Privacy policy

⚠ Draft for legal review. Written against the GDPR (Regulation (EU) 2016/679) and Czech Act 110/2019 Coll. on Personal Data Processing, but not reviewed by a lawyer. Fill in the details in square brackets — the controller’s identification above all — and have it reviewed before publishing.

Last updated: [DATE]

1. Who is the controller

• Operator: [REGISTERED BUSINESS NAME]
• Company number (IČO): [IČO]
• VAT number (DIČ): [DIČ, or “not VAT-registered”]
• Registered seat: [STREET, NUMBER, POSTCODE, PRAGUE]
• Email: [CONTACT EMAIL]
• Website: praguedolls.cz

[If a Data Protection Officer is appointed, name them here with their contact route. It is not mandatory for an activity of this size, but it is worth discussing with your adviser given the nature of the data handled.]

2. Our commitment: as little data as possible

This site is built on the data-minimisation principle (Article 5(1)(c) GDPR). We ask for nothing in order to browse: there are no user accounts, no newsletter, no profiling and no third-party tool watching you. We process personal data only when you decide to write to us, and only what we need in order to reply.

3. What we process, why, and on what legal basis

3.1. Enquiries and booking requests

• Data: the name or alias you choose to give, one contact route (email, phone or messaging) and the content of your message, including the district or hotel, the date and the kind of occasion.
• Purpose: to answer your enquiry, propose an option and coordinate the service requested.
• Legal basis: steps taken at your request prior to entering into a contract, and performance of that contract (Article 6(1)(b) GDPR).
• Retention: for the duration of the relationship and, afterwards, for the limitation periods applicable to contractual claims. If no booking follows, entries are deleted after 12 months, or sooner if you ask.

You may write to us under an alias. We do not verify your identity and we do not need it in order to help you.

3.2. Casting applications

• Data: name, age, a contact route, languages, the photographs you attach and the content of your application.
• Purpose: to assess your application and, where appropriate, invite you to meet us in person. Verifying that you are over 18 is an absolute requirement.
• Legal basis: your explicit consent (Article 6(1)(a) GDPR) and pre-contractual steps (Article 6(1)(b)).
• Retention: 6 months if there is no fit, after which the application is deleted along with the photographs. A declined application is deleted after 30 days. If we would like to keep it longer for future rounds, we will ask you separately.
• Your photographs are never published without specific, informed, written consent, which you can withdraw at any time.

3.3. Cookie consent log

• Data: date and time, the categories accepted, browser type and a truncated IP address (the final digits are removed, so it no longer identifies you).
• Purpose: to be able to demonstrate your decision to the supervisory authority.
• Legal basis: compliance with a legal obligation and the accountability principle (Articles 6(1)(c) and 5(2) GDPR).
• Retention: 12 months, deleted automatically.

3.4. Age verification

When you confirm that you are over 18, a cookie is stored in your browser with the date of that confirmation. Nothing is recorded on our servers and it is not linked to any person. Legal basis: our legitimate interest in restricting access to an adult audience (Article 6(1)(f) GDPR).

3.5. Server logs

Our hosting provider keeps access logs (IP address, date, resource requested) for security reasons and to diagnose incidents. Legal basis: legitimate interest in the security of the system (Article 6(1)(f)). Retention: [PROVIDER’S PERIOD, typically 30 days].

4. Special categories of data

We do not ask for and do not want any of the special categories in Article 9 GDPR — health, sexual orientation, beliefs, ethnic origin or membership of anything. Please do not include them in your messages. If any are volunteered regardless, they are deleted as soon as they are noticed.

5. Recipients

We do not pass your data to third parties, we do not sell it, and we do not use it for profiling or automated decision-making.

The only parties with access, as processors and under a contract meeting Article 28 GDPR, are the providers strictly needed to run the service: [HOSTING PROVIDER] and [EMAIL PROVIDER]. [Confirm that both store the data within the European Economic Area; if either transfers it outside, state the safeguard relied on here — standard contractual clauses or an adequacy decision.]

We would disclose data to anyone else only under a legal obligation, for example in response to a court order.

6. Your rights

You may exercise the rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and withdraw any consent you have given, by writing to [CONTACT EMAIL].

We reply within one month at the latest. We will not ask you to justify a deletion request and we will not try to talk you out of it.

If you believe we have not handled your request properly, you may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7 — uoou.gov.cz).

7. Security and confidentiality

The site is served entirely over an encrypted connection (HTTPS). We apply technical and organisational measures appropriate to the risk, access to enquiries is restricted to the people who have to handle them, and everyone with access is bound by a duty of confidentiality that outlives their relationship with us.

No communication over the internet is absolutely secure. If you would rather not put something in writing, leave it out of the form and mention it to our team through whichever channel you prefer.

8. Minors

This site is intended exclusively for adults aged 18 and over, and says so before any content is shown. We do not knowingly process data belonging to minors. If we find that a record belongs to someone under 18, it is deleted immediately.

9. Changes to this policy

Any change is published on this page with its update date. If a change materially affects how we handle your data, we will tell you through the contact route you have given us.