Privacy policy

1. Data controller

2. What data we process and why

Bookings

When you make an online booking with us, we process the name, phone number and e-mail you fill in yourself. Optionally also the name of a nail technician, if you ask for one.

• Purpose: handling and confirming your booking.
• Legal basis: performance of a contract, or steps taken before entering into a contract — Article 6(1)(b) GDPR. News and advertising are described separately below: e-mail news and targeted ads only with your consent, and commercial messages to existing customers based on legitimate interest.
• Storage: a database at a provider in the EU (Frankfurt, Germany).

Confirmations and reminders

We send a booking confirmation and a reminder before the appointment to the e-mail or phone number you give us. This is part of the service you ordered, not a commercial message.

E-mail news and targeted ads (with consent only)

If you tick the consent box when booking, we use your e-mail to send Bliss news and offers. We may pass your e-mail and phone number in encrypted (hashed) form to Meta Platforms Ireland Ltd. so that our ads on Facebook and Instagram are shown to you or to people with similar interests. Legal basis: consent — Article 6(1)(a) GDPR. You can withdraw consent at any time via the link in every e-mail or by writing to info@nailounge.eu; withdrawal does not affect your booking.

Commercial messages

If you have already visited us, we may occasionally send you an SMS, message or e-mail with news and offers about our services (manicure, pedicure and related care). This applies to the contact details you gave us when booking online, by phone or in person at the salon. Legal basis: the controller’s legitimate interest in direct marketing to its own customers — Article 6(1)(f) GDPR together with Section 7(3) of Czech Act No. 480/2004 Coll. You can refuse these messages at any time, free of charge: reply STOP to the message or write to info@nailounge.eu. After that we will only send you confirmations and reminders of your appointments.

Spam protection

The booking page runs the Cloudflare Turnstile bot-verification tool by Cloudflare, Inc. (USA). When it loads, your IP address is transferred to Cloudflare’s servers. Without it we could not run the form. Cloudflare is certified under the EU-U.S. Data Privacy Framework, so the transfer relies on the European Commission’s adequacy decision.

Branch map

The map loads only once you scroll to it. Only then is your IP address transferred to the servers of the OpenStreetMap mapping service, which cannot deliver the map tiles without it. The map sets no cookies. The servers are run by the OpenStreetMap Foundation, based in the United Kingdom, for which the European Commission has issued an adequacy decision — so this is not a transfer to a third country.

3. Cookies and browser storage

• The site does not use analytics or marketing (tracking) cookies. It loads neither Google Analytics nor Google Fonts — the fonts are hosted by us directly.
• An unfinished booking is not stored in your browser; if you reload the page, you start again.
• On the booking page, the Cloudflare Turnstile verification tool stores its own technical value, which it needs in order to work.

Because the site stores no cookies that require consent, no cookie banner is shown.

4. Recipients of the data

• Database provider — storage of bookings (EU / Frankfurt).
• Website hosting provider — running the site (EU).
• E-mail and SMS provider — sending confirmations and reminders.
• Cloudflare, Inc. (USA) — the Turnstile verification service in the booking form; on the booking page your IP address is transferred to its servers.
• Mapping service — OpenStreetMap, the map data; once the map loads, your IP address is transferred to its servers.
• Meta Platforms Ireland Ltd. — ad targeting on Facebook and Instagram; only with consent and only hashed e-mail and phone number.

5. Transfers outside the EU

Data is transferred to a third country (USA) only on the booking page, through the Cloudflare Turnstile service. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision. In all other cases your data stays within the EU, or in a country with an adequacy decision.

6. Retention period

We keep booking data (name, phone, e-mail, chosen service and nail technician) for 12 months from your last visit, so that we can handle any complaints and make your next booking easier; then we delete it. Accounting and tax records are kept for 10 years under the Czech Accounting Act and VAT Act. We use your contact details for commercial messages until you opt out.

7. Your rights

In connection with the processing you have the right of access to your data, to its correction or erasure, to restriction of processing, to portability, the right to object and the right to lodge a complaint with the supervisory authority.

You can exercise your rights by e-mail at info@nailounge.eu.

8. Supervisory authority

Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

Last updated: 20 October 2026. This document is for information only and we may update it from time to time.