Privacy policy
Valid from 30. 10. 2026
This page explains what personal data we process when you use the website mystic-nails.acko.studio, why we do so, how long we keep it and what your rights are. It is a translation; the version in the website's main language is binding.
Who processes your data
The controller of your personal data is Provozovatel doplníme (demo), company ID (IČO) 00000019, registered office Bärensteinská 304/12, 431 91 Vejprty, údaje o zápisu doplníme ("we"), the operator of Mystic Nails Salon & Spa.
For anything about personal data, contact us: phone +420 608 980 666.
Who helps us
The website and messages are run for us by Feedmetoo s.r.o., company ID (IČO) 06309798, registered office Pražská 6, 269 01 Rakovník (brand ACKO), as our processor under a data processing agreement. It may use the data only for us and on our instructions. It uses these providers:
- Cloudflare – delivering the website, protection against attacks and bots, file and backup storage.
- Supabase – database (in the EU).
- Railway – running the application in which we manage the website (in the EU).
- Resend – sending e-mails.
- Sentry – catching application errors, without anything you fill in on the website (in the EU).
Cloudflare and Resend are US companies. Transfers to the US are covered by the European Commission's adequacy decision (EU–US Data Privacy Framework) or by standard contractual clauses approved by the European Commission.
When you visit the website
When you open the website, your IP address, browser type, the time and the page address are processed. Without them the website cannot be delivered or protected against attacks. This data serves only operation and security (our legitimate interest, Art. 6(1)(f) GDPR). The website uses no advertising and no tools that would track you.
Traffic measurement. We count visits ourselves, without cookies. From the IP address and the browser type, the server makes an anonymous identifier that changes every day: the random key used to make it is deleted within three days, so your visits cannot be linked from one day to the next. The IP address and browser type are not stored. What is recorded is the page visited, the website you came from, the link's tags (utm parameters), the device type and the country. Cloudflare keeps the individual records for at most 3 months; the totals of page views and visits are kept for 25 months. Nothing is stored on your device. The measurement is our legitimate interest (Art. 6(1)(f) GDPR): knowing which pages people read and where they come from.
What the website stores in your browser is described on the Cookies page.
When you book an appointment
What we process: the chosen service and time, your name, phone and possibly e-mail and a note. By phone number we keep a client card: name, phone, an overview of your bookings and our own note on your visits. Our clients are listed in a list where we find you by name or phone number. For each booking we keep its history: what happened to it and when (for example received, confirmed, moved or cancelled), without the text of any message.
Why: to hold the time for you, confirm or decline it, and contact you if anything changes. The legal basis is steps prior to and performance of a contract (Art. 6(1)(b) GDPR); we keep the client card in our legitimate interest in knowing our clients and their visits (point f).
Who sees the data: we and our staff who handle bookings, and the processor ACKO. The person you are booked with sees your name, the booking's note and our note on the client card for their appointments, not your phone or e-mail. We send the confirmation by text message from our phone, and by e-mail too if you give one. Our phone receives only a notice with the day and time, never your name or contact.
Calendar on the phone: we, or the person you are booked with, may put a confirmed booking into the calendar on our phone to have appointments at hand. The event holds the service and your name; the phone number only if we set it so, and never for the person you are booked with. The phone's maker (Apple or Google) may store the calendar in its cloud, depending on the phone's settings.
Link to manage the booking: the confirmation contains a link to view or cancel your booking. Anyone with the link can cancel the booking, so do not forward it. The page behind the link does not show your name or contact.
How long: the name, phone, e-mail and note of a booking are deleted 12 months after its date; only an impersonal record of the service, price and date remains. The client card is deleted 24 months after your last booking.
Protection against abuse
Forms are protected against bots by Cloudflare Turnstile. During the check Cloudflare processes your IP address and technical data about the browser; it does not see the content of the form. For limits against abuse we create an irreversible fingerprint of your IP address; we do not store the IP address itself and delete the fingerprint after 24 hours. The legal basis is our legitimate interest in preventing abuse of the website (Art. 6(1)(f) GDPR).
Your rights
You have the right to:
- know what data about you we process and get a copy of it,
- have inaccurate data corrected,
- ask for erasure when we no longer need the data or process it unlawfully,
- ask for processing to be restricted,
- object to processing based on legitimate interest,
- receive the data you gave us in a machine-readable format.
Just contact us (phone +420 608 980 666). We answer within one month at the latest. If you believe we handle your data in breach of the law, you can complain to the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.
Do you have to give us your data?
Browsing the website requires no data. Without your contact details, however, we cannot answer you. We do not carry out automated decision-making or profiling.
Backups and changes
Data is backed up daily for security; deleted data disappears from the backups within 6 weeks at the latest. We update this page when the way the website works or the law changes.