Privacy Policy (Ochrana osobných údajov)
This is a translation for your convenience. The Slovak version is legally binding.
Information under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) · version 1.0 · effective from [TO CONFIRM: publication date]
Operator (prevádzkovateľ): Alina Koroleva · place of business (miesto podnikania) Blatnická 1649/3, 831 02 Bratislava – Nové Mesto · Business ID (IČO) 56024461 · registered in the Trade Register (Živnostenský register) of the District Office Bratislava, No. 110-337740 · ARTIZO studio: Radlinského 27, 811 07 Bratislava – Staré Mesto · [email protected] · +421 951 589 817 · full operator details
1. Who processes your data
The controller (prevádzkovateľ) of your personal data is Alina Koroleva (details above). This policy covers the websites artizo.sk and artizokids.sk and all our services. For anything about your personal data, email us at [email protected] or call +421 951 589 817.
2. Data protection officer
We have not appointed a data protection officer (zodpovedná osoba) — the obligation under Article 37 GDPR does not apply to us. Please contact us directly.
3. What data we process and where it comes from
- Contact details: name, phone, email.
- Your enquiry: the text of your message and what you are interested in (course, age group, date).
- Contract details: the service, group, dates, attendance at lessons (for subscriptions and make-up lessons), payments.
- Invoicing details: name and address; for companies also the Business ID (IČO), Tax ID (DIČ) and VAT ID (IČ DPH).
- Children’s data: the child’s name and age; for the camp also the parents’ contacts and an emergency contact.
- Information about a child’s health: only for the camp, and only with your explicit written consent.
- Photos and videos: only with your consent.
- Technical data about visits to the website (section 5).
Most of the data comes directly from you. Some is given to us by someone else: a parent gives us the child’s data and the emergency contact, the buyer of a gift voucher gives us the recipient’s name, and a company gives us the list of team-building participants. We do not ask for birth numbers (rodné číslo).
4. What we use the data for, on what legal basis, and for how long
| Purpose | Legal basis | How long |
|---|---|---|
| Replying to your enquiry (form, WhatsApp, email, phone) | Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract | until the enquiry is dealt with |
| Keeping a record of enquiries in our internal chat, so that none is forgotten | Art. 6(1)(f) GDPR — legitimate interest in keeping track of enquiries | at most 12 months after the enquiry is dealt with |
| Signing up and performing the contract: lessons, subscriptions, workshops, camps, parties, vouchers | Art. 6(1)(b) GDPR — contract | for as long as the contract lasts |
| Establishing and defending legal claims | Art. 6(1)(f) GDPR — legitimate interest | 3 years after the contract ends (limitation period) |
| Invoices and tax records | Art. 6(1)(c) GDPR — legal obligation | [TO CONFIRM: 5 or 10 years, depending on how the books are kept] |
| Communicating with company representatives about corporate bookings | Art. 6(1)(f) GDPR — legitimate interest in communicating with the company you represent | during the cooperation and then until the limitation period ends |
| Photos and videos | Art. 6(1)(a) GDPR — consent; § 12 of the Civil Code (Občiansky zákonník) | until consent is withdrawn, [TO CONFIRM: at most X years after the last attendance] |
| Delivering and protecting the website | Art. 6(1)(f) GDPR — legitimate interest in a secure, working website | we don’t keep this data ourselves (section 5) |
In addition, for camps:
| Purpose | Legal basis | How long |
|---|---|---|
| Information about a child’s health | Art. 9(2)(a) GDPR — your explicit consent | until the end of the camp; [TO CONFIRM: how long we keep the record if a health incident happened at camp — question for a lawyer] |
| [TO CONFIRM: the list of children under § 24(5) of Act No. 355/2007 Coll. — include only if it applies to the studio (RÚVZ decision)] | Art. 6(1)(c) GDPR — legal obligation | at most 60 days after the child’s stay ends |
5. The form, the buttons and visits to the website
5.1 How the form works
The form helps you write your message. You then choose how to send it:
- on WhatsApp — your WhatsApp app opens with the message ready, and you send it yourself;
- by email — the message arrives in our mailbox [email protected] (Google Workspace).
When you submit the form, a copy of what you filled in (name, contact, the course or age group you chose, your message and the page you are writing from) passes through the website’s server (Cloudflare) to our private chat in the Telegram app. This is our record of enquiries. Only Alina Koroleva and people she designates, who are bound by confidentiality, have access to it.
The form has no consent box: we need the data to reply to you (section 4). Please don’t write any health information in the form.
5.2 The WhatsApp, phone and email buttons
These are plain links: they open your app, and you write to or call us directly. When you click one, we send only a note to the same chat saying which button it was, on which page and when. The note contains no name, number or anything else by which we could recognise you.
5.3 Technical data and visitor numbers
The websites run on Cloudflare’s infrastructure. On every visit, Cloudflare technically processes your IP address and browser data to deliver the website to you and protect it from attacks. We know our visitor numbers only from aggregate figures that Cloudflare counts on its servers; we use no cookies and no measuring script in your browser for this. We do not keep this technical data ourselves.
6. Photos, children and health data
6.1 Photos and videos
- We photograph and film people who can be recognised, and publish their photos, only with their consent — for children, with a parent’s consent.
- You give consent on a separate written form. Each way of publishing — the website, the studio’s Instagram and Facebook, printed materials, exhibitions, the parents’ group — has its own unticked box. On the form you also choose the scope (group shots only, portraits too, or no faces) and whether we show a name (none, or first name only).
- The form also covers consent to publish photos of the child’s artwork — these are the child’s own copyright works.
- We listen to the child’s view: from about 12, the child signs the form together with you; from 16, they sign it themselves.
- Taking part in lessons or the camp never depends on consent.
- You can withdraw consent at any time — by email or in person. We then remove the photos from the website and our social media without undue delay. Printed materials that have already been published cannot be recalled.
- Photos published on Instagram and Facebook are also processed by Meta (sections 7 and 8).
6.2 Children’s data
- A child is signed up by a parent or another legal guardian, who is the party to the contract.
- We process only what we need: the child’s name and age, and for the camp also the parents’ contacts and an emergency contact.
- For an enquiry we don’t need the child’s name — the age group is enough.
6.3 Health information at camp
- Allergies, medication and similar information belong to the special categories of personal data. We process them only for the camp and “Zimné dielničky”, and only with your explicit written consent (Art. 9(2)(a) GDPR), which you give on a separate camp form.
- Please don’t send this information to us on WhatsApp or through the forms on the website.
- Only the camp leader, who is bound by confidentiality, has access to it.
- We destroy it after the camp ends. [TO CONFIRM: how long we keep the record if a health incident happened at camp — question for a lawyer]
- You can withdraw your consent at any time.
7. Who else gets access to the data
- Cloudflare — hosting of the websites, and the server through which the copy of the form passes.
- Google (Google Workspace) — our email mailbox.
- Telegram — our internal chat with the record of enquiries.
- WhatsApp (Meta) — if you write to us on WhatsApp.
- Meta (Instagram, Facebook) — only photos you have agreed to publish.
- The technical administrator who runs the websites for us (processor).
- [TO CONFIRM: accountant or accounting firm, if any]
- Public authorities, where the law requires it (for example the tax administration or the regional public health authority, RÚVZ).
We do not sell data and do not use it for advertising.
8. Transfers outside the European Union
- Cloudflare, Google and Meta may also process data in the USA. These transfers rely on European Commission Decision (EU) 2023/1795 on the EU-US Data Privacy Framework, or otherwise on standard contractual clauses.
- Telegram: [TO CONFIRM: where Telegram processes the data and on what basis the transfer takes place — not yet assessed]
9. Do you have to give us your data?
- Without a contact we cannot reply to you, and without the details on the sign-up form we cannot accept a booking (a contractual requirement).
- Invoicing details are required by law.
- Consent to photos and to the processing of health information is voluntary.
10. Automated decision-making
We do not make automated decisions or use profiling.
11. Your rights
You have the right:
- to access the data we process about you;
- to have incorrect data corrected;
- to have your data erased;
- to restrict processing;
- to data portability;
- to withdraw consent at any time — this does not affect processing that took place before.
Email us at [email protected]. We will reply without undue delay, and within one month at the latest.
12. Right to object
You can object at any time to processing based on legitimate interest (Art. 6(1)(f) GDPR) — just email us at [email protected]. We will then stop the processing unless we can show compelling legitimate grounds, or need the data to establish or defend legal claims. We do not send marketing emails.
13. Complaints
If you think we are handling your data incorrectly, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, [email protected], dataprotection.gov.sk. We would, however, be glad to sort it out with you first.
14. Cookies
Our websites use no cookies. They only remember the language you chose. Details are in our Cookie Policy.
15. Changes
We update this policy when the way we process data changes. Every version is dated; we announce significant changes on the website and by email to our clients.
Questions about data protection
[email protected] · +421 951 589 817
Version history
- 1.0 — first version.