Privacy notice
Last updated 2 November 2026
This explains what personal data I collect, why, and what you can ask me to do with it. Short version: I collect as little as I can, I never sell it, and you can ask me about it any time.
Who looks after your data
Hana Habal, sole trader, is the controller of your personal data.
Business ID (IČO):
Address:
Email: hana@hanahabal.com
What I collect and why
| What | Why | Legal basis (GDPR) | How long I keep it |
|---|---|---|---|
| Booking details: your name, email, the time you pick, and a phone number if you choose to give one | To arrange and run our sessions | Our contract, Art. 6(1)(b) | While we work together, then deleted within 12 months of our last session |
| Payment and invoice details: your name, what you paid and when | Billing and accounting | Legal obligation, Art. 6(1)(c) | As long as Czech tax and accounting law requires, up to 10 years |
| What you tell me in sessions, which may include health-related information | To give you the session you asked for | Your explicit consent, Art. 9(2)(a), which you can withdraw any time | I only keep short notes if they help our work, and delete them within 12 months of our last session |
| In pair sessions: the second person’s name and email | To arrange and run the session for both of you | Our contract, Art. 6(1)(b), and explicit consent for anything health-related, Art. 9(2)(a) | The same as booking details and session notes above |
| Website visits: anonymous counts of which pages are viewed, with no cookies and no profile of you | To see which pages help people | Legitimate interest in running a useful website, Art. 6(1)(f) | Kept only as totals by Cloudflare’s statistics tool |
| Emails and messages you send me | To reply to you | Legitimate interest in answering you, Art. 6(1)(f) | Until the conversation is done, then up to 12 months |
| Workshop enquiries from companies: the contact person’s name and work email | To discuss and arrange the workshop | Legitimate interest, Art. 6(1)(f) | Until the enquiry or the workshop is finished, then up to 12 months |
The booking form never asks about symptoms or health. You decide what you share in a session.
Do you have to give me your data?
To book, I need your name and email, because I can’t arrange a session without them. Everything else, like a phone number, is optional. What you share in sessions is always up to you.
If someone else gave me your details
If someone booked a pair session with you, I got your name and email from them. I use them only to arrange and run that session, as described here.
Who my sessions are for
Adults, and young people aged 10 and over.
Young people under 18
- A parent or legal guardian books, pays, and gives consent, including consent for me to handle health-related information about their child. They can withdraw it at any time.
- I collect the parent’s name and contact details as well as the young person’s.
- At the start, I agree with both of them what stays between me and the young person, and what a parent will be told.
- If I believe a young person or someone else is at serious risk, I always act on it. That can mean telling a parent, or the authorities when the law requires it, for example child protection services.
- Young people can ask me about their own data too. I involve a parent where the law requires it.
How I keep your data safe
I’m the only person with access. My accounts use strong passwords and two-step login, session notes are kept in an encrypted folder, and I delete data on the schedule above.
Pair sessions
In a pair session, both of you hear what’s said. I don’t keep secrets from one of you on behalf of the other, so if you tell me something separately, I may encourage you to bring it into the session.
Supervision
I’m in psychotherapy training, and part of training is discussing my work with a supervisor. I never share your name or anything that would identify you.
When I couldn’t keep something private
Only in rare cases: when there is a serious and immediate risk to your life or someone else’s, or when the law requires me to share something. If that ever happens, I share only what is necessary and, where I can, I tell you first.
Who else handles your data
I use a few services to run this practice. They handle data only on my instructions:
- Cloudflare hosts this website and counts visits. Like any website host, it processes your IP address when you visit.
- Cal.com runs the booking page.
- Stripe processes payments. I never see your card details.
- Google provides my email, calendar and video calls (Google Meet).
- My accountant sees invoices, for bookkeeping and taxes.
Some of these companies are based outside the EU, mainly in the US. Where they transfer data out of the EU, they do so under safeguards the EU recognises, such as the EU–US Data Privacy Framework or standard contractual clauses.
I never sell your data or use it for advertising.
Cookies
This website doesn’t set any cookies of its own, and it doesn’t use advertising or tracking. That’s why there’s no cookie banner.
| What | Cookies? | Your consent needed? |
|---|---|---|
| The website itself (pages, fonts, photos, video) | None. Everything loads from this site, nothing from Google or YouTube. | No |
| Visitor statistics (Cloudflare Web Analytics) | None. It counts page views without cookies and without identifying you. | No |
| Hosting security (Cloudflare) | Only if needed to block bots or attacks, a strictly necessary security cookie | No, it’s strictly necessary |
| Booking (Cal.com) and payment (Stripe) | These open as their own websites, with their own cookie rules | Handled on their sites |
If this ever changes, for example if I embed a booking calendar or a YouTube video on this site, I’ll ask for your consent first.
Data protection officer
I’m a one-person business and not required to appoint a data protection officer. Questions go straight to me.
Your rights
You can ask me to:
- show you the data I have about you
- correct it
- delete it, unless the law makes me keep it (like invoices)
- limit how I use it, or object to how I use it
- give it to you in a portable format
- stop using what you shared on the basis of consent, by withdrawing that consent
Email me and I’ll reply within one month. I don’t make automated decisions or profiles about anyone.
If you think I’ve handled your data wrongly, you can complain to the Czech data protection authority, Úřad pro ochranu osobních údajů, at uoou.gov.cz.
Changes
If this notice changes, I’ll update the date at the top. Big changes, I’ll tell current clients about by email.