Privacy policy (GDPR)

The controller of personal data is the operator of the kissEpi clinic and website, with premises at Senovážné nám. 978/23, 110 00 Prague 1. Contact: info@kissepi.cz, telephone +420601267111. We will provide the entity’s identification details (business name, company ID number, etc.) by email on request.

We process the data you provide to us when:

• completing a contact or booking form on the website,
• communicating with us by email, telephone, text message or via social media,
• visiting our premises and in connection with the provision of healthcare or related services in accordance with the applicable documentation and legislation.

This may include, in particular, your first name, surname, contact details, information about arranged appointments and, where applicable, data required for invoicing and performance of a contract.

• Performance of a contract / pre-contractual steps: arranging and providing services, bookings.
• Legitimate interest: operating the website, basic technical security, responding to enquiries, internal records (to the extent permitted by law).
• Legal obligation: accounting and tax records, documentation under specific regulations where applicable.
• Consent: e.g. marketing communications or analytics and marketing cookies, where we use them only on the basis of consent.

Data may be processed by trusted processors to the extent necessary for their task: the hosting and web services provider, the operator of the booking or email system, and accounting or legal services. We have a contractual relationship with each processor in accordance with Article 28 of the GDPR.

Only with your consent, Google, Meta and Seznam.cz also receive data, see section 9.

Where we use tools with servers outside the EU/EEA, we ensure appropriate safeguards (e.g. standard contractual clauses) in accordance with the GDPR.

We retain data for as long as necessary to fulfil the purpose of processing and for the period required by law (e.g. for accounting). After this period, we anonymise or delete it.

You have the right of access to your data, rectification, erasure (subject to the conditions of the GDPR), restriction of processing, data portability, the right to object to processing based on legitimate interest, and the right to withdraw your consent to processing at any time (withdrawal of consent does not affect the lawfulness of processing before its withdrawal).

We handle requests without undue delay. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

Information about cookies and similar technologies can be found on our Cookie policy page.

Only with your consent in the cookie banner, we use Google Analytics, Google Ads, Meta (Instagram, Facebook) and Sklik (Seznam.cz). They show us which pages and ads helped people find us. The legal basis is your consent (Article 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll.). You can change or withdraw your consent at any time using the “Cookie settings” button in the website footer.

• Visit source. When you arrive from an ad, the page address contains a click identifier (e.g. gclid or fbclid) and campaign details (UTM). With marketing consent, the website remembers them until you close the browser. Without consent, it keeps them only on the page currently open.
• Form enquiries. Together with your details, we store the visit source, the landing page and whether you gave marketing consent. We use this to evaluate which ads work.
• Hashed email and phone. After you submit the form, and only with your marketing consent, Google Ads and Meta may receive your email and phone number in hashed form (SHA-256, irreversibly converted into a code). This is used only to match the enquiry to an ad click (enhanced conversions, Advanced Matching). Without consent, nothing of this kind is sent.
• Enquiry outcome. We may later upload to Google Ads and Meta the information that an enquiry led to a visit to the clinic. This applies only to enquiries submitted with marketing consent.

Google and Meta may transfer data to the USA. Both companies participate in the EU-US Data Privacy Framework.

Write to us at info@kissepi.cz. We will be glad to help with access, rectification or an explanation of how your data is processed.