Below you will find the principles governing the processing of personal data that you provide to us as
the data controller if you visit our website available at https://www.healingwithrayna.com/, or if you
are our customers or persons interested in our products or services.

We process personal data in accordance with applicable and effective legal regulations, in particular
Regulation (EU) 2016/679 of the European Parliament and of the Council – the General Data
Protection Regulation (hereinafter referred to as “GDPR”), and Act No. 110/2019 Coll., on the
Processing of Personal Data.

The purpose of this document is to inform you about how your personal data will be handled and to
inform you of your rights.

CONTENTS:
I. Data Controller – our identification and contact details
II. Source of Personal Data – how we obtain access to your personal data
III. Categories of Personal Data and Requirement to Provide Them – which personal data we
process about you, whether you are obliged to provide them, and the consequences of not providing
them
IV. Purposes and Duration of Processing – for what purposes and for how long we process your
personal data and what authorizes us to do so
V. Automated Decision-Making and Profiling – whether automated individual decision-making or
profiling takes place on our part
VI. Cookies – which cookies we use
VII. Recipients of Personal Data – to whom we disclose your personal data
VIII. Transfer of Personal Data to a Third Country or an International Organization – whether your
personal data are transferred outside the European Union
IX. Security of Personal Data – which technical and organizational measures we have adopted to
secure your personal data
X. Your Rights – what rights you have in relation to the processing of personal data
XI. Final Provisions – effectiveness of this document and the possibility of its amendment

I. DATA CONTROLLER

The controller of personal data is:

Barbora Mazlová
Registered in the Trade Register
Company ID (IČO): 11776595
Registered office: Kroměřížská 985/4, 62700 Brno
Telephone: +420 731 375 040
E-mail: healingwithrayna@gmail.com

II. SOURCE OF PERSONAL DATA

We process personal data that we obtain directly from you. We obtain your personal data when you
visit our website, when you complete and submit a form on our website, or in another manner (e.g.
by providing them to us by e-mail, by telephone, during a video call, via social networks, or during
personal communication).

III. CATEGORIES OF PERSONAL DATA AND REQUIREMENT TO PROVIDE THEM

1. To the necessary extent, we process in particular the following ordinary personal data about
you, if you make them available to us: first and last name, Company ID (IČO), VAT ID (DIČ),
residential address, registered office address, payment details, telephone number, e-mail
address, identifier of another form of remote communication, IP address, information about
products or services ordered by you, and other information that you provide to us during our
communication or cooperation (e.g. data concerning your marital status, personal and
property circumstances, etc.).
2. If you allow us to publish your testimonial and possibly also provide us with your photograph
or video recording, we also process the personal data stated in the testimonial and the
relevant photograph or video recording. If you use the option to log in, discuss, rate, or share
via social networks (Facebook, Instagram, YouTube, or others), we also process information
contained in your post or comment and public information on your profile on the relevant
social network (in particular first and last name, photographs, age category, and other public
information according to your settings). With your consent, we also process your personal
data consisting of marketing and analytical cookies and information about your interests and
preferences. If you participate in any live events organized by us, we may also process
personal data captured in photographs or video recordings from such events.
3. Providing the category of ordinary personal data referred to in paragraph 1 of this Article is
necessary for mutual communication or for concluding and fulfilling a contract; if they are
not provided, it will not be possible to communicate with each other or to conclude and fulfill
a contract. In cases where the processing of personal data is based on your consent, it
depends solely on your decision whether to provide us with your personal data or not.
4. We process special categories of personal data (sensitive data) about you only if you
voluntarily provide such data during our cooperation and only with your explicit consent.
These are personal data revealing racial or ethnic origin, political opinions, religious or
philosophical beliefs, trade union membership, health data, sex life, or sexual orientation.

IV. PURPOSES AND DURATION OF PROCESSING

A. PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF CONCLUDING AND PERFORMING A
CONTRACT
1. We process your personal data for the purpose of concluding a contract and fulfilling
the contract concluded between us (mutual communication before and after
concluding the contract, delivery of the ordered product or service, processing of
payment). For this purpose, we process your ordinary personal data referred to in
Article III(1) above and, with your explicit consent, also special categories of personal
data referred to in Article III(4) above.
2. The legal basis for the processing of personal data is the performance of a contract
concluded between us and the implementation of measures taken prior to
concluding the contract at your request.
3. For this purpose, we process your personal data for the duration of the contractual
relationship between us, and after its termination, we further process some of your
personal data for other purposes (see Sections B to F below).

B. PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF COMPLIANCE WITH LEGAL
OBLIGATIONS
1. We also process personal data for the purpose of fulfilling legal obligations applicable
to us (e.g. statutory obligations in the field of taxation). For this purpose, we process
the following personal data: first and last name, Company ID (IČO), VAT ID (DIČ),
residential address, registered office address, payment details, and information
about products or services ordered by you.
2. The legal basis for the processing of personal data is the fulfillment of a legal
obligation applicable to us.
3. For this purpose, we process your personal data for the period stipulated by
generally binding legal regulations.

C. PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING
1. We also process your personal data for the purpose of direct marketing (sending commercial
communications, newsletters, etc.). For this purpose, we process the following personal data:
first and last name, residential address, registered office address, telephone number, e-mail
address, and information about products or services ordered by you.
2. If you are our customer, the legal basis for such processing of personal data is our legitimate
interest. Given your previous purchase of our product or service, we assume that you are
interested in our news and information about similar products or services.
3. You may unsubscribe from commercial communications at any time by clicking on the
relevant link included in each e-mail sent, or by notifying us at our e-mail address stated
above. Otherwise, we will process your personal data for this purpose for a period of 3 years
from your last order of our products or services.

D. PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF PUBLIC PRESENTATION
1. Photographs and video recordings are taken at live group events organized by us for the
purpose of promoting and presenting our products and services on websites and social
networks or in other promotional materials. For this purpose, we process your personal data
captured in photographs and video recordings from the relevant event.
2. If the photographs or video recordings capture the overall atmosphere of the event (i.e. not
your person in detail), the legal basis for such processing of personal data is our legitimate
interest. However, if you do not wish to appear in photographs or videos, you may inform us
of this before or during the event, and in such case we will not photograph or record you.
3. For this purpose, we process your personal data for the period during which the photographs
and video recordings from the event are published on websites, social networks, or in other
promotional materials.

E. PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF PROTECTION OF RIGHTS AND
ENFORCEMENT OF CLAIMS
1. We also process personal data for the purpose of protecting our rights and enforcing legal
claims (in particular arising from concluded contracts or caused damage). For this purpose,
we process your personal data from concluded contracts and our mutual communication.
2. The legal basis for the processing of personal data is our legitimate interest.
3. For this purpose, we process your personal data for the duration of the contractual
relationship and for the following 4 years after its termination, or for a period of 4 years from
our last contact if no contract was concluded, and in the event of a dispute, also for the
entire duration of the dispute until its final resolution and satisfaction of all claims.

F. PROCESSING OF PERSONAL DATA BASED ON YOUR CONSENT
1. Based on your consent, we process your personal data for the following purposes:
a) sending newsletters, information about news, our products and services, and other
commercial communications, if you are not our customer;
b) sending commercial communications relating to third parties;
c) analysis of your preferences and interests, improvement of our website, and ad
targeting;
d) publication of your testimonial on our website, social networks, or in other
promotional materials;
e) publication of a detailed depiction of your person in a photograph or video recording
from a live event on our website, social networks, or in other promotional materials;
f) discussions, ratings, or sharing of information via social networks.
2. You may grant your consent, for example, by completing and submitting a form on our
website, via a pop-up bar on our website, during individual communication (e.g. by e-mail), in
written form, by posting a post, comment, or reaction to a post or comment on a social
network, or in another manner. Before granting consent, we will inform you which personal
data we will process based on your consent and for which specific purpose the consent will
apply.
3. You may withdraw your consent at any time by clicking on the relevant link included in each
e-mail sent, or by notifying us of the withdrawal of consent at our e-mail address stated
above, and in the case of cookies, by disabling the storage of such cookies in your browser or
via the cookie bar located on our website. However, if we also process your personal data on
the basis of other legal grounds listed under Sections A to E above, we will continue to
process them on the basis of those respective legal grounds even after the withdrawal of
your consent.

V. AUTOMATED DECISION-MAKING AND PROFILING

1. We do not carry out automated individual decision-making within the meaning of Article 22
GDPR.
2. Personal data that you provide to us (in particular e-mail address and telephone number)
may, based on your consent, be profiled for the purpose of analyzing your preferences and
interests and targeting advertising.

VI. COOKIES

1. When using the website, we use cookies and related technologies. Cookies are small text files
used to store and receive identifiers and other information about devices from which you
access our website.
2. We use technical and functional cookies, analytical cookies, and marketing cookies. Technical
and functional cookies ensure the proper functioning of our website and facilitate its use and
may be placed without your consent. Analytical cookies are used to analyze data for the
purpose of improving our products and services. Marketing cookies are used to track user
preferences for the purpose of targeted advertising. Analytical and marketing cookies are
used in cooperation with third-party tools only on the basis of your prior consent.
3. You may refuse the use of cookies in your browser settings or configure the use of only
certain cookies.
4. More information about the individual cookies we use can be found on our website.

VII. RECIPIENTS OF PERSONAL DATA

1. If we share your personal data with another person, we ensure that their protection is
maintained.
2. As we are unable to ensure all activities related to our business independently, we use
services and applications of third parties who thus gain access to your personal data. We
have concluded the relevant GDPR-compliant agreements with these parties.
3. Specifically, the recipients of personal data include:
a) web hosting and domain: WebSupport / WordPress
b) e-mailing: Gmail / SureForms / TidyCal / OttoKit
c) invoicing system: Seyfor a. s.
d) booking system: TidyCal
e) payment gateway: Stripe / SureRank
f) e-commerce platform: SureCart / Etsy
g) goods delivery: Česká pošta / PPL / Zásilkovna / DPD
h) social networks: Facebook and Instagram (Meta Platforms)
i) virtual assistant
j) accounting firm
k) marketing agency
l) IT company
m) cloud storage
4. With your consent, your personal data that you provide to us (in particular e-mail address,
telephone number, cookies) may be shared in encrypted form with third parties (e.g. Meta
Platforms, Google) for the purpose of analyzing your preferences and interests and targeting
advertising.
5. Other users of social networks to which you post content, comments, or reactions, as well as
other clients who have purchased the same product or service as you, also have access to
your personal data (e.g. in the case of a group call within an online course, your name or
nickname, and if the camera is on, your image is visible to all participants). By using these
options, you consent to such sharing of your personal data.
6. If you use the option to post comments or questions on our website, you consent that your
personal data (first and last name and information included in the comment or question) will
also be visible to other visitors to the website.
7. Your personal data may also be disclosed to relevant administrative authorities or courts, or
to legal representatives, in order to fulfill our legal obligations or protect our rights and
legitimate interests.
8. If additional applications or services of other parties are used in the future, we will ensure
that our standard of personal data security and processing is maintained when selecting
them.

VIII. TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY OR INTERNATIONAL
ORGANIZATION

As we use certain foreign processors, your personal data may be transferred to third countries,
namely to the United States of America. On 10 July 2023, the European Commission adopted a
decision on an adequate level of protection of personal data pursuant to Article 45(3) GDPR.
According to this decision, the United States of America ensures an adequate level of protection for
personal data transferred from the European Union to organizations in the United States that are
listed on the so-called Data Privacy Framework List. Our processors TidyCal, Etsy, OttoKit, Stripe,
Meta Platforms, and Google are included on this list, thereby ensuring an adequate level of
protection of your personal data.

IX. SECURITY OF PERSONAL DATA

1. As the controller, we have adopted all technical and organizational measures to secure your
personal data to prevent accidental or unlawful access, alteration, destruction, or loss of
your personal data, unauthorized processing, or other misuse. The adopted technical and
organizational measures correspond to the level of risk to the rights and freedoms of natural
persons and to the nature, scope, and purposes of the processing of personal data.
2. In particular, we have adopted the following technical and organizational measures to secure
your personal data:
a) protection of access to computer equipment processing personal data by individual strong
passwords and protection of these passwords against disclosure;
b) protection of such computer equipment by antivirus software;
c) protection of portable computer equipment or portable data storage devices (supervision,
data encryption, etc.);
d) locking of premises in which documents containing personal data are stored;
e) granting access to personal data only to authorized persons who are bound by
confidentiality obligations regarding your personal data and adopted security measures.
3. The implemented technical and organizational measures are regularly tested, and their
effectiveness in ensuring the security of personal data processing is assessed and evaluated.

X. YOUR RIGHTS

1. In relation to the processing of personal data, you have the following rights:
a) Right of access to personal data (Article 15 GDPR)
You have the right to obtain information as to whether or not your personal data are being
processed and, if so, to access the personal data and details of their processing.
b) Right to rectification or completion of personal data (Article 16 GDPR)
You have the right to request that we rectify inaccurate personal data concerning you and,
taking into account the purposes of processing, also the right to have incomplete personal
data completed.
c) Right to erasure of personal data (Article 17 GDPR)
You have the right to request that we erase personal data concerning you, and if one of the
grounds listed in Article 17 GDPR is met, we are obliged to erase your personal data upon
your request.
d) Right to restriction of processing (Article 18 GDPR)
If the conditions set out in Article 18 GDPR are met, you have the right to request that we
restrict the processing of your personal data.
e) Right to data portability (Article 20 GDPR)
If the processing of your personal data is carried out by automated means and is based on
consent or on a contract, you have the right to obtain personal data concerning you in a
structured, commonly used, and machine-readable format and to transmit them to another
controller. Where technically feasible, you also have the right to request that we transmit
your personal data directly to another controller.
f) Right to object to the processing of personal data (Article 21 GDPR)
Under the conditions set out in Article 21 GDPR, you have the right to object at any time to
the processing of personal data. If you object to processing for direct marketing purposes,
including profiling, we will no longer process your personal data for these purposes.
g) Right to withdraw consent to the processing of personal data
If personal data are processed based on your consent, you have the right to withdraw your
consent at any time. Withdrawal of consent does not affect the lawfulness of processing
based on consent given before its withdrawal.
h) Right to lodge a complaint with the Data Protection Authority
If you believe that your right to personal data protection has been violated, you have the
right to lodge a complaint with the Office for Personal Data Protection (https://uoou.gov.cz/).
2. You may exercise your rights using the contact details provided above (postal or e-mail
address). Before processing your request, we may contact you in order to reasonably verify
your identity.

XI. FINAL PROVISIONS

1. We are entitled to amend these personal data processing principles to a reasonable extent.
The current version is available on our website indicated above.
2. These personal data processing principles take effect on 1 January 2026.