacy notice applies too.

3. Visitors to our pages

  • What: your IP address, browser and device details, and the pages you request, as every web server receives them. On groop.la/classes, our network provider Cloudflare estimates your approximate location (around city level) from your IP address so we can show classes nearby. If you search for a place, the text you type goes to our address search provider.
  • Why and legal basis: to show you the pages and results you ask for, and to keep the service secure and working, which is in our legitimate interest (GDPR Article 6(1)(f)).
  • How long: we don’t store your approximate location or searches; we use them only to answer the request. Server and network logs with IP addresses are kept for a short time for security, at most 30 days.

We don’t use analytics or advertising tools, and we don’t track you across other websites.

4. People who book classes

What the organization you book with keeps

When you book, the organization’s records about you are held in Groopla: your name, phone number and/or email address, which of them you’ve confirmed with a code, your notification choices, and your bookings, waitlist places, passes, payments (status and amounts, never card numbers) and attendance, including missed classes. The organization is the controller of these records (section 2). It may also see your history of messages from Groopla, such as reminders that were sent or failed.

Those records are kept for as long as the organization keeps you as a client. We delete them when the organization deletes them, when it closes its account (within 30 days, and from backups within a further 30 days), or when it asks us to. The history of messages sent to you is deleted after 12 months.

What we do as controller

  • Signing in. To sign you in we send a one-time code by text message or email, and keep a record of the request and of your signed-in session: your phone number or email address, your IP address and browser, and when you signed in. Legal basis: providing the portal you asked to use under our terms (Article 6(1)(b)), and keeping accounts secure (Article 6(1)(f)). A session ends after 30 days without use, or when you sign out. Sign-in requests and ended sessions are deleted after 90 days.
  • Your bookings in one place. If you book with several organizations, the portal shows all your bookings together, and groop.la/classes suggests upcoming classes from organizations you’ve booked with before. We use your bookings only for this; each organization still sees only its own records. Legal basis: providing the portal (Article 6(1)(b)), and our legitimate interest in showing you relevant classes (Article 6(1)(f)). You can object at any time; signing out also stops the suggestions.
  • Finding your account across regions. Groopla can run in several regions. To send you to the right one, we keep a one-way coded fingerprint of your phone number and email address (a keyed hash) with the name of the region, not the number or address itself. Legal basis: our legitimate interest in running the service reliably (Article 6(1)(f)). It’s deleted when no organization has you as a client any more.

You need to give a phone number or email address to book through Groopla, because that’s how we confirm it’s you and how the organization reaches you about your bookings. You can also book with the organization directly instead.

5. Owners and team members

  • What: your name, email address and organization, your role and whether you can host sessions, a hashed password (we never see the password itself), invitation details, your notification and inbox settings, sign-in sessions with IP address and browser, and a record of what you did in the app, such as editing a class or cancelling a booking, which your team sees in the activity feed.
  • Why and legal basis: to provide Groopla under our agreement with the organization. For the owner who signed up that is a contract with us (Article 6(1)(b)). For invited team members it’s our and the organization’s legitimate interest in giving its team the accounts it asked for (Article 6(1)(f)). Security, preventing abuse and the activity record are also legitimate interests.
  • Support: when you ask us for help, or when we need to fix a problem, keep Groopla secure or meet a legal obligation, we may view your organization’s account in read-only mode. Every such view is recorded.
  • How long: for as long as the organization has its account. Activity feed entries are deleted after 12 months. Sessions end when you sign out, and unused ones are deleted after 90 days. If an owner removes you from the team, your sign-in is ended straight away; your name stays on the history of what you did and the classes you hosted, until the organization’s account is closed. Webhook delivery logs, which may contain booking data, are deleted after 30 days.
  • Staff email addresses are unique across all regions, so we keep a coded fingerprint of yours with your region, like the one in section 4.

6. Billing

  • What: the billing details an owner enters (company or personal name, address, billing email and tax ID), the plan, invoices, payments and refunds. Card details go straight to Stripe; we don’t see or keep them.
  • Why and legal basis: to charge for paid plans (Article 6(1)(b)); to issue and keep invoices and accounting records and check EU VAT numbers, as tax law requires (Article 6(1)(c)); and to set up and defend claims (Article 6(1)(f)).
  • How long: invoices and accounting records for 5 years from the end of the year in which the tax became due, as Polish tax law requires, even after the account is closed. Other billing details are deleted with the account.

7. When you write to us

If you email us, including to report content or complain, we keep your message, your email address and our reply, so we can answer and keep a record of what was agreed. Legal basis: our legitimate interest in answering you (Article 6(1)(f)), or a legal obligation where the law requires us to handle the request. We keep these messages for up to 3 years after the matter is closed, the general period for claims.

8. Messages we send

Groopla sends the messages needed to use it: sign-in codes, booking confirmations, changes and reminders, and waitlist updates to clients, by text message or email as the organization and the client have chosen. Owners and team members get messages about their account, such as invitations, password resets, getting-started tips after sign-up, inbox summaries they subscribed to, plan and payment notices, and warnings about failing webhooks.

We don’t send marketing. If we ever want to send product news, we’ll ask for your consent first, as Polish law requires, and you can withdraw it at any time.

9. Who else handles data

We don’t sell personal data. These providers handle it for us, under contracts that require them to protect it and use it only for us:

  • Hetzner Online GmbH hosts our servers and database, in Germany or Finland.
  • Our email provider sends emails, so it receives email addresses and message content.
  • Cloudflare, Inc. carries and protects traffic to Groopla and estimates visitors’ approximate location, so all traffic passes through it.
  • Twilio Inc. sends text messages and sign-in codes, so it receives phone numbers and message content.
  • komoot GmbH (Photon) or Unwired Labs (LocationIQ) turn addresses and typed places into map positions. They receive the text only, not who typed it.
  • Stripe processes payments for Groopla plans and calculates the tax on them.
  • InFakt keeps our accounts and issues our invoices.

Some recipients act as controllers in their own right:

  • Organizations see their own clients’ records, and the names and actions of their team.
  • Stripe, when a client pays an organization online. The payment goes to the organization’s own Stripe account, under its agreement with Stripe and Stripe’s privacy policy.
  • Tools an organization connects through our API or webhooks receive the data it sends them, under that organization’s responsibility.
  • Polish tax authorities, which receive our invoices through the national e-invoicing system (KSeF), and the European Commission’s VIES service, which checks EU VAT numbers.
  • Courts, authorities and professional advisers, when the law requires it or to set up or defend legal claims.

If Groopla is taken over by a company, data moves to it under this policy, and we tell you in advance.

10. Transfers outside Europe

We keep our database in the European Union. Twilio and Cloudflare are based in the United States, and LocationIQ may process requests outside Europe. Where data leaves the European Economic Area, we rely on an adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or on the European Commission’s standard contractual clauses. Write to us for a copy of the safeguards.

11. Cookies and browser storage

We use only what Groopla needs to work, which the law allows without asking for consent. There are no analytics or advertising cookies.

  • __Host-session_id: keeps owners and team members signed in to the app, until they sign out.
  • __Host-client_session_id: keeps clients signed in to the portal, for up to 30 days without use.
  • gpl_region: remembers which region your account is in, so requests go to the right servers.
  • _groopla_session: carries short messages between pages, such as “Booking confirmed” or form errors; it ends when you close the browser.
  • __Host-admin_session_id: signs our own staff in to our admin panel, on a separate domain.

Your light or dark theme, and whether the app’s side menu is collapsed, are stored in your browser (localStorage) and never sent to us. You can delete cookies and stored data in your browser settings; you’ll then need to sign in again.

12. Automated decisions

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects (GDPR Article 22). Some things happen automatically under rules the organization sets: for example, online booking can be paused after a number of missed classes, waitlist places are filled in order, and unpaid bookings are released. The organization can always review and change these, and its staff can still book you.

13. Your rights

You have the right to:

  • get a copy of your data and information about how we use it;
  • have it corrected if it’s wrong;
  • have it deleted, or its use restricted, in the cases the law provides;
  • receive data you gave us in a common machine-readable format, or have it sent to someone else;
  • object to processing based on our legitimate interests, on grounds relating to your situation;
  • withdraw consent at any time where we rely on it, without affecting what we did before.

Write to [email protected]. We may ask you to confirm it’s you, for example with a code sent to your phone or email. We answer within one month, or tell you within that month if we need up to two more because the request is complex. For data an organization controls, we pass your request to it and help it answer; you can also go to the organization directly.

You can complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also complain where you live or work in the EU.

14. Security

All traffic to Groopla is encrypted. Passwords are stored only as strong one-way hashes, clients sign in with one-time codes, each organization’s data is kept separate, and only the people who need it can access the systems, with administrative access recorded. We back up the database regularly and keep our software up to date. If a breach puts your rights at high risk, we tell you without undue delay.

15. Children

Groopla isn’t meant for children to use on their own. Clients must be at least 16; a parent or guardian books for younger children and gives their own contact details.

16. Changes

If we change this policy in a way that matters, we update the date above and tell organization owners, and clients with an account, by email before the change applies.