Privacy Policy

Last updated: 20 February 2026

1. Data Controller

The controller of personal data is:

(hereinafter "controller" or "we")

2. What personal data we process

In connection with providing our services, we process the following categories of personal data:

a) Contact form and email communication

• Name and surname
• Email address
• Phone number (if provided)
• Content of your message

b) Program participation (Motivation, Sobriety Month, Sober Diary, Transformation)

• Name and surname
• Email address
• Phone number
• Health data to the extent necessary for providing services (special category of data)
• Billing information

c) WhatsApp community

• Phone number
• Name (or nickname) in WhatsApp profile
• Content of communication within the group

d) Cookies and technical data

• IP address
• Browser type and device
• Cookie data (see Cookie Policy)

3. Purposes and legal basis for processing

4. Special categories of data

As part of our programs for women recovering from alcohol dependency, we may process health data, which falls under special categories of personal data under Art. 9 GDPR.

We process these data exclusively on the basis of your explicit consent, which you may withdraw at any time. Consent is obtained in writing before the start of the program.

All health data are processed with maximum confidentiality and access is limited to Lucie Buková as coach and data controller.

5. Recipients of personal data

Your personal data may be disclosed to the following categories of recipients:

• Email service provider – Brevo (Sendinblue), based in the EU, for sending email communications
• WhatsApp (Meta Platforms) – for operating the community group. Meta processes data under its own terms, with transfers to the USA secured under the EU-US Data Privacy Framework
• Hosting provider – FORPSI (Internet CZ, s.r.o.), based in the Czech Republic
• Accountant and tax advisor – to the extent necessary for fulfilling legal obligations

We do not sell or share personal data with third parties for marketing purposes.

6. Transfer of data to third countries

By using the WhatsApp service (Meta Platforms, Inc.), your data may be transferred to the United States of America. This transfer is secured under the European Commission adequacy decision (EU-US Data Privacy Framework) pursuant to Art. 45 GDPR.

Otherwise, we do not transfer your data outside the European Economic Area.

7. Your rights

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR) – the right to obtain confirmation of whether your data is being processed and access to it
• Right to rectification (Art. 16 GDPR) – the right to rectification of inaccurate data
• Right to erasure (Art. 17 GDPR) – the right to erasure of data when the purpose of processing no longer exists
• Right to restriction of processing (Art. 18 GDPR) – the right to request restriction of processing in certain cases
• Right to data portability (Art. 20 GDPR) – the right to obtain data in a structured, machine-readable format
• Right to object (Art. 21 GDPR) – the right to object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3) GDPR) – at any time, without affecting the lawfulness of prior processing

To exercise your rights, contact us at: kara@sober-sisters.eu

We will respond to your request without undue delay, within 30 days at the latest.

8. Right to lodge a complaint

If you believe that the processing of your personal data violates GDPR, you have the right to lodge a complaint with the supervisory authority:

9. Personal data security

We have adopted appropriate technical and organisational measures to protect your personal data, in particular:

• SSL/TLS encryption of web communication
• Restricted access to personal data only for authorised persons
• Regular data backups
• Secure storage of passwords and access credentials

10. Final provisions

This Privacy Policy is valid and effective from 20 February 2026.

The controller reserves the right to amend this policy. The current version is always available on this page.

This policy has been prepared in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
• Czech Act No. 110/2019 Coll., on Personal Data Processing
• Czech Act No. 480/2004 Coll., on Certain Information Society Services
• Czech Act No. 89/2012 Coll., Civil Code