Privacy policy

How we handle your data on the nailounge & The SPA by nailounge website. By default, the website is designed to load no tracking tools or third-party cookies — which is why you will not see a cookie banner here.

1. Data controller

2. What data we process and why

Bookings. When you make an online booking with us, we process the name, telephone number and email address that you provide. Optionally also the name of a preferred technician, if you request one.

• Purpose: processing and confirming your booking.
• Legal basis: performance of a contract or taking steps prior to entering into a contract — Art. 6(1)(b) GDPR. News and advertising are described separately below: e-mail news and targeted ads only with your consent, and commercial messages to existing customers based on legitimate interest.
• Storage: a database at an external provider located in the EU (Frankfurt, Germany).

Confirmations and reminders. If you enter an email address, we send you a booking confirmation and a reminder before your appointment. This is part of the service you booked, not marketing. If we cannot assign your preferred technician, we will call you.

E-mail news and targeted ads (with consent only). If you tick the consent box when booking, we use your e-mail to send nailounge news and offers. We may pass your e-mail and phone number in encrypted (hashed) form to Meta Platforms Ireland Ltd. so that our ads on Facebook and Instagram are shown to you or to people with similar interests. Legal basis: consent — Art. 6(1)(a) GDPR. You can withdraw consent at any time via the link in every e-mail or by writing to [email protected]; withdrawal does not affect your booking.

Commercial messages. If you have already visited us, we may occasionally send you an SMS, message or e-mail with news and offers about our services (manicure, pedicure, lashes, massages and other care at nailounge and The SPA). This applies to the contact details you gave us when booking online, by phone or in person at a branch. Legal basis: the controller’s legitimate interest in direct marketing to its own customers — Art. 6(1)(f) GDPR together with Section 7(3) of Czech Act No. 480/2004 Coll. You can refuse these messages at any time, free of charge: reply STOP to the message or write to [email protected]. After that we will only send you confirmations and reminders of your appointments.

Spam protection. The booking page runs an anti-bot verification tool from an external provider (USA). When it loads, your IP address is transmitted to its servers. Without it we could not operate the booking form.

Studio map. The interactive map loads only when you scroll to it. Map data is provided by an external map service based in the United Kingdom; when it loads, your IP address is transmitted to its servers. The map sets no cookies. No such connection is made before you reach the map.

3. Cookies and browser storage

• The website does not use analytics or marketing (tracking) cookies. It does not load Google Analytics, Google Fonts or advertising tools — both the fonts and map library are hosted directly by us.
• If you switch the website language, we remember your choice in the browser’s functional storage (localStorage). It stays on your device only and does not require consent under the law.
• On the booking page, the anti-spam verification tool stores its own technical data required for it to work.

4. Data recipients

• Database provider — booking storage (EU / Frankfurt).
• Website hosting provider — operating and delivering the website; processes technical data such as your IP address.
• Map service — map data (United Kingdom), only when the map is displayed.
• Spam protection — the booking form's verification service (USA); on the booking page your IP address is transmitted to its servers.
• Email delivery provider — booking confirmations and reminders.
• Meta Platforms Ireland Ltd. — ad targeting on Facebook and Instagram; only with consent and only hashed e-mail and phone number.

5. Transfers outside the EU

Data may be transferred to a third country (USA) on the booking page (the anti-spam verification service) and when the website is delivered by the hosting provider, which processes technical data such as your IP address. Both providers are certified under the EU‑U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision. The map service is based in the United Kingdom, which is also covered by an adequacy decision. In all other cases, your data remains within the EU.

6. Retention period

We retain booking data (name, phone, email, chosen service and any preferred technician) for 12 months after your last visit, so that we can handle any complaints and make your next booking easier; after that we delete it. We keep accounting and tax records for 10 years as required by Czech accounting and VAT law. We use your contact details for commercial messages until you opt out, and your e-mail for news and the hashed contact for ads until you withdraw your consent.

7. Your rights

In relation to the processing of your data, you have the right to access and rectify or erase it, restrict processing, data portability, object to processing and lodge a complaint with a supervisory authority.

You can exercise your rights by emailing [email protected].

8. Supervisory authority

Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

Last updated: 19 October 2026. This document is for information purposes and may be updated from time to time.