Privacy policy

1. Who processes your data

The controller — the person who decides why and how your personal data is processed — is me:

• Jana Lukačovičová — Yoga Space
• Športová 120/5, 831 04 Bratislava, Slovak Republic
• Company ID: 50775928 · Tax ID: 1081852552
• Email: jana.luk@hotmail.co.uk · Phone: +421 919 345 949

I have not appointed a data protection officer — for anything concerning your personal data, contact me directly at the email above.

2. What data I process

How much data is involved depends on how you get in touch and whether you come for a treatment or a class:

• The contact form on this site — your name, email address and the text of your message.
• Direct communication — whatever you choose to tell me by email, SMS, phone or Instagram.
• Bookings and invoicing — name, contact details and the details needed to issue a receipt if you book a service.
• Health data of physiotherapy and therapeutic yoga clients — history, examination findings and the course of treatment. This is a special category of data under Art. 9 GDPR; I process it solely in order to provide care, only with your explicit consent, and only on the basis of what you tell me yourself.
• Server technical data — IP address, date and time of the request, browser type. These arise automatically in the web server logs and serve to run and secure the site.

This site uses no analytics tools (such as Google Analytics), no advertising scripts and no profiling, and there is no automated decision-making.

3. Why I process data, and on what legal basis

• Answering your enquiry — your consent, or steps taken at your request prior to entering into a contract (Art. 6(1)(a) and (b) GDPR).
• Providing a yoga or physiotherapy service — performance of a contract (Art. 6(1)(b) GDPR).
• Health data — your explicit consent (Art. 9(2)(a) GDPR), given before treatment begins.
• Issuing and keeping accounting records — compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Running and securing the website — the legitimate interest in keeping the site working and protected from misuse (Art. 6(1)(f) GDPR).

4. Cookies and local storage

This site uses no marketing or analytics cookies, which is why you see no cookie banner.

A single cookie is stored — your choice of light or dark appearance. It contains no personal data, cannot identify you, lasts at most a year, and you can delete it at any time in your browser settings. It is a strictly necessary cookie and does not require consent.

5. Who your data may be shared with

I do not sell your data and give it to no one for marketing. It is shared only with those without whom the service could not work:

• Resend (Resend, Inc., USA) — delivery of contact form messages to my mailbox.
• My web hosting provider — operation of the server the site runs on.
• Google Maps (Google Ireland Limited) — the embedded map preview on the Contact page, see section 6.
• My email provider — storage of received correspondence.
• My accountant and public authorities — to the extent required by law.

With each of these partners, the processing is covered by a data processing agreement or equivalent contractual terms.

6. The map on the Contact page

The Contact page embeds a Google Maps view. When it loads, your IP address and browser details are transmitted to Google, which processes them under its own privacy terms. If you would rather avoid this, simply do not visit the Contact page, or block third-party content in your browser — the address and phone number are also in the footer of this site.

7. Transfers outside the EU

Resend, which delivers messages from the contact form, is based in the United States. The transfer is covered by the Standard Contractual Clauses approved by the European Commission. All other data is processed within the European Union.

8. How long I keep data

• Contact form messages and email correspondence — no more than 2 years from our last exchange, if no contractual relationship arises from it.
• Client data including treatment records — for as long as care is provided, and thereafter for the period required by law, or until you withdraw your consent.
• Accounting records — 10 years, as required by the Slovak Accounting Act.
• Web server logs — normally 30 days.

9. Your rights

In relation to your personal data you have the right:

• to access it and to receive a copy of the data I hold about you,
• to have inaccurate data corrected or incomplete data completed,
• to erasure (the “right to be forgotten”),
• to restriction of processing,
• to data portability to another controller,
• to object to processing based on legitimate interest,
• to withdraw your consent at any time — withdrawal does not affect the lawfulness of processing before it,
• to lodge a complaint with the supervisory authority.

To exercise any of these, write to jana.luk@hotmail.co.uk. I will reply within one month at the latest.

The supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, statny.dozor@pdp.gov.sk, www.dataprotection.gov.sk.

10. Keeping your data safe

The site is served exclusively over an encrypted HTTPS connection. Access to messages, client documentation and my mailbox is mine alone and password-protected. Paper records are kept locked away. I process only the data that is genuinely needed and do not collect it “just in case”.

11. Changes to this document

If the way data is processed changes — a new tool or service, for instance — I will update this page and change the date shown above. It is worth looking back here now and then.