Privacy Policy
Data controller: Aleš Pavel (sole trader)
Business ID (IČO): 72803631
Registered address: Na hřebenech II 782/19, Podolí, 147 00 Prague 4, Czech Republic
E-mail: alespavel@gmail.com
Data mailbox (Czech): aatsxp9
1. Introduction
This Privacy Policy describes how Aleš Pavel, as operator of the Beautis SaaS platform (the "Operator", "we"), processes personal data in accordance with GDPR Regulation (EU) 2016/679 and applicable Czech data protection law.
We distinguish two roles: (a) the Operator as controller of data relating to customers (salons) who subscribe to Beautis; (b) the customer (salon) as controller of their own clients' data — in that relationship we act as processor under Article 28 GDPR.
2. Personal Data We Process About Customers (Salons)
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Identity & contact | Name, e-mail, phone number | Account management, communication, invoicing | Performance of contract (Art. 6(1)(b)) |
| Payment & billing | Bank transactions, variable symbols | Licence activation and renewal, accounting | Contract + legal obligation (Art. 6(1)(b)(c)) |
| Technical & login | IP address, login timestamps, JWT tokens | Security, authentication | Legitimate interest (Art. 6(1)(f)) |
3. Personal Data of Salon Clients (as Processor)
On the customer's (salon's) instructions, we process data that the salon enters about its own clients. This typically includes:
- First and last name
- Contact details (e-mail, phone number)
- Date of birth, gender
- Visit history, purchased services and products
- Membership credits and voucher balances
The salon is responsible for having a valid legal basis (consent, contract performance, etc.) for this processing. We process this data solely on the salon's instructions and do not share it with third parties without the salon's consent.
4. Recipients of Personal Data
We do not sell personal data. We share it only with:
- SMSAPI.cz — salon clients' phone numbers for sending SMS appointment reminders (on the salon's instructions).
- FIO Bank, a.s. — customer payment transactions for licence activation.
- Hosting provider — Coolify / infrastructure provider acting as a sub-processor; all databases are stored within the EU.
We have data processing agreements (Art. 28 GDPR) or rely on standard contractual clauses with all processors.
5. Retention Periods
| Data type | Retention period |
|---|---|
| Accounting and invoicing records | 10 years (statutory obligation) |
| Customer (salon) data in the system | Duration of agreement + 30 days after termination |
| Salon clients' data | As instructed by the salon (controller) |
| Technical logs (IP addresses, logins) | 90 days |
6. Your Rights
Customers (salons) have the following rights under GDPR regarding their own personal data:
- Right of access — obtain a copy of the personal data we hold about you.
- Right to rectification — correct inaccurate or incomplete data.
- Right to erasure — request deletion of data where there is no longer a lawful basis for processing.
- Right to restriction — restrict processing in circumstances provided by law.
- Right to data portability — receive your data in a machine-readable format.
- Right to object — object to processing based on legitimate interest.
To exercise your rights, contact us at alespavel@gmail.com. We will respond within 30 days.
You also have the right to lodge a complaint with the supervisory authority — the Office for Personal Data Protection (uoou.cz), or the data protection authority in your country of residence within the EU/EEA.
7. Cookies
The Beautis web application (fe.beautis.eu) uses only technically necessary cookies to maintain your session (JWT token stored in localStorage — no third-party tracking cookies). The information website beautis.eu does not use cookies.
8. Security
We implement appropriate technical and organisational measures to protect personal data, including:
- Encrypted communication (HTTPS/TLS)
- Password hashing (bcrypt)
- Tenant data isolation (multi-tenant architecture with salonId filtering)
- Regular database backups
9. International Transfers
All data is stored on servers within the European Union. We do not transfer personal data to third countries outside the EU/EEA without appropriate safeguards as required by GDPR.
10. Changes to This Policy
We may update this Privacy Policy at any time. For material changes, we will notify customers by e-mail or in-app notice. The current version is always available at beautis.eu.
11. Contact
For any questions regarding data protection, please contact us:
- E-mail: alespavel@gmail.com
- Data mailbox: aatsxp9
- Post: Aleš Pavel, Na hřebenech II 782/19, Podolí, 147 00 Prague 4, Czech Republic