Privacy Policy - Enter Fyzio

Information on personal data processing (GDPR)

1. Personal data controller

1.1 The personal data controller is:

Mgr. Jiří Hájek

IČO: 22122745

Mgr. Zdislava Tučková

IČO: 22122664

Bc. Martin Vávra

IČO: 22337920

Business premises Pekařská 635/6, 158 00 Praha 5-Jinonice (hereinafter referred to as “Controller”).

1.2 Contact details of the Controller:

E-mail: enterfyzio@gmail.com

Phone: +420 797 970 264

Web: www.enterfyzio.cz

2 Processed personal data

2.1 The administrator processes the following personal data:

- Name and surname
- Address
- Telephone number
- E-mail address
- Date of birth
- Health data related to the services provided
- Payment data
- Identification and contact data (name, surname, academic title, telephone, e-mail)
- Billing and payment data (method and date of payment, payment via payment gateway)

3. Purpose of processing personal data

3.1 Personal data is processed for the following purposes:

- Providing physiotherapy services
- Managing orders and bookings
- Billing and bookkeeping
- Communicating with clients
- Fulfilling legal obligations
- Marketing activities (only with the client’s explicit consent)
- Concluding and fulfilling a contract
- Processing special categories of personal data necessary for the provision of healthcare
- Protecting the legitimate interests of the Controller
- Sending commercial communications

4. Legal basis for processing personal data

4. 1 The legal bases for processing personal data are:

- Performance of the contract between the Controller and the client
- Performance of the Controller’s legal obligations
- The Controller’s legitimate interest in improving the services provided and communication with clients
- Consent of the data subject (for marketing purposes)

5. Recipients of personal data

5.1 Personal data may be disclosed to the following categories of recipients:

- Employees and associates of the Controller
- Personal data processors (e.g. IT service providers, accounting services)
- Public administration authorities in case of legal obligation

5.2 The Controller may transfer personal data to third countries (e.g. the USA) only if the processing of personal data is carried out in accordance with European security standards and legal regulations.

6. Retention period of personal data

6. 1 Personal data is retained for the period necessary to fulfil the purpose of processing, but no longer than the period specified in the relevant legislation.

6.2 Retention period of personal data:

Conclusion and performance of a contract: for the period necessary to fulfil the contract
Performance of legal obligations: for the period specified in the relevant legislation
Legitimate interests: for the duration of the relevant limitation periods, which may be up to 15 years
Sending commercial communications: until withdrawal of consent

7. Rights of data subjects

7.1 Data subjects have the following rights:

- Right of access to personal data
- Right to rectification of inaccurate or incomplete data
- Right to erasure of personal data (right to be forgotten)
- Right to restriction of processing of personal data
- Right to data portability
- Right to object to processing of personal data
- Right to withdraw consent to processing of personal data (if processing is based on consent)

7. 2 These rights can be exercised by data subjects through the contact details of the Controller set out in section 1.2.

8. Lodging a complaint

8.1 Data subjects have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (OPPD), if they believe that the processing of their personal data infringes the GDPR.

9 Security of personal data

9.1 The controller shall take all appropriate technical and organisational measures to safeguard personal data against loss, misuse, unauthorised access and other unlawful processing.

9. 2 Security measures include:

- Implementation and enforcement of internal data protection regulations
- Antivirus protection and firewalls
- Encryption
- Access control and authorization data
- Backups
- Physical means of protection

10. Final Provisions

10.1 This information on the processing of personal data takes effect on the date of its publication on the Controller’s website.

10.2 The Controller reserves the right to update this information at any time. The current version will always be published on the Controller’s website.

In Prague, 20.3.2025