Version 1.2. Effective date: 2026-08-17. This policy applies to the MRBL application.
1. Data controller
The controller of user, staff, booking, order and service data is MARBELLA GC, MRBL, Stowarzyszenie, Andrzeja Małkowskiego 30/1, 70-304 Szczecin, zachodniopomorskie, PL, KRS 0000999517 (Krajowy Rejestr Sądowy), REGON 523542992, NIP 8522687709, wojciech@mrblgolf.com, +48 606 425 036, https://www.mrblgolf.com. Privacy contact: wojciech@mrblgolf.com.
2. Technology provider and processor
INNOVARE GROUP LTD, Companies House 12878269, 7 Bell Yard, London, England, WC2A 2JR, hello@timzy.app, provides Timzy as a SaaS platform and processes booking data on the Controller's instructions. It is a separate controller only for limited platform-security, business-account, billing and legal-compliance data.
3. Categories of data
We process account and contact data, user and device identifiers, an optional profile image, authentication data handled by Firebase, booking and service data, communications, notification tokens, IP address, operating-system and application version, diagnostics and security events. External sign-in data: account identifier, email and name released by the sign-in provider.
4. Sources of data
Data comes directly from the user, authorised Controller staff, the device and application, and providers of active functions identified in this policy. We do not purchase user databases.
5. Purposes and legal bases
Data is used to create and protect accounts, manage bookings and services, communicate, provide support and operate active functions. The legal basis is contract performance or pre-contract steps, a legal obligation, legitimate interests in system security and legal claims, or consent where an optional feature requires it.
6. Whether data is required
Fields marked as required are necessary to create an account, enter into or perform a contract, or handle a request. Without them, the relevant function may be unavailable. Other data is optional.
7. Recipients and subprocessors
Access is limited to authorised Controller personnel, the selected service provider, INNOVARE GROUP LTD, and active technical providers: Google Cloud/Firebase, Expo, Google Sign-In, Apple Sign-In. Data may be disclosed to authorities where required by law. Access should follow contracts and least-privilege principles.
8. International transfers
Some providers may process data outside the EEA or United Kingdom. Where required, an adequacy decision, standard contractual clauses or another valid mechanism and safeguards identified by a transfer assessment are used.
9. Retention
Personal data in booking history is retained for up to 72 months. After that period, client identifiers are removed, while non-personal visit statistics, such as date, service, employee, duration, price and status, may be retained indefinitely for reporting. Order and billing records are retained for 72 months, support correspondence for 24 months and technical logs for 12 months, unless law or an active claim requires longer retention. If backups are enabled for the instance, deleted data expires from them within 90 days.
10. Account deletion
Delete an account in the application's Settings or start a request at https://mrbl-3f8cb.web.app/delete-account/. The profile, files, tokens and sign-in data are deleted or anonymised. Records required by law or needed for legal claims may be kept only for the necessary period.
11. Individual rights
Subject to law, you may request access, correction, deletion, restriction and portability, and object to processing. Consent can be withdrawn without affecting earlier processing. Send requests to wojciech@mrblgolf.com.
12. Complaint
You may complain to Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, https://uodo.gov.pl/, or the authority for your residence, workplace or the alleged infringement.
13. Security
We use access controls, authentication, encryption provided by the cloud services in use, event logging and restricted production-data access. No system can provide absolute security.
14. Children
The standard application is not intended for anyone under 16 and does not assume intentional processing of children's data. Such processing requires a separate audit, legal basis and appropriate guardian-consent process.
15. Health data
The standard policy does not cover intentional processing of health data. Such a feature requires an additional legal basis, safeguards and an approved legal module before publication.
18. Automated decisions
The application does not make solely automated decisions producing legal or similarly significant effects. A change requires a policy update before launch.
19. Cookies and similar technologies
The mobile application may use local storage, device identifiers and tokens required for sign-in, security and notifications. The public document site uses no marketing or analytics cookies unless its deployment is separately changed.
20. Changes, versions and contact
The current version is available at https://mrbl-3f8cb.web.app/privacy/. Material changes are published as a new version and communicated where required by law. Contact: wojciech@mrblgolf.com.