Privacy policy
This page explains what data we process about you, why, for how long and what your rights are. We follow Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing.
Last updated: 19 October 2026
Who processes your data
The data controller is Lotus spa s.r.o., company ID 02177064, registered office Národní 961/25, 110 00 Prague 1, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, section C, file 216324.
For anything regarding personal data, email us at info@lotusspa.cz or call +420 608 233 266. We have not appointed a data protection officer as the law does not require us to.
Booking an appointment
- What data
- name, phone, email, chosen massage, time and any note
- Why
- to arrange and provide the massage and let you know about any change
- Legal basis
- performance of a contract (Art. 6(1)(b) GDPR)
- How long
- while the booking is handled and then for up to 3 years for possible complaints
- Who has access
- online booking runs on the Termino system, operated for us as a processor by Slevomat.cz, s.r.o., company ID 24698059 (Termino terms)
Gift voucher orders
- What data
- name, email, phone (optional), voucher type and price, dedication
- Why
- to prepare the voucher for pickup at reception and agree any details with you
- Legal basis
- steps taken at your request before entering into a contract, and its performance (Art. 6(1)(b) GDPR); accounting records are kept to meet accounting and tax obligations (Art. 6(1)(c) GDPR)
- How long
- the order and correspondence for the validity of the voucher plus 3 years; accounting records for as long as accounting and tax law requires (up to 10 years)
- Who has access
- form emails are sent through Resend (Resend, Inc., USA) as a processor (Resend privacy policy); the website is hosted by Cloudflare, Inc. Transfers to the USA rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
When you call or write to us
- What data
- name, phone or email and the content of your message
- Why
- to reply and help with your request
- Legal basis
- legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), or steps prior to a contract (Art. 6(1)(b) GDPR)
- How long
- until resolved, at most 1 year unless a contract follows
- Who has access
- only us and our email provider
Visit statistics (Google Analytics)
Only if you click Allow in the cookie bar. Without consent, Google Analytics is not loaded at all.
- What data
- a random identifier in cookies (no name or email), device and browser type, approximate location from your IP address (city), pages visited and clicks on booking, phone and voucher order. Google Analytics 4 does not store full IP addresses.
- Why
- to understand how people use the website and improve it
- Legal basis
- your consent (Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications)
- How long
- cookies 2 years, data in Google Analytics 14 months
- Who has access
- Google Ireland Limited as a processor; data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework (how Google uses data)
You can withdraw your consent at any time: .
Google Maps
The map in the contact section only loads when you click “Show map”. Only then does Google Ireland Limited receive your IP address and browser details, and it may set its own cookies. By clicking, you consent to this (Art. 6(1)(a) GDPR). See the Google privacy policy.
Running the website
The website is hosted by Cloudflare, Inc. as our processor. On every visit, your IP address and technical browser details are briefly processed for security and protection against attacks. The legal basis is our legitimate interest in running the website securely (Art. 6(1)(f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework (Cloudflare privacy policy).
Our fonts are stored on our own website, nothing is loaded from Google Fonts. The link to our Facebook page is a plain link: until you click it, Facebook knows nothing about your visit.
Your rights
You have the right to:
- know what data we hold about you and get a copy (Art. 15 GDPR),
- have inaccurate data corrected (Art. 16),
- have your data erased if we no longer need it or process it unlawfully (Art. 17),
- restrict processing, for example while we look into your objection (Art. 18),
- receive the data you gave us in a machine-readable format (Art. 20),
- object to processing based on legitimate interest (Art. 21),
- withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3)).
Send your request by email to info@lotusspa.cz or by post to Lotus spa s.r.o., Národní 961/25, 110 00 Prague 1. We will reply within one month at the latest.
Right to lodge a complaint
If you believe we do not comply with the law when processing your personal data, you have the right to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.
Other information
We need the data for bookings and voucher orders to provide the service. Without it, we cannot process a booking or an order. All other data is voluntary.
We do not use automated decision-making or profiling. We do not pass your personal data to third parties for their own marketing and we never sell it.
Updates to this policy
We may update this policy from time to time, especially when we change how we process personal data or which services we use. The date of the last update is shown at the top of this page.