Privacy Policy

1. Data Controller

Ensana s.r.o. (hereinafter "Ensana", "we", "us") is the data controller responsible for processing your personal data within the Vitality Program service and collected through the Ensana Vitality Quiz.

Contact: Ensana s.r.o., ID No. 05456274, registered office at: Na příkopě 392/9, Staré Město, 110 00 Praha 1, Czech Republic, Email: info@ensanahotels.com

Data Protection Officer — Email: dpo@ensanahotels.com

2. Data We Collect

When you use the Ensana Vitality Quiz, we may collect:

• Email address (provided by you)
• Quiz answers and calculated vitality score
• Marketing consent preferences
• Technical data (IP address, browser type, device information) collected via cookies. Only strictly necessary cookies are used unless you accept analytics cookies in the Cookiebot consent banner.

3. Purpose of Processing

We process your personal data to provide the Vitality Program service: this includes processing your quiz answers to generate your personalised vitality report and sending you ongoing personalised health, spa, and wellness recommendations and offers based on your score.

We use automated processing (profiling) of your quiz answers to ensure that the recommendations and offers we send you are relevant to your health and vitality needs.

4. Legal Basis

We process your data based on:

• Explicit Consent (Art. 9(2)(a) GDPR) — for processing your health-related data (quiz answers) to provide the Vitality Program service, including the vitality report and subsequent personalised wellness recommendations.
• Consent — for analytics cookies.
• Legitimate interest — for technical website optimisation and general (non-personalised) service improvement.

5. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Withdraw your cookie consent at any time in the Cookiebot consent banner — see the Cookie Policy
• Withdraw your consent to the Vitality Program at any time — this covers the processing of your quiz answers and the personalised emails; use the unsubscribe link in any email or contact us below

To exercise your rights, contact us at info@ensanahotels.com or contact our DPO at dpo@ensanahotels.com.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined above, unless a longer retention period is required by law. Marketing data is retained until you withdraw your consent. The period for which we process your data based on your consent will generally not exceed 3 years, unless you choose to opt out of our Vitality Program earlier. Analytics data collected through Google Analytics is retained for 14 months; the retention period for user-level data restarts each time you visit the site again.

7. Data Sharing

We share your data only with service providers who process it on our instructions: SendGrid (Twilio) for delivering your vitality report by email, ZoomLetter (VirtualZoom) for managing the Vitality Program mailing list, the record of your consent and your quiz answers and vitality score, which we store there so that the recommendations we send you stay relevant, Cloudflare for hosting and protecting this website, Google (Google Analytics and Google Tag Manager) for website analytics if you accept analytics cookies, and Cookiebot (Usercentrics) for managing your cookie consent. Each of them is bound by a data processing agreement and may not use your data for its own purposes. We do not sell your data.

8. International Data Transfers

Some of our service providers may transfer personal data outside the European Economic Area, in particular Google (Google Analytics and Google Tag Manager), whose terms allow processing in any country where Google or its subprocessors operate facilities. Where that happens, the transfer is governed by Google's data processing terms, which incorporate the European Commission's Standard Contractual Clauses, and Google is additionally certified under the EU–U.S. Data Privacy Framework. Analytics data from visitors in the EU is collected through servers in the EU and Google does not log or store their IP addresses. You can request a copy of the safeguards we rely on using the contact details below.

9. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at info@ensanahotels.com or contact our Data Protection Officer at dpo@ensanahotels.com.

You also have the right to lodge a complaint with a supervisory authority. The authority in the Czech Republic is Úřad pro ochranu osobních údajů (https://uoou.gov.cz/).