Privacy policy

The controller of your personal data is LEXPO TRADE s.r.o., company ID (IČO) 17643694, registered at Na Bělidle 63/1, 150 00 Praha 5 – Smíchov, Czech Republic, the operator of the Massage DeLuxe salon.

• E-mail for data protection questions: info@massagedeluxe.cz
• Phone: +420 774 505 613
• Premises: Na Bělidle 63/1, 150 00 Praha 5 – Smíchov

Given the scale and nature of our processing we have not appointed a data protection officer. Your questions are answered directly by the operator at the e-mail address above.

We process only the data we need. We do not buy databases and we do not collect data "just in case".

Bookings. From the booking form we receive your first name and surname, phone number, e-mail address, the chosen service, the date and time of the appointment, your language and an optional note. Attached to the booking are its status, price, deposit amount and payment details.

Deposit payment. We take the deposit by bank transfer. From an incoming payment we learn the sender's name, their account number, the amount and the reference, which is what the bank passes on to us. We do not process card payments.

Gift vouchers. For a voucher we process the purchaser's name and e-mail, optionally the recipient's name and a dedication, plus the value, code and validity.

Contact form and enquiries. Name, phone number, optional e-mail and the text of your message.

Newsletter. If you subscribe, we process your e-mail address and the date consent was given.

Running the website. Technical logs (IP address, browser type, request time) needed for security and availability, and cookie data as described in the Cookie policy.

In the booking note, or to the therapist on the day, you may tell us about your health: pregnancy, injuries, back pain, oil allergies. This is a special category of personal data under Article 9 of the GDPR and we treat it accordingly.

• Telling us is entirely voluntary, but without it we cannot guarantee the treatment will be safe for you.
• The legal basis is your explicit consent under Article 9(2)(a) GDPR, which you give by sharing the information with us.
• It is visible only to the therapist performing the treatment and to reception staff to the extent necessary.
• Health notes are never used for marketing and are not passed to anyone.

• Performance of a contract (Art. 6(1)(b) GDPR): bookings, delivering the treatment, issuing and redeeming vouchers, communication about your appointment.
• Legal obligation (Art. 6(1)(c) GDPR): accounting and tax records under Czech accounting and VAT legislation.
• Legitimate interest (Art. 6(1)(f) GDPR): protection against no-shows and misuse of the booking system, website security, establishing or defending legal claims.
• Consent (Art. 6(1)(a) GDPR): newsletter, analytics and marketing cookies. Consent can be withdrawn at any time.
• Explicit consent (Art. 9(2)(a) GDPR): health information under article 3.

• Booking and customer records: 3 years from your last visit, so that we know what worked for you next time and can defend claims if needed.
• Accounting and tax documents: 10 years from the end of the tax period, as required by law.
• Voucher records: for the validity period and 3 years afterwards.
• Contact form enquiries: 1 year from the last communication.
• Newsletter: until consent is withdrawn.
• Health notes: for the duration of the customer relationship, at most 3 years from the last visit.
• Website technical logs: normally 30 days.
• Cookie consent: 6 months, after which we ask again.

Once these periods expire we delete or anonymise the data so that you can no longer be identified from it.

We do not sell personal data. We share it only with processors who handle a specific part of our operation for us and who are bound by a data processing agreement.

• Hosting and database provider: storing the application's data.
• E-mail infrastructure provider: sending booking confirmations, reminders and vouchers.
• Analytics provider: only if you consent in the cookie banner.
• Our accountants: processing tax documents.
• Public authorities: only where required by law.

Our main processors process data within the European Union. Where a service does involve a transfer to a third country, it takes place under standard contractual clauses approved by the European Commission or on the basis of an adequacy decision.

We do not carry out automated decision-making or profiling that would produce legal effects for you or similarly significantly affect you. The booking system only assigns a free room and therapist based on availability.

• Right of access: to confirmation of whether we process your data, and a copy of it.
• Right to rectification: to have inaccurate data corrected or completed.
• Right to erasure: to have data deleted once the reason for processing it has fallen away. This does not extend to records we are legally required to keep.
• Right to restriction of processing: while accuracy or lawfulness is being resolved.
• Right to data portability: to receive your data in a machine-readable format.
• Right to object to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with a supervisory authority.

Write to info@massagedeluxe.cz or call +420 774 505 613. So that we do not disclose data to the wrong person, we may ask you to verify your identity. We respond within one month; in complex cases the period may be extended by a further two months, of which we will inform you.

You can change your cookie consent at any time on the Cookie policy page. You can unsubscribe from the newsletter using the link in the footer of every e-mail.

If you believe we are not handling your data properly you can contact the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. We would appreciate the chance to put it right directly first.

We may update this document if the way we process data or the services we use change. The current wording is always on this page and carries a version date.