Privacy Policy

1.Controller and contact

The controller of personal data is Bonsai Thajské Masáže s.r.o., company no. 22632344, registered office Osadní 869/32, 170 00 Prague 7 – Holešovice, registered in the Commercial Register kept by the Municipal Court in Prague, section C, insert 419350. Premises: Dělnická 411/23, 170 00 Prague 7 – Holešovice.

Contact for any question or to exercise your rights: info@bonsaimasaze.cz, +420 728 806 846. Requests are handled by the company’s managing director. The Salon has no data protection officer; it is not required to appoint one.

These principles cover clients, voucher buyers and their recipients, and anyone who contacts the Salon.

2.Data, purposes, and legal bases

For booking and performance we process names, email addresses, telephone numbers, selected services, appointment times, communications, and necessary notes. For vouchers we also record order numbers, codes, validity and redemption, price, payment status, and any dedication. The legal basis is Article 6(1)(b) GDPR: entering into and performing a contract or taking pre-contractual steps.

Accounting and related records are processed to meet legal obligations under Article 6(1)(c) GDPR. Data necessary for proportionate protection and defence of claims, dispute handling, and system security may be processed on legitimate interests under Article 6(1)(f). Necessity and proportionality are assessed for each purpose.

Marketing based on voluntary consent relies on Article 6(1)(a) GDPR; consent is not a condition of booking or purchasing and may be withdrawn at any time. The Salon sends marketing messages only to people who have consented; consent is collected separately from any order or booking and withdrawing it has no effect on the service. It can be withdrawn by replying to any message or writing to info@bonsaimasaze.cz.

If a dedication includes the recipient’s name, the source is the buyer and the purpose is gift personalisation. If the recipient is not party to the contract, necessary personalisation may rely on proportionate legitimate interests under Article 6(1)(f) GDPR. Buyers must not include another person’s health or other sensitive data. The recipient learns about the processing from the voucher and the accompanying e-mail, which link to these principles; on request the Salon provides the information directly at the contact address.

3.Health information

Health information is a special category of personal data under Article 9 GDPR and the Salon keeps it separate from ordinary booking data.

The Salon does not store health information in the booking system or in any other electronic record. The client gives it directly to the therapist before the treatment begins, orally or in writing on the spot, and it serves solely to carry out that visit safely.

Clients should therefore not put health information into the booking note, nor send it by e-mail or message. If it is supplied anyway, the Salon removes it from its records once it notices.

Processing during the visit itself rests on the client’s explicit consent under Article 9(2)(a) GDPR, given by disclosing the information before the treatment. Accepting the terms and conditions does not replace it.

4.Noona and other recipients

The following recipients process personal data for the Salon:

• Noona Labs ehf. — booking system. Holds bookings, client contact details and the record of gift voucher redemption. For this data it acts as a processor; for the client’s own user account it may act as a separate controller under its own policy, which does not replace this document.
• Vercel Inc. — hosting of the websites and of the voucher application.
• Resend — sending the confirmation e-mails with the voucher. Processing takes place in the EU region (Ireland).
• Google Ireland Ltd. — the voucher order log (Google Sheets and Apps Script) and website traffic statistics (Google Analytics 4).
• GOPAY s.r.o. — payment gateway for buying vouchers online. The Salon has no access to card details and does not store them.

Data may further be made available, to the extent necessary, to authorised Salon staff, to accounting and legal advisers, and to public authorities where the law requires it.

5.Transfers outside the EEA

Resend processes e-mail in the EU region (Ireland). Hosting with Vercel runs in a European region (Frankfurt).

With Google (Google Sheets, Apps Script and Google Analytics) data may be transferred to the United States. Such transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework), or on standard contractual clauses.

Noona Labs ehf. is established in Iceland, a country of the European Economic Area, so this is not a transfer outside the EEA.

A copy of the safeguards used is available from the Salon on request at the contact address.

6.Retention

We keep data for the following periods:

• Accounting records (including records of voucher sales) — 5 years from the end of the accounting period they relate to, under Act No. 563/1991 Coll. on Accounting.
• Order and voucher data — for the validity of the voucher and then 3 years, matching the general limitation period under § 629 of the Civil Code.
• Bookings and client contact details — 3 years from the last service provided. After that the record is deleted.
• Enquiries that did not lead to a contract — no more than 12 months after they were handled.
• Marketing consent — until the consent is withdrawn; afterwards only the record of its granting and withdrawal is kept for as long as needed to evidence it.

If a dispute or proceedings begin, we keep the necessary data until they conclude and for as long as related obligations require. Deletion is carried out by the managing director, manually in Noona and in the voucher log.

7.Your rights

Subject to the GDPR, you may request access and a copy, rectification, erasure, restriction, and portability. You may object to processing based on legitimate interests. Consent may be withdrawn at any time; objection to direct marketing is unconditional.

Send requests to info@bonsaimasaze.cz. We respond without undue delay, generally within one month; a statutory extension is possible with reasons given. Identity is verified proportionately where necessary. Rights are not absolute; for example, erasure must not prevent fulfilment of a legal obligation.

You may complain to the Czech Office for Personal Data Protection or another competent supervisory authority under the GDPR.

8.Required data, website, and updates

The data needed for a booking or an order is required to conclude and perform the contract; without it the service cannot be arranged. The voucher dedication and marketing consent are optional.

Cookies and traffic statistics

The Salon’s websites use Google Analytics 4 (measurement ID G-DV910KQ3RK for the Czech site and G-HJ5H8TBQ3B for the English one) for traffic statistics. The tool stores cookies on the visitor’s device and processes the IP address and on-site behaviour.

The pages also load fonts from Google Fonts, which transmits the visitor’s IP address to Google. The link to the Noona booking system and to social networks is an ordinary link; data is transferred only once it is opened. There are no advertising or tracking pixels on the Salon’s websites.

Cookies that are not necessary to operate the website are stored only with consent. Consent is collected by a bar on the first visit; until it is given, no statistics or marketing tools run. Declining does not affect how the website works.

The marketing category covers tools that measure advertising performance, such as the Meta pixel. The Salon deploys them only once consent has been given; where they are not listed as active in this document, they are not in use.

You can change your choice at any time: Change cookie settings. It can also be withdrawn by deleting cookies in your browser.

Automated decision-making

The Salon does not carry out automated decision-making or profiling with legal effects for the client.

Changes

Changes in processing are reflected in the current version of these principles published on the Salon’s website.