Privacy policy

We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on personal data processing. This document explains what data we collect, why, and for how long.

1. Data controller

The controller has not appointed a data protection officer — please use the contact above for all matters.

2. What data we process and why

Health-related information shared in connection with a treatment is processed only to the extent necessary for the safe delivery of the service and is handled with particular care.

3. How long we keep the data

• Order and booking data — for the duration of the contract and 4 years afterwards (limitation periods).
• Accounting documents — 10 years from the end of the tax period, as required by law.
• Data processed on the basis of consent — until consent is withdrawn, at most 5 years.

4. Who we share the data with

We do not pass data to anyone other than the following processors, who help us run the service:

• PayU S.A. — card payment processing. Card details are entered directly at the gateway; we never see them.
• Zásilkovna, PPL, Czech Post — parcel delivery (name, address, phone, email).
• Resend — sending transactional emails (order and booking confirmations).
• Server provider — running the website and database; data is stored on a server in the European Union.
• Accountant — processing tax records.
• Google Ireland Limited — anonymised traffic statistics, if you consent to them.

We do not transfer data outside the EU and do not use it for automated decision-making or profiling.

5. Your rights

• the right of access to your data and to a copy of the data processed,
• the right to rectification of inaccurate data,
• the right to erasure (“the right to be forgotten”), unless a legal obligation prevents it,
• the right to restriction of processing,
• the right to data portability,
• the right to object to processing based on legitimate interest,
• the right to withdraw consent at any time, without affecting the lawfulness of prior processing,
• the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.cz.

To exercise a right, email us at info@beautymaniac.cz. We reply within one month at the latest.

6. Security

The website runs exclusively over an encrypted HTTPS connection. The database is not accessible from the internet, passwords are stored only as an irreversible hash, and access to the administration is protected by a separate login. We back up the data daily.

7. Cookies

Necessary cookies keep the basket, the booking form and sign-in working — the site would not function without them and they do not require consent. Analytics cookies are used only with your consent and serve anonymised traffic statistics. You can change your consent at any time in your browser settings, where cookies can also be deleted.