Privacy policy
How we handle the data you give us when booking a massage, what we do with cookies and what your rights are.
This document fulfils the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (“GDPR”), Slovak Act No. 18/2018 Coll. on personal data protection and § 109 of Slovak Act No. 452/2021 Coll. on electronic communications.
1. Data controller
The controller of personal data is J&B Brand s.r.o., Tarasa Ševčenka 3935/14, 080 01 Prešov, company ID 55 229 239, registered in the Commercial Register of the Prešov District Court, section Sro, insert no. 45465/P, which operates the Malé Thajsko massage salon at Slovenská 15, Prešov.
Contact for personal data matters: info@malethajsko.sk, +421 917 496 338.
We have not appointed a data protection officer (DPO), as the law does not require it.
2. What data we process and why
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Booking a massage and related communication | first and last name, phone, e-mail, date and time, type and length of massage, any note you write in the form | Art. 6(1)(b) GDPR, performance of a contract and steps prior to entering into it | while handling the booking and 3 years after the appointment (general limitation period) |
| Proof that you accepted the booking terms | version of the terms and the time you accepted them | Art. 6(1)(f) GDPR, legitimate interest in proving the agreed terms | together with the booking |
| A register of customers who repeatedly failed to attend a booked appointment or behaved inappropriately towards staff. Such customers cannot book online, or we book them only after payment for the missed appointment | name, phone number, brief reason for the entry | Art. 6(1)(f) GDPR, legitimate interest in protecting the salon’s property and staff safety | while the reason for the entry lasts, reviewed at least once a year |
| Accounting and tax obligations | details on the payment receipt | Art. 6(1)(c) GDPR, compliance with a legal obligation | 10 years, as required by accounting regulations |
| Website operation and security (server logs) | IP address, access time, visited address, browser type | Art. 6(1)(f) GDPR, legitimate interest in secure operation | short term, according to hosting settings |
| Our Facebook and Instagram profiles | what you publish on the profile or write to us through it | Art. 6(1)(f) GDPR, legitimate interest in communicating with customers | while the profile exists, messages until resolved |
| Photos and names of our therapists on the website | photo, the name the therapist uses | Art. 6(1)(a) GDPR, consent of the data subject | until consent is withdrawn, at most for the duration of employment |
| Website traffic measurement | a daily anonymous fingerprint (from the IP address and browser, cannot be traced back to a person), pages viewed, referring page, device type, browser language, clicks on the website | Art. 6(1)(f) GDPR, legitimate interest (improving the website and planning capacity); nothing is stored on the device, so § 109(8) of Slovak Act No. 452/2021 Coll. does not apply | aggregated statistics 24 months, the fingerprint key is deleted daily |
Providing data in the booking form is voluntary, but without a name and contact we cannot confirm your booking or notify you of a change. We do not use data for automated decision-making or profiling, and a person decides on every booking.
Please do not write information about your health in the form’s note. If something needs to be taken into account during the massage, tell the therapist on site.
3. Cookies and traffic measurement
A cookie is a small file a website stores in your browser. On this website we only use those necessary for it to work, which by law do not require consent.
| Cookie | What it is for | Validity |
|---|---|---|
| mt_salon | employee login to the salon’s internal calendar. Does not concern ordinary website visitors | until the browser is closed |
| mt_cookie_consent | remembers your choice in the cookie bar so we do not ask again. Saved only once you make a choice | 12 months |
We measure traffic with our own tool, without cookies. We do not use Google Analytics, Meta Pixel or anything similar, and no data leaves our server. The tool stores nothing in your browser. It counts visitors using a daily fingerprint created from the IP address and browser type with a random key that changes every day, the old one being discarded. The fingerprint therefore cannot reveal who you are, and we will not recognise you the next day. We record which pages you opened, where you came from, device type, browser language and what you clicked (for example the phone number or the booking button). This helps us improve the website and plan salon capacity, the legal basis being our legitimate interest.
Since nothing is stored on your device or passed to third parties, consent is not required by law and so the cookie bar does not appear. If we add a third-party tool in the future, the bar will appear before it loads and no data will go anywhere without your consent. You can change your consent at any time via the link Cookie settings in the footer.
Your browser can also block cookies altogether in its privacy settings. If you block necessary cookies, however, the website may not work properly.
4. Data recipients
We do not sell data or give it to anyone for their own purposes. Only those we need to run the salon have access to it:
- Websupport s. r. o., company ID 36 421 928. Operates the server running the website, booking system and booking database, and sends booking e-mails.
- Smash, s. r. o., company ID 46 007 041. Develops and manages the website and booking system for us, and has access to booking data during maintenance and troubleshooting.
- Stripe Payments Europe, Limited (Ireland), only if you choose to pay by card online. You enter card details directly on the Stripe payment page, we neither see nor store them. Stripe receives your e-mail, the amount and the booking number from us. For payments it also follows its own privacy policy.
- accountant and tax adviser, to the extent of accounting documents
- public authorities, where required by law
Suppliers process data strictly according to our instructions and may not use it for their own purposes.
5. Data transfers outside the EU
Booking data is kept on a server in the Slovak Republic and we do not transfer it outside the European Economic Area.
When paying by card online, Stripe may also transfer payment data outside the EU, for example to the USA, on the basis of the European Commission’s standard contractual clauses.
If you contact us via Facebook or Instagram, that communication takes place on Meta’s platforms and is governed by its terms, which we cannot influence.
6. Your rights
With regard to your data, you have the right to:
- know whether and what data we process about you, and receive a copy
- have incorrect data corrected or completed
- request erasure if the data is no longer needed or if you have withdrawn consent
- request restriction of processing
- data portability for data you gave us and that we process automatically
- object to processing based on legitimate interest, including an entry in the register under section 2. We will assess your objection and let you know our decision
- withdraw consent at any time where we process data on that basis. Withdrawal does not affect the lawfulness of processing before withdrawal
Just write to info@malethajsko.sk. We will reply within one month at the latest. If you are not satisfied, you can file a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.
7. Security
The website and booking system run over an encrypted connection (HTTPS). The booking database is stored outside the publicly accessible part of the server. The salon’s internal calendar can only be accessed after logging in, and every change is recorded under the name of the person who made it. Only staff who need the data for their work can access it.
8. Changes to this document
If the way we process data changes, we will update this document and the validity date above. We will announce material changes on the website.
9. Contact
J&B Brand s.r.o., Malé Thajsko salon
Slovenská 15, Prešov
info@malethajsko.sk
+421 917 496 338