Privacy Policy

1. Data controller

The data controller is SKINFINITY s.r.o., Company ID 296 41 225, VAT ID CZ29641225, with its registered office at Sokolská 1883/8, Nové Město, 120 00 Prague 2, Czech Republic, registered with the Municipal Court in Prague under file number C 449923.

Privacy-related questions and requests may be sent to info@myskinfinity.cz.

2. Personal data we process

To handle an enquiry, we may process:

• the contact person's full name,
• company name and type of business partner,
• email address and, if provided, phone number,
• the message and subsequent business communication,
• technical data necessary for form delivery and protection against misuse.

3. Purposes and legal grounds

We process personal data only for the following purposes:

• handling questions and enquiries and discussing potential business cooperation — depending on the circumstances, this constitutes steps taken before entering into a contract or our legitimate interest in conducting B2B communication,
• keeping communication records and protecting legal claims — based on our legitimate interest,
• complying with legal obligations if the communication becomes part of contractual, accounting or other statutory records.

We do not use enquiry data for newsletters, advertising messages or profiling without a separate valid basis.

4. Recipients and form technology

Access to personal data is limited to authorised company personnel and providers necessary for website operation, form delivery and corporate email. The website is hosted through ChatGPT Sites, operated by OpenAI. The contact form is delivered using FormSubmit directly to our corporate mailbox; this website does not itself store the content of form submissions. We disclose data to these providers only to the extent required to provide their services and do not sell personal data to third parties.

Some technical providers may use infrastructure outside the European Economic Area. Any such transfer must retain the level of protection required by European Union law. Information about FormSubmit is available in its privacy policy. According to its published documentation, FormSubmit may retain submitted forms in its archive for 30 days; further details are available in its service documentation.

5. Retention period

Enquiries that do not lead to a business relationship are generally retained for no longer than 12 months after the last communication. We keep them longer only where necessary to protect legal claims or comply with a legal obligation. If a business relationship is established, we retain the data for the duration of that relationship and subsequently for the period required by applicable law.

FormSubmit's technical archive is governed by that provider's rules; its documentation states that submissions are retained for 30 days.

6. Your rights

Subject to the conditions of the GDPR, you may request access to your personal data, correction, erasure or restriction of processing, object to processing based on legitimate interests and, where applicable, request data portability. We will respond without undue delay, generally within one month.

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, website uoou.gov.cz.

7. Required and optional information

Fields marked with an asterisk are required to handle your enquiry. Providing a phone number is optional. Without the required information, we may be unable to respond. We do not use automated decision-making or profiling when processing enquiry data.

8. Cookies and analytics

We have not added Google Analytics, advertising pixels or our own marketing cookies, and we do not track visitors for advertising purposes. The hosting platform may process technical and operational data necessary for secure website operation and provide us with basic aggregate traffic statistics, such as visitor and page-view counts. If we add analytics or marketing tools that require consent in the future, we will update this Policy and obtain the required consent before activating them.