For creating, confirming and managing an appointment.
Processed separately in the health questionnaire with enhanced protection.
For feedback and communication related to the service.
Data controller
Stavbárska 5223/46
821 07 Bratislava – mestská časť Vrakuňa
IČO: 57 161 011
DIČ: 2122597422
IČ DPH: SK2122597422
Commercial Register of the Slovak Republic, Section Sro, Insert 191193/B
Jozef Masáže BA
email: jozefmasazeba@gmail.com
tel.: +421 918 323 594
web: jozefmasazeba.sk
The controller determines the purposes and means of processing personal data in connection with Jozef Masáže BA services.
Where we obtain data
We obtain data mainly directly from the client during booking, communication, a visit to the premises, completion of the health questionnaire or a review. An administrator may also create a booking on behalf of the client using information provided by phone, email or in person.
When an external booking channel is used, booking data may also be received through that channel (for example Bookio during a transition period) and then transferred to our internal systems to the extent necessary to manage the booking and form.
What personal data we process
- Identification and contact data: first name, surname, email, phone number, preferred language.
- Booking data: service, massage therapist, date and time, duration, price, booking status, client note, change history, cancellation/no-show and related communication.
- Client records: visit history, optional gender information, internal organisational notes and assigned tags.
- Reviews: number of stars, comment, date and link to a review invitation or booking.
- Technical and operational data: IP address when a booking is created, approximate location derived from IP (if provided by the network infrastructure), device type, operating system, web browser, user agent, referrer/source of visit, event time and technical logs needed for secure and reliable system operation.
- Health-related data: only to the extent of the answers provided in the pre-visit health questionnaire.
Purposes and legal bases for using data
| Purpose | Examples of data | Legal basis |
|---|---|---|
| Receiving a request, confirming and managing a booking, and providing the service | name, contact details, service, appointment, booking history | Art. 6(1)(b) GDPR – performance of a contract or steps prior to entering into a contract |
| Accounting, tax and other legal obligations | data required by law | Art. 6(1)(c) GDPR – legal obligation |
| Internal client management, operational organisation, security, protection of legal claims and reasonable internal statistics | visit history, tags, organisational notes, IP and technical booking data, referrer, security logs, aggregated statistics | Art. 6(1)(f) GDPR – legitimate interest; the client has the right to object |
| Pre-visit health questionnaire | answers concerning health status | Art. 6(1)(a) and Art. 9(2)(a) GDPR – consent and explicit consent to process health data |
| Unrelated marketing, if used in the future on the basis of consent | contact details within the scope of consent | Art. 6(1)(a) GDPR or another lawful basis if permitted by law |
Pre-visit health questionnaire
The pre-visit health questionnaire is operated on a separate portal formular.jozefmasazeba.sk. Health data are a special category of personal data, so their processing is separated from ordinary booking data.
Before submitting the health questionnaire, the client gives separate explicit consent to processing health data for assessing safety and appropriately adapting the massage. Consent to health data processing is not part of agreement to the Terms.
The client may withdraw consent. Withdrawal does not affect the lawfulness of processing before withdrawal. If the massage therapist no longer has information needed to perform the massage safely, it may be necessary to postpone or not provide the service. After withdrawal, data may be retained only where another legal basis applies, for example the protection of legal claims.
Booking system and forms portal
The Jozef Masáže BA booking system and the forms portal are technically connected. When a relevant booking is created or changed, data needed to match the client and appointment are synchronised to the forms portal, such as booking identifier, status, name, contact, service, therapist and appointment.
The forms portal is the only place that controls the timing and sending of the pre-visit health questionnaire and its reminders. During a transition period, the portal may process bookings from the external Bookio system and the Jozef Masáže BA system in parallel.
The synchronisation is intended for proper operation of the service, not for marketing profiling of the client.
Email communication and reviews
In connection with a booking, we may send service emails, particularly acknowledgement of the request, booking confirmation or change, an appointment reminder and a request for feedback. The questionnaire email and any questionnaire reminder are sent by the forms portal.
After the service, the client may receive a link to a Google review or our own review form. By following an external link (for example Google), the client enters the relevant provider's environment. An internal review remains in our system.
We do not automatically publish an identifiable review, client name or photograph on our website or in promotional materials merely because the client submitted an internal review.
Cookies and external services
The website and booking system may use technical cookies or similar technologies required for secure operation, login and session continuity. Google Tag Manager and, through it, analytics or marketing tools may be deployed on the main website.
If a particular analytics or marketing technology requires consent, it should be activated only after the user's corresponding choice in the cookie banner. The scope of external tools used depends on the actual website configuration.
Who may receive the data
We disclose personal data only to the extent necessary. Typical recipients may include:
- hosting and database infrastructure providers – currently Websupport services,
- email infrastructure providers depending on how email is delivered and received,
- analytics or map service providers, if they are actually enabled on the website and the user has consented where required,
- an external booking channel, if the client chooses to book through such a channel,
- public authorities, where disclosure is required by law.
We do not sell personal data to data brokers.
Data transfers outside the European Economic Area
Our own booking and forms system is operated within our hosting infrastructure. Some external services, if enabled (for example selected Google services), may involve processing or transfer of data outside the EEA.
In such a case, transfer takes place only where a mechanism permitted by the GDPR exists, such as an adequacy decision or appropriate contractual safeguards under the relevant provider's conditions.
How long we keep data
| Category | Typical period / rule |
|---|---|
| Regular client and booking records, tags and organisational notes | generally 36 months from the client's last activity unless there is a reason to retain a specific item longer |
| Pre-visit health questionnaire | generally 36 months according to the forms portal retention policy; longer only where another legal reason applies, such as an ongoing dispute or legal claim |
| Accounting and tax data | for the period required by applicable law |
| Internal reviews and review invitations | for as long as needed for feedback and management of the client relationship, generally no longer than the regular client retention period unless there is a reason for longer retention |
| IP address, device, browser, referrer and technical booking logs | generally for the regular client/booking retention period or less where the data are no longer needed for operational, security or legal purposes |
After the relevant period, we delete or anonymise the data if we no longer need them in identifiable form.
Data you need to provide
Information marked as required in the booking form is needed to create and manage a booking. If the client does not provide it, we may be unable to create the booking or communicate with the client.
Some information is optional, for example a free-text note. The scope of the health questionnaire depends on the current form version and the safety needs of the service.
Your rights
Subject to the conditions of the GDPR, you have in particular the right to:
- obtain confirmation as to whether we process your personal data and request access to them,
- request correction of inaccurate data or completion of incomplete data,
- request erasure where the legal conditions are met,
- request restriction of processing,
- receive data portability where processing is based on a contract or consent and carried out by automated means,
- object to processing based on legitimate interests,
- withdraw consent at any time where the specific processing is based on consent,
- lodge a complaint or request proceedings with the supervisory authority.
When handling a request, we may reasonably verify the applicant's identity to prevent disclosure to an unauthorised person.
How we protect data
We use appropriate technical and organisational measures, such as HTTPS, separate administrator login, restricted access rights, secure tokens in customer links, audit and security logging, backups and database permissions.
Access to data is limited to persons who need it to operate the service and perform their duties.
Automated decision-making and profiling
We do not use decisions based solely on automated processing under Article 22 GDPR that would produce legal or similarly significant effects for the client. Internal tags, filters and statistics are used for organisation and operational overview.
Contact and supervisory authority
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
dataprotection.gov.sk
If you believe that we process personal data contrary to law, you may contact the controller or the supervisory authority directly.