Your privacy matters to us. This policy explains in plain language what personal data we process about you, for what purpose, how long we keep it and what rights you have.
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the “GDPR”) and applicable data protection legislation.
Last updated: 14 August 20261. Data controller
The controller who determines the purposes and means of processing your personal data is:
- Peter Mačej
- Registered address: č. p. 206, 747 67 Hrabyně, Czech Republic
- Company ID (IČO): 24063339 | VAT ID (DIČ): CZ9502211697
- Sole trader registered in the Czech Trade Licensing Register
- E-mail: info@melmophysio.com
- Phone: +421 918 843 620
- Website: melmophysio.com
If you have any question regarding the processing of your personal data, you can contact us at the e-mail address above.
2. What data we process and why
We always process personal data for a specific, predetermined purpose and only to the extent necessary:
| Purpose of processing | Personal data processed | Legal basis | Retention period |
|---|---|---|---|
| Registration and management of a user account | First and last name, e-mail, username, password (stored encrypted), IP address | Performance of a contract (Art. 6(1)(b) GDPR) | For as long as the account exists, until its deletion |
| Providing access to purchased online courses and tracking progress | Account identification data, list of purchased courses, lesson progress | Performance of a contract (Art. 6(1)(b) GDPR) | For as long as the account exists, until its deletion |
| Processing orders and payments | First and last name, e-mail, billing details, order and payment data | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the contractual relationship |
| Bookkeeping and compliance with tax obligations | Billing and payment data, accounting documents | Legal obligation (Art. 6(1)(c) GDPR) | 10 years from the end of the accounting period |
| Communication and answering your enquiries | First and last name, e-mail, phone, message content, IP address | Consent of the data subject (Art. 6(1)(a) GDPR) | Until consent is withdrawn, max. 3 years |
| Sending news and marketing communications | First and last name, e-mail | Consent of the data subject (Art. 6(1)(a) GDPR) | Until consent is withdrawn |
| Website statistics and service improvement | IP address, device and browser data, on-site behaviour | Consent of the data subject – cookies (Art. 6(1)(a) GDPR) | Until consent is withdrawn, per cookie lifetime |
| Website security and protection | IP address, access logs | Legitimate interest (Art. 6(1)(f) GDPR) | Max. 12 months |
| Welcome questionnaire – goals, experience and motivation | Answers about motivation, sporting activity, level of experience and goals | Consent (Art. 6(1)(a) GDPR) | Until the user deletes the answers or closes the account |
| Welcome questionnaire – assessing health limitations and tailoring recommendations | Health data (health limitations, injuries, chronic pain) – a special category of personal data | Explicit consent (Art. 9(2)(a) GDPR) | Until consent is withdrawn or the answers deleted, at the latest when the account is closed |
Providing personal data for the performance of a contract and for statutory obligations is necessary – without it we cannot create your account, give you access to the courses or issue a tax document. Providing data on the basis of consent is always voluntary and you may withdraw your consent at any time.
3. Cookies
Our website uses cookies that help us ensure it works correctly (e.g. account login, cart contents, language selection) and, with your consent, also to measure traffic.
You can change your cookie settings at any time in the consent bar or directly in your browser. Detailed information is available in our separate Cookie Notice.
4. Who we share your data with
We do not sell or rent your personal data. We share it only with vetted service providers (processors) who enable us to run the website and deliver our services, and always only to the extent necessary for the given purpose:
- Web hosting provider – operation of the website and data storage
- Payment gateway provider (Stripe) – processing of online payments. You enter your card details directly in the provider's secure interface and we have no access to them.
- Video platform provider (Vimeo) – playback of course video content
- E-mail and analytics providers – e-mail delivery and traffic measurement
- Accounting office – processing of accounting documents
We may also disclose personal data to public authorities where required by law or on the basis of a court decision. If the business is transferred to another person, the data passes to the legal successor, who is bound by the same obligations.
5. Transfers outside the EU
Some of our service providers may process data outside the European Economic Area. In such cases the transfer is safeguarded in accordance with the GDPR – on the basis of a European Commission adequacy decision or standard contractual clauses.
6. Data security
We have implemented appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access or disclosure. The website is secured with an encrypted connection (SSL/HTTPS), passwords are stored exclusively in encrypted form and access to data is limited to authorised persons. We review the measures in place regularly.
7. Links to other websites
Our website may contain links to third-party websites. This policy does not apply to them and we accept no responsibility for their content or for how they handle personal data. We recommend that you review their own privacy policies.
8. Your rights
In relation to your personal data, you have the following rights under the GDPR:
- Right of accessYou have the right to know whether and what personal data we process about you, and to obtain a copy of it.
- Right to rectificationIf your data is inaccurate or incomplete, you have the right to have it corrected or completed.
- Right to erasure (“right to be forgotten”)You may request erasure of your data if it is no longer necessary for the purpose for which it was collected, or if you withdraw your consent.
- Right to restriction of processingYou have the right to ask us to temporarily restrict the processing of your data.
- Right to data portabilityYou have the right to receive your data in a structured, commonly used and machine-readable format.
- Right to objectYou have the right to object to processing based on legitimate interest, as well as to direct marketing.
- Right to withdraw consentWhere we process data based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
You can exercise your rights by e-mail at info@melmophysio.com. We will respond to your request no later than one month from its receipt.
9. Supervisory authority
If you believe that we process your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
Website: www.uoou.cz
We would, however, appreciate it if you contacted us directly first – we can resolve most matters quickly and to your satisfaction.
10. Changes to this policy
We may update this privacy policy from time to time, for example when our services or the applicable legislation change. The current version is always published on this page together with the date of the last update. We recommend that you review it occasionally.
