Privacy policy
Who controls your data
The data controller is Martin Sobek, Olgy Havlové 2896/7, Prague 3, company ID 01886584, operator of NUAD Thai Massage & Spa. For privacy enquiries, contact info@nuad.cz or write to the address above.
Voucher orders
To handle your order we process your name, email, selected massage, quantity, duration, price and payment method. Phone and notes are optional. Bank-transfer orders require a postal address for delivery, with no postage charge. The data is used to handle your order, deliver the voucher and communicate about payment. Vouchers are sold and redeemed only at Hotel Don Giovanni, Prague 3.
Booking requests
We process the selected location, massage, duration, date and time, name and phone. Email and notes are optional. For couples massage, duration and price are agreed by phone. We use the data to handle the request and confirm the appointment by phone. Sending a request does not confirm availability. Please do not include medical or other sensitive information in the notes.
Why we need the data
Data required for an order or booking is processed to prepare and perform a contract under Article 6(1)(b) GDPR. Accounting records are retained to meet legal obligations under Article 6(1)(c) GDPR. Website security and prevention of abuse are our legitimate interests under Article 6(1)(f) GDPR. We cannot handle your request without the necessary contact details. We do not use the data for automated decision-making or profiling.
Access and security
Only authorised people handling orders and bookings have access. Hosting and email providers and, for postal delivery, the carrier may process the necessary data. Access is restricted according to work needs. Form security may use a keyed hash of your IP address; request records do not retain the original IP. Technical server logs may contain access information. We do not transfer personal data outside the EU/EEA. Specific service providers will be clarified before production launch.
Retention
Booking requests are retained for 12 months from receipt. Voucher orders and accounting records are retained for 10 years. Security and server logs are retained for 90 days. Data is then deleted or anonymised.
Cookies and external services
The new website uses no analytics or third-party cookies. Only necessary session cookies support the cart and security. The cart is stored in a server session; browser session storage keeps only the intro-animation state. Fonts and images are hosted on our website. Maps and social links take you to an external website only when clicked.
Your rights
You may request access, correction, erasure or restriction of processing and, where applicable, data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent. Send requests to info@nuad.cz. You may also complain to the Czech Office for Personal Data Protection (uoou.gov.cz).
