Privacy policy

1. Controller

Ausbildungszentrum für Selbstverteidigung und Kampfkunst SportUnion, register number (ZVR) 1561748312, Erikaweg 4, 9241 Wernberg, Austria, represented by its chairman Raimund Pock. Email: infoSPAM-SCHUTZ-BITTE-ENTFERNEN@masvillach.at. Data protection contact for MASPro: officeSPAM-SCHUTZ-BITTE-ENTFERNEN@pock.biz.

2. Roles under data protection law

We are the controller for the administration of MASPro accounts, user permissions, contracts, billing, platform operations, abuse prevention, security logs and support. Clubs generally determine the purposes and means of processing their member, lead, appointment, message, payment and form data. To that extent we process data as a processor on their documented instructions. Affected end customers should contact the club concerned first; we support the club in handling such requests.

A public booking form may additionally contain a privacy notice specific to that club. That notice governs the booking in question and supplements this platform information.

3. Categories of data processed

• Account and organisation: name, email address, phone number, club, roles, permissions, sign-in and OAuth account information.
• Members and leads: core and contact data, memberships, notes, documents, attendance and communication in line with the club’s configuration.
• Bookings and forms: the service selected, appointment, location, form entries, consent status as well as technical request and security data.
• Communication: sender, recipient, content, attachments as well as delivery and error status for activated email, SMS or messaging channels.
• Payments and accounting: transaction, invoice and payment status; full card details are processed by the payment providers used and are not stored by MASPro.
• Integrations: connection status, provider IDs, encrypted access tokens and the data requested through the integration.
• Usage and security: IP address, browser/device information, timestamps, audit, diagnostic and error data.

4. Purposes and legal bases

• Providing and administering the platform, performance of the contract and pre-contractual measures (Art. 6(1)(b) GDPR).
• Compliance with statutory retention, tax and record-keeping obligations (Art. 6(1)(c) GDPR).
• IT security, prevention of fraud and misuse, error analysis and needs-based improvement (Art. 6(1)(f) GDPR).
• Optional functions or integrations on the basis of consent (Art. 6(1)(a) GDPR) or on the instruction of the club acting as controller.

Where we act as a processor, the club determines the specific legal basis.

5. Optional integrations

MASPro provides configurable connections, for example to Google services, payment processing, email, SMS, messaging, document dispatch, maps, error analysis or AI-assisted functions. Data is transferred to a provider only where the function has been activated and is used, or where this is technically necessary. Each club is responsible for its selection, configuration, legal basis and the information provided to end customers. AI functions must not be used with special categories of personal data without prior review.

6. Google API Services and Google user data

When an authorised user establishes a Google connection, MASPro uses — depending on the function expressly selected — basic profile data (OpenID, email, profile), Google Drive and Google Sheets for selected files and spreadsheets, Gmail for the shared inbox and message workflows, Google Contacts through the People API for the phonebook and contact synchronisation, Google Calendar for appointments and availability, and Google Data Manager for authorised conversion events.

• Google Drive and Google Sheets: the drive.file scope limits MASPro to files opened with or created by MASPro. MASPro uses it to select, import and process the files designated by the user. For expressly configured spreadsheets, MASPro can read and write values through Google Sheets. MASPro does not request access to all other files in the connected Drive account for this purpose.
• Gmail: a separately enabled Gmail connection uses gmail.modify. This scope technically permits reading, composing and sending messages and modifying message labels. MASPro uses it solely to make incoming messages, including senders, recipients, subject, body and attachments, available in the shared inbox or message workflow enabled by the user; to send messages initiated by the user or a configured automation to the selected recipients; and to mark successfully processed incoming messages as read. MASPro does not permanently delete Gmail messages, alter unrelated messages or account settings, or use Gmail content for advertising. Configured workflows may transfer attachments to document processing or invoice import. If the club expressly enables AI-assisted reply analysis, the subject and message body may be transferred to the configured AI service provider solely to provide that function; use for training general-purpose AI models is excluded.
• Google Contacts / People API: An optionally enabled connection reads contacts from the Google account connected by the user to make them available in the MASPro phonebook and synchronise them according to the selected rules. Import-only requests contacts.readonly; export and two-way synchronisation require contacts. Names, email addresses, phone numbers, addresses, company/organisation information, contact groups and labels, custom fields, application-specific mappings and technical contact and change identifiers are retrieved and stored for synchronisation. The selection of groups, sources, categories and fields controls transfer and synchronisation; it does not already restrict the API retrieval to that selection. Google contacts are retrieved, not Workspace directories or “Other contacts”. Imported contacts are initially held as external phonebook entries; linking them to a member or booking contact is an explicit action. With write access, MASPro can transfer selected local contact data to Google and create or update contacts and labels. Automatic deletion is disabled by default and limited to linked Google contacts managed by MASPro under confirmed rules; other Google contacts are deleted only after explicit deletion confirmation. Deleting a Google contact does not delete native members or booking contacts in MASPro. Import-only does not write contacts to Google. Rules are reviewed in a preview before activation.
• Google Calendar: A separately enabled connection synchronises selected Google calendars with MASPro appointments or takes their availability into account for scheduling. calendar.calendarlist.readonly enables calendar selection; depending on the selected mode, calendar.events.readonly is requested to read events, calendar.events for export or two-way synchronisation, or calendar.events.freebusy for availability-only queries. Data processed includes calendar identifiers, names and time zones and, for event synchronisation, titles, descriptions, locations, start and end times, recurrence, status and technical event and change identifiers. Availability-only queries process busy periods without event titles, descriptions or other event details. For export or two-way synchronisation, MASPro transfers the appointment and, where configured, booking information selected by the configuration to Google and can create, update or remove events there according to confirmed rules. Calendar names and descriptions are transferred to Google when calendar creation is enabled; only then is calendar.app.created requested. Only when sharing management is enabled is calendar.acls requested to manage calendar sharing with recipient identifiers and access roles. Data in exported events may be accessible to people with the relevant permissions for the Google destination calendar. Read and availability access alone do not permit event export or changes to sharing.
• Conversion tracking: if a club activates conversion tracking, MASPro may send a booking event to the Google Ads destination it has configured. This event may contain the destination and transaction identifier, timestamp, consent status, value and currency, any Google click identifiers present (gclid, gbraid or wbraid) and — only where configured and legally permissible — the email address and phone number in SHA-256 hashed form.
• Storage: the OAuth email address, technical connection data, granted scopes and encrypted refresh tokens are stored for as long as the connection is needed. Imported Gmail messages and attachments, sent content, provider message identifiers and imported or exported business data are processed according to the customer contract, configured workflow and the general retention rules in section 9. For Contacts and Calendar, this includes local contact or event copies, links, synchronisation state and necessary conflict, change and operation records. Pausing or disconnecting synchronisation does not automatically delete this data or contacts or events already transferred to Google; deletion of remaining data can be requested using the procedures described below. Click identifiers and the associated conversion attribution are retained only until the end of the attribution window configured by the club and are then deleted on a regular cycle.
• Transfer and disclosure: Contact and calendar data is retrieved through the People API or Google Calendar API and, where export or two-way synchronisation is enabled, transferred to the Google account or destination calendar selected by the user. Within MASPro, access follows the permissions of the connected club. Gmail content is retrieved through the Google Gmail API or sent to recipients selected by the user or the enabled workflow. Where conversion tracking is enabled, conversion data is transmitted to Google Data Manager or the configured Google Ads destination. Google user data is not sold, not used by MASPro for personalised advertising, not passed on to data brokers and not used to train general-purpose AI models. Any other disclosure takes place only to the connected club, to necessary technical service providers, on the user’s documented instruction, or where required by law.
• Withdrawal and deletion: the connection can be disconnected in MASPro and additionally revoked in the Google Account, which ends further API access. Users may then request deletion of remaining data using the procedures described under Deletion & data subject rights.

7. Recipients and processors

We use hosting, storage, database, communication, payment, monitoring and integration providers. Depending on the functions activated, these may include in particular Hetzner, self-hosted Supabase technologies, Google, Microsoft, Meta, Stripe, Resend, Bird/MessageBird, Vonage, Sentry, Mapbox as well as selected document or AI providers. The current overview, including purpose and the conditions under which each is used, is available under Security & providers. Authorities or advisers receive data only where there is a legal basis or for the defence of legal claims.

8. Transfers to third countries

Some providers may process data outside the European Economic Area. Where no adequacy decision applies, we base transfers in particular on the European Commission’s standard contractual clauses and assess additional safeguards. The specific processing depends on the provider’s region, product and configuration.

9. Retention

We store personal data only for as long as it is needed for the respective purpose, the customer relationship, legitimate security and record-keeping interests or statutory obligations. Statutory invoicing and accounting records are regularly retained for seven years. Operational data follows the contract, the club configuration and any deletion request. Security logs, backups and event data are overwritten or deleted according to staggered technical periods; deleted data may remain in backups until the regular overwrite cycle and is not restored for other purposes.

10. Security

We use risk-based technical and organisational measures, including TLS transport encryption, role-based access, separate environments, logging, secured secrets, updates, backups and incident handling procedures. No system is absolutely secure; security reports can be submitted in line with our vulnerability disclosure policy.

11. Rights of data subjects

Where the statutory conditions are met, data subjects have the right to access, rectification, erasure, restriction, data portability, objection and withdrawal of consent with effect for the future. There is also a right to lodge a complaint with the Austrian Data Protection Authority. For club data, the request should first be addressed to the club concerned. Details can be found under Deletion & data subject rights.

12. Contact and changes

Data protection enquiries: officeSPAM-SCHUTZ-BITTE-ENTFERNEN@pock.biz. We update this policy in the event of material changes and indicate the current version date. Where a change requires renewed consent, this is obtained separately.