Privacy
Policy

Effective from 24 October 2026

1. Who is the data controller

I am a self-employed individual operating under a trade license, and in connection with my business I process the personal data of my clients and of people interested in my services in the role of data controller under the GDPR – Regulation (EU) 2016/679.

2. What data I process and why

When you contact me through the contact form on this website, I store the following data:

• first name and surname
• email address
• phone number
• the service you selected and your preferred date and time
• the content of your message

This data is used solely so that I can handle your inquiry – get back to you and agree on a date and the terms of the service. The legal basis for the processing is taking steps prior to entering into a contract and my legitimate interest in responding to your inquiry (Article 6(1)(b) and (f) GDPR).

When you order a gift voucher, I store the following data:

• the buyer's name, email address and phone number
• the recipient's name, who the voucher is from, and the dedication
• the delivery address, if the voucher is sent by post
• the selected course, the price, payment details (amount, payment reference, date received) and the voucher status (paid, sent, redeemed)

This data is used to issue, deliver and redeem the voucher and to keep accounting records. The legal basis is the performance of a contract and compliance with a legal obligation (Article 6(1)(b) and (c) GDPR). The recipient's name and the dedication are provided by the buyer so that the voucher can be issued in her name.

If the order came through a recommendation from a partner hairdresser (via the QR code on her leaflet), I send her the buyer's first name and what was ordered by email, so that her commission can be paid. I do not share the surname or contact details.

I do not use the data for bulk marketing mailings, nor do I sell it to third parties.

3. How long I keep the data

I keep inquiry data for as long as necessary to handle your booking and for a reasonable period afterwards in case of follow-up communication (usually 3 years from the last interaction), after which I delete it. Data from completed bookings that is tied to accounting records is kept for the period required by law (usually 10 years).

Data from gift voucher orders is kept for the validity of the voucher and until it is redeemed; data tied to accounting records is kept for the period required by law.

4. Who I share the data with

I process personal data in a database running on infrastructure provided for me by the following technical processors:

• Vercel Inc. – website hosting and server infrastructure
• Neon (Databricks) – the database where inquiries are stored

I have concluded, or will conclude, a data processing agreement under Article 28 GDPR with any other processors (e.g. an email notification service). I do not provide the data to any of them for their own marketing purposes.

5. Cookies and analytics

This website does not use advertising or tracking cookies. I measure traffic with my own simple solution that works anonymously – it does not store cookies, IP addresses or any personal identifier, only aggregate statistics (e.g. the number of page views). In addition, I use the anonymous statistics of the hosting provider Vercel (Vercel Web Analytics), which likewise do not use cookies and do not identify visitors.

6. Your rights

With regard to your personal data, you have the right:

• to access the data I process about you
• to have inaccurate or outdated data rectified
• to erasure (the “right to be forgotten”) where the data is no longer needed
• to restriction of processing
• to object to processing
• to data portability
• to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) if you believe your right to personal data protection has been infringed

To exercise any of these rights, write to me at makeupbartoskova@gmail.com. I will respond to your request within 30 days at the latest.

7. Data security

Data transferred between your browser and the website is encrypted (HTTPS). Access to the inquiry database is password-protected and limited to the persons who need the data to handle your booking.

8. Changes to this policy

I may update this policy from time to time, for example when the data processed or the services used change. The current version is always available on this page.