Privacy and cookies

Who we are

PitchPace is operated by Webinson, s.r.o., Alžbetina 16, 040 01 Košice, Slovensko, IČO 50 399 411, DIČ 2120324261, IČ DPH SK2120324261, Obchodný register Mestského súdu Košice, oddiel Sro, vložka č. 39598/V — the same company that operates PitchPlace, the camp map at pitchplace.app.

Questions, requests, objections: [email protected]. We answer within a few working days.

We have two roles. For this website and for the people who sign in to the console we decide why and how data is used: we are the controller. The guests a campsite enters into its own console are that campsite’s data: the campsite decides about it and we handle it on the campsite’s behalf: we are the processor.

Visiting this website

The front page uses no analytics, no advertising and no tracking, and it loads nothing from other sites: its fonts, pictures and styles all come from pitchpace.app.

As with any website, the server sees your IP address and your browser’s details when your browser asks for a page. Cloudflare delivers the site on our behalf and uses them to deliver it and to defend it against attacks. We do not keep them ourselves: the server’s own log holds only what kind of page was asked for, how it was answered and how long that took — no IP address, no browser details — so that we can find faults.

If you write to [email protected], we use your message and your address to answer you. Mail for pitchpace.app is forwarded by Cloudflare Email Routing.

Cookies and local storage

PitchPace sets no advertising, profiling or third-party cookies and keeps nothing in your browser’s local storage. These are all of its cookies, every one of them first-party:

Cloudflare, which delivers the site, may set a security cookie in your browser (cf_clearance) if it asks the browser to prove it is not a robot. It is not set otherwise.

All of these are strictly necessary for something you asked the site to do — show it in your language or look, save a form, keep you signed in. Under Art. 5(3) of Directive 2002/58/EC, transposed in Slovakia by Act No. 452/2021 Coll. on electronic communications, they therefore need no consent, and this notice is the information that is required instead. That is why there is no cookie banner: there is nothing to consent to. You can block or delete the cookies in your browser; the language and the look are then not remembered, and signing in stops working.

If you have an account

Accounts are created by invitation, by a campsite’s administrator. For each account we keep the name and e-mail address, the role (administrator or staff), the language you chose, a hash of the password (Argon2id, never the password itself) and the time of the last sign-in. For each device you are signed in on we keep a label such as “Chrome on macOS”, when it was last used and when it expires — never an IP address.

We use this so that you can sign in and so that the console stays secure: to provide the service your campsite asked for, and in our legitimate interest in security (Art. 6(1)(b) and (f) GDPR). A sign-in ends after 30 days, or after 14 days without use. A link to set or reset a password works once and for 7 days. The account is removed when the campsite’s property is removed from PitchPace, or when you or the campsite ask.

To slow down password guessing, the server counts recent sign-in attempts per IP address and per e-mail address in its memory for 15 minutes. Nothing of it is written to disk.

Guests’ data in the console

A campsite that uses PitchPace enters its bookings: guests’ names, contact details, dates, numbers of guests and notes. This data is the campsite’s: it decides what to enter and why. We process it only on the campsite’s behalf — to store it, show it to the campsite’s own people, work out availability and prices from it, and export it when the campsite asks — as a processor under Art. 28 GDPR. We use it for nothing else and share it with no one but the providers named below.

If you are a guest of a campsite, ask the campsite first about your data; we will help it answer you. The calendar addresses a campsite connects from booking sites are secrets: we keep them private, and the screens show only the site and the last few characters. The calendars PitchPace publishes list only nights with nothing left to sell — never a guest.

The terms on which we process a campsite’s data are set out in the data processing agreement that the campsite concludes with us. Its text is published: Data processing agreement

Where the data is processed

The console and its database run on a server of Hetzner Online GmbH in Nuremberg, Germany. Nightly backups stay on that server for 14 days. Cloudflare, Inc. delivers the site, answers for its domain name and forwards its mail; it works from data centres around the world. Transfers outside the EEA rely on an adequacy decision (such as the EU–US Data Privacy Framework) or on EU Standard Contractual Clauses.

Apart from these two providers nobody else receives the data of this website or of the console: PitchPace sends no e-mail through a third party and has no analytics or advertising partners.

Your rights

You have the right to access, correct, export, restrict and erase your personal data, and to object to processing that rests on our legitimate interest. Write to [email protected].

You may also complain to the Slovak supervisory authority (Úrad na ochranu osobných údajov SR, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk) or to the authority where you live.

Changes

When this notice changes, its version changes. If PitchPace starts to use data in a way that is not described here, this notice changes before it does.