Legal information
Privacy Policy
We want you to know exactly what personal data we process in connection with our website and your communication with the clinic, why we process it, and how long we keep it. Everything that matters is on this page.
In brief
- We do not measure traffic or deploy any marketing technologies without your consent.
- Data from the forms on our website goes only to our email inbox — we do not store it in any database.
- We never sell your data and share it only with those who genuinely need it to run our services.
- You can exercise your rights, including withdrawing consent, at any time — contact details are below.
01 Data controller
The controller of your personal data is ESTELA PLASTICKÁ CHIRURGIE s.r.o., company ID 05310857, VAT ID CZ05310857, with its registered office at Vohnoutova 382/19, 625 00 Brno, Czech Republic (also “we” or “the clinic”). We provide healthcare services at our practice at Horníkova 34, 628 00 Brno.
For any matter concerning personal data, contact us by email at info@estela.cz, by phone on +420 778 277 277, or via Czech data box b4fztpm.
02 What data we process, why, and for how long
We process only the data you give us yourself, plus the technical data needed to run the website. The table below summarises every purpose.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling your enquiry (form, email, phone) | name, email, phone, content of your message; for the form also the page it was sent from | Art. 6(1)(b) GDPR — steps taken at your request prior to providing a service | 1 year after the enquiry is resolved |
| Gift voucher orders (form, email, phone) | name, email, phone, voucher value or procedure, recipient's name and dedication, delivery method, note; for the form also the page it was sent from; number and validity of the issued voucher | Art. 6(1)(b) GDPR — concluding and performing the voucher purchase contract; recipient's name and dedication Art. 6(1)(f) — legitimate interest in issuing the voucher as the buyer requests; accounting records Art. 6(1)(c) — legal obligation | for the voucher's validity and 1 year after it expires; if no purchase follows, 1 year after the enquiry is resolved; accounting records for the period required by accounting and tax law |
| Technical operation and security of the website | IP address, technical server logs | Art. 6(1)(f) GDPR — legitimate interest in reliable and secure operation | a matter of weeks (per hosting provider retention) |
| Traffic statistics (Google Analytics 4) | cookies and online identifiers, device and usage data | your consent — Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll. | see the Cookie Policy; reports kept in the tool for 14 months |
| Marketing (Google Ads, Sklik) | advertising cookies and identifiers | your consent — Art. 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll. | see the Cookie Policy |
Providing your data is voluntary. Without the details marked as required in the form, however, we will not be able to handle your enquiry.
03 Where the data comes from
All personal data comes directly from you — from the form, an email or a phone call. The only exception is the recipient's name on a gift voucher, which the buyer gives us; we use it solely to issue the voucher. Technical data arises automatically when you visit the website. We do not buy data about you from third parties, we do not build profiles beyond the purposes listed above, and we do not carry out automated decision-making with legal effects for you.
04 Who has access to the data
Data is accessed only by authorised clinic staff and by contracted processors who run the website and communication for us. We have data processing agreements under Art. 28 GDPR in place with all of them.
| Company | Role | Country | Transfer safeguards |
|---|---|---|---|
| Netlify, Inc. | website hosting and operation | USA | EU-U.S. Data Privacy Framework; standard contractual clauses as a fallback |
| Resend, Inc. | sending emails from the website forms | USA | EU-U.S. Data Privacy Framework; standard contractual clauses |
| Webglobe, s.r.o. | email mailbox and domain — receives form messages and email correspondence | Czechia | — |
| Google Ireland Ltd. | Google Analytics 4 and Google Ads — only with your consent | Ireland; possible transfer to Google LLC, USA | EU-U.S. Data Privacy Framework; standard contractual clauses |
| Seznam.cz, a.s. | Sklik — campaign measurement and retargeting, only with your consent | Czechia | — |
We may also disclose data to public authorities where the law requires it.
05 Transfers outside the EU
Some of our processors (Netlify, Resend, Google LLC) are based in the USA. Transfers rely on the European Commission's adequacy decision — the EU-U.S. Data Privacy Framework — for companies certified under it. Should the framework cease to apply, standard contractual clauses under Art. 46 GDPR are in place with these processors.
06 Cookies and similar technologies
The website stores only what is strictly necessary in your browser; traffic measurement and marketing technologies run only after your consent. See the Cookie Policy for details. You can change your choice at any time using the button.
07 Your rights
In connection with the processing of personal data you have the right:
- to access the data we process about you and obtain a copy;
- to rectification of inaccurate data and completion of incomplete data;
- to erasure where the reason for processing has ceased;
- to restriction of processing while your request is being reviewed;
- to portability of the data you have provided to us;
- to object to processing based on legitimate interest;
- to withdraw consent — at any time, with future effect; for cookies most easily via the Cookie settings button, otherwise through any contact listed above.
We will handle your request without undue delay, within one month at the latest. To avoid disclosing data to the wrong person, we may ask you to verify your identity.
If you believe we are not handling your data correctly, we will be glad to hear from you first. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
08 Medical records
Patient medical records are kept in accordance with Czech Act No. 372/2011 Coll., on Health Services, and are not governed by this policy. Information about data processing connected with the provision of care is available at the clinic.
09 Security
All communication with the website is encrypted (HTTPS). We process only the data genuinely needed for each purpose, access is limited to authorised staff, and our processors are bound by contractual safeguards and confidentiality.
10 Changes to this policy
We may update this policy, for instance when the services we use change. The current version with its effective date is always available on this page; we will announce substantial changes on the website.