Privacy Policy

1. Introduction

This Privacy Policy explains what personal data we collect about you as a client or as a visitor to our website, why we process it, how long we retain it, and what rights you have in connection with it.

Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the GDPR) and with Act No. 110/2019 Coll., on the processing of personal data.

Protecting your privacy is important to us. We process personal data only to the extent necessary to provide our services, to comply with our legal obligations, and to communicate with you.

Data Controller

Business name: Ing. Yaroslava Vlasová – Yara Space & Hair Spa Vlasový Wellness

Company ID (IČO): 22130292

Registered office: Křižná 169/8, 767 01 Kroměříž, Czech Republic

Place of business: Křižná 169/8, 767 01 Kroměříž, Czech Republic

E-mail: office@yaraspace.cz

Telephone: +420 776 886 466

Website: https://yaraspace.cz

The controller has not appointed a data protection officer. For all matters relating to the processing of personal data, please use the contact details above.

2. What Personal Data We Process

2.1 Data of Salon Clients

• Identification data: first name and surname
• Contact data: telephone number, e-mail address
• Booking data: date and time of the visit, chosen service, name of the stylist
• Data on services provided: history of procedures, products and shades used, recommended home care
• Photographs of the result of a procedure, where you have given consent to their capture
• Billing data where you request the issue of a tax document

2.2 Health Data (Special Category of Data)

Before colouring, chemical, and treatment procedures, we ask you during the consultation for information that may affect the safety and outcome of the procedure: known allergies and sensitivities, disease or injury of the scalp, pregnancy and breastfeeding, medication taken, and the result of an allergy test.

This data falls within the special category of personal data under Article 9 of the GDPR. We process it solely on the basis of your explicit consent, only for the purpose of safely carrying out the procedure, and we do not pass it on to any third party.

You may withdraw your consent at any time. In that case, however, it may not be possible to carry out certain procedures safely.

2.3 Data of Website Visitors

• Data entered in the contact or booking form
• Technical data: IP address, browser and operating system type, source of the visit, pages visited, date and time of the visit
• Data from cookies, to the extent set by your consent

As a rule, we evaluate technical data in aggregated and anonymised form for the purposes of measuring traffic and improving the website.

3. Purposes and Legal Bases of Processing

Each processing purpose has its own legal basis under Article 6 of the GDPR:

Booking an appointment and providing the service

Legal basis: performance of a contract, Art. 6(1)(b)

Retention period: for the duration of the services and 3 years thereafter

Keeping a history of procedures for follow-up care

Legal basis: legitimate interest, Art. 6(1)(f)

Retention period: 3 years from the last visit

Processing of health data prior to a procedure

Legal basis: explicit consent, Art. 9(2)(a)

Retention period: until consent is withdrawn, no longer than 3 years

Issuing and recording tax documents

Legal basis: legal obligation, Art. 6(1)(c)

Retention period: 10 years under the VAT Act and the Accounting Act

Handling a complaint or grievance

Legal basis: legal obligation and legitimate interest

Retention period: 4 years from resolution

Responding to an enquiry from the contact form

Legal basis: legitimate interest, Art. 6(1)(f)

Retention period: 1 year from the last communication

Sending commercial communications and news

Legal basis: consent, Art. 6(1)(a)

Retention period: until consent is withdrawn

Publishing photographs of work results

Legal basis: consent, Art. 6(1)(a)

Retention period: until consent is withdrawn

Website traffic analytics

Legal basis: cookie consent, Art. 6(1)(a)

Retention period: according to the settings of the individual cookies

Protection of the controller’s legal claims

Legal basis: legitimate interest, Art. 6(1)(f)

Retention period: for the duration of the limitation period

Providing the data necessary to book and deliver the service is a contractual requirement. Without this data, the service cannot be ordered or performed. Providing data for marketing purposes is entirely voluntary.

4. Recipients of Personal Data

We do not sell or rent your personal data. We pass it on only to the extent necessary to the following categories of recipients:

• The provider of web hosting and technical support for the website
• The provider of the booking system, where used
• The provider of traffic measurement services (Google Analytics, Google Site Kit)
• The accountant and tax adviser
• The provider of e-mail and communication platforms, including the WhatsApp service
• Public authorities in the cases laid down by law

We have a data processing agreement in place with each processor under Article 28 of the GDPR.

Employees and collaborating stylists have access only to the data they strictly need to perform their work and are bound by a duty of confidentiality.

Transfers Outside the European Union

Some technical service providers may process data on servers outside the European Economic Area. Any such transfer always takes place on the basis of a European Commission adequacy decision or on the basis of standard contractual clauses approved by the European Commission.

5. Cookies

Cookies are small text files stored in your browser. We use the following categories:

Necessary (technical) cookies

They enable the basic functioning of the website, for example submitting a form or storing your language choice.

They are stored on the basis of legitimate interest and cannot be switched off.

Analytical cookies

They are used to measure traffic and user behaviour (Google Analytics).

They are stored only with your consent.

Marketing cookies

They enable relevant advertising to be displayed and its effectiveness to be measured.

They are stored only with your consent.

You give consent to the storage of non-essential cookies via the banner shown on your first visit to the website. You can change your settings at any time in the cookie settings on our website or directly in your browser, where cookies can also be deleted.

6. Your Rights

In relation to your personal data, you have the following rights under the GDPR:

Right of access

You can ask whether and what data we process about you and obtain a copy of it.

Right to rectification

You can request the correction of inaccurate data or the completion of incomplete data.

Right to erasure

You can request the deletion of data where the reason for its processing has ended and no legal obligation prevents it.

Right to restriction of processing

You can request the temporary suspension of processing, for example while the accuracy of the data is being verified.

Right to data portability

You can obtain the data in a machine-readable format or have it transferred to another controller.

Right to object

You can object to processing based on legitimate interest, including direct marketing.

Right to withdraw consent

You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Right to lodge a complaint

You can contact the supervisory authority, see below.

You may exercise your rights in writing at the controller’s registered office or by e-mail at office@yaraspace.cz. We will respond to your request no later than one month from its receipt. In justified cases, this period may be extended by a further two months, of which we will inform you.

We may ask for additional information to verify your identity. Handling a request is free of charge, except for manifestly unfounded or repetitive requests.

Supervisory Authority

Authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů)

Address: Pplk. Sochora 27, 170 00 Prague 7, Czech Republic

Web: https://www.uoou.cz

Telephone: +420 234 665 111

7. Security of Personal Data

We have adopted technical and organisational measures appropriate to the nature of the data processed:

• Encrypted data transfer between the browser and the website using the HTTPS protocol
• Restricted access to data, only for authorised persons who need it for their work
• A duty of confidentiality for all employees and collaborators
• Secure storage of physical documentation in a lockable space
• Regular updates of the software used and data backups

Please note that data transmission over the internet cannot be made absolutely secure. We nevertheless make every reasonable effort to minimise the risk.

8. Automated Decision-Making

In processing your personal data, no automated decision-making or profiling takes place that would produce legal effects concerning you or similarly significantly affect you.

9. Links to Third-Party Websites

Our website may contain links to third-party websites, for example to social media profiles on Instagram and Facebook or to map services. These websites have their own privacy policies, and we are not responsible for their content or for the processing of data on them.

10. Changes to This Policy

We may update this Policy where necessary, for example when the scope of our services or the applicable legislation changes. The current version is always available on this page, together with its effective date.

We will inform you in advance of any material changes affecting processing based on your consent, by e-mail or by a notice on the website.

11. Contact

If you have any questions about the protection of personal data, please do not hesitate to contact us:

E-mail: office@yaraspace.cz

Telephone: +420 776 886 466

Place of business: Křižná 169/8, 767 01 Kroměříž, Czech Republic

This Privacy Policy is effective from: 27 July 2026

Document version: 2.0