1. Who processes your data
Pixxla s. r. o., Vajnorská 135, 831 04 Bratislava – Nové Mesto, Slovakia, company ID 53 658 981, email pixxla.sauna@gmail.com, is the controller for this website, the contact form, newsletter, gift-voucher sales and Pixxla’s own marketing.
For a sauna booking and delivery of the service, the controller is the provider identified before you submit the order and in the booking confirmation. Pixxla may arrange the booking, payment and support for that provider and acts as an independent controller for its own legal duties and communications.
For Sauna Pardubice bookings and optional paid-booking advertising measurement, the controller is Pixxla Sauna, s.r.o., company ID 24564869, Nademlejnská 1069/20, 198 00 Prague 9, Czech Republic; contact pixxla.sauna@gmail.com. This is a separate legal entity from the Slovak Pixxla s. r. o. named above.
You may always send a rights request to Pixxla. If it concerns a local provider, we will promptly route it to the correct party.
2. Purposes, data and legal bases
| Purpose | Examples of data | Legal basis | Recipients | Retention |
|---|---|---|---|---|
| Contact and support | Name, email, optional phone, topic, message and language. | Pre-contract steps or legitimate interests in responding. | Brevo, Pixxla email and, where relevant, the provider. | While handling the request, then only as needed for legal duties or claims. |
| Booking, payment and access | Contact/billing details, location, time, group size, booking/payment status, voucher and access events. | Contract, legal obligations, rights and safety. | Provider, Pixxla, Reenio, payment gateway, email/SMS and access vendors. | For the contract and the applicable statutory archiving and limitation periods. |
| Vouchers, withdrawal and complaints | Name, email, order or code, dates, request, communications and evidence. | Contract, legal obligation and legal claims. | Pixxla, provider, Brevo, email and advisers where needed. | While handling the matter and for the applicable legal periods. |
| Newsletter | Email, language, time and proof of opt-in or opt-out. | Consent. | Brevo. | Until withdrawal; a minimal consent or suppression record may remain for compliance and to prevent unwanted re-enrolment. |
| Website, security and choices | IP and headers for form protection, approximate GeoIP country, language, market and cookie choice. | Legitimate interests, necessary operation, and consent for optional technology. | Vercel and providers enabled in cookie settings. | The application-level form rate-limit record is kept for no more than 15 minutes; separate security and operational hosting logs follow the provider’s verified settings; language/market 30 days; cookie choice 180 days. |
| Google reviews and external content | Public author name, text/translation, rating, date, links and, after consent, profile image. | Legitimate interests in informing visitors; consent to load external media. | Google, Meta/Instagram or Google/YouTube. | Short technical cache; otherwise under the external provider’s rules. |
| Analytics and marketing | Online identifiers, page, market, locale and events without form contents. | Consent. | Google Analytics and a market-specific Meta Pixel. | Withdrawing consent stops further optional measurement; data already collected is kept until the verified retention period configured in the relevant service expires or until earlier deletion. |
| Paid Pardubice booking – advertising measurement | Only with separate voluntary consent: booking ID, payment time and amount in CZK, and email and/or phone in hashed form. Hashed contact details are still personal data. | A separate, unticked opt-in in the Pardubice booking form; declining it does not affect the booking. | Reenio as the booking and payment source, Vercel and Upstash as technical vendors, and Meta as recipient of the Pardubice conversion. | The technical queue and alert record hold the numeric booking ID, status, attempt count, technical timestamps and a machine-readable alert reason; we do not store email, phone or the Meta payload there. A record without a delivery attempt expires within 7 days of intake; after a delivery attempt begins or processing completes, we retain the record for no more than 90 days after the attempt or completion. A numeric ID may remain in a technical queue index for up to 15 days after insertion even if processing stops. An alert record is held for no more than 7 days after creation. Following withdrawal, we keep the numeric booking ID on a suppression list for no more than 400 days so no further conversion is sent. Withdrawal cannot undo data sent before it; data held by Meta follows its current retention settings and policies. |
| Cameras, locks and safety sensors | Depending on location: entrance image, lock status, code use, alarm or technical event. | Legitimate interests in safety, contract, vital interests or legal claims as applicable. | The location controller and its technical vendors. | The exact period is stated on the sign and location-specific notice. |
3. Where the data comes from
We obtain data from you, your use of the website and booking interface, Reenio and the payment provider, location access or safety devices, and public Google Maps profiles.
Required booking, payment and contact fields are needed to handle your request or contract. Newsletter, optional cookies and external content are voluntary.
Open-Meteo receives only a sauna’s fixed coordinates from our server, not your location or IP address. GeoIP is an approximate country lookup, not GPS.
4. Recipients and external services
We mainly use Vercel, Brevo, Reenio, a payment gateway, Google, Meta and Pixxla’s email service. The specific payment or communications provider appears in the relevant interface.
Following an external link such as Google Maps, Koalendar, social media, YouTube or an external London booking takes you to an independent service with its own privacy rules.
Some vendors may process data outside the EEA. We will provide current information about a specific transfer, destination and safeguard on request based on that service’s current documentation.
5. How long we keep data
We keep data only for as long as the stated purpose and applicable law require. Where one record serves several purposes, it is erased after the last legal ground ends.
Camera and access retention differs by location and technology and must be stated before entry to a monitored area.
6. Your rights
Subject to the GDPR, you may have the right to:
- access and a copy
- rectification
- erasure or restriction
- data portability
- object to processing, including direct marketing
- withdraw consent
Exercise your rights at pixxla.sauna@gmail.com; we may reasonably verify your identity. You may also complain to the supervisory authority where you habitually live or work, or to the Office for Personal Data Protection of the Slovak Republic.
7. Automation, security and sensitive data
GeoIP may affect the first home-page redirect and the selected market chooses the marketing pixel. This has no legal or similarly significant effect. This website does not make such decisions based solely on automated processing.
Do not send diagnoses or detailed health information in free text unless necessary for an incident or legal claim. In an emergency call 112; the contact form is not an emergency channel.
We restrict access to people who need it and use appropriate technical and organisational measures, although no transmission or storage is risk-free.
8. Changes and contact
We update this policy when services, vendors or legal duties change and will communicate a material change appropriately.
Cookie details and controls are in our cookie policy.
Send questions and requests to pixxla.sauna@gmail.com.