Privacy Policy

WORKING DRAFT – DO NOT PUBLISH
Draft version: 0.3
Effective date: TO BE COMPLETED before publication

1. Who processes your personal data

The data controller is:

Kathelyn Nasayao Marquez-Chovanec
Company ID No.: 19875762
registered office: Matoušova 1286/5, Smíchov, 150 00 Prague 5, Czech Republic
Essence Thai Spa Massage premises: Preslova 1286/13, Prague 5 – Smíchov, Czech Republic
email: info@essencethaispamassage.cz
telephone: +420 774 481 411

hereinafter the “Controller” or “Essence Thai Spa Massage”.

You may also use info@essencethaispamassage.cz for requests and questions concerning personal data protection.

2. Scope of this Policy

This Policy explains how we process personal data relating to website visitors, prospective and existing customers, gift-voucher purchasers and people who communicate with us. It is an information document; general consent to it is not required to visit the website.

3. Personal data we may process

Depending on how you use our services, we may process in particular:

• identification data, especially your name;
• contact details, especially your email address and telephone number;
• booking data, especially the selected service, date, time, duration, price, booking status and related communications;
• for hotel bookings, the hotel name or address and room number;
• payment and voucher data, such as payment status, amount, currency, transaction identifier or voucher code; we do not directly process full payment-card details;
• information contained in an enquiry, complaint or other communication;
• technical and operational data, such as IP address, device and browser type, website-use information, cookie identifiers and records of consent or refusal;
• traffic-source and conversion data, including transaction ID, booking value and currency, where the visitor permits the relevant analytics or marketing technologies.

We do not systematically record or retain customers’ health data. If a customer orally tells a therapist before a massage about information needed for safe service delivery, such as pregnancy, an allergy or a contraindication, we do not normally record it in the booking system, customer profile, email or other records.

If a customer sends us health information in writing on their own initiative, we will handle it only to the extent necessary. RECOMMENDED FOR LEGAL REVIEW: the procedure, legal basis, access restrictions and prompt deletion of unsolicited health data.

4. Bookings and Acuity Scheduling

To create and manage a booking, we process mainly the customer’s name, email address, telephone number, selected service, appointment and price. A hotel booking may also require the hotel name or address and room number.

The purposes are to create and automatically confirm the booking, email appointment confirmation, provide the service, permit rescheduling, process changes or cancellation and handle related requests. The legal basis is taking steps before entering into a contract and performing the contract. Where necessary, we may also retain data to comply with legal obligations and protect legal claims.

The booking system is provided by Acuity Scheduling / Squarespace Scheduling. A successfully completed booking does not require manual approval: it is confirmed automatically and an automatic confirmation email is sent. A customer may reschedule through the system. The system does not permit self-service cancellation; cancellation is available by telephone, email or WhatsApp at +420 774 481 411.

TO BE COMPLETED: the actual Acuity retention period and deletion settings. The period must reflect operational needs, contractual and legal duties and the protection of legal claims.

5. Payments and Stripe

A customer may pay online when booking or later at the salon. Online payments are technically processed by Stripe. Stripe receives the information required to process the payment and prevent fraud; full payment-card details are not routinely made available to the salon.

The purposes are to receive and record payments, issue refunds, deal with complaints, keep accounts and protect legal claims. The legal bases are performance of a contract, compliance with legal obligations and, where necessary, the legitimate interest in protecting rights.

Accounting and tax documents are retained for the periods required by law. RECOMMENDED FOR REVIEW BY AN ACCOUNTANT / LAWYER: the specific periods based on the entrepreneur’s actual tax status and document type.

6. Email, telephone, WhatsApp and SMS communications

We process contact details and communication content to confirm and remind customers of bookings, handle changes and cancellations, answer enquiries and complaints and deal with other operational matters. Depending on the situation, the legal basis is pre-contractual steps, contract performance, legal obligation or the legitimate interest in handling communications and protecting rights.

SMS is used only for booking-related communications, particularly confirmations, reminders and operational information, and not for marketing.

Email services and hosting for the new website are provided by FORPSI. Booking emails and SMS may also be sent through Acuity / Squarespace and their suppliers.

TO BE COMPLETED: the actual retention period for ordinary customer communications and the configuration of mailboxes, Acuity and WhatsApp.

7. Web hosting and FORPSI

The new website and business email use FORPSI services. To the extent that FORPSI stores or technically accesses personal data on our behalf, it may act as a processor. This may include website operational logs, email messages and technical backups.

TO BE COMPLETED before publication: the exact FORPSI contracting entity, services used, actual log and backup retention periods, processing location and contractual role. These facts have not been verified for this draft and are not assumed here.

8. Google Analytics 4 and Google Ads

Where the visitor gives the relevant consent, we plan to use:

• Google Analytics 4, Measurement ID G-9CDK7XJLF1, to measure website traffic and use;
• Google Ads conversion tracking, ID AW-10782951242, to measure advertising effectiveness and completed bookings.

Conversion measurement may process technical identifiers, traffic-source, device and interaction information, and booking data limited to transaction ID, value and currency. Names, email addresses, telephone numbers and health data must not be sent to analytics or advertising systems.

The purposes are traffic measurement, advertising evaluation and marketing optimisation. Consent will be the legal basis for storing/reading non-essential cookies and related processing. Without consent, analytics and marketing technologies will not be activated, subject to any strictly technical signals whose exact configuration must be verified before launch.

TO BE COMPLETED: the actual GA4, Google Ads and Consent Mode configuration, GA4 retention period and specific cookie list after implementation is finalised.
RECOMMENDED FOR LEGAL REVIEW: allocation of roles between the Controller and Google and the legal mechanism and safeguards for any transfers outside the EU/EEA.

9. Cookies and consent management

The website may use technologies that are necessary for security and basic website and booking functions; preference technologies if introduced; analytics technologies, especially Google Analytics; and marketing technologies, especially Google Ads.

Analytics and marketing technologies will start only after consent. The cookie interface must allow visitors to consent, refuse and later withdraw or change their choice equally easily. Withdrawal does not affect the lawfulness of earlier processing.

The consent record will be retained as necessary to demonstrate the choice and renewed at reasonable intervals. TO BE COMPLETED: consent-platform provider and actual retention period.

Before launch, we recommend creating a separate Cookie Policy containing the current technologies, purposes, providers and durations.

10. Google Fonts

The website may use Google Fonts. The preferred option is local font hosting, which avoids a direct connection between the visitor and Google servers when fonts load.

TO BE COMPLETED before publication: whether fonts will actually be hosted locally. If loaded externally, the transfer of technical data, legal basis and any transfer outside the EU/EEA must be described and assessed.

11. Gift vouchers, packages and Loyalty

When a voucher, package or Loyalty product is purchased or redeemed, we process the data required for ordering, payment, issuing and verifying the booking or voucher code and providing the service. The legal bases are pre-contractual steps and contract performance; legal obligation for accounting documents; and legitimate interest for protecting claims.

A gift voucher is issued for a specific service and may be delivered electronically or issued physically in the salon. It is redeemed using a voucher code. Loyalty is a prepaid package for a specified number of massages and uses a unique booking/Loyalty code emailed to the customer for successive bookings and redemption. These codes confer entitlement and should be protected against unauthorised use.

If a customer reports a code as lost, stolen or potentially misused, we may process the data needed to locate the purchase, verify entitlement and, where appropriate, block or replace the code.

TO BE COMPLETED: the precise purchaser and recipient data processed for each purchase method and the actual Acuity retention settings.

12. Recipients, processors and transfers outside the EU/EEA

Depending on the service, necessary access may be given to Acuity Scheduling / Squarespace; Stripe; FORPSI; Google where the relevant consent has been given; email and SMS providers involved in bookings; accounting, tax or legal advisers where necessary; and public authorities where required by law.

Some providers belong to international groups and processing may involve a transfer outside the EU/EEA. In that event, an appropriate GDPR mechanism and safeguards must be used, such as an adequacy decision or Standard Contractual Clauses.

TO BE COMPLETED / RECOMMENDED FOR LEGAL REVIEW: current contracting entities, roles, other processors and transfer mechanisms for Squarespace/Acuity, Stripe, Google and the SMS provider.

13. Retention periods

We do not retain personal data longer than necessary. Before publication, specific periods will be completed and operationally implemented:

14. Your rights

Subject to the GDPR, you have in particular the right to obtain confirmation and access; correct inaccurate or complete incomplete data; request erasure or restriction; object to processing based on legitimate interests; receive portable data where the legal conditions apply; withdraw consent at any time where processing is based on consent; and lodge a complaint with the Czech Office for Personal Data Protection.

Send requests to info@essencethaispamassage.cz. We may reasonably verify your identity before responding.

Czech Office for Personal Data Protection: Pplk. Sochora 27, 170 00 Prague 7, website uoou.gov.cz.

15. Automated decision-making and profiling

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for customers. Subject to consent, Google Analytics and Google Ads may help create statistics or advertising audiences; TO BE COMPLETED according to the final advertising-feature configuration.

16. Security

We use technical and organisational measures appropriate to the nature of the processing. Access is limited to people and suppliers who need it for the stated purpose. No transmission or storage method can guarantee absolute security.

17. Changes to this Policy

We may update this Policy when services, technologies or legal requirements change. The current version will show its version number and effective date. Material changes will be communicated appropriately.

Sources used for this working draft

• Regulation (EU) 2016/679 (GDPR), particularly Articles 5, 6, 9, 12–22, 28, 32 and 44–49.
• Czech Office for Personal Data Protection guidance on basic principles, data-subject rights and cookies.
• Confirmed technical and operational information supplied by the operator.