1. Controller and contact
The controller is Masaz4you s.r.o., Company ID (IČO) 14366312, registered office Francouzská 312/100, 101 00 Praha 10 – Vršovice. EPIMEA is the name of our premises at Le Palais Art Hotel, U Zvonařky 1, 120 00 Praha 2 – Vinohrady.
For data protection matters, contact us at trendmyself@gmail.com or +420 776 252 560. We have not appointed a data protection officer as we are not legally required to.
2. Bookings, purchases and communication
We process the data you give us when booking, buying a voucher or membership, creating an account or contacting us: name, e-mail, phone, the service ordered, date and time, redemption and payment details and the content of messages. For gifts, the buyer may enter the recipient's details; we use them only to deliver and redeem the voucher.
- Handling orders and bookings: performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR).
- Accounting and tax: compliance with a legal obligation (Art. 6(1)(c) GDPR).
- Handling claims and securing our services: our legitimate interest (Art. 6(1)(f) GDPR).
Mandatory data are needed to handle your request; without them a booking or purchase may not be possible. Please do not send detailed health information through the contact form, e-mail or chat.
The contact form on this website sends your name, e-mail address and message to our inbox so that we can reply (Art. 6(1)(b) GDPR, steps at your request, or Art. 6(1)(f), our legitimate interest in answering your enquiry). The message is delivered by the e-mail service Resend; we do not use the data for marketing.
3. Visiting this website
The website is static and uses no analytics or advertising tools. To deliver and secure the pages, the hosting provider (Vercel Inc.) processes technical data such as IP address, time of request and browser type in server logs for a limited time. The legal basis is our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).
Fonts and scripts are served from our own server, not from third parties. The Google map on the Contact page loads only with your consent; see the Cookies page.
The Book, Buy a voucher and Get EPIMEA PASS buttons lead to the booking system on the Wix platform (www.masaz4you.cz). This policy applies there too, together with the Wix cookies the booking system tells you about.
4. Health questionnaire before a treatment
Before a treatment we use a paper questionnaire with information needed to assess contraindications and tailor the care (for example allergies, pregnancy, health limitations, massage preferences). It includes the date of the visit and may include a name, room number or booking reference and a signature.
Health data are a special category of personal data. To record and use them we require your separate, explicit and demonstrable consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). A booking, acceptance of the terms or a signed declaration of accuracy does not replace this consent. You may withdraw it at any time at the premises or by e-mail; this does not affect the lawfulness of earlier processing.
Questionnaires are kept in a locked cabinet for 3 months after the visit so that records can be traced in case of a complaint or related legal claim (Art. 6(1)(f) and Art. 9(2)(f) GDPR). Only authorised persons have access, and questionnaires are securely shredded afterwards. The hotel has no automatic right to view them, and we disclose data to third parties only on an appropriate legal basis and to the extent necessary.
5. Who is involved in processing
- Wix.com Ltd. and its suppliers: booking system, payments, vouchers, members' area and related communication.
- The payment provider chosen at checkout: processing of payment data. Never enter a full card number in our forms or messages.
- Google Ireland Ltd.: e-mail communication (Gmail) and the map on the Contact page if you allow it.
- Resend, Inc. (USA): delivery of messages from the contact form. Transfers to the USA are based on the EU Standard Contractual Clauses.
- Vercel Inc. (USA): hosting of this website and processing of the submitted form. Transfers to the USA are based on the EU Standard Contractual Clauses.
- Vercel Inc.: hosting of this website.
- Accountants, legal advisers, insurers and public authorities to the extent required by law; staff providing the ordered service.
Some of these suppliers also process data outside the European Economic Area (in particular in the USA). Transfers rely on a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. About Wix: wix.com/about/privacy, list of sub-processors here. We will gladly provide more information about recipients and safeguards.
6. How long we keep data
We keep data for as long as needed to handle the booking, order and communication; for memberships and vouchers also for their validity and settlement. Accounting and tax records are kept for the period required by law (usually 5 to 10 years depending on the record). Data needed to establish or defend a claim may be kept for the limitation periods and any proceedings. Health questionnaires follow section 4. Once the purpose ends, data are deleted or anonymised.
7. Marketing messages
We send marketing messages only with your consent or to our own customers under Section 7 of Czech Act No. 480/2004 Coll., always with the option to refuse them free of charge at any time via the link in the e-mail or by writing to us. Marketing consent is not a condition of booking.
8. Your rights
Under the GDPR you have the right of access to your data and a copy, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interest, and to direct marketing at any time. You can withdraw consent as easily as you gave it. Erasure may not apply to data we must keep by law or for legal claims.
Send your request to trendmyself@gmail.com. If necessary, we will reasonably verify your identity. We usually reply within one month and will tell you about any statutory extension. You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
This policy in itself is not consent to the processing of health data and does not change the terms of memberships or vouchers already purchased.