1. Who we are
The controller of your personal data is Morovid s.r.o., with its registered office at Kurzova 2222/16, 155 00 Praha, company identification number (IČO) 21762261, VAT identification number (DIČ) CZ21762261, registered in the Commercial Register maintained by Městský soud v Praze, represented by its managing director Jan Malčák.
For any question about this policy or your personal data, contact us at privacy@retunk.com.
2. Scope of this policy
This policy applies to our marketing website (retunk.com and retunk.cz), the owner administration application (retunk.app), salon websites published through our platform, and our application programming interface.
It does not apply to third-party services that you access separately, even where we link to them. Those services are governed by their own privacy policies.
3. Personal data we process
Depending on how you use Retunk, we may process the following categories of personal data:
| Category | Examples |
|---|---|
| Account and identity data | Name, email address, password (stored in hashed form), phone number, role within a salon. |
| Organisation data | Salon name, address, opening hours, services, staff, branding and custom domain. |
| Booking and customer data | Names, contact details, appointment history, notes and preferences of a salon's own clients, entered by the salon or its customers. |
| Payment data | Transaction identifiers, amounts, currency, status and the last digits of a payment card. Full card numbers are handled by our payment provider, not by us. |
| Communications data | Emails and SMS messages we send on behalf of a salon (for example booking confirmations and reminders), and support conversations with you. |
| Technical and usage data | IP address, device and browser type, timestamps, requested pages and aggregate, non-identifying usage statistics. |
4. When we are a controller and when we are a processor
For personal data relating to salon owners and their staff (account holders), we act as the data controller and determine why and how that data is processed.
For personal data relating to a salon's own clients, the salon is the controller and we act as a processor, processing that data only on the salon's documented instructions. That processing is governed by our Data Processing Agreement, which forms part of our Terms of Service.
If you are a client of a salon and wish to exercise your data protection rights over an appointment, note or preference held about you, please contact the salon first. We will support the salon in responding.
5. Why we process data and our legal bases
| Purpose | Legal basis |
|---|---|
| Providing and operating Retunk, including bookings, reminders and published websites | Performance of a contract (Art. 6(1)(b) GDPR) |
| Creating and administering your account and providing support | Performance of a contract (Art. 6(1)(b) GDPR) |
| Billing, invoicing and accounting | Performance of a contract and legal obligation (Art. 6(1)(b) and (c) GDPR) |
| Keeping the service secure, preventing fraud and abuse | Legitimate interests (Art. 6(1)(f) GDPR) |
| Understanding how the service is used and improving it | Legitimate interests, or consent where required (Art. 6(1)(f) or (a) GDPR) |
| Sending product updates and commercial communications | Consent or legitimate interests (Art. 6(1)(a) or (f) GDPR) |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f) GDPR) |
Where we rely on legitimate interests, we have carried out a balancing test and concluded that our interests do not override your rights. You may object at any time — see section 11.
8. International transfers
We host the service primarily within the European Economic Area. Some of our providers are established in or may access data from outside the EEA, in particular the United States.
Where personal data is transferred outside the EEA, we rely on appropriate safeguards under Chapter V GDPR — an adequacy decision, the European Commission's Standard Contractual Clauses and, where relevant, the EU–U.S. Data Privacy Framework. You may ask us for a copy of the relevant safeguards at the contact address above.
9. How long we keep data
We keep personal data only for as long as we need it for the purposes described above, or as required by law:
| Data | Retention period |
|---|---|
| Account and organisation data | For as long as the account exists, then deleted within 30 days of account closure. |
| Booking and customer data | As instructed by the salon; deleted or returned in line with our Data Processing Agreement when the salon leaves. |
| Server and access logs | 30 days. |
| Backups | Rotated and permanently deleted within 90 days. |
| Invoices and accounting records | 10 years, as required by Czech accounting and tax law. |
| Support conversations | Up to 3 years after the last exchange. |
| Marketing consent records | Until you withdraw consent, plus 3 years to demonstrate compliance. |
10. How we protect data
We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS), encryption at rest, access controls based on least privilege, logging and monitoring, secure development practices, and regular review of our providers. If a personal data breach occurs that is likely to affect you, we will notify the relevant authority and, where required, you, without undue delay.
11. Your rights
Subject to the conditions in the GDPR, you have the right to:
- access the personal data we hold about you and obtain a copy;
- have inaccurate or incomplete data corrected;
- have your data erased ("right to be forgotten");
- restrict how we process your data;
- receive your data in a portable, machine-readable format or have it transmitted to another controller;
- object to processing based on our legitimate interests, including profiling;
- withdraw any consent you have given at any time, without affecting the lawfulness of processing before withdrawal; and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
To exercise any of these rights, email us at the contact address above. We will respond within one month, and may ask you to verify your identity.
Separately, you have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Olšanská 3, 130 00 Praha 3, uoou.cz) or with the supervisory authority in your country of residence.
12. Children
Retunk is a business tool intended for adults. Accounts may only be created by persons aged 18 or over, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time, for example to reflect new features or legal requirements. We will post the revised version on this page and update the date at the top. Where changes are significant, we will notify account holders by email or in the application.
14. Contact
Morovid s.r.o., Kurzova 2222/16, 155 00 Praha, IČO 21762261, DIČ CZ21762261. Email: privacy@retunk.com.