Privacy policy

Version of 13 November 2026. The German version (Datenschutzerklärung) is legally binding.

1. Who we are

The controller for the processing described in this policy is FREIZEITLAB GmbH, Kalvarienbergstraße 22/10, 8020 Graz, Austria, FN 671161b (“we”, “us”). Email: support@leisbase.com.

We are not legally required to appoint a data protection officer. Please send all data protection questions to the email address above; the management handles them.

2. Which roles this policy covers

We process personal data in two different roles:

• As controller for our own purposes: when you visit leisbase.com, contact us, request a quote or a demo, and when you manage a customer account (sign-in, billing, support, security). Sections 4 to 14 describe this processing.
• As processor for the venues that use Leisbase: for the data of their guests, staff and contacts, which the venues enter into or collect through the platform. Here the venue is the controller and decides about the processing; we act only on its instructions under a data processing agreement (Art. 28 GDPR). Section 3 explains what this means for you as a guest.

3. Guests of venues: data we process on behalf of venues

If you book a game, buy a gift card, sign a waiver, join a loyalty club, chat with a venue’s chatbot or otherwise deal with a venue that uses Leisbase, the venue is responsible for your data. Its privacy policy, which it must provide to you, tells you which data it processes, for which purposes and on which legal basis.

Please address requests concerning your data (for example access, erasure or withdrawing consent to marketing) to the venue. If you contact us instead, we forward your request to the venue without delay, where we can identify it, and support the venue in answering it. The platform provides venues with functions for this, such as exporting a guest’s data and erasing it.

We do not use guest data for our own purposes, do not sell it and do not use it to advertise to guests.

4. Visiting this website

No cookies, no advertising, statistics without profiles. The information pages on leisbase.com set no cookies, use no advertising services, store nothing on your device and load no fonts or other content from third parties. To see how the website is used, we run the cookieless statistics of our own platform: for each page view it records the page, the referring page, campaign parameters, device type, browser, operating system, language and the approximate location (country, region, city). Your IP address is used only to derive that location and a visitor number that changes every day and cannot be traced back to you; the IP address itself is not stored. Nothing is sent if your browser signals “Global Privacy Control” or “Do Not Track”. The legal basis is our legitimate interest in understanding and improving our website (Art. 6(1)(f) GDPR); you can object at any time by writing to us. The statistics are collected on Cloudflare’s network as our processor. The only exception is the contact form on the support page, described in section 5. We do not create usage profiles.

Hosting and server logs. The website is hosted and delivered by Cloudflare (Cloudflare Pages; Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit them, Cloudflare processes technically necessary data: IP address, date and time, requested address, amount of data transferred, referrer, and browser and operating system details. This serves to deliver the website and keep it stable and secure, for example to fend off attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Some content of the platform may also be delivered via the content delivery network bunny.net (BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia), which processes the same technical data for the same purposes. Cloudflare and bunny.net act as our processors; the data is kept only as long as these purposes require.

Links. The pages link to the sign-in of the platform (app.leisbase.com) and to other websites, for example to AI assistants for summarising an article. Data is only sent to their operators once you click such a link; their privacy policies apply there.

5. Enquiries, demos and quotes

Contact form on the support page. When you send this form, the details you enter (team chosen, name, email address, venue or workspace, your role, where the problem occurred, a booking or order number and your message), the language and address of the page and your IP address are sent to our support desk, where they become a support request (ticket). You receive a confirmation with a ticket number by email, and our replies come by email. To protect the form against automated messages, Cloudflare Turnstile is loaded when you start filling it in; it checks technical characteristics of your browser and receives your IP address, without setting advertising cookies. If the support desk cannot be reached, the form instead prepares an email in your mail app, which you send yourself. The legal basis is the performance of the contract or steps prior to it (Art. 6(1)(b) GDPR) and our legitimate interest in answering requests and protecting the form (Art. 6(1)(f) GDPR). Closed support requests are deleted two years after they were closed. Emails are sent via Postmark as our processor.

The request form on the pricing page does not send any data to us: it only prepares an email in your mail app, which you send yourself. When you email us, call us or request a demo, we process the details you give us – in particular name, company, role, email address, phone number, information about your venue and the content of your message – to answer your request, prepare a quote and, where requested, present the platform.

The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR). We use Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as our processor for email and calendars.

We may follow up on your enquiry by email. If you do not want this, tell us and we will stop.

6. Customers and their users

When a business uses Leisbase, we process the following data of the persons who set up and manage the account and of the users who sign in:

• Account and contact data: name, business email address, phone number, role, company name and address, VAT number.
• Sign-in and security data: password (stored only as a hash), two-factor and passkey settings, sign-in times, IP address, approximate location derived from it, browser and device, and security events such as notifications about new sign-ins.
• Contract and billing data: Order, fees, invoices, payment method and payment status, Prepaid Balance and top-ups.
• Support and communication: messages to our support, information you give us when we help you, and service messages we send you.
• Technical and usage data: logs of the actions in the Workspace (audit log), error reports and technical diagnostic data needed to operate the platform.
• Acceptance of legal documents: which version of the Terms and the data processing agreement was accepted, when and by whom.
• Questions to the help assistant: questions that users ask the in-app help assistant about using Leisbase.

We process this data to conclude and perform the contract, to provide the platform, to bill our services and to provide support (Art. 6(1)(b) GDPR); to meet legal obligations, in particular tax and accounting obligations (Art. 6(1)(c) GDPR); and on the basis of our legitimate interests (Art. 6(1)(f) GDPR) in keeping the platform secure, detecting and preventing misuse and fraud, fixing errors, improving the platform with aggregated and anonymised evaluations, evaluating questions to the help assistant to improve our help pages, enforcing our claims, and informing customers about new functions, changes, their trial and their plan. You can object to information about new functions at any time, for example with the unsubscribe link in each such email.

When registering, we use Cloudflare Turnstile to protect against automated sign-ups; it checks technical characteristics of your browser without setting advertising cookies. Error reports are sent to Sentry with personal data filtering switched on. Emails from the platform are sent via Postmark. Our own subscription fees are processed by Stripe.

The data that users enter into the Workspace about the venue’s guests, staff and contacts – for example bookings, rota, time records or chat messages – is processed by us as processor for the venue (section 3), even if it relates to you as an employee of the venue. Your employer is responsible for it.

7. Cookies, local storage and resources in the platform

The staff panel at app.leisbase.com uses only cookies and local storage that are strictly necessary to provide the service you request: the session and security cookies that keep you signed in and protect your sign-in (for example remembering a device you trust), the device registration of a time clock terminal, and settings such as the layout, theme or collapsed sections you chose. Under sec. 165(3) of the Austrian Telecommunications Act 2021, no consent is required for this. The panel uses no analytics, advertising or session recording tools.

To display the panel, your browser loads some resources from third-party servers, which receive your IP address and technical browser data: the Stripe payment form on the billing page, GIPHY when you search for a GIF in the team chat, embedded YouTube videos in privacy-enhanced mode and Cloudflare Turnstile at registration. Fonts, program libraries and profile picture placeholders come from our own servers. The legal basis is our legitimate interest in a fast and working panel (Art. 6(1)(f) GDPR).

The guest-facing widgets and pages are set up by each venue. Which additional cookies or tracking tools are used there, and whether a consent banner is shown, is decided by the venue; its privacy policy applies. The widgets give venues the means to load analytics and advertising tools only after consent; using them correctly is the venue’s responsibility.

8. Desktop app and mobile team app

The desktop app for macOS and Windows and the mobile team app are access points to the platform. They process the same data as the browser version. In addition, the apps check for and download updates from our servers and, if you allow it on your device, receive push notifications. These are delivered through the Apple Push Notification service, Firebase Cloud Messaging of Google or, in the browser, the push service of your browser’s manufacturer; they receive a device token and the content of the notification, for example the sender’s name and a preview of a chat message.

Functions such as the desktop time tracker, location when clocking in or out and, if the venue switches it on, whether the phone leaves the venue area during a shift or call recording are used by the venue as your employer and are processed by us on its behalf (section 3). They only work if the venue switches them on; the venue must inform you about them.

9. Recipients and service providers

We only share personal data where this is necessary for the purposes above. We use the following service providers as our processors, bound by data processing agreements:

• Hetzner Online GmbH, Gunzenhausen, Germany – servers, databases, file storage and backups of the platform, in data centres in the EU;
• Cloudflare, Inc., USA – hosting and delivery of the website, delivery of the platform, protection against attacks, DNS, bot protection at registration, storage of files such as chat attachments and exports in the EU;
• BunnyWay d.o.o. (bunny.net), Slovenia – delivery of content via its content delivery network;
• AC PM LLC (Postmark), USA – sending emails from the platform;
• Functional Software, Inc. (Sentry), data stored in the EU (Germany) – error reports;
• Google Ireland Limited, Ireland – email and calendars of our team;
• Stripe Payments Europe, Ltd., Ireland – processing of our subscription fees.

In addition, data may be passed to our tax advisers, auditors and lawyers, who are bound by professional confidentiality; to banks for processing payments; and to courts and authorities where we are legally required to do so or need it to enforce or defend legal claims. If our business or parts of it are sold or merged, data may pass to the acquirer within the limits of data protection law.

The service providers we use as processor for venues, including the AI providers behind the chatbot and the AI assistant, are listed in Annex 2 of our Data Processing Agreement, which is public.

10. Transfers outside the EU

Some of our service providers are based in the USA or may access data from there. Transfers take place only on the basis of an adequacy decision of the European Commission – for the USA the EU-US Data Privacy Framework, where the recipient is certified under it – or of the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us.

11. How long we keep data

We keep personal data only as long as it is needed for the purpose for which it was collected, and beyond that only where the law requires it. In particular:

• support requests: two years after they were closed;
• enquiries that do not lead to a contract: as long as needed to handle them and follow up, in general no longer than three years after the last contact;
• account and contract data: for the duration of the contract; after the end of the contract the Workspace is scheduled for deletion and deleted after a grace period of 30 days;
• sign-in records: 365 days; audit logs of the Workspace: 730 days;
• backups: database snapshots expire at the latest 13 months after their creation; backup copies of files are deleted at the latest 12 months after the Workspace has been deleted;
• invoices, accounting records and business correspondence: seven years under sec. 132 of the Austrian Federal Fiscal Code (BAO), longer where proceedings are pending;
• data needed to assert, exercise or defend legal claims: until the end of the applicable limitation periods.

12. Security

We protect data with technical and organisational measures appropriate to the risk, including encrypted transmission (TLS), a separate database for each workspace, passwords stored only as bcrypt hashes, encrypted backups, encrypted storage of secrets, role and permission concepts, two-factor authentication and passkeys, logging of changes, malware scanning of files sent to the chatbot and shared in the team chat, and hosting in data centres in the European Union. No system is perfectly secure; if a breach of the protection of personal data occurs, we inform the competent authority and the persons concerned as required by law.

13. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it rectified (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR).

To exercise your rights, write to support@leisbase.com. We may ask you to confirm your identity. If you are a guest of a venue, please see section 3.

You have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at; you can also contact the authority in the EU member state where you live or work.

14. Other information

Obligation to provide data. You are not obliged to provide personal data. Without the data marked as required, however, we cannot answer your enquiry, conclude a contract or give you access to the platform.

No automated decisions. We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR).

Children. Our services are aimed at businesses. We do not knowingly collect data from children for our own purposes.

Changes. We update this policy when our processing or the law changes. The version published on this page applies; we inform customers of material changes in the platform or by email.