Protecting your
data.

Some of our locations are run by franchise partners (independent companies). Personal data from the website and ordering system is, however, managed centrally by Bubblelab s.r.o. as the controller — a franchisee only accesses data to the extent needed to prepare and hand over your order (see Art. 5). Who acts as the seller for a given order is addressed in the Terms & Conditions.

1. Introduction

This policy describes how Bubblelab s.r.o. (hereinafter "we" or the "controller") processes personal data of visitors to the websites bubblelab.cz and bubblelab.sk (including the ordering system at order.bubblelab.cz and order.bubblelab.sk) in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Czech Act No. 110/2019 Coll. on the processing of personal data, and Czech Act No. 127/2005 Coll. on electronic communications. As a company established in the Czech Republic, this is the applicable legal framework regardless of which language version of the site you are using.

2. What data we process

2.1 Staff reviews (the /hodnocení form)

If you send us a review, we store:

• the selected location and the staff member who served you
• a star rating (1–5) and an optional text comment
• your receipt number (used to verify that a purchase was made)
• your IP address (as a technical identifier against abuse)
• the date and time of submission
• optionally your email — only if you choose to enter it. We use it exclusively to contact you and resolve the situation if you weren't satisfied (a rating of 3 stars or fewer).

We don't require your name. Email is entirely optional — you can submit a review without it.

2.2 Cookies and analytics

With your consent, when you visit the site we may process:

• cookie identifiers and similar technologies
• on-site behavior data (pages visited, time spent, referral source)
• technical device data (browser type, OS, screen resolution)
• approximate geolocation derived from your IP address

2.3 Email communication

If you write to us at [email protected] or send a CV for a Careers position, we process the content of the message, your name, email, and any other details you provide.

2.5 Customer account (registration and login)

If you voluntarily create a customer account in the bubblelab.cz/ucet section, we process the data you provide at registration or in your profile settings:

• first and last name
• email (used as your login)
• optionally, your phone number and date of birth
• password in hashed form (bcrypt algorithm) — only if you choose password login; alternatives are a one-time email link, signing in with Google/Apple, or a passwordless passkey (see below)
• when signing in with Google: a stable Google account identifier (sub claim) and profile picture URL
• when signing in with Apple: a stable Apple account identifier (sub claim) and the email Apple provides you with (which may be its private relay address, if you choose that)
• if you register passwordless login (passkey / WebAuthn): a public key and a technical identifier for your device — your fingerprint, Face ID, or PIN itself never leaves your device and is never transmitted to us
• your favorites (limited editions and drinks) and notification preferences (email / push) that you enable yourself

The account is entirely optional and exists solely for your benefit — for faster reviews, saving favorite drinks, and receiving updates. We don't use account data for profiling, nor do we share it with third parties beyond the processors listed in Art. 5. You can edit your data at any time directly in your account; to request account deletion, email [email protected].

2.6 Game leaderboard (mini-game)

The site includes an optional entertainment mini-game. If you're logged in and play it, we store against your customer account:

• your best score achieved (overall and for the current week)
• the number of games played

On the public leaderboard, other logged-in players only see your first name and last-name initial (e.g. "Thomas N.") along with your score — never your full last name, email, or other data. The leaderboard is visible only to logged-in users; playing while logged out stores no data. This data is used exclusively to display the leaderboard, is never used for profiling, and is deleted together with your account.

2.7 Drink pickup orders (order.bubblelab.cz / order.bubblelab.sk)

If you order a drink for pickup at a location through our ordering system, we process the data necessary to prepare and hand over your order:

• email and phone number — required, used to confirm your order and to reach you if something is wrong with it
• optionally, your name and a note for the order
• the order contents (drinks, size, toppings), its price, the chosen location, and pickup time
• the order number and a random technical identifier (token) that lets you check the order status via a link in the email — without logging in or providing any further data
• optionally, your loyalty card number (see Art. 2.8)
• the order status and the times of its changes (received, preparing, ready, handed over, cancelled)

The order is visible to staff at that location — on the printed order ticket and on the operational overview behind the bar. New-order details (contents, phone, email) are also sent to an internal operations Discord channel so staff notice it immediately (see Art. 5).

We keep you informed about your order by email (an acceptance confirmation and a "your drink is ready" message), and if you're logged in with browser push notifications enabled, we send a push notification instead of an email. These aren't marketing messages — they relate solely to your specific order.

To prevent fake orders (a prepared drink nobody collects), we limit the number of simultaneously uncollected orders per email and phone number.

We don't process the order or the payment online — you pay on site when picking up, so we never process payment details (card numbers, etc.) at all.

2.8 Loyalty card number

Our loyalty program is based on percentage discounts, not points collection. To get your discount on web orders too, you can save your loyalty card number in your account. We then:

• pre-fill it at checkout (you can also enter it once without an account),
• save a copy with that order and display it to staff (on the ticket and the bar overview) so they can apply your discount in the checkout system.

Saving the card number is entirely optional — you can delete or change it in your account at any time. The number itself is an identifier within the Storyous checkout/loyalty system — it doesn't reveal your purchasing behavior to us beyond what's described above.

2.9 QR codes and short links (campaign measurement)

On flyers, posters, and at our locations we use QR codes and short links (addresses in the form bubblelab.cz/s/…) to see which campaigns and placements actually work.

• When a QR code is scanned, we store: a hash of your IP address (not the IP itself), device and browser type, the page you came from, an approximate country and city derived from the IP, and the scan time.
• For short links, we store only the aggregate number of clicks per day — no data about individual visitors.

We don't use this data to identify you, and we don't link it to your customer account.

2.10 Browser push notifications

If you enable push notifications yourself, we store the technical address (endpoint) of your browser's push channel and the encryption keys your browser generates. Delivery is handled by your browser vendor's push service (Google, Mozilla, Apple — see Art. 5). We send notifications about news (only if you turn them on) and about your order status. You can revoke permission at any time in your browser settings or your account.

2.11 Credit loyalty program (beta)

In addition to the percentage discount (Art. 2.8), we run a new, separate credit loyalty program — currently in beta. If you take part in it (by registering, logging into the app, or trying it on the /beta/program page), we additionally process:

• your current credit wallet balance
• a full transaction history (top-ups, purchase cashback, payment with credit, refunds, reversals, manual adjustments) including the date, amount, and location
• one-time coupons/discount codes we issue to you or that you redeem, and their status (valid/used/expired)
• if you have a date of birth saved in your account (Art. 2.5) and the program is active: a one-time birthday bonus

The test button on the /beta/program page remains free of charge (for internal testing only). The app also has a technically ready top-up flow that pays by card through the Stripe payment gateway (see Art. 13 of the terms of service) — in that case we never process or store your card number ourselves, only Stripe sees it; we only receive confirmation of the payment and its amount. This in-app payment is currently switched off while the app is finalized. Topping up by purchasing directly at the till (via Storyous) remains an alternative route, where payment details are processed exclusively by that location's checkout system (see Art. 5).

2.12 Mobile app (team app and customer app)

If you install our mobile app (the customer loyalty program, or the internal team app), we additionally process:

• a technical device token for delivering push notifications (Apple APNs for iOS, Google FCM for Android) — a different mechanism from browser push (Art. 2.10), which you set up and revoke directly in the app / your phone's notification settings
• an app access token — a technical identifier for your login session in the app, equivalent to a session cookie on the web
• if you sign into the customer app via Sign in with Apple: the same Apple account identifier (sub claim) as when signing in on the web (Art. 2.5) — we only verify the login token's cryptographic signature using Apple's public keys, and send it no extra data of yours
• if you request a digital loyalty card for Apple Wallet / Google Wallet: your name and loyalty card number (Art. 2.8) are embedded directly in the card you save to your phone — this copy is then under the control of your device, not our database

The internal team app displays the same data we already process under Art. 2.4 (shift schedules, attendance, performance reviews) — just via a mobile interface instead of the web panel; nothing additional is collected.

3. Purposes and legal basis of processing

Purpose	Legal basis (Art. 6 GDPR)	Retention period
Displaying and moderating staff reviews	Legitimate interest (Art. 6(1)(f)) — service improvement and feedback	For the duration of the service, max. 3 years
Verifying the receipt to prevent form abuse	Legitimate interest (Art. 6(1)(f))	Immediately; we don't store any data ourselves besides the receipt number
Contacting you after a low rating (voluntarily provided email)	Consent (Art. 6(1)(a)) — by entering your email in the form	For the duration of the service, max. 3 years (together with the review)
Traffic analytics (Google Analytics)	Consent (Art. 6(1)(a)) given in the cookie banner	Per Google's settings, typically 14 months
Personalized advertising (Google AdSense)	Consent (Art. 6(1)(a))	Per Google's settings
Handling an email inquiry	Legitimate interest or pre-contractual relations (Art. 6(1)(b)/(f))	3 years from the last communication
Recruitment (submitted CVs)	Consent / pre-contractual relationship	6 months after the hiring process ends, unless otherwise agreed
Maintaining a voluntary customer account, login, and saving favorites	Consent / performance of the account service contract (Art. 6(1)(a)/(b)) — by voluntary registration	For the lifetime of the account; within 30 days of a deletion request
Sending customers alerts about new limited editions (email / push)	Consent (Art. 6(1)(a)) — by explicitly enabling it in account settings, revocable at any time	Until consent is withdrawn or the account is deleted
Fulfilling a drink pickup order (preparation, handover, status communication)	Performance of a contract (Art. 6(1)(b)) — the order can't be prepared or handed over without this data	12 months from pickup (for complaints and proof of order)
Informing you of order status (email, or push notification)	Performance of a contract (Art. 6(1)(b)) — relates solely to your order, not a marketing message	For the duration the order is being handled
Limiting uncollected orders per email / phone (fake-order prevention)	Legitimate interest (Art. 6(1)(f)) — protecting operations against abuse and ingredient waste	Together with the order
Storing the loyalty card number and showing it to staff to apply a discount	Consent (Art. 6(1)(a)) — by voluntary entry; for a specific order, performance of a contract (point b)	Until deleted in your account; a copy on the order for 12 months
Measuring QR-code campaign effectiveness (IP hash, device, approximate location)	Legitimate interest (Art. 6(1)(f)) — evaluating our own promotion; IP is stored only as a hash	24 months
Measuring short-link clicks	Contains no personal data — only the aggregate daily click count is stored	For the lifetime of the link
Mini-game leaderboard (score, games played, first name and last-name initial shown to logged-in players)	Legitimate interest (Art. 6(1)(f)) — an entertainment feature for logged-in users; you may object	For the lifetime of the account; within 30 days of a deletion request
Maintaining the credit wallet and transaction history (beta loyalty program)	Performance of a contract / consent (Art. 6(1)(a)/(b)) — by voluntarily joining the program	For the lifetime of the account; within 30 days of a deletion request
Issuing and redeeming coupons	Performance of a contract (Art. 6(1)(b))	Until redemption/expiry + 12 months (proof of transaction)
Push notifications via the mobile app (device token, FCM/APNs)	Consent (Art. 6(1)(a)) — by enabling notifications in the app/phone, revocable at any time	Until consent is withdrawn or you log out of the app
Generating a digital loyalty card (Apple/Google Wallet)	Consent (Art. 6(1)(a)) — by voluntarily downloading the card to your phone's wallet	The card lives on your device; on our side, only for as long as the card number (Art. 2.8) is valid

4. Cookies — types and consent

In accordance with Section 89(3) of Czech Act No. 127/2005 Coll., we only store cookies on your device if they are not strictly necessary, or with your consent.

• Necessary cookies — provide basic site functionality (session, CSRF protection, cookie banner). These cookies don't require consent.
• Analytics cookies — Google Analytics (G-C6JW4R1125). Activated only after consent.
• Advertising cookies — Google AdSense, managed via Google Tag Manager (GTM-N6J26BRM). Activated only after consent.

You can withdraw consent at any time by clearing cookies in your browser or deleting the "cookieConsent" record from the site's storage. Until consent is given, all Google consent categories (both analytics and advertising) are set to denied under Google Consent Mode v2 (analytics_storage, ad_storage, ad_user_data, ad_personalization), and the Google AdSense script doesn't load at all until you consent.

5. Recipients of personal data

We may share your data with the following categories of recipients — all act as processors under signed agreements:

• Google Ireland Ltd. — Google Analytics, Google AdSense, Google Tag Manager, "Sign in with Google" (Google OAuth) for employee authentication to internal systems, Firebase Cloud Messaging (delivering push notifications to the Android app), and Google Wallet (digital loyalty card). Potential data transfer to the USA based on standard contractual clauses under Art. 46 GDPR and the EU-US Data Privacy Framework.
• Apple Inc. — the Apple Push Notification service (delivering push notifications to the iOS app), Apple Wallet (digital loyalty card), and "Sign in with Apple" for logging into your customer account and the app (Art. 2.5, 2.12). It receives a technical device token, and, when a card is generated into the wallet, your name and loyalty card number; when you sign in with Apple, we only verify the login token's signature using its public keys and send it no extra data. Potential data transfer to the USA based on standard contractual clauses under Art. 46 GDPR.
• Microsoft Ireland Operations Ltd. — the Microsoft Entra ID service ("Sign in with Microsoft") for employee and partner authentication to internal systems. Potential data transfer to the USA based on standard contractual clauses under Art. 46 GDPR and the EU-US Data Privacy Framework.
• Stripe Payments Europe, Ltd. — the payment gateway for topping up the in-app credit wallet (Art. 2.11, Art. 13 of the terms of service) and the upcoming online card payment for orders. Your card number and payment details are entered directly into Stripe and never reach our servers — we only receive confirmation of the payment and its amount.
• Storyous.com s.r.o. — the Storyous checkout and loyalty system. We pass it the receipt number to verify a review's validity; the loyalty card number is used by staff to apply your discount directly at checkout.
• Discord Netherlands B.V. / Discord Inc. — an internal operations channel to which new-order details (order contents, customer phone and email) are sent so staff at the location notice it immediately. The channel is private and accessible only to authorized employees. Processing also takes place on servers in the USA based on standard contractual clauses under Art. 46 GDPR.
• Browser push service providers (Google, Mozilla, or Apple, depending on the browser you use) — deliver push notifications to your device. The notification content is encrypted; they're given your browser's technical push channel address, not your email or name.
• Behold Designs Ltd. — the Behold.so service for displaying the public Instagram feed on the homepage. Behold caches public posts from the @oxotea_cz account on its CDN. We don't share your personal data with it, but when you visit the page, images load from its infrastructure (IP address, technical browser headers).
• Functional Software, Inc. (Sentry) — an error-monitoring service. When a server error occurs, a record containing the IP address, URL, and technical request data may be sent to the USA. The transfer is secured by standard contractual clauses and the EU-US Data Privacy Framework.
• The operator of your chosen location (franchise partner) — if the location you chose is run by a franchise partner, its staff will see your order (contents, name, phone, loyalty card number) in order to prepare and hand it over. They process this data under a contract and our instructions, solely to fulfill that order. You can see the specific operator in the ordering system before you submit your order, and in the confirmation email.
• Our web hosting provider — stores data on a server in the EU.
• Accounting and IT consultants — only to the extent necessary for operations.

Beyond the recipients listed above, we don't share your data with any third party unless required to do so by law.

6. Transfers outside the EU/EEA

Data is transferred outside the EU as part of the Google (Analytics, AdSense, Tag Manager, OAuth, Firebase, Wallet), Apple (APNs, Wallet), Microsoft (Entra ID OAuth), Discord (internal operations channel with orders), and browser push services, specifically to the USA. This transfer is secured by standard contractual clauses approved by the European Commission and both providers' participation in the EU-US Data Privacy Framework.

7. Your rights

As a data subject, you have the following rights under GDPR:

• Right of access (Art. 15) — to know what data we process about you.
• Right to rectification (Art. 16) — to have inaccurate data corrected.
• Right to erasure / "to be forgotten" (Art. 17).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object (Art. 21) — particularly against processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — withdrawal doesn't affect the lawfulness of processing before it.
• Right not to be subject to automated decision-making (Art. 22).

Send your requests to [email protected]. We respond within 30 days at the latest. For identification purposes, we may request additional information to ensure data isn't released to an unauthorized person.

8. Right to lodge a complaint

If you believe that the processing of your data violates GDPR, you have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
Website: uoou.cz

9. Security

Data is stored over an encrypted connection (HTTPS) and protected by measures reflecting the current state of the art. Only authorized employees and processors bound by confidentiality have access to personal data.

Internal portals (admin and partner) are protected by multi-step authentication — users can log in with a password (stored hashed with bcrypt), through federated Google or Microsoft identities (OAuth 2.0 / OpenID Connect), or with passwordless authentication (passkey / WebAuthn). Two-factor authentication (TOTP), protected by application-key encryption, is available for sensitive operations.

The customer account (bubblelab.cz/ucet) and the customer app offer similar passwordless login via passkey (WebAuthn) or a federated Google / Apple identity (OAuth 2.0 / OpenID Connect) — alongside a classic password and a one-time email link.

10. Changes to this policy

We may update this policy if the scope of processing or the legal framework changes. The current version is always available on this page.

Effective: October 11, 2026 (added Sign in with Apple and passwordless passkey login for the customer account and app, and the Stripe payment gateway for topping up credit; the previous version from October 3, 2026 added the credit loyalty program (beta), the customer and team mobile apps, push notifications via FCM/APNs, and the Apple/Google Wallet digital loyalty card)