Personal Data Processing Policy
For the purchase and redemption of gift vouchers
SMILLE DENTAL CLINIC s.r.o.
1. Introductory Information
These Personal Data Processing Policy explains how SMILLE DENTAL CLINIC s.r.o. processes the personal data of individuals who order, purchase or redeem electronic gift vouchers for dental hygiene and teeth whitening services through the website.
This policy applies in particular to the processing of personal data in connection with:
a) ordering a gift voucher,
b) online payment,
c) issuing and sending the electronic voucher,
d) recording the unique voucher code,
e) redeeming the voucher at the clinic,
f) any withdrawal from the contract, complaints or communication with the customer.
This policy applies solely to the processing of personal data in connection with gift vouchers. The processing of personal data in connection with the actual provision of healthcare services may be governed by separate documentation issued by the healthcare provider.
2. Data Controller
The data controller is:
SMILLE DENTAL CLINIC s.r.o.
registered address: Štefánikova 203/23, 150 00 Prague 5
Company reg. no.: 28434218
e-mail: info@smille.cz
tel.: 257 941 296
The controller determines the purposes and means of processing personal data in connection with the sale and redemption of gift vouchers.
3. What Personal Data We Process
In connection with the purchase and redemption of gift vouchers, we may process in particular the following personal data:
a) the buyer's name and surname,
b) the buyer's e-mail address,
c) phone number, if provided in the order or required for communication,
d) billing details, if required for the issuance of a receipt,
e) order data, in particular the type of voucher purchased, the order date, the voucher issue date and the voucher price,
f) the unique voucher code,
g) data on the status of the voucher, in particular whether it has been issued, sent, redeemed, invalidated or whether its validity has expired,
h) payment data to the extent necessary for payment identification, in particular information on whether the payment was successful,
i) the content of communication with the customer regarding the order, withdrawal from the contract, complaint or redemption of the voucher.
We do not process complete payment card data. Card payments are processed via a payment gateway and payment card data is processed by the relevant payment service provider.
4. Purposes and Legal Bases of Processing
We process personal data only to the extent necessary for the purposes set out below.
4.1. Order Fulfilment and Contract Performance
We process personal data for the purpose of:
a) accepting and confirming orders,
b) matching payments,
c) issuing the electronic gift voucher,
d) sending the voucher to the e-mail address provided in the order,
e) recording the validity and redemption of the voucher,
f) communicating with the customer regarding the order or redemption of the voucher.
The legal basis is the performance of a contract or steps taken prior to entering into a contract.
4.2. Compliance with Legal Obligations
We process certain personal data for the purpose of complying with statutory obligations, in particular in the areas of accounting, taxation and retention of tax documents.
The legal basis is compliance with a legal obligation.
4.3. Handling Complaints, Withdrawals and Protecting Legal Claims
We may also process personal data for the purposes of:
a) handling complaints,
b) processing withdrawals from contracts,
c) resolving complaints,
d) demonstrating compliance with contractual and statutory obligations,
e) protecting the controller's legal claims.
The legal basis is primarily the legitimate interest of the controller in protecting its rights and demonstrating proper fulfilment of obligations, or compliance with a legal obligation.
4.4. Technical Operation of the Website and Security
When using the website, technical data necessary for the operation of the website, security, prevention of misuse and the proper functioning of the ordering process may also be processed.
The legal basis may be the legitimate interest of the controller in the secure and functional operation of the website.
4.5. Marketing Communications
We will not use personal data obtained in connection with the purchase of a gift voucher for sending commercial communications unless we have an appropriate legal basis to do so, in particular consent or another lawful reason.
If a buyer grants consent to the sending of commercial communications, they may withdraw it at any time.
5. To Whom Personal Data May Be Disclosed
Personal data may be made accessible only to persons involved in fulfilling the purposes set out above, in particular:
a) web/e-commerce solution provider,
b) payment gateway provider,
c) e-mail and hosting services provider,
d) accounting, tax or legal services provider,
e) persons providing IT support and system security,
f) public authorities, where required by law.
We enter into appropriate data processing agreements with persons who process personal data on our behalf as processors.
6. Retention Period
We retain personal data only for as long as is necessary for the relevant purpose.
Personal data related to the order and voucher records are retained for the duration of the contractual relationship and subsequently for the period necessary to protect legal claims.
Data stated on accounting and tax documents are retained for the period required by applicable legislation.
Data relating to complaints, withdrawals or other communications are retained for the period necessary to handle the relevant request and subsequently for the period necessary to protect legal claims.
7. Processing of Data When a Voucher Is Redeemed at the Clinic
When a gift voucher is redeemed, we process primarily the unique voucher code and information as to whether the voucher was valid and has been redeemed.
If the holder of the voucher uses the service at the clinic, data may also be processed in connection with the actual provision of the service under healthcare documentation regulations. Such processing is not governed solely by this policy but also by legislation regulating the provision of healthcare services and the maintenance of healthcare records.
The gift voucher itself is not issued in the name of a specific individual. However, when it is redeemed, the holder of the voucher may be identified through the standard appointment and service provision process.
8. Cookies and Similar Technologies
The seller's website may use cookies or similar technologies.
Technical cookies necessary for the functioning of the website and the ordering process may be used without the user's consent, provided they are necessary for the delivery of the requested service.
Analytical, marketing or other non-essential cookies may only be used in accordance with applicable legislation, in particular on the basis of user consent where such consent is required.
More detailed information about cookies may be provided in a separate document or in the cookie settings bar on the website.
9. Rights of Data Subjects
In connection with the processing of personal data, you have in particular the following rights:
a) the right to information about the processing of personal data,
b) the right of access to personal data,
c) the right to rectification of inaccurate or incomplete data,
d) the right to erasure of personal data, where the statutory conditions are met,
e) the right to restriction of processing,
f) the right to data portability, where the statutory conditions are met,
g) the right to object to processing based on legitimate interests,
h) the right to withdraw consent, where processing is based on consent,
i) the right not to be subject to automated individual decision-making including profiling, where this occurs.
10. How to Exercise Your Rights
You may exercise your rights by e-mail at:
info@smille.cz
or in writing to:
SMILLE DENTAL CLINIC s.r.o.
Štefánikova 203/23
150 00 Prague 5
When processing your request, we may ask you to verify your identity if this is necessary to protect personal data and prevent unauthorised disclosure.
11. Right to Lodge a Complaint
If you believe that we are processing your personal data in breach of applicable legislation, you have the right to lodge a complaint with the supervisory authority.
The supervisory authority in the Czech Republic is:
Office for Personal Data Protection
Pplk. Sochora 27
170 00 Prague 7
web: www.uoou.cz
12. Automated Decision-Making and Profiling
In connection with the purchase and redemption of gift vouchers, no automated individual decision-making takes place that would have legal effects on you or similarly significantly affect you.
We do not use personal data for profiling for the purposes of automated decision-making.
13. Transfer of Personal Data Outside the European Union
We process personal data primarily within the European Union or the European Economic Area.
If personal data is transferred outside the European Union or European Economic Area in connection with the technical services used, such transfer will be carried out only under the conditions set out in the GDPR, in particular on the basis of appropriate safeguards.
14. Security of Personal Data
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or unauthorised disclosure.
Access to personal data is granted only to persons who need it to fulfil their work or contractual obligations.
15. Changes to This Policy
This policy may be updated, in particular in the event of changes to legislation, changes to the technical solution of the website or changes to the manner of selling and recording gift vouchers.
The current version of the policy will always be available on the controller's website.
This policy is effective from 1 June 2026.