Privacy Policy

1) Who processes your data (controller)

The controller of your personal data is Eden’s Garden s.r.o.
Registered office: Podolská 1489/6a, 147 00 Prague 4
Company ID (IČO): 01982966
info@edensgarden.cz

2) What data we process and why (purposes and legal bases)

We only process data necessary for the purposes listed below:

Service bookings, provision of massage/wellness services, gift vouchers and e-shop
Identification and contact details (name, email, phone), booking/order details, payment and billing details.
Legal basis: performance of a contract (Art. 6/1 b GDPR) and legal obligation in accounting and tax matters (Art. 6/1 c GDPR).
Communication and answers to enquiries (contact form, phone, e-mail)
Name, email, phone, message content.
Legal basis: legitimate interest in the handling of the enquiry and quality support (Art. 6/1 f GDPR).
Online payments and settlement
Identification and payment details required to execute and match the payment (see Processors below – Comgate).
Legal basis: performance of the contract (Art. 6/1 (b) and legal obligation (Art. 6/1 c). On our website and booking portal you will see “Online Payments – Payments – Comgate”. Eden’s Garden Grandior Spa
Marketing (e.g. newsletters, events), remarketing and web analytics
Email, technical and analytical data (IP address, cookie/online identifiers, web behaviour data).
Legal basis: consent (Art. 6/1 a) for email marketing and storage/non-essential cookies; legitimate interest (Art. 6/1 f) in basic traffic statistics in aggregate form. We inform you about specific cookies and consent options in the Cookie Policy.
Exercising rights, handling complaints and legal claims
Data necessary to establish, exercise or defend legal claims.
Legal basis: legitimate interest (Art. 6/1 f) or legal obligation (Art. 6/1 c).

3) Where we get the data from

Primarily directly from you when booking, ordering, paying, communicating or using our websites (including grandior.edensgarden.cz and eshop.edensgarden.cz).

4) Who helps us with the data (recipients/processors)

We use trusted partners who only process data according to our instructions:

Payment gateway: Comgate a.s., Gočárova třída 1754/48b, 500 02 Hradec Králové, ID: 27924505 – online payment.
Web hosting/IT administration, reservation system and e-shop (e.g. WordPress/WooCommerce and necessary add-ons), hosting and IT support providers; in practice also plugins facilitating GDPR regime (data export/deletion, retention settings, etc.).
Email services and communication tools: your email provider/SMTP.
Analytical and marketing tools: only if you give your consent in the cookie bar (see Cookie Policy ).
In the case of payment by employee benefits, we may – depending on the method of application – transmit the necessary data to the benefit provider to process the payment. (Eden’s Garden is listed as a partner in the Benefit Plus catalogue .)

The actual range of processors and technical solutions may change; however, we always take contractual and technical measures in accordance with the GDPR.

5) Transfers to third countries

If we use tools based outside the EU/EEA (typically some cloud or analytics services), the transfer only takes place if there is an appropriate transfer mechanism (notably the European Commission’s Standard Contractual Clause) and with additional measures. The specific tools and categories of cookies are described in the Cookie Policy.

6) Data retention

Reservation and performance of services: for the duration of the contractual relationship and subsequently for the period necessary to protect the rights (usually 3 years), accounting and tax documents for the period prescribed by law (usually 10 years).
Communication via forms/email: up to 12 months from the last interaction, unless it is related to a contract.
Consent-based marketing: until consent is withdrawn.
Cookies: according to the categories and time limits set out in the Cookie Policy.

7) Your rights

You have the right to access, rectification, erasure, restriction, portability, to object to processing (including objection to processing on legitimate interest and direct marketing) and the right to withdraw consent (if it is based on).
You also have the right to lodge a complaint with the supervisory authority: the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7.

8) Security

We maintain appropriate technical and organisational measures (access control, transmission encryption, regular system updates, contracted processors) to protect your data against misuse, loss or unauthorised access.

9) Cookies and similar technologies

The website uses cookies and similar technologies. You can find the categories, durations and list of providers in the Cookie Policy and in the consent interface on the website, where you can change your choices at any time. The link to the Cookie Policy is in the footer of the website.

10) Automated decision making

We do not make decisions based solely on automated processing that would have legal effects on you or similarly significantly affect you.

11) How to exercise your rights / contact us

The fastest way is by email to info@edensgarden.cz. We process applications without undue delay, within 1 month at the latest; in complex cases we may extend the deadline by 2 months (we will inform you).