GDPR
Privacy Policy
Personal Data Protection and GDPR
Your privacy matters to me. Whether you visit my website, book a therapy session, attend a workshop, enrol in an online course, or subscribe to my newsletter, I am committed to protecting your personal information and handling it responsibly.
This Privacy Policy explains what personal data I collect, why I process it, how it is protected, and what rights you have under the General Data Protection Regulation (GDPR).
1. Data Controller
The controller responsible for processing your personal data is:
Karolína Molinari
Business ID (IČO): 66482259
Registered address: Votavova 323/14, 190 14 Prague 9 – Klánovice, Czech Republic
Email: karolina@samatastudio.cz
Website: www.karolinamolinari.cz
Hereinafter referred to as the “Data Controller” or “I”.
As the Data Controller, I determine the purposes and means of processing your personal data and take appropriate measures to protect it in accordance with applicable data protection legislation.
2. What Personal Data I Collect
Depending on how you interact with my services, I may process the following categories of personal data:
Identification and contact details: Name, email address, telephone number, and billing address.
Booking and purchase information: Reservations, purchased services, workshop registrations, online course enrolments, payment status, and communication relating to your bookings.
Health-related information: Relevant health conditions, contraindications, physical or emotional concerns, and other information you voluntarily provide through intake forms or consultations.
Communication records: Messages and enquiries submitted through contact forms or email.
Marketing information: Newsletter subscriptions, consent preferences, and interactions with marketing emails.
Technical information: IP address, browser information, website usage data, and cookies, where applicable.
I collect only the information reasonably necessary for the relevant purpose.
3. Purposes and Legal Bases for Processing
Your personal data is processed for the following purposes:
Providing Therapies, Workshops, and Online Courses
I process your identification, contact, and booking information to arrange and provide individual therapy sessions, breathwork experiences, workshops, and online educational programmes.
Legal basis: Performance of a contract or steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
Health Information and Intake Forms
Certain services may require information about your health, medical history, contraindications, or emotional well-being to help assess the suitability and safety of the practices offered.
Health-related information is treated as a special category of personal data under the GDPR.
Where explicit consent is the applicable legal basis, I request it separately before processing such information, in accordance with Article 9(2)(a) GDPR.
You are not required to disclose information unrelated to the safety or suitability of the service. However, without essential safety information, I may be unable to provide a particular service.
Health-related information is not used for advertising or marketing purposes.
Payments, Invoicing, and Accounting
I process billing and transaction information to issue invoices, maintain accounting records, and comply with tax and other legal obligations.
Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR).
Communication and Customer Support
I process your contact details and correspondence to respond to enquiries, manage reservations, and communicate about services.
Legal basis: Performance of a contract, pre-contractual steps, or legitimate interests, depending on the nature of the communication (Article 6(1)(b) or (f) GDPR).
Newsletters and Marketing Communications
If you subscribe to my newsletter, I process your name and email address to send information about workshops, courses, therapies, and related content.
Legal basis: Consent (Article 6(1)(a) GDPR).
If you are an existing customer, I may also send information about my own similar services where permitted by Czech law, provided that you have been given an opportunity to opt out.
You can unsubscribe at any time using the link included in each marketing email.
Website Analytics and Advertising
Where applicable, I may process technical and usage data to understand website performance, improve the user experience, and measure advertising effectiveness.
Non-essential cookies and similar tracking technologies are used only after the required consent has been obtained.
4. Health Information and Confidentiality
My work may involve personal information relating to physical health, emotional experiences, stress, trauma, or other sensitive matters.
I recognise the particularly sensitive nature of this information.
Health-related data is:
Collected only when relevant to the services provided.
Accessible only to authorised persons who need it for a legitimate purpose.
Protected by appropriate technical and organisational security measures.
Not shared with third parties for advertising or unrelated commercial purposes.
Retained only for as long as necessary under the applicable legal basis and retention requirements.
Information shared during individual sessions is treated confidentially, subject to applicable legal obligations.
5. How Long Personal Data Is Retained
Personal data is retained only for as long as necessary for the purpose for which it was collected or for the period required by applicable law.
Retention depends on the category of information:
Booking and service records: For the period necessary to provide the service and subsequently to address legitimate legal claims, where applicable.
Accounting and tax records: For the periods required by Czech accounting and tax legislation.
Health-related intake information: For the period necessary for the relevant service and any further period supported by an applicable legal basis.
Newsletter subscriptions: Until you withdraw your consent or the information is no longer needed for the stated purpose.
Website analytics and cookies: According to the applicable cookie settings and retention periods.
When personal data is no longer required, it is securely deleted or anonymised, subject to legal retention obligations.
6. Third-Party Service Providers
To operate my website and provide services, I may use external platforms and service providers.
Depending on the services and technical configuration in use, these may include:
Reservio: Appointment and reservation management.
MailerLite: Email marketing and newsletter communication.
WordPress and LearnDash: Website management and online course delivery.
Website hosting providers: Website operation, data storage, and technical maintenance.
Payment and invoicing providers: Payment administration, invoicing, and accounting.
Google and Meta: Website analytics, communication, and advertising services, where enabled.
Only the providers actually used for the relevant processing activity receive the personal data necessary for that purpose.
Where required, appropriate data processing agreements and safeguards are maintained.
7. International Data Transfers
Some external service providers may process or store personal data outside the European Economic Area (EEA).
Where such transfers occur, I ensure that they are based on a valid legal mechanism under the GDPR, such as:
An adequacy decision issued by the European Commission.
Standard Contractual Clauses approved by the European Commission.
Other applicable safeguards permitted under the GDPR.
Additional protective measures are applied where required.
8. Cookies and Website Tracking
My website may use cookies and similar technologies to support its operation and improve your browsing experience.
Cookies may fall into the following categories:
Essential Cookies
Necessary for the proper functioning, security, and basic operation of the website.
These do not require consent where they are strictly necessary.
Analytics Cookies
Help me understand how visitors use the website and identify opportunities for improvement.
These are activated only after the required consent has been obtained.
Marketing Cookies
May be used to measure advertising performance or display relevant content through platforms such as Google or Meta.
These are activated only with the required consent.
You can accept, reject, or manage non-essential cookies through the website’s cookie preferences, where available.
You may also manage cookies through your browser settings.
9. Your Rights Under the GDPR
You have the following rights regarding your personal data, subject to the conditions established by applicable law:
Right of Access
You may request confirmation of whether your personal data is being processed and obtain access to that information.
Right to Rectification
You may request the correction of inaccurate or incomplete personal data.
Right to Erasure
You may request the deletion of your personal data where the legal conditions for erasure are met.
Certain information may need to be retained to comply with legal obligations or establish, exercise, or defend legal claims.
Right to Restrict Processing
You may request that the processing of your personal data be restricted in circumstances provided by the GDPR.
Right to Data Portability
Where applicable, you may request your personal data in a structured, commonly used, machine-readable format.
Right to Object
You may object to processing based on legitimate interests and to processing for direct marketing purposes.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority.
Requests concerning your personal data can be sent to:
I will respond without undue delay and generally within one month, in accordance with the GDPR.
10. Data Security
I implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, accidental loss, or destruction.
Access to personal information is limited to persons who require it for legitimate professional purposes.
Employees, collaborators, and relevant service providers are subject to appropriate confidentiality and data protection obligations.
11. Photography and Video Recordings
Photographs or videos may be taken during certain workshops or events.
Where identifiable images are used for promotional or marketing purposes, I obtain the necessary permission or establish another appropriate legal basis before publication.
Participants are informed about photography or filming arrangements and may contact me with any privacy concerns.
12. Automated Decision-Making
I do not use solely automated decision-making that produces legal or similarly significant effects concerning individuals as part of my therapy or workshop services.
Any automated processing or profiling associated with advertising platforms is subject to the applicable privacy and cookie settings.
13. Changes to This Privacy Policy
I may update this Privacy Policy to reflect changes in legislation, technology, or the services I provide.
The current version will always be available on my website.
14. Contact and Supervisory Authority
For any questions or requests relating to personal data protection, please contact:
Karolína Molinari
Email: info@karolinamolinari.cz
Website: www.karolinamolinari.cz
You may also contact the Czech Data Protection Authority:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Website: www.uoou.gov.cz
Last updated: 24 October 2026