---
title: Emily Booking Privacy Policy
description: Emily Booking is an online booking system for nail and beauty salons. We are run from Zlín, Czech Republic. Emily Booking is operated by Tranquila casa.
---

[Skip to content](https://emilybooking.cz/privacy-policy#main-content)

[![](https://emilybooking.cz/hubfs/Emily%20Booking/logo-mark.svg) EmilyBooking](https://emilybooking.cz/?hsLang=en)

[Features](https://emilybooking.cz/#features) [How it works](https://emilybooking.cz/#process) [Pricing](https://emilybooking.cz/#pricing) [FAQ](https://emilybooking.cz/#faq)

EN

- EN English
- [CZ Čeština](https://emilybooking.cz/cs/privacy-policy)
- [VN Tiếng Việt](https://emilybooking.cz/vi/privacy-policy)

[Start free](https://emilybooking.cz/register?hsLang=en)

# Privacy Policy

**Emily Booking** · Effective from: 17 October 2026 · Version 1.0

> **Language note:** The Czech version of this document is the only legally binding version. This English text is a translation for your convenience and may contain errors. If the versions differ, the Czech version prevails.

## At a glance

- Emily Booking is an online booking system for businesses that take bookings and appointments, such as salons, studios, clinics, coaches and instructors. We are run from Zlín, Czech Republic.
- Emily Booking is operated by **Tranquila casa s.r.o.**, Zlín (details in section 2).
- **For business owners and website visitors, we are the controller.** This policy explains what we do with your data.
- **For the clients of a business, the business is the controller and we are its processor.** When you book an appointment with a business, the business decides how your data is used. We store and process it only on the business's instructions. Please read the business's own privacy notice, and send requests about your booking to the business.
- We do not sell personal data. We do not show advertising. We do not use booking data for marketing.
- Our servers and database are in the European Union (Google Cloud, Belgium).
- Contact: [dalibor.selucky.tc@gmail.com](mailto:dalibor.selucky.tc@gmail.com) with "Privacy" in the subject line.

## 1. About this policy

This policy explains how we collect and use personal data when you:

- visit our website;
- register a business or use the staff app as a business owner or staff member;
- contact us; or
- book an appointment through a booking page powered by Emily Booking (see section 9).

It follows the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), Czech Act No. 110/2019 Coll. on the Processing of Personal Data, and Czech Act No. 127/2005 Coll. on Electronic Communications (for cookies and similar technologies). Our separate [Cookie Policy](https://emilybooking.cz/cookie-policy?hsLang=en) gives details about cookies and browser storage.

## 2. Who we are

- **Controller:** Tranquila casa s.r.o., registered office Česká 4754, 760 05 Zlín, Czech Republic
- **Company ID (IČO):** 04976207 · **VAT ID (DIČ):** CZ04976207
- **Registered** in the Commercial Register kept by the Regional Court in Brno, section C, file 92883
- **Email:** [dalibor.selucky.tc@gmail.com](mailto:dalibor.selucky.tc@gmail.com)
- **Website:** [emilybooking.cz](https://emilybooking.cz?hsLang=en)

We have not appointed a Data Protection Officer, because the law does not require one for our activities. We may ask you to confirm your identity before we act on a request about your data.

## 3. Data we collect

### 3.1 Business owners and staff (our customers)

- **Account data:** business name, your name, email address and password. Passwords are handled by Google Firebase Authentication. We never see or store them in readable form.
- **Business settings:** services, prices, durations, opening hours, capacity, breaks, staff names, staff roles, language and the email address the business uses for client replies.
- **Usage and security records:** log-in times, an audit log of changes (who changed which booking or setting, and when), and technical logs such as IP address, browser and error messages.
- **Communication:** messages you send us and our replies.

### 3.2 Website visitors

- **Technical data** sent by every browser: IP address, browser type, device, pages requested, date and time. It is processed by our hosting providers to deliver and protect the site.
- **Your language choice**, stored in your own browser (not in a cookie, see the Cookie Policy).
- **Analytics data**, only if you consent and only if analytics is switched on (see the Cookie Policy).

### 3.3 Clients of businesses (processed for the business)

When a client books through a business's booking page, or the business's staff enter a booking, we process on the business's behalf: first name and last name, phone number, email address (optional), preferred language, the booked services, date, time and price, booking history, the status of each booking (confirmed, moved, cancelled, no-show), and any private notes the business's staff write. Section 9 explains our role.

We ask businesses **not** to record health information (for example allergies, skin conditions or other medical details) in notes unless the client gave it for the service and the business has a legal basis for it.

## 4. Where the data comes from

- From you, when you register, use the app, book or contact us.
- From the business, for its clients' bookings that its staff enter by hand.
- Automatically, from your browser and our security systems.

## 5. Why we use the data, and our legal basis

| Purpose | Data | Legal basis (GDPR Art. 6(1)) |
| --- | --- | --- |
| Creating and running business accounts, signing in, confirming email addresses | Account data, business settings | (b) contract |
| Providing the booking system and the staff app | Business settings, usage records | (b) contract |
| Sending service emails to business owners (account confirmation, password reset, important notices) | Email, name | (b) contract |
| Security, preventing abuse and spam, fixing errors | Technical logs, audit log | (f) legitimate interest in a safe, working service |
| Answering questions and support requests | Communication | (b) contract, or (f) legitimate interest for general enquiries |
| Keeping accounting and tax records (once the service is paid) | Billing data | (c) legal obligation |
| Establishing or defending legal claims | Relevant records | (f) legitimate interest |
| Website analytics (if switched on) | Analytics data | (a) consent |
| Remembering your language | Language choice in your browser | Needed for the feature you asked for (see the Cookie Policy) |

Where we rely on legitimate interest, we have weighed it against your rights. You can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time. This does not affect processing that already happened.

If you do not give us the data needed to register, we cannot create your business account.

We do not use your data for decisions based solely on automated processing that have legal or similarly significant effects on you. Spam protection (for example a hidden form field) may block a submission, but it never decides anything else about you.

## 6. Who receives the data

We share data only as needed to run the service, and only with providers bound by data processing agreements:

| Provider | What they do | Where |
| --- | --- | --- |
| Google Cloud / Firebase (Google Cloud EMEA Ltd / Google Ireland Ltd, Ireland) | Hosting, database (Firestore), server functions, sign-in (Firebase Authentication) | Database and functions in the EU (Belgium, europe-west1). Sign-in and the content delivery network may process data globally. |
| Resend (Resend, Inc., USA) | Sending booking and account emails | EU sending region (Ireland); company and account data in the USA |
| HubSpot (HubSpot, Inc., USA / HubSpot Ireland Ltd) | Hosting of our website or the websites of businesses. Optional sync of a business's clients into the business's own HubSpot CRM, only if the business switches it on. | EU and USA |
| Google Fonts (Google Ireland Ltd) | Delivering the fonts used on our website | Global. Your browser connects to Google's servers. |

We may also disclose data to advisers (lawyers, accountants), to courts, police or public authorities where the law requires it, or to a buyer or successor of our business under equivalent safeguards.

## 7. Transfers outside the EU

Some providers (Resend, HubSpot, parts of Google) are based in the USA or may process data there. These transfers are covered by the EU–US Data Privacy Framework, under which these providers are certified, supplemented by the European Commission's Standard Contractual Clauses in their data processing agreements and by technical measures such as encryption in transit. You can ask us for a copy of the relevant safeguards.

## 8. How long we keep data

| Data | Retention |
| --- | --- |
| Business account and settings | While the account is active, then 2 years after the account is closed. |
| Registrations that were never confirmed | 2 years. |
| Bookings of business clients and staff notes | 2 years after the client's last visit, then deleted or anonymised, unless the business sets a shorter period or deletes them earlier. |
| Cancelled bookings and no-shows | 6 months. |
| Audit log of changes | 2 years. |
| Technical and security logs | 7 days, longer only while investigating an incident. |
| Email delivery logs at our email provider | According to the provider's log settings, no longer than 2 years. |
| Support messages | 2 years after the last contact. |
| Accounting records (once the service is paid) | 10 years, as Czech tax law requires. |
| Analytics data (if switched on) | No longer than 14 months. |

When a period ends, we delete the data or make it truly anonymous.

## 9. Booking with a business: our role as processor

If you book an appointment with a business that uses Emily Booking:

- **The business is the controller** of your booking data. It decides why and how your data is used, for example to manage your appointment, contact you about it, or keep its own client records.
- **Emily Booking is the processor.** We store and process your data only to provide the booking system to the business and on its documented instructions, under a data processing agreement (GDPR Art. 28). We do not use your booking data for our own purposes.
- You receive service emails about **your booking** (confirmation, change, cancellation, reminder) in the language you chose. These are not marketing. Each email contains a "Manage booking" link that lets you cancel or reschedule within the business's rules.
- **For questions or to use your rights** (access, correction, deletion and so on), please contact the business. If you contact us instead, we will pass your request to the business and help it respond.

## 10. Security

We protect personal data with appropriate technical and organisational measures. These include:

- encrypted connections (HTTPS) and encryption at rest by our hosting provider;
- a separate login for every business, so each business sees only its own data;
- a database that browsers can never read directly, because all access goes through our checked server code;
- staff app pages that cannot be embedded in other sites, plus strict content security rules;
- secrets kept in a secret manager and never in the code;
- the fewest possible people with access.

No system is completely secure. If a breach is likely to put your rights at risk, we report it to the Czech data protection authority (ÚOOÚ) without undue delay and, where feasible, within 72 hours. If the risk is high, we also tell the people affected. For data about a business's clients, we inform the business without undue delay so that it can meet its own duties.

## 11. Your rights

Under the GDPR you have the right to:

- **be informed** about how your data is used (this policy);
- **access** your data and receive a copy;
- **rectification** of inaccurate or incomplete data;
- **erasure** ("right to be forgotten") in certain cases;
- **restriction** of processing in certain cases;
- **object** to processing based on legitimate interest;
- **data portability**: receive the data you gave us in a common machine-readable format, where processing is based on contract or consent;
- **withdraw consent** at any time, where we rely on consent;
- **lodge a complaint** with a supervisory authority (section 12).

**How to make a request:** email [dalibor.selucky.tc@gmail.com](mailto:dalibor.selucky.tc@gmail.com). We answer within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you why within the first month. Requests are free. Only for manifestly unfounded or excessive requests may we charge a reasonable fee or refuse. Some rights have legal limits, for example where other people's rights are affected or where we must keep records by law. If so, we explain why.

Business owners can see and correct most of their data directly in the staff app. For a full copy of your data, email us.

## 12. Complaints

Please contact us first at [dalibor.selucky.tc@gmail.com](mailto:dalibor.selucky.tc@gmail.com). We will try to resolve your concern quickly.

You also have the right to complain to a supervisory authority at any time, in particular in the EU country where you live or work, or where the alleged breach happened. In the Czech Republic this is:

**Úřad pro ochranu osobních údajů (ÚOOÚ)**, Pplk. Sochora 27, 170 00 Praha 7, [www.uoou.gov.cz](https://uoou.gov.cz).

Clients and users in other EU countries can also contact the data protection authority of their own country.

## 13. Children

Emily Booking is a tool for businesses. Business accounts may only be created by adults. Booking pages are meant for adults or for bookings made by a parent or guardian. We do not knowingly collect data from children under 15 (the age of digital consent in the Czech Republic) without parental involvement.

## 14. Changes to this policy

We update this policy when our service, providers or legal obligations change. The current version and its effective date are always on this page. If a change materially affects how we use existing data, we will tell business owners by email in advance. Where the law requires it, we will ask for consent again.

[![](https://emilybooking.cz/hubfs/Emily%20Booking/logo-mark.svg) EmilyBooking](https://emilybooking.cz/?hsLang=en)

Online booking for businesses that work with appointments. Your page, your clients, no commission.

 All systems running

Product

- [Features](https://emilybooking.cz/#features)
- [How it works](https://emilybooking.cz/#process)
- [Pricing](https://emilybooking.cz/#pricing)
- [FAQ](https://emilybooking.cz/#faq)

Account

- [Create account](https://emilybooking.cz/register?hsLang=en)
- [Log in](https://emilybooking.cz/login?hsLang=en)

Legal

- [Privacy](https://emilybooking.cz/privacy-policy?hsLang=en)
- [Cookies](https://emilybooking.cz/cookie-policy?hsLang=en)
- [Terms](https://emilybooking.cz/terms-of-use?hsLang=en)

 © 2026 Emily Booking. From Zlín, with Love ♥

CZ · EN · VN