Information on the Processing of Personal Data

effective from 10 March 2026

This information is provided in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter the "GDPR") and Act No. 110/2019 Coll., on the processing of personal data.

1. Controller of Personal Data

The controller of personal data is the company Bulovka Premium Clinic, a.s., IČ: 092 59 392, with its registered office at Pacovská 2104/1, Krč, 140 00 Praha 4, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, Insert 25403 (hereinafter the "Controller").

Contact details of the Controller: e-mail recepce@bulovkadc.com, tel. +420 733 143 111.

2. Categories of Personal Data Processed

The Controller processes the following categories of personal data:

• Identification data: first name, surname;
• Contact data: e-mail address, telephone number;
• Billing data: address, IČO, DIČ (in the case of a business purchase);
• Order data: order number, purchased services/vouchers, price, order date;
• Payment data: data on the execution of the payment (the Controller does not store the payment card details themselves — these are processed exclusively by the payment service provider);
• Technical data: IP address, cookies, browser data (for analytical purposes only).

3. Purposes of Processing and Legal Basis

Personal data are processed for the following purposes:

4. Period of Processing of Personal Data

• Performance of a contract: for the duration of the contractual relationship and subsequently for the duration of the limitation periods (3 years from the expiry of the Voucher's validity);
• Legal obligations: for the period stipulated by the relevant legal regulations (accounting documents — 5 years, tax documents — 10 years);
• Legitimate interest: for the duration of the legitimate interest, at most 3 years from the last contact;
• Consent to marketing: until the consent is withdrawn, or until the expiry of the period stated in the consent.

5. Recipients of Personal Data

Personal data may be transferred to the following categories of recipients:

• Payment service provider — processing of online card payments (ČSOB);
• E-mail service provider — delivery of order e-mails and Vouchers;
• Hosting and cloud service provider — data storage (Google Firebase);
• Accounting and tax advisor — keeping the accounts;
• Public authorities — on the basis of a legal obligation (tax authority, courts, etc.).

The Controller does not transfer personal data to third countries outside the European Economic Area, except in cases where the cloud service provider uses servers under the regime of standard contractual clauses approved by the European Commission.

6. Rights of the Data Subject

In connection with the processing of personal data, you have the following rights:

• Right of access — the right to obtain confirmation from the Controller as to whether your personal data are being processed, and if so, the right to access such data;
• Right to rectification — the right to request the correction of inaccurate or the completion of incomplete personal data;
• Right to erasure — the right to request the erasure of personal data if the purpose of processing has ceased, consent has been withdrawn, or the data are being processed unlawfully;
• Right to restriction of processing — the right to request the restriction of processing in the cases stipulated by the GDPR;
• Right to data portability — the right to receive personal data in a structured, commonly used and machine-readable format;
• Right to object — the right to object to processing based on the Controller's legitimate interest;
• Right to withdraw consent — consent to the processing of personal data for marketing purposes may be withdrawn at any time by sending an e-mail to recepce@bulovkadc.com or by clicking the unsubscribe link in every marketing e-mail;
• Right to lodge a complaint — the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

You may exercise your rights by sending a request to the e-mail address recepce@bulovkadc.com or in writing to the registered office of the Controller. The Controller is obliged to respond to the request without undue delay, no later than 30 days from its receipt.

7. Cookies and Analytics

The online store uses cookies and similar technologies to ensure the proper functioning of the website, traffic analytics (Google Analytics 4) and measurement of marketing campaign performance (Google Tag Manager).

Necessary cookies — ensure the basic functionality of the website (login, cart, security). Their use is based on the Controller's legitimate interest and cannot be refused.

Analytical cookies — help us understand how visitors use the website. The data are anonymized and serve to improve services.

Marketing cookies — used only with your consent for the purposes of targeted advertising and content personalization.

8. Security of Personal Data

The Controller has adopted appropriate technical and organizational measures to ensure the protection of personal data, in particular:

• encryption of communication (HTTPS/TLS);
• secure access to data with multi-level authentication;
• regular data backups;
• restriction of access to personal data to authorized persons only;
• payment data are processed exclusively by the payment service provider in accordance with the PCI DSS standard.

9. Consent to Processing for Marketing Purposes

By granting consent during the order, you agree to the processing of your personal data for the purposes of service offers, sending discounts or other third-party offers, including by electronic means (in particular e-mail), and for the purposes of carrying out advanced marketing activities exceeding the Controller's legitimate interest.

Consent is entirely voluntary, valid for an indefinite period and may be withdrawn at any time. In the event that consent is not granted or is withdrawn, no marketing communications will be sent to you and some offers of our services may not be fully tailored to your needs or provided in their full offered scope.

Consent may be withdrawn:

• by sending an e-mail to recepce@bulovkadc.com;
• by clicking the unsubscribe link in every marketing e-mail;
• in writing to the registered office of the Controller.

10. Final Provisions

The Controller is entitled to update this information on the processing of personal data at any time. The Controller will inform about substantial changes through the online store.

This information on the processing of personal data is valid and effective from 10 March 2026.