Privacy Policy

Personal data processing principles under GDPR

The protection of your personal data is important to us. This document informs you how we collect, process and protect your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data ("GDPR") and Czech Act No. 110/2019 Coll. on personal data processing.

1. Data Controller

Pursuant to Article 4(7) of the GDPR, the data controllers — depending on the type of service provided — are two entities:

a) For sessions, consultations, workshops and digital content:
Veronika Barkoci
ID No.: 747 35 632
Registered office: Komenského 68, 798 27 Němčice nad Hanou, Czech Republic
Not a VAT payer
Email: [email protected]
Phone: +420 739 291 302

b) For courses, seminars and online educational programs:
Kódy Vaší Duše s. r. o.
ID No.: 109 02 457
Registered office: Komenského 68, 798 27 Němčice nad Hanou, Czech Republic
Registered with the Regional Court in Brno, Section C, File 123537
The company is not a VAT payer
Represented by Managing Director Veronika Barkoci
Email: [email protected]
Phone: +420 739 291 302

The controllers have not appointed a Data Protection Officer (DPO), as this obligation does not apply to them under Article 37 of the GDPR.

2. Scope of Processed Personal Data

The controller processes personal data provided by the buyer in connection with concluding a contractual or other legal relationship with the controller, or which the controller has collected otherwise and processes in accordance with applicable legislation or to fulfil the controller's legal obligations.

The data entered in the application and order form are necessary for the buyer's identification and for the realisation of the entire transaction. These are particularly:

•

first name and surname

•

email address

•

phone number

•

billing and delivery address

•

ID No. and VAT ID (for entrepreneurs)

•

data on ordered services and payments

•

content of communication with us (email, contact form)

•

IP address and device data (from technical server logs, only to the necessary extent)

3. Purpose and Legal Basis of Processing

We process your personal data for the following purposes and on the following legal bases under Article 6(1) of the GDPR:

•

Performance of contract [Art. 6(1)(b)] — concluding and performing the service contract (sessions, consultations, workshops, courses, seminars, online programs), communication regarding agreed services, providing access to digital content.

•

Compliance with legal obligations [Art. 6(1)(c)] — bookkeeping, issuing invoices and tax documents under Czech Act No. 563/1991 Coll. on Accounting and Act No. 235/2004 Coll. on VAT.

•

Legitimate interest [Art. 6(1)(f)] — protection against claimed damages, dispute records, debt collection, securing the online shop against misuse.

•

Consent [Art. 6(1)(a)] — sending commercial communications (newsletter), only if you actively request them. You can withdraw consent at any time by sending a message to [email protected].

4. Recipients and Processors of Personal Data

We do not provide your personal data to third parties for marketing or commercial purposes. Only the following categories of recipients and processors who help us with the operation of the service have access to your data:

•

Accountant and tax advisor — for accounting and tax document processing.

•

Hosting and technical infrastructure providers — operators of the servers on which our website and database run (within the EU).

•

Payment service providers — Fio banka, possibly the GOPAY s.r.o. payment gateway for processing payments.

•

Email and communication service providers — for sending transactional and confirmation emails.

•

State authorities — only in cases and to the extent stipulated by law (tax office, courts, Czech Trade Inspection Authority, etc.).

5. Transfer of Personal Data Outside the EU

We process personal data primarily within the European Union and the European Economic Area. We do not transfer them to third countries outside the EU/EEA, unless such transfer is necessary for performance of the contract or based on your express consent, and always with appropriate safeguards under Article 44 et seq. of the GDPR.

6. Personal Data Retention Period

We process personal data only for the necessary period:

•

Order and invoicing data — for the period stipulated by Czech Act on Accounting and Act on VAT, i.e. typically 10 years from the end of the tax period.

•

Communication with clients — for the duration of the contractual relationship and 4 years after its termination (limitation period).

•

Newsletter data — until consent is withdrawn or until you unsubscribe.

•

Website logs and operational data — maximum 6 months, then anonymised or deleted.

7. Your Rights as a Data Subject

In connection with the processing of your personal data, you have the following rights, which you can exercise by sending a request to [email protected]:

•

Right of access (Art. 15 GDPR) — to obtain confirmation whether we process your data, and a copy of the processed data.

•

Right to rectification (Art. 16 GDPR) — to correct inaccurate or incomplete data.

•

Right to erasure / "right to be forgotten" (Art. 17 GDPR) — to request deletion of data if it is no longer needed for the purposes for which it was processed, or if you withdraw consent and there is no other legal basis for processing.

•

Right to restrict processing (Art. 18 GDPR) — to suspend processing in cases stipulated by law.

•

Right to data portability (Art. 20 GDPR) — to receive your data in a structured, commonly used and machine-readable format.

•

Right to object (Art. 21 GDPR) — to object to processing based on our legitimate interest.

•

Right to withdraw consent (Art. 7 GDPR) — to withdraw previously granted consent at any time; withdrawal does not affect the lawfulness of processing before its withdrawal.

•

Right to lodge a complaint (Art. 77 GDPR) — to contact the supervisory authority: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

8. Personal Data Security

We have adopted reasonable technical and organisational measures to secure your personal data against unauthorised access, loss, destruction or misuse. Communication with our website takes place exclusively over an encrypted connection (HTTPS/TLS). Only authorised persons bound by a duty of confidentiality have access to personal data.

The buyer acknowledges that at live events (workshops, courses), participant registration must be carried out before the start of the event, where their identity will be verified.

9. Cookies and Tracking Technologies

Our website uses only technically necessary cookies for proper functionality (session, cart, language and currency preferences). These cookies do not require consent under Section 89 of Czech Act No. 127/2005 Coll. on electronic communications.

In case we use analytical or marketing cookies on the website (e.g. Google Analytics, social network pixels), we will ask for your consent through a cookie bar and you will have the option to refuse them or selectively allow them.

10. Automated Decision-Making and Profiling

When processing your personal data, we do not use automated decision-making or profiling within the meaning of Article 22 of the GDPR that would have legal effects on you or similarly significantly affect you.

11. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. The current version can always be found on this page. We will inform you of significant changes by email or notification on the website.

12. Contact

For any questions, requests or complaints regarding the processing of your personal data, please contact us:

Email: [email protected]
Phone: +420 739 291 302
Address: Komenského 68, 798 27 Němčice nad Hanou, Czech Republic

We process requests without undue delay, no later than within 30 days of their receipt (in justified cases the deadline may be extended by up to 60 days, of which we will inform you).

Effective Date

This Privacy Policy is effective from 30 May 2026.