Personal Data Protection

Information on processing of personal data in accordance with Regulation (EU) 2016/679 (GDPR).

1. Who processes your data

The data controller is XC platform s.r.o., Company ID 17838339, with registered office at Kolbenova 616/34, 190 00 Prague 9, registered in the Commercial Register maintained by the Municipal Court in Prague, file no. C 377607. Complete contact details can be found on the Operator and contact page.

2. What data we process

Data obtained from XContest (when logging in via OAuth):

  • username and XContest ID
  • full name
  • email address
  • pilot licence number
  • user identifier (UUID)

Data created by service operation:

  • flight records (date, launch site, XContest flight identifier)
  • payment records (amount, date, variable symbol, counterparty details from bank statement)
  • credit balance and history of credit transactions
  • audit log of administrator actions

Technical data: login cookie (HMAC-SHA256 signed, 180 days), IP address in server log (Cloudflare, 30 days), browser information.

3. Purpose and legal basis for processing

  • Fulfilment of contract (Art. 6(1)(b) GDPR) — operation of the application, display of your flights, generation of payment details, matching of incoming payments, recording of paid and owed launch fees, management of credit balance.
  • Fulfilment of legal obligation (Art. 6(1)(c) GDPR) — maintenance of payment records for accounting and tax purposes.
  • Legitimate interest (Art. 6(1)(f) GDPR) — securing the service, preventing misuse, protection against attacks, resolving operational incidents.

4. Data retention period

  • User account: during use of the service and for a further 3 years from the last login. After this period, the account is anonymized or deleted.
  • Payment records and tax documents: 10 years (in accordance with Section 35 of Act No. 235/2004 Coll., on VAT, and Section 31 of Act No. 563/1991 Coll., on Accounting).
  • Server logs: 30 days (default Cloudflare retention).

5. Recipients and processors

Your data is passed to the following entities only to the extent necessary for service operation:

  • The relevant paragliding club — administrators of the club whose launch sites you use can see your name, pilot identifier, flights and payments relating to this club. Clubs are independent data controllers for their own legal pilot↔club relationship.
  • Cloudflare, Inc. (USA) — application hosting, edge cache, DDoS protection. Data transfer to the USA is carried out on the basis of the EU-US Data Privacy Framework (DPF) and standard contractual clauses.
  • Neon, Inc. — database service operator. Your data is physically stored in the EU (Frankfurt region, AWS eu-central-1). The contractual relationship with Neon is concluded in accordance with GDPR.
  • XContest (xcontest.org) — user authentication via OAuth and source of flight information (server-to-server API).
  • Letecká amatérská asociace ČR (LAA ČR — the Czech Aero Club) — verification of your membership in the Svaz PG/ZL (Czech Paragliding/Hang Gliding Association). We pass only the pilot licence number, no other personal data.

FIO Bank is NOT a recipient of your personal data. We only read information about incoming transactions from the club's bank statement for the purpose of matching payments. The separate relationship between the club and the bank is independent and startovne.online does not participate in it.

6. Your rights

As a data subject you have the right to:

  • access to your personal data (Art. 15 GDPR)
  • rectification of incorrect or incomplete data (Art. 16 GDPR)
  • erasure ("right to be forgotten", Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • object to processing based on legitimate interest (Art. 21 GDPR)
  • not be subject to automated decision-making (Art. 22 GDPR — does not apply; no automated decision-making takes place here)

You can assert these rights by email to info@xcontest.org. We will respond to your request without undue delay, no later than 30 days. Some rights (especially erasure) may be limited by the obligation to retain accounting and tax documents.

7. Cookies and localStorage

The application stores only technically necessary data:

  • Login cookie (HMAC-SHA256 signed, valid for 180 days) — without it, it would not be possible to remain logged in.
  • localStorage in browser — stores the contents of your cart before payment is sent. Data does not leave your device.

We do not use any analytical, marketing or tracking cookies. We do not pass any information about your behaviour to third parties for advertising purposes. No consent banner is therefore needed.

8. Complaint to supervisory authority

If you believe that processing of your personal data violates GDPR, you have the right to lodge a complaint with the Úřad pro ochranu osobních údajů (the Czech Office for Personal Data Protection; Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz).

9. Changes to these policies

These personal data protection policies may be updated from time to time. We will inform users of significant changes by email or notification in the application. The current version is always available on this page.

Effective from: 30 April 2026

← Back to FAQ