Privacy policy

Who the data controller is

The data controller is Diana Borzenets, IČO 21220697, atelier at OC Černá Růže, Na Příkopě 12, 110 00 Praha 1 – Nové Město. For any question about your data, use the contact details at the end of this page.

What happens when you simply browse

This is a static site. While you are only reading it, it stores no cookies in your browser, measures no traffic and contains no analytics or advertising scripts. Fonts and photographs are hosted on our own server, so nothing loads from third-party servers — not even Google Fonts. The exception comes only once you start filling in the booking form: at that point Google's bot protection loads, and the already-booked times are fetched from our booking calendar so that the calendar in the form offers you free times only. Both are described below.

• No analytics, counters or advertising code — anywhere on the site
• No cookies are stored while you are reading the pages
• Fonts and images served from our own server, with no third-party calls
• No embedded map or other content loaded from an external site
• Google reCAPTCHA loads on your first interaction with the booking form, not when the page opens
• Booked times are likewise fetched only on your first interaction with the form. All that is sent is a request for a range of days — no name, no contact details; the request is nonetheless served by Google's servers, which see your IP address

Hosting and server logs

The site is hosted with the hosting provider Vercel. Like any web server, it records technical connection data — IP address, browser type, and the time and address of the request. These records are necessary to deliver the page, run the site and protect it from abuse; the legal basis is legitimate interest under Article 6(1)(f) GDPR. We do not use them for marketing and do not link them to an identified person. If you open a personal link for choosing a pickup time, its address — with the link's random code — is recorded in the same log.

Retention period: 1 hour (the default runtime log retention on the Vercel Hobby/free plan). This would extend to up to 30 days if the site were upgraded to the Pro plan with Observability Plus.

When you contact us directly

Besides the booking form, you can arrange work with us by phone, WhatsApp, Telegram or email. We process only what you send us yourself — usually a name, a contact and a description of the job — in order to agree a time and carry out the order. The legal basis is steps prior to and performance of a contract under Article 6(1)(b) GDPR. WhatsApp and Telegram are operated by third parties under their own terms; those conversations take place in their environment, outside this website.

Links to other services

The pages link to our Google Maps profile, to WhatsApp and to Telegram. Until you click them, nothing is sent anywhere — these are ordinary links, not embedded content. Once you click, you leave this site and that service's own privacy terms apply.

Online booking

When you submit the booking form, we process your name, a phone contact (WhatsApp or Telegram), the chosen service, the preferred date and time, and the language you filled the form in. This is used to check availability, confirm the booking and reply to you in your own language. The legal basis is steps prior to and performance of a contract under Article 6(1)(b) GDPR; without this data the request cannot be handled. The services involved:

• Google Calendar — showing free times in the form's calendar, checking the slot and creating the booking
• Google Sheets — the list of requests the atelier works from
• Telegram — an immediate message to Diana about a new request: number, name, phone, service, preferred time and language
• Google reCAPTCHA — protecting the form against bots (see the next section)

Retention period: booking records are kept for 12 months after the job is completed, then deleted.

A finished order: the personal link for choosing a pickup time

When your order is ready, Diana sends you a WhatsApp message with a personal link on which you choose a time to collect it. The message is prepared from the phone number and language in your booking; it contains a greeting (without the name in Czech), the order amount in crowns where there is one, and the link itself. The legal basis is performance of a contract under Article 6(1)(b) GDPR. How it works:

• The link contains a random code (a token). Its only purpose is to let the page recognise which order it belongs to; from it nobody can learn anything beyond your name, your language and the atelier's free times
• The page opens without cookies, stores nothing in your browser, contains no analytics and loads nothing from third-party servers. When it opens it contacts our server (Google Apps Script) once, so Google's servers see your IP address
• Only the atelier's free times are shown — no names or details of other customers
• When you confirm a time, we save it in the requests sheet, create a “Pickup” entry in the atelier's calendar and send Diana a Telegram message: your name, the order number and the chosen time. The time can be chosen only once; after that the link stops working
• The link is valid for 30 days, and it also stops working as soon as the order has been handed over or cancelled

Retention period: the link's code and the chosen time are kept together with the booking record — 12 months after the job is completed, then deleted.

Notes and reminders

So that nothing slips through, Diana can add a short internal note to a booking (for example, what is to be done to the garment). The note is visible to the same people as the booking itself (see “Who can see this data”) and is kept in the same sheet. Before a visit and after an order is handed over we may write to you on WhatsApp: to remind you of tomorrow's visit or of an order that is waiting for you, and to thank you with a request for a review. Diana sends these messages by hand — nothing is sent to you automatically in our name.

• Every day Diana receives a list of tomorrow's visits in Telegram: time, name, kind of visit (appointment or order pickup), service and note, with a button that opens a WhatsApp chat. The phone number itself is not shown in the message
• If an order is ready but no pickup time has been chosen, the system prompts Diana to write to you again
• The legal basis for reminders is performance of a contract (Article 6(1)(b) GDPR); for a request for a review it is our legitimate interest (point (f))
• If you do not want to receive such messages, tell us — Diana will then write to you only about the order itself

Retention period: the note and the records of reminders sent are kept with the booking record — 12 months after the job is completed, then deleted. Messages in WhatsApp and Telegram are kept by those services under their own rules.

Who can see this data

Booking, order and pickup-time data is seen by Diana as the atelier's operator and owner and, where needed, by staff to whom the owner gives access. Technically it is stored in Google services (Sheets, Calendar, Apps Script) under the atelier's account; messages to Diana arrive in Telegram. Other customers see at most that a time is taken — without names. We do not sell data, do not pass it to advertising services and do not use it for profiling.

Form protection: Google reCAPTCHA

To keep bots away from the booking form, it is protected by Google reCAPTCHA v3. It deliberately loads only at the moment you first click into the form — if you are just browsing, nothing is sent to Google. Once loaded, reCAPTCHA assesses whether it is dealing with a human: it passes Google your IP address, details about your browser and device, and information about how you interact with the page, and stores a cookie of its own for that purpose. The legal basis is our legitimate interest in protecting the form from abuse under Article 6(1)(f) GDPR.

Google's own privacy policy and terms of service apply to this processing: policies.google.com/privacy and policies.google.com/terms.

Transfers outside the EU

Google and Telegram are providers based outside the European Union, so data from the booking form and from reCAPTCHA may be processed on servers outside the EU, primarily in the United States. Google LLC participates in the EU–US Data Privacy Framework, which serves as the legal basis for those transfers; the European Commission's standard contractual clauses apply in addition. Telegram is operated by a non-EU company under its own terms — all that is sent there are working messages to Diana: the details of a new request (name, phone, service, time) and notices of a chosen pickup time.

Your rights

Your rights apply to everything you send us — whether through the booking form or directly by phone, WhatsApp, Telegram or email. Under the GDPR you have the right:

• to access your data and to receive a copy of it
• to have inaccurate or incomplete data corrected
• to erasure, where the reason for processing no longer applies
• to restriction of processing and to data portability
• to object to processing based on legitimate interest
• to withdraw consent at any time, without affecting processing carried out beforehand

A request sent to the contacts below is enough. We will reply within one month of receiving it at the latest.

Complaint to the supervisory authority

If you believe we handle your data in breach of the rules, you may contact Úřad pro ochranu osobních údajů (uoou.cz), the supervisory authority for data protection in the Czech Republic.

Changes to this page

We will revise this page whenever what actually happens on the site changes — for example when a new tool is added or the scope of processing changes. The date of the last revision is shown at the top of the page.