DATA PROTECTION
I. Content and purpose of the document
II. Personal data controller – who are we and how can you contact us?
III. What personal data do we process and how do we obtain it?
IV. For what purposes do we process personal data, for how long and what entitles us to do so?
V. Disclosure of personal data to other persons
VI. Information about your data protection rights
VII. Other important information for exercising your rights
I. Content and purpose of the document
This document contains information regarding the protection of personal data provided by visitors to the www.sauna-in.cz website or the booking system at www.sauna-in.cz. and the protection of personal data provided to us directly by clients and those interested in our services and products in person at the SAUNA-IN (CARETTA SPA CZ s.r.o.)
The purpose of this document is to inform you (data subjects) of your rights and to provide clear information on how personal data will be handled.
We appreciate your trust in providing us with your personal data and therefore we process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation, commonly known as GDPR. Clicking on the regulation number in the previous sentence will take you directly to the text of this regulation and you will also find there the exact legal provisions that we refer to in this text below.
II. Personal data controller – who are we and how can you contact us?
The operator of the aforementioned website is:
CARETTA SPA CZ s. r. o.
Headquarters: Krmelínská 631, 739 29 Stará Ves nad Ondřejnicí
Identification number: 24727237
VAT: CZ24727237
File No.: C 68836 filed with the Regional Court in Ostrava
(hereinafter referred to as the “Administrator”)
Contact details of the Administrator:
Contact address: Krmelínská 631, 739 29 Stará Ves nad Ondřejnicí
Contact e-mail: recepce@sauna-in.cz
Contact phone: +420 724 201 221
III. What personal data do we process and how do we obtain it?
We primarily process data that you voluntarily provide to us. By filling in one of the forms on the website, by entering your data in your user account in the booking system, by providing data in the preparation of contracts and related documents and in connection with the execution of contracts (i.e. in connection with the delivery of goods, provision of services), by personal contact, by telephone, in writing, by e-mail or by other means of communication (text messages, messages in messenger applications, etc.). If necessary, we also process data from public registers (to include or check your identification data in contracts).
If you access our website, the IP address is recorded and, if you have cookies enabled in your browser, data about the pages you visit is recorded. We use Google Analytics on our website, details of which can be found directly on Google’s website. You can deactivate the use of cookies in your browser. We also use social media advertisements to offer our services, this does not directly involve the processing of your personal data, you may only see our advertisements if, for example, you have previously visited one of our websites.
If we need your consent to process certain personal data for specific processing purposes, we will only process such data for that purpose with your consent.
You provide us with the data voluntarily in principle, in some cases we would not be able to deliver the ordered goods or provide the service without providing the data, we will always notify you in advance. You are only obliged to provide us with data in cases where this is directly required by law.
Personal data we process:
Name, surname, phone number, email, IP address, cookies, information about the goods and services you have ordered, information about what goods you have bought from us, information about what services we have provided to you. In the case of legal entities and self-employed persons, we additionally store the address, ID number and VAT number.
IV. For what purposes do we process personal data, for how long and what entitles us to do so?
1. Processing of personal data for the purpose of concluding a contract and fulfilling contractual obligations
In order for us to conclude a contract with you and deliver the goods you have ordered in our e-shop or to provide the ordered service, to conduct a course or other live event and to conduct related communication with you, we process the following common personal data: name, surname, telephone number and e-mail, in addition to the address of the registration number, VAT number – if you are ordering as an entrepreneur.
The legal title (legal reason) for the processing of this data is directly the performance of contractual obligations under the contract concluded between us. Such an obligation is in particular the delivery of goods or services, sending specific instructions before a course or other live event, arranging a consultation date, etc. This does not have to be a contract concluded in a conventional printed form. It can also be a contract made verbally, over the phone or by completing and submitting an order form on the website and our confirmation of such order. For the purpose of the performance of the contract, we process ordinary personal data for the duration of the contractual relationship between us. After the end of the contractual relationship, some data is then retained for the purposes of compliance with legal obligations or for legitimate interest purposes, as you will read in the following sections of this document.
2. Processing of personal data for compliance with accounting, tax and other legal obligations
In order to comply with the obligations arising from the applicable legislation, especially in the field of accounting, tax law and archiving, we process the data provided on invoices, i.e. name, surname, address, or ID number, VAT number and information about the purchased goods or services.
The period of time for which the data is processed is determined directly by the relevant legal regulations that oblige us to process it.
3. Processing of personal data for the purposes of our or a third party’s legitimate interests
A legitimate interest can cover a wide range of situations. We therefore inform you about the legitimate interests for which we process personal data: The legitimate interest is to protect and prove our rights and legal claims, in particular those arising from contracts entered into or harm caused. For these purposes, we process personal data for a period of 4 years after the end of the contractual cooperation or our last contact if no contract has been concluded. This period is set in relation to the limitation periods for claims, taking into account that we may not become aware of any claim brought before a court immediately when it is brought by the other party. For these purposes, data from contracts and our communications with each other concerning orders, the conclusion of contracts and the performance of contracts are stored.
Furthermore, direct marketing is a legitimate interest. For sending commercial communications, we generally process the following personal data of our clients: name, surname, e-mail. In addition, in the case of written communication: address. In case of telephone contact: telephone number. In the case of other means of communication (messenger, Facebook, etc.) the relevant contact details. You can always simply stop receiving commercial communications by clicking on the link provided in the email. If we use a traditional printed form or a phone call or one of the communication applications such as messenger, facebook, etc. to send you our offer or information about our news, we will also respect this if you let us know that you do not want further contact.
4. Processing of personal data on the basis of your consent for marketing purposes
If you give us your consent, we will process your personal data to send you offers of our services and products for a period of 5 years. However, we will only need your consent for this processing if you are not our client.
Only with your consent will we publish the personal data contained in your reference, only with your consent will we publish your personal photograph or personal video taken during one of our live events.
Before you give us your consent, we will inform you of what data and for which specific purpose the consent will apply. You can withdraw your consent at any time. However, if we also process some of your personal data on the basis of another legal basis (see points 1 to 3 above), we may continue to process your personal data for these purposes even after you have withdrawn your consent, as consent is not required for these specific purposes.
V. Disclosure of personal data to other persons
We are assisted by other persons who act as processors to ensure that we meet some of our contractual or legal obligations. These include, in particular, cooperating accountants, financial institutions, providers of data storage and software applications, freight forwarders, collaborators who administer websites and software applications or who perform technical, organisational, operational, administrative, logistical or other categories of activities for us. We enter into written contracts with processors, which agree on data protection obligations to keep your data safe. All potential global technology providers (data storage, social networks, software, etc.) used by us, with whom it is technically not possible to enter into a separate written processing agreement, are also obliged to comply with all GDPR requirements on their side and are fully committed to the protection of all personal data of users, including those managed by us.
Personal data may also be disclosed to the relevant administrative authorities if we are obliged to do so by law (i.e. in particular in the case of an inspection in which the authority is entitled to require the submission of personal data).
VI. Information about your other data protection rights
This is the right to confirm whether we are processing your personal data and, if so, to access that data and information about its processing.
This is the right to have inaccurate personal data concerning you corrected without undue delay. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing an additional declaration (in which you provide complete data).
In the cases provided for by law or the GDPR, you have the right to request that we delete your personal data without undue delay (the GDPR lists the grounds in Article 17, including exceptions where deletion is not carried out).
In the cases set out in Article 18 of the GDPR, you have the right to request that we restrict the processing of your personal data.
Under the conditions set out in Article 20 of the GDPR, you have the right to obtain your personal data and transfer it to another controller. Where technically feasible, you have the right to request the transfer directly to another controller.
Where we process personal data for legitimate interest purposes, you have the right to object to such processing and we will then no longer process the data unless our legitimate interest overrides your interests or rights and freedoms. If the legitimate interest is direct marketing, then objecting will always result in the cessation of further processing for direct marketing purposes.
If you believe that your data protection rights are being violated, you have the right to file a complaint with the Office for Personal Data Protection. For more information about the Office and data protection, please visit the Office’s website directly at www.uoou.cz.
VII. Other important information for exercising your rights
If you have further questions about the processing of your personal data by us, you can contact us by email at recepce@sauna-in.cz or by sending a written request to our correspondence address listed at the beginning of this document. You can also directly exercise your rights, which we describe in Article VI. Please note that we may contact you afterwards to verify that the request is indeed made directly by you and to verify your identity and request in a reasonable manner. The same applies to any telephone or similar communication.
This text is effective from 01.05.2023
