CS
ENLegal information
Privacy policy
Effective from 6 November 2026. This English version is a translation; if it differs from the Czech version, the Czech version prevails.
Contents
- Controller of your personal data
- What data we process
- Why we process data and on what legal basis
- Bookings through Reservio
- Contact form, enquiries and withdrawal
- Electronic voucher orders and payments
- Marketing messages
- Photos and videos
- Who data may be shared with
- Transfers of data outside the European Economic Area
- How long we keep data
- Cookies and similar technologies
- Whether providing data is required
- Your rights
- Data security
- Changes to this policy
This policy explains how The Spot Art studio s.r.o. processes the personal data of customers, website visitors and other people who communicate with it.
1. Controller of your personal data
The controller of your personal data is The Spot Art studio s.r.o., Company ID 237 26 547, with its registered office at Příčná 1892/4, 110 00 Praha 1, registered in the Commercial Register maintained by the Municipal Court in Prague under file number C 431207.
We run the studio at V Horkách 19, 140 00 Praha 4. Please send questions and requests about personal data to info@spotart.cz. Website: https://spotart.cz/
The controller has not appointed a data protection officer.
2. What data we process
Depending on how you use our services, we may process in particular:
- your first name and surname;
- your email address and phone number;
- identification details of your Instagram or Facebook profile;
- the content of enquiries, messages and other communication with us;
- booking details (service, date and time, note and, where applicable, a voucher number);
- details of an electronic voucher order, its value, status and payment;
- the text of a personal message and, where applicable, the name of the recipient;
- details needed to issue and keep accounting documents;
- details related to a complaint, withdrawal from the contract or another claim;
- IP address, device and browser details, cookie identifiers and details of how you use the website;
- photos or video recordings, if you consent to them being taken and used.
We usually obtain the data directly from you when you place an order, make a booking, visit the website or communicate with us. We may also obtain the name of the recipient or the text of a personal message from the buyer who orders a voucher. The buyer should provide only the details needed to issue the voucher and should reasonably inform the recipient that the details have been passed on. If we only have the name of the recipient without their contact details, we do not contact the recipient ourselves and use the details solely to personalise and record the voucher.
3. Why we process data and on what legal basis
| Purpose of processing | Typical data | Legal basis |
|---|---|---|
| Handling an enquiry or an event request | name, email, phone, social media profile, content of the message; for an event also the type, number of people and date | steps taken before entering into a contract; depending on the nature of the message, also our legitimate interest in handling the communication |
| Booking a session and communication about your visit | name, email, phone, service, date and time and booking note | performance of a contract or steps taken before entering into it |
| Selling and delivering an electronic voucher | name, email, phone and order and payment details | performance of a contract |
| Personalising the voucher for the recipient | name of the recipient and personal data in the message provided by the buyer | legitimate interest in issuing and delivering a personalised voucher as the buyer wishes |
| Redeeming a voucher during a visit | voucher number and booking details | performance of a contract |
| Accepting payment, accounting and compliance with legal obligations | identification, order, payment and accounting data | performance of a contract and compliance with legal obligations |
| Complaints, withdrawals, grievances and protection of legal claims | order and payment details and related communication | performance of a contract, compliance with legal obligations and legitimate interest in protecting legal claims |
| Operation and security of the website | IP address, technical logs, device details and strictly necessary cookies | legitimate interest in safe and reliable operation; use of strictly necessary cookies |
| Source of orders and enquiries | general source of the visit (type and name of the website or service, campaign label), landing page | legitimate interest in knowing where customers come from |
| Detailed analytics with cookies and online advertising | cookie identifiers, IP address, device and website usage details | your consent |
| Analysis of website use (PostHog) | a random identifier in browser storage, pages visited, clicks and scrolling, a recording of the visit to the website including the content of ordinary form fields, loading speed and page errors, device details, approximate location estimated from the IP address | your consent |
| Offers of our similar services to existing customers by email | name, email and details of a previous purchase | legitimate interest and the conditions of Section 7(3) of Act No. 480/2004 Coll.; you can unsubscribe from each message with one click |
| Taking recognisable photos or videos and using them for promotion | likeness and photographic or audiovisual recording | your consent |
Where processing is based on legitimate interest, you can object to it. Where it is based on consent, you can withdraw your consent at any time; withdrawal does not affect the lawfulness of processing before the withdrawal.
4. Bookings through Reservio
You book a session in the Reservio booking system at the-spot-art.reservio.com. Reservio processes the booking details (name, email, phone, chosen service, date and time and note) on our behalf as a processor.
To redeem a gift voucher, write its number in the note of your booking. We check it during your visit and deduct it from the price.
Reservio’s own rules, including its cookies and visitor measurement, also apply on the pages of the booking system. Based on our settings, Reservio passes information about the progress of a booking to our Google Analytics account.
When you go from our website to the booking system, we pass it, in the link address, the label of the campaign that brought you to the website (UTM parameters). With your consent to analytics, we also pass the Google Analytics visit identifier, so that the booking belongs to the same visit. If you have also consented to advertising, the same parameter also carries Google Ads identifiers (of the browser and of the ad click), so that the booking can be attributed to the ad.
5. Contact form, enquiries and withdrawal
The contact form collects your name, email and message; an event enquiry also collects your phone number, type of event, number of people and preferred date. We deliver the message to our email and keep a copy of it in our database with the provider Cloudflare. For an event enquiry, we send you a copy. Sending is handled by the Resend service.
The withdrawal form collects your name, email, order or voucher number and, optionally, the reason. We email you a confirmation with its content and the time it was sent.
We do not process the details needed to reply or to handle your request on the basis of consent, but so that we can handle your request.
We also accept enquiries through Instagram and Facebook. In that case we process the profile identification details, the content of the message and the details you voluntarily give us. The operator of the social network also processes data under its own rules.
6. Electronic voucher orders and payments
On the website we sell only electronic gift vouchers. When you order, we process your first name and surname, email, phone if given, the name of the recipient, the name of the giver and the text of the personal message. You buy without a customer account.
Orders are processed directly by this website and stored in our database with the provider Cloudflare. Online payment by card, Apple Pay, Google Pay or bank transfer is handled by the Comgate payment gateway. After payment, we email you the voucher as a PDF and the invoice; sending is handled by the Resend service. A copy of the order arrives in our mailbox. We do not process payment card details; you enter them in the secure environment of the payment gateway.
7. Marketing messages
If you have bought a voucher from us, we may occasionally send an offer of our similar services to the email address from your order (Section 7(3) of Act No. 480/2004 Coll.). Every such message contains an unsubscribe link, and you can also unsubscribe by emailing us; you can object to this processing at any time without giving a reason. We send marketing messages to anyone else only with their prior consent, which is not a condition of a purchase, a booking or a reply to an enquiry and can be withdrawn at any time.
Our processor Daniel Vilím (vilim.one) keeps the customer database for these messages for us in his application; the data is stored in the European Union and we do not pass it to anyone else.
8. Photos and videos
We may take and publish recognisable photos or video recordings of customers for promotional purposes only on the basis of voluntary consent. Consent is not a condition of a purchase or a visit. You can withdraw your consent at any time at info@spotart.cz. We will then stop using the photos or videos for that purpose and remove them from the online places we manage, unless we have another legal ground for further processing. Withdrawal does not affect the lawfulness of processing before the withdrawal. For minors, we require the consent of a legal guardian.
9. Who data may be shared with
To the extent necessary, our authorised employees and collaborators may have access to personal data, as well as the providers of the services we use, in particular:
- Reservio: booking system, management of bookings and visitor measurement on the booking pages;
- ComGate Payments, a.s.: processing of online payments;
- Cloudflare: operation of the website, database of orders and enquiries, and security;
- Resend: sending emails with the voucher and invoice and delivering messages from the website to our mailbox;
- Microsoft: the studio’s mailbox (Microsoft 365);
- Daniel Vilím (vilim.one): development and operation of the website, evaluation of measurement and management of the customer database for our marketing messages, as our processor;
- GoDaddy: hosting of the payment relay service and management of the domain’s DNS;
- Google: basic visitor measurement without analytics cookies and, depending on your consent, detailed analytics and advertising services (Google Analytics, Google Ads);
- Meta Platforms: operation of Instagram and Facebook and, depending on your consent, Meta Pixel and Conversions API;
- Seznam.cz, a.s.: depending on your consent, Sklik ad measurement and targeting;
- PostHog Inc.: depending on your consent to analytics, analysis of website use (clicks, scrolling, loading speed and a recording of the visit to the website including the content of ordinary form fields); it stores the data in the EU (Germany);
- public authorities or other persons, if the law requires us to disclose data or if disclosure is necessary to protect our rights.
We run the cookie bar and the management of your choices ourselves, without a third-party service.
10. Transfers of data outside the European Economic Area
Some providers may process personal data, or allow access to it, outside the European Economic Area as well. For transfers to the relevant certified US companies of the Google, Meta, Microsoft and GoDaddy groups and to Cloudflare and PostHog Inc., the European Commission’s adequacy decision under the EU-US Data Privacy Framework applies; where this framework does not apply, the providers use, under their contractual terms, in particular the European Commission’s standard contractual clauses. For limited transfers outside the EEA, Resend refers in its data processing addendum to the European Commission’s standard contractual clauses.
You can obtain information about the safeguards used to transfer your data outside the EEA, and a copy of them, at info@spotart.cz. If a provider or transfer mechanism changes, we will update this policy accordingly.
11. How long we keep data
| Category or purpose | Retention period |
|---|---|
| Non-binding enquiries that do not lead to a booking or purchase | no longer than 1 year from the end of the communication |
| Bookings and related communication | no longer than 3 years from the visit, the cancellation of the booking or the last handling of the case |
| Successful orders and contractual communication | no longer than 3 years from the fulfilment of the order, except for data on accounting documents and data needed to record a voucher that is still valid |
| Records of an issued voucher | for its period of validity and then no longer than 3 years from its full redemption or expiry; this does not affect the statutory retention periods for accounting documents or retention for specific legal claims |
| Unfinished or unsuccessful orders | no longer than 1 year from creation, unless needed to deal with fraud, a complaint or a technical incident; after that we delete the name, contact details, personal message and technical identifiers and keep only the order number, items, amount, status and date for statistics |
| Accounting documents and accounting records | for the period required by law, currently usually 5 years; if we become registered for VAT, we will keep the relevant tax documents for 10 years |
| Complaints, disputes and legal claims | for the duration of the matter and then for as long as the related claim can be made or defended |
| Contacts for our marketing messages | no longer than 3 years from the last purchase, and always only until you unsubscribe or object |
| Technical and security logs | usually no longer than 6 months; longer only when dealing with a specific security incident |
| Analysis of website use (PostHog) | recordings of visits no longer than 90 days, other data no longer than 7 years |
| Cookies and similar identifiers | according to the specific purpose and the period stated in the cookie overview, at most for the validity of the relevant consent |
| Photos and videos used on the basis of consent | for as long as the consent lasts; after it is withdrawn, we stop further use and remove the recordings from the online places we manage, unless we have another legal ground |
When the relevant period ends, we delete or anonymise the data, unless further retention is required by law or by a specific legal claim.
13. Whether providing data is required
Providing data for analytics or advertising cookies and for promotional photos is voluntary.
We require the data needed to handle an order or a booking in order to enter into and perform the contract. We process the data needed to meet accounting and other legal obligations on the basis of the relevant legislation. Adding a personal message and the name of the recipient is voluntary.
Without the data marked as required for an order, payment or booking, however, we may not be able to complete the order, deliver the electronic voucher, accept the payment, confirm the booking or handle your request.
14. Your rights
Under the conditions set out in the GDPR, you have in particular the right to:
- obtain confirmation of whether we process your personal data and request access to it;
- request the correction of inaccurate data or the completion of incomplete data;
- request the erasure of data if we have no legal ground for further processing;
- request restriction of processing;
- receive your data in a structured, machine-readable format and request its portability, where the legal conditions are met;
- object to processing based on legitimate interest;
- withdraw your consent to processing based on consent at any time;
- lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, website: https://uoou.gov.cz/;
- go to court.
You can send your request to info@spotart.cz. Before handling a request, we may verify your identity in a reasonable way, so that we do not disclose data to an unauthorised person. We will reply without undue delay, usually within one month, unless the GDPR provides otherwise.
15. Data security
We take appropriate technical and organisational measures with regard to the nature of the data and the risks of processing. We limit access to data to the people who need it for their work, and we require adequate data protection from our suppliers.
16. Changes to this policy
We may reasonably change this policy, in particular when our services, the tools we use or the law change. The current version is always available on our website and is marked with its effective date.