We value your trust and your privacy. This policy explains what personal data we process about you, why, on what legal basis, to whom we disclose it, and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing. In case of any discrepancy, the Czech version of this policy prevails.
1. Data controller
Royal medical service & spa s.r.o., operator of the ESCAPE Thai Massage salon
Company ID (IČO): 05832241 · VAT ID (DIČ): CZ05832241
Registered office: Rybná 716/24, 110 00 Prague 1, Czech Republic
Salon: Elišky Krásnohorské 133/11, 110 00 Prague 1 – Josefov, Czech Republic
Registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 271637
Email: info@escapemassage.cz · Phone: +420 734 331 444
For any data-protection matter, contact us at the email above. We have not appointed a Data Protection Officer (DPO), as we are not legally required to do so.
2. What data we process
Depending on how you use our services, we may process:
- Identification and contact data: name and surname, email, phone number.
- Booking data: chosen massage, length, date and time, and any notes or preferences.
- Gift voucher data: the recipient’s name and a personal message, if you fill them in for a PDF voucher, and the recipient’s email if you send them the voucher by email (we use it only to deliver the voucher and to remind them of its validity). For courier delivery, your delivery address and a phone number for the courier. We always send a courier voucher to you as the buyer, never straight to the recipient.
- Escape Club membership data: the email you sign in with (using a one-time code, no password), date of birth (optional, based on your consent; it can be saved only once, and you can have it deleted or corrected at reception or by emailing info@escapemassage.cz), preferred language, visit history, club credit balance and redeemed rewards.
- Payment data: amount and payment status. Online payments are handled through the secure Comgate payment gateway (Comgate a.s.), including Apple Pay and Google Pay, and card payments at reception through a Comgate payment terminal; we never see or store card numbers.
- Newsletter data: your email address, if you subscribe. You confirm the subscription via a link in an email. As evidence of your consent we store the time of confirmation, where the sign-up came from (website, booking, account) and the IP address.
- Communication with us: when you email us, use the contact form, or message us on WhatsApp or Instagram, we process your name or profile name, your email or phone number and the content of the messages.
- Messages we send: which email or text message we sent you (for example a confirmation, a reminder or a review request), when, whether it was delivered, and whether you opened the email or clicked a link in it (see Emails in section 9).
- Website usage data: IP address, device and browser type, cookies and similar identifiers (see section 9).
- Special category data: optional health information you choose to provide in a booking note (see section 4).
For an online booking we need your name, email and phone; for a voucher purchase, your email (for pick-up or courier also your name, and for courier your address and phone). Without them we cannot accept the booking or order. All other details are optional.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Handling bookings, providing the massage, selling and redeeming gift vouchers, running Escape Club membership | Performance of a contract (Art. 6(1)(b) GDPR) |
| Bookkeeping and meeting tax obligations | Legal obligation (Art. 6(1)(c)) |
| Improving our services, operational security, backups and a log of changes in the booking system, fraud and abuse prevention, protecting our legitimate claims, keeping a list of unsubscribed addresses, aggregate cookieless measurement of visits and ads (Google, and our own page view count, which stores no IP address or anything personal) | Legitimate interest (Art. 6(1)(f)) |
| Answering your questions (email, form, phone, WhatsApp, Instagram) | Steps prior to entering into a contract and performance of a contract (Art. 6(1)(b)); for other questions, legitimate interest (Art. 6(1)(f)) |
| A booking reminder the day before (by email or text message) | Performance of a contract (Art. 6(1)(b)) |
| Emails to existing customers: after your visit, a request for a Google review (only once), and occasionally an offer of our similar services (massages, gift vouchers and invitations to Escape Club) based on your earlier visits and purchases. For this we keep a customer list (name, email, language, whether it was a booking or a voucher). We write to you for no longer than 24 months after your last visit or purchase. You can decline them at any time: right when you book or buy a voucher, via the link in each such email, or at info@escapemassage.cz. | Legitimate interest (Art. 6(1)(f) GDPR) in conjunction with Section 7(3) of Act No. 480/2004 Coll. |
| Sending the newsletter and marketing offers, analytics and marketing cookies, measuring ad performance, date of birth in Escape Club | Consent (Art. 6(1)(a)) |
| Processing optional health information | Explicit consent (Art. 9(2)(a)) |
Emails and text messages about your visit. The day before your booked appointment we send you a short reminder by email or by text message to the number in your booking (time, address, how to change or cancel). The reminder is part of handling your booking and contains no advertising. Don’t want text messages? Tell us at reception, by phone or at info@escapemassage.cz. After your visit we send you a request to review us, only once per email address and without a reminder. We send it to all guests alike, regardless of how the visit went. As our customer, you will also occasionally get an email offering our similar services. You can decline review requests and offers at any time, free of charge, via the link in each such email, by emailing info@escapemassage.cz, or right when you book or buy a voucher. Declining does not affect your booking or your confirmation emails.
How we choose what to send you. To keep our emails relevant, we sort guests into simple groups: whether you live in Prague or are visiting (from your answer when you subscribe), the language you use with us, when you last visited and what you chose. Messages that would not make sense are left out automatically, for example when you already have your next appointment booked. We never use the pregnancy massage or other health-related massages for this. About one in ten guests, picked at random by email address, gets fewer automatic offers, so that we can see whether our emails really help our guests. Prices and discounts do not change for anyone because of this.
Any consent you give (newsletter, cookies, date of birth, health notes) can be withdrawn at any time, free of charge (see section 8). Withdrawal does not affect the lawfulness of earlier processing.
4. Health data
The booking note is entirely optional. If you include information about health considerations (e.g. an injury, pregnancy, allergies), it helps us adapt the massage so it is safe and pleasant for you.
Such data falls into the special categories of personal data and we process it solely on the basis of your explicit consent, which you give by voluntarily entering it. You are under no obligation to provide it, and leaving it out has no effect on your ability to book.
The same applies if you send us health information by email or in a message, or tell us by phone or at reception and we note it with your booking. We use it only to adapt your massage. Please share only what matters for the massage.
5. Recipients and processors
We never sell your data. We disclose it only to the extent each purpose requires: to processors who work for us under a data-processing agreement, and to a few recipients who handle the data as independent controllers under their own policies (the payment gateway, the courier, advertising services and social networks; for ad measurement via Meta, as joint controllers, see Measuring purchases):
- Supabase: database for bookings, vouchers and Escape Club accounts, and account sign-in (hosted in the EU).
- Cloudflare: running and securing the website and the booking system, including protecting forms from bots (Cloudflare Turnstile).
- Brevo (Sendinblue): sending emails (confirmations, vouchers, reminders, review requests, offers to customers, newsletter) and text messages, keeping the list of customers and subscribers.
- Forpsi: our mailbox info@escapemassage.cz.
- Comgate (Comgate a.s.): online payments (card, Apple Pay, Google Pay) and card payments at reception. When you pay with Apple Pay or Google Pay, Apple or Google also processes the payment details under its own terms.
- Pluxee and Edenred: benefit card payments at reception; the card issuer processes the payment details under its own terms.
- Google: website analytics (Google Analytics), tag management (Google Tag Manager), measuring ad performance and remarketing (Google Ads), map embedding and secure storage of database backup copies (Google Drive).
- Microsoft: click maps and recordings of how the site is used (Microsoft Clarity), only with your consent to analytics.
- Meta (Facebook, Instagram, WhatsApp): measuring ad performance and showing relevant ads, only with your consent to advertising cookies, and carrying messages when you write to us on WhatsApp or Instagram.
- Seznam.cz (Sklik): measuring ad performance and showing relevant ads, only with your consent to advertising cookies.
- Libero: our previous booking system, until the switch to the new one. We have taken over its bookings, vouchers and club credit, and will have the data deleted at Libero once the transfer is complete.
- Ecomail: our previous tool for the list of Escape Club members. On the day we switched to the new system, we moved the members to the new Escape Club (the controller stays the same, only the provider changes). Only members who had consented to the newsletter were added to the newsletter list in Brevo: that consent remains valid and you do not need to confirm it again. Members without that consent were moved to Escape Club only. Contacts who never confirmed their sign-up were not moved. As proof we keep the source and date of your original sign-up. We will then delete the data at Ecomail.
- Shipping / courier service: delivering printed gift vouchers to the buyer’s address.
- Accountant and accounting and invoicing software provider: keeping accounts and accounting records.
- Public authorities: only to the extent required by law.
Measuring purchases. When you complete an online purchase (a booking or a voucher), we pass on details of the purchase (order number, amount and the services chosen) according to your choice in the cookie banner: with “Analytics only” to Google Analytics, and with “Accept all” also to Google Ads, Meta and Sklik, so that we know which ad led to it. We pass on your email and phone only as an encoded fingerprint (a hash), never in readable form. Meta also receives your IP address and browser details. Some of this data is sent directly by our server. With consent to advertising cookies, these services may later show you our ads (remarketing). With “Essential only”, Google receives only a cookieless signal (see section 9) and our server passes on nothing about your purchase. We are joint controllers with Meta Platforms Ireland Ltd. for collecting and transmitting this data to Meta (essence of the arrangement: facebook.com/legal/controller_addendum). Meta is responsible for any further processing.
WhatsApp and Instagram. When you message us on WhatsApp (+420 734 331 444) or Instagram, Meta also transmits and stores the messages under its own terms. Our reception team replies to you. We delete conversations no later than 12 months after the last message. Please never send us card numbers in a message.
We are happy to provide the current list of processors on request at info@escapemassage.cz.
6. Transfers to third countries
We process your data primarily within the European Union. Some providers (notably Google, Meta, Microsoft, Cloudflare and Supabase) may process data outside the EU, e.g. in the USA. In such cases the transfer is safeguarded by appropriate measures under the GDPR, typically the Standard Contractual Clauses approved by the European Commission, or the provider’s certification under the EU-U.S. Data Privacy Framework. We will give you a copy of these safeguards on request at info@escapemassage.cz.
7. Retention periods
| Data | Retention period |
|---|---|
| Bookings and records of services provided | For the duration of the relationship and then for the limitation periods (typically 3 years) |
| Health notes in a booking | Together with the booking (typically 3 years); we delete them sooner if you withdraw consent or ask us to |
| Accounting and tax documents | For the statutory period (typically 10 years) |
| Escape Club membership and club credit | For the duration of membership, until you request erasure; date of birth until you withdraw consent |
| Gift vouchers | For the voucher’s validity (12 months) and related periods |
| Newsletter | Until consent is withdrawn |
| List of unsubscribed addresses and numbers that do not want text messages | Permanently, even after your other data is deleted, so that we never write to you again by mistake |
| WhatsApp and Instagram conversations | No longer than 12 months after the last message |
| Copies of booking confirmations and vouchers in our mailbox | 12 months |
| Proof of newsletter consent | While consent lasts and 3 years after withdrawal |
| Backups and the log of changes in the booking system | Backups up to 4 months, change log 400 days. Deleted data disappears from them at the latest when these periods end. |
| Customer list for review requests and offers (without newsletter) | 24 months from the last visit or purchase, or until you decline |
| Record of emails and text messages sent | 25 months, after which only an encoded fingerprint of the address remains (so that messages are not repeated) |
| Delivery, opening and link clicks of emails | 13 months |
| Recipient’s email (voucher sent by email) | Until the voucher expires and 6 months after |
| Cookies and website usage data | Per cookie type (see section 9), typically up to 26 months |
8. Your rights
In relation to your personal data you have the right to:
- access your data and obtain a copy;
- rectification of inaccurate data and completion of incomplete data;
- erasure (“right to be forgotten”), unless a legal obligation prevents it;
- restriction of processing;
- data portability to another controller;
- object to processing based on legitimate interest, for example to review requests (we always comply with an objection to commercial messages);
- withdraw consent where processing is based on consent;
- lodge a complaint with the supervisory authority.
Right to object. You can object at any time to processing we do on the basis of legitimate interest (for example the review request, offers to existing customers or cookieless measurement). We always comply with an objection to marketing messages: just use the link in the email or write to info@escapemassage.cz.
You can exercise your rights by emailing info@escapemassage.cz, by phone on +420 734 331 444 or in person at reception. You can also change the name, phone, language and newsletter subscription in your Escape Club account yourself, under My account. So that we never hand your data to someone else, we may ask you to confirm your identity. We will handle your request without undue delay, at the latest within one month. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz.
9. Cookies and website
Our website uses cookies. Essential cookies provide the basic functions of the site and are processed on the basis of legitimate interest. Analytics and marketing cookies (e.g. Google) are used only with your consent, which you give through the cookie banner and can change or withdraw at any time. After a completed booking your browser remembers your name, email and phone (only on your device, never sent anywhere) so your next booking is faster. You can delete them any time with “Not you?” in the form or by clearing your browser data.
What each choice in the cookie banner switches on:
- Essential only: only what the site needs to work (for example remembering your choice). No analytics or advertising cookies are stored. In this mode Google Analytics and Google Ads receive only cookieless signals (for example that a page was viewed), from which Google estimates visits and ad performance in aggregate. If you arrive from a Google ad, the click identifier stays in the page address so that a purchase can be attributed to the ad without cookies.
- Analytics only: also Google Analytics 4 and Microsoft Clarity: aggregate visit statistics, click maps and recordings of how the site is used. Form contents are not recorded. This helps us improve the site and booking. Google Ads still receives only cookieless signals.
- Accept all: also advertising cookies (Google Ads, Meta (Facebook and Instagram), Sklik): measuring how ads perform, showing relevant ads and remarketing (see Measuring purchases in section 5). Interactive Google Maps load as well.
Without consent, a Google map loads only when you tap it yourself (“Open interactive map”). You can change your choice any time with “Cookie settings” in the site footer. We remember it for 12 months, then ask you again. How long cookies last by default: Google Analytics (_ga) up to 2 years, Microsoft Clarity up to 1 year, Google Ads and Meta (_gcl_au, _fbp) 90 days, Sklik under Seznam.cz’s rules.
Emails. Brevo tells us whether an email was delivered and opened. We measure clicks on links in our emails through our own address (escapemassage.cz/go/…). This shows us which messages are useful, and a click lets us know, for example, not to send you another review request. We delete these records after 13 months. Links also carry a source label (for example utm_source=email), which our analytics sees on the website only if you have consented to analytics.
10. Security
We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse, in particular encrypted transmission (HTTPS), access controls, storing data with vetted providers, regular backups to separate storage, and processing payments through a certified gateway that does not expose card numbers to us.
11. Changes to this policy and contact
We may update this policy from time to time. The current version is always available on this page, with the date of the last change. For any data-protection question, contact us at info@escapemassage.cz or +420 734 331 444.