Privacy policy

1. Controller and contact

The controller of your personal data is predatory rabbit, s.r.o., company ID (IČO) 17709989, registered office Vinohradská 1107/45, 120 00 Prague 2 (“we”).

For anything about your personal data, write to info@massagehall.cz or by post to our registered office. We have not appointed a data protection officer (Art. 37 GDPR).

This policy covers:

• the website massagehall.cz,
• the booking app app.massagehall.cz (bookings and member account),
• the e-shop shop.massagehall.cz (gift vouchers),
• the Rabbit Hall salons in Prague (Vinohrady, Anděl, Vršovice).

2. What data we process

We only process the data we need. It depends on what you do with us.

Bookings and member account

• name (it can be made up),
• phone and email,
• booking history: date and time, branch, masseuse, massage, extra services, cancellations and loyalty carrots,
• a note about breaking the salon rules and a possible ban on further bookings (blacklist).

Visiting the salon

• details of your payment on site,
• details of a gift voucher, if you redeem one.

Contacting us

When you call or write to us (phone, WhatsApp, Telegram, Jivo chat on the website, email), we process your contact details and the content of your messages.

E-shop

When you order a gift voucher, we process your name, contact details, delivery address (only for courier delivery) and payment details (bank transfer or cash).

Job applications

In the job application form you enter your name and phone, optionally your email and a text about yourself, and attach 1 to 3 photos.

Reviews

For a review we process your name or nickname, your rating and the text of the review.

Visiting the website

Technical data: IP address, browser and device type. Cookies and similar technologies are described in section 4.

We do not accept online card payments on the website, in the app or in the e-shop.

We do not ask for special categories of data, such as data about health or sex life. Please do not include them in messages or notes.

You give us your data voluntarily. Without contact details, however, we cannot handle your booking or job application.

3. Purposes, legal bases and retention periods

Each processing activity has a purpose and a legal basis under Art. 6(1) GDPR. We keep data only for the period shown in the table. After that we delete or anonymise it.

Purpose	Legal basis	Retention period
Bookings and member account	Performance of a contract, Art. 6(1)(b)	Until the account is closed. We delete an inactive account 3 years after your last visit.
Bookings without an account	Performance of a contract, point (b)	3 years after the massage
Blacklist (safety of masseuses and guests)	Legitimate interest, point (f)	For as long as the ban lasts
Accounting and tax (payments, vouchers)	Legal obligation, point (c)	10 years
Communication and answering questions	Performance of a contract, point (b), or legitimate interest, point (f)	1 year
Gift voucher orders in the e-shop (processing and delivery)	Performance of a contract, point (b)	As accounting records 10 years, otherwise 3 years
Website technical data and server logs (operation and security)	Legitimate interest, point (f)	Up to 30 days, longer only while handling a security incident
Job applications	Steps before entering into a contract, point (b)	6 months
Reviews	Consent, point (a)	Until you withdraw consent or the review is deleted
Analytics (Google Analytics 4) and Google Maps	Consent, point (a)	See section 4
Service SMS and emails (confirmations, reminders, login codes)	Performance of a contract, point (b)	Same as bookings

Our legitimate interest for the blacklist is the safety of masseuses and guests. For questions, it is replying to your message. For technical data, it is running the website and keeping it secure.

We do not send marketing messages. We do not sell your data.

4. Cookies and similar technologies

A cookie is a small file that a website stores in your browser. Without consent we use the necessary cookie rh_consent and Cloudflare Turnstile (only with forms), which the website needs to work and stay secure, and Jivo chat, so that we can reply to you quickly. The chat loads after your first interaction with the page, at the latest 8 seconds after the page loads. The legal basis is our legitimate interest in running the website securely and in communicating with you quickly (Art. 6(1)(f) GDPR).

Only with your consent do we load Google Analytics 4 and Google Maps. You can also load a map without consent by clicking “Show map”.

Name	Purpose	Duration
rh_consent	Necessary. Stores your choice in the consent window.	12 months
Google Analytics 4 (_ga, _ga_*)	Visitor statistics, only after consent. Without consent, Google Consent Mode only sends anonymous signals without cookies.	Up to 2 years
Google Maps	Map of our branches. Loads only after consent or after you click “Show map”.	Google cookies under Google’s policy
Jivo chat	Online chat. Loads after your first interaction with the page, at the latest 8 seconds after the page loads.	Jivo cookies under Jivo’s policy
Cloudflare Turnstile	Protects forms against spam. Loads only with forms.	Under Cloudflare’s policy
Currency preference (rh_currency in localStorage)	Remembers your choice of CZK or €.	In your browser until deleted

You can change or withdraw your consent at any time with the Cookie settings button at the end of this page or the Cookie settings link in the website footer.

5. Recipients and processors

Some data is processed on our behalf by companies that provide technology and services for us. These are the categories:

• website and e-shop hosting provider (servers in the EU),
• booking app hosting and file storage provider (servers in the EU, Frankfurt),
• app database provider,
• providers that send SMS and emails from the app,
• job queue services (background processing for the app),
• Google (Analytics 4, Google Maps), Jivo (chat) and Cloudflare (Turnstile),
• accountants and authorities, where the law requires it.

We have contracts with our processors under Art. 28 GDPR. We will give you a list of the specific processors on request. We do not sell data to anyone.

6. Transfers outside the EU

Some providers are based in the USA: Google, Cloudflare and the booking app hosting provider. Transfers to the USA are based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or, where needed, on standard contractual clauses approved by the Commission.

Jivo chat is operated by a company based outside the EU, so chat data may also be processed outside the EU. We will tell you about the safeguards for such transfers on request.

7. Security

• The website, app and e-shop use an encrypted HTTPS connection.
• Only authorised people have access to the data, each with their own login.
• Processors are bound by contract.
• We do not store photos from the job application form on the public website.

8. Your rights

Under the GDPR you have these rights:

• access (Art. 15): find out what data we hold about you and get a copy,
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20): receive your data in a machine-readable format or have it sent to another controller,
• objection (Art. 21) to processing based on legitimate interest,
• withdrawal of consent at any time; processing before the withdrawal remains lawful,
• a complaint to the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

You can also complain to the supervisory authority in the EU country where you live or work (Art. 77 GDPR).

How to exercise your rights

Write to info@massagehall.cz or send a letter to our registered office. We reply within 1 month. In complex cases we may extend this by a further 2 months and will tell you why. Before we reply, we may verify your identity so that we do not give your data to someone else.

9. Automated decision-making

We do not carry out automated decision-making or profiling with legal effects (Art. 22 GDPR). A person always decides about adding someone to the blacklist.

10. Changes to this policy

We may change this policy, for example when we add a new service. The current version is always on this page with its effective date. We inform registered members about significant changes.