Privacy notice
Maroš Kellner - SILEO · version 1.0 · effective from 7. 10. 2026
This notice explains what data we process when you book, why, for how long, who receives it and what rights you have. The Slovak and English versions have the same content; if you find a difference, please let us know at info@kellnerchiropraxia.sk.
1. Controller
The controller of your personal data is Maroš Kellner - SILEO, Karola Kuzmányho 1575/21, 060 01 Kežmarok, company ID (IČO) 41768728 ("we"). For questions about data protection and to exercise your rights, contact info@kellnerchiropraxia.sk or +421 908 320 125. More about us: https://kellnerchiropraxia.sk.
We have not appointed a data protection officer because Article 37 of Regulation (EU) 2016/679 (GDPR) does not require us to.
2. Who operates the booking system
The Rezerva booking system is operated for us by Andrej Petrulák, trading as TatraByte, Slnečná 954/28, 059 71 Ľubica, Slovakia, company ID 57647194 ("TatraByte"). TatraByte processes your data only on our behalf and on our instructions under a contract pursuant to Article 28 GDPR. It is not a party to your booking, does not use your data for its own purposes, does not combine it with data of other businesses and does not sell it.
3. What data we process and where it comes from
Most data comes directly from you. If you book by phone or in person, our staff enter it into the system.
When you book an appointment: name, phone, e-mail, note, chosen service, staff member, date, time and price. We keep a customer record with the number of your visits and no-shows and a staff note (for example your usual haircut or colour). We also record how you reached us: campaign parameters in the page address (UTM), the domain of the page you came from (without the rest of the address), the page with the form and your answers to "Have you visited us before?" and "How did you hear about us?" if the form asks them. If you join the waiting list for a full day, we store your name, phone, e-mail, the day and the service.
Health data. Booking an appointment with us is in itself data about your health, because it allows conclusions about health problems (judgment of the Court of Justice of the EU C-21/23). Please do not describe your health condition in the note – we will discuss it in person. The note also appears in the confirmation e-mail.
Technical data: the form is protected by Cloudflare Turnstile, which processes your IP address and browser and connection data while you fill in the form. To limit the number of bookings we store, for 2 days, a hash of the IP address, the e-mail and the time of the attempt (for salons and restaurants also the phone number).
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Handling the appointment: confirmation, reminder, changes, cancellation and offering a freed slot to the waiting list | performance of a contract and steps taken at your request before entering into it – Art. 6(1)(b) GDPR |
| Customer record – history of visits and no-shows, staff note | our legitimate interest in serving regular customers according to their preferences and planning appointments – Art. 6(1)(f) GDPR |
| Learning how customers reach us | our legitimate interest in knowing which channels work – Art. 6(1)(f) GDPR |
| Protection against fake bookings and misuse of the form | our legitimate interest – Art. 6(1)(f) GDPR (section 6) |
| Defending legal claims | our legitimate interest – Art. 6(1)(f) GDPR |
We process health data only with your explicit consent under Art. 9(2)(a) GDPR, which you give by ticking the box in the form. Consent is voluntary: without it you can book by phone at +421 908 320 125. You may withdraw consent at any time at info@kellnerchiropraxia.sk; withdrawal does not affect processing before it. After withdrawal we process health data only to the extent needed to defend legal claims (Art. 9(2)(f) GDPR).
5. Which data you must provide
Required fields are marked in the form. Without your name, phone, e-mail and date we cannot accept an online booking, because we could not contact you or send a confirmation. You do not have to provide optional data and the booking does not change if you leave it out.
Explicit consent to the processing of health data is not a condition of the service – without it you can book by phone.
6. Our legitimate interests
- Protection against fake bookings and misuse of the form (Recitals 47 and 49 GDPR): invented bookings block slots for real customers.
- Proving and defending legal claims: in a dispute we need to show what you booked and which terms you accepted.
- Serving regular customers and planning appointments: visit history and notes help us provide the service the way you are used to; recording no-shows protects the slots of others.
- Learning how customers reach us: we store only the data sent together with the booking, we store nothing on your device and we do not track you on other websites.
We will send you our balancing test (legitimate interest assessment) on request. You may object to processing based on legitimate interest (section 13).
7. Recipients
- TatraByte (Andrej Petrulák, Ľubica, Slovakia) – operates the booking system as our processor.
- Cloudflare, Inc. (USA) – runs the system and the database (database primarily in the EU), Turnstile form protection and the check whether your e-mail domain exists (it receives only the domain, not the full address). Cloudflare also uses Turnstile signals to improve Turnstile as a separate controller.
- Resend (Plus Five Five, Inc., USA) – delivers booking e-mails.
- OpenStreetMap Foundation (United Kingdom) – only if you click to show the map; it receives your IP address and browser data.
- Courts, law enforcement authorities, the Slovak Trade Inspection and other authorities – where the law requires it.
Protection of the whole platform (limits on attempts, security records, technical logs) is provided by TatraByte as a separate controller; details are in its policy at rezerva.tatrabyte.sk/o-systeme. We do not sell your data.
8. Transfers outside the European Union
- USA (Cloudflare, Resend): based on the Commission's adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) and standard contractual clauses under Commission Implementing Decision (EU) 2021/914. The database is primarily in the EU; e-mails and delivery records are stored in the USA.
- United Kingdom (OpenStreetMap Foundation): based on the Commission's adequacy decision valid until 27 December 2031, only after you click the map.
We will send you a copy of the safeguards on request.
9. How long we keep data
- Appointment booking: 24 months from the booking, then we anonymise it.
- Customer record including the staff note: 24 months after your last booking, then we delete it.
- Waiting list entry: deleted the day after the day you signed up for.
- Entry in the list of fake bookings: 30 days.
- Records of attempts: 2 days. Technical logs: at most 7 days. Backups: data we delete disappear from backups within 30 days.
If a dispute, payment chargeback, inspection or your request is pending, we postpone deletion of the affected records until it ends.
10. Automated checks when you book
When you submit the form, the system automatically checks whether a human is filling it in (Turnstile), how many attempts came within 24 hours from the same IP address and with the same e-mail (for salons and restaurants also the same phone number), whether the phone number is obviously invented (for example a sequence of digits), whether the e-mail domain exists and accepts mail, and whether your phone number (for accommodation also your e-mail and IP address) is on our list of fake bookings. If the domain cannot be checked because of a technical error, the booking goes through. Data are added to that list only when a person from our business marks a booking as fake; the entry lasts 30 days. The system sends at most 8 booking confirmations a day to one e-mail address so that the forms cannot be misused to flood someone's inbox.
If a check fails, you cannot complete the booking online and the form offers booking by phone at +421 908 320 125. Because booking by phone is always possible, this is not a decision with legal or similarly significant effects under Article 22 GDPR. If you think it is a mistake, contact us and a person will review it. We do not use profiling for marketing.
11. E-mails you will receive
- Booking messages – confirmation, status changes, reminders, arrival instructions and payment requests; for accommodation also one factual message that the booking was not made if the payment for a room we held for you did not go through. They are part of the booking and do not require consent.
The sender is Maroš Kellner - SILEO; the e-mails are technically delivered by Resend from the booking system's address and replies go to info@kellnerchiropraxia.sk. We do not track opens or clicks.
12. Cookies and storage on your device
The booking pages use no analytics or advertising cookies, which is why they show no consent banner. They store only what is necessary for the booking:
- Cloudflare Turnstile while you fill in the form – the
cf.turnstile.uitem in the browser's local storage;
The map loads only after you click and fonts are served from our own domain. The full overview is in the document Cookies and device storage at rezerva.tatrabyte.sk/o-systeme.
13. Your rights
You have the right:
- of access to your data and to a copy (Art. 15 GDPR);
- to rectification of inaccurate data (Art. 16 GDPR);
- to erasure (Art. 17 GDPR) – however, we cannot erase data that the law requires us to keep (for example accounting documents and, for accommodation, the guest register and accommodation tax records) before the statutory period ends; we will restrict their processing instead;
- to restriction of processing (Art. 18 GDPR);
- to data portability for data you gave us under a contract or consent (Art. 20 GDPR);
- to withdraw consent at any time, without affecting processing before withdrawal (Art. 7(3) GDPR);
- to lodge a complaint with the supervisory authority – Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk – or to go to court.
Right to object (Art. 21 GDPR). You may object at any time, on grounds relating to your situation, to processing based on legitimate interest; we will then stop unless we demonstrate compelling legitimate grounds or need the data to defend legal claims.
Send your request to info@kellnerchiropraxia.sk or call +421 908 320 125. To make sure we do not disclose data to someone else, we may ask you to verify yourself, for example by replying from the e-mail used for the booking or by giving the booking code. We will reply without undue delay and at the latest within one month; for complex requests we may extend this by two months and will tell you within the first month why. Handling requests is free of charge.
14. Data about other people
If you book for someone else or give details of other people, please tell them about this notice. You may give explicit consent to processing another person's health data only as their legal representative or with their authorisation.
15. Changes to this notice
We update this notice when our processing or the law changes. For every booking we store the version you saw when booking; we will send you earlier versions on request.