Document
Privacy notice
What personal data I process, what I use it for, and what your rights are.
Who works with your data
Controller
NýRao s. r. o., Jahodová 3199/11, 900 28 Ivanka pri Dunaji, Slovakia, Company No.: 55 341 349, Tax No.: 2121948103, entered in the Commercial Register of the Bratislava III City Court, section Sro, insert no. 168140/B.
Contact for data protection matters: gabi@wholeyoubygabi.sk, +421 908 107 122.
The controller is not required to appoint a data protection officer, so please bring anything and everything to Gabi directly.
Processing is governed by Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on personal data protection.
What data, and what for
Booking a class — name, e-mail, phone, the chosen date. Without them we can’t put you on the list or let you know if a class moves. Legal basis: performance of a contract.
Orders and your account — name, e-mail, phone, billing and delivery address, order contents, payment method, purchase history and unlocked content. Legal basis: performance of a contract; for accounting records, compliance with a legal obligation.
Contact form — name, e-mail, and where given a phone number and your message. Legal basis: legitimate interest in answering your question, or steps taken before entering into a contract.
Health information in pregnancy and private practice. If you tell us yourself what should be taken into account during a class — the week of pregnancy, an injury, a diagnosis — that is a special category of data. We process it only with your explicit consent, use it solely to run the class safely, and share it with no one. You can withdraw your consent at any time; you don’t have to give it at all.
Running the site — IP address, browser type and access records in the server logs, plus protection of forms against spam. Legal basis: legitimate interest in the security and functioning of the site.
We do not profile you and we make no automated decisions that would have a legal effect on you.
How long we keep it
- Accounting records — 10 years, as required by the Accounting Act.
- Order and account data — for as long as the account exists, and 3 years after the last order (the limitation period for any claims).
- Class bookings — 1 year after the class took place.
- Contact form messages — 1 year after they are dealt with.
- Health information — until consent is withdrawn, at most 1 year after the last class.
- Server logs — for as long as the hosting provider keeps them, usually a few months.
Who your data reaches
We don’t sell data and we don’t give it to anyone for marketing. It is handled only by those without whom the site wouldn’t work — each of them bound by a data processing agreement and by confidentiality:
- WebSupport s. r. o. — hosting, database and mail server (Slovakia).
- creona, s. r. o., Ku Bratke 1, 934 01 Levice, Company No.: 47 457 589 — technical operator of the site; in the course of development and support it may have access to data in the system.
- Payment service provider — for card or bank payments. We never see or store card details; they stay with the payment gateway and the bank.
- Courier company — name, address and phone, only if you had goods delivered.
- External booking system — where a particular class is booked through a third-party system (LimeClock), that system’s terms also apply to the booking. This is always stated with the class in question.
- Our accountant and, in justified cases, public authorities where the law requires it.
We do not transfer data outside the European Economic Area.
Cookies
The site stores in your browser only what it needs to work. These are what’s known as strictly necessary cookies, and the law doesn’t require consent for them — it requires that you know about them. So here they are:
- Signing in (
wordpress_logged_in_…,wp-settings-…) — so you stay signed in to My space. Set only if you sign in. - Basket and order (
woocommerce_cart_hash,woocommerce_items_in_cart,wp_woocommerce_session_…) — so the basket isn’t lost between pages. Set only once you put something in it. - Form protection — tells a person from a bot flooding the site with spam.
- Your choice on the cookie notice (
wy_cookies) — so the notice doesn’t appear every time. Valid for 12 months.
What you won’t find here: no analytics, no advertising pixels, no third-party tracking scripts. We don’t measure where you came from or where you go next.
The site also hosts its own typefaces — they aren’t loaded from Google Fonts, so your IP address isn’t sent to the United States every time a page opens. The same goes for avatars and emoji images, which WordPress normally fetches from elsewhere; we’ve switched both off. So nothing leaves for a third party when a page loads.
The one exception: when you click a link that leads away — to Instagram, to a map, or to a booking in the LimeClock system — someone else’s site opens and their rules apply from then on.
You can delete or block cookies at any time in your browser settings. Signing in and the basket won’t work once you block them.
Your rights
In relation to your data you have the right:
- to know whether and what data we process about you, and to receive a copy,
- to correct it when it’s wrong,
- to have it erased when it’s no longer needed and no legal obligation holds it,
- to restrict processing or to object to it where it rests on legitimate interest,
- to receive it in a portable format and take it elsewhere,
- to withdraw consent where processing rests on consent — withdrawal doesn’t affect what happened before.
Write to gabi@wholeyoubygabi.sk. We reply within one month; if it turns out to be more involved, we’ll let you know and extend that by at most two further months.
If you feel your data isn’t being handled properly, you can complain to the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, statny.dozor@pdp.gov.sk.
Security
The site runs solely over an encrypted HTTPS connection. Access to the administration is limited to a small circle of people and protected by separate passwords. Videos are stored outside the public part of the server and played through a signed link with limited validity, so they can’t be reached by anyone without access.
This notice is valid and effective from 9 September 2026. If we change it, the new version will always be at this address. It is a translation of the Slovak original; in the event of any discrepancy, the Slovak version prevails.