Privacy Policy

1. Data controller

The controller of personal data processed through this website is David Hilbert, company registration number 29712700, operator of Hotelové Závady, with its registered address at Příčná 671, 788 15 Velké Losiny.

For personal data enquiries, contact us at kontakt@hotelovezavady.cz or by telephone on +420 728 060 979.

2. Personal data we process

• Contact details: name, email, telephone number and hotel or company name.
• Enquiry details: number of buildings, approximate number of rooms or spaces and users, selected areas of interest, message content and subsequent business communications. The telephone field is available only in the Czech and Slovak forms.
• Enquiry attribution: first page visited, submission page, visit source (the referring website’s domain) and the campaign parameters utm_source, utm_medium and utm_campaign. We do not send form content in analytics events.
• Website technical data: IP address, device type, browser, approximate location, pages visited and visit time, where available from operational logs or analytics.
• Billing and contractual data: information needed for offers, contracts, invoicing, accounting and customer support.
• Data entered into the application by the customer: particularly user accounts, issue reports, photographs, comments, repair history and operational metadata.

3. Purposes and legal bases for processing

• Responding to an enquiry and preparing an offer: pre-contractual negotiations.
• Providing the application, customer support and account administration: performance of a contract.
• Invoicing, accounting and compliance with statutory obligations: legal obligation.
• Website and application security, protection against abuse and incident handling: legitimate interest.
• Basic business communications with customers and records of the relationship’s history: legitimate interest.
• Marketing communications outside a customer relationship or optional analytics/marketing cookies: consent, where required.

4. Retention periods

• We retain enquiries and business communications for the time needed to handle the enquiry and thereafter for a reasonable period to protect legal claims.
• We retain contractual and billing data for the duration of the contract and thereafter for the period required by accounting, tax and other legislation.
• We retain operational and security logs for a reasonable period needed for security, diagnostics and the protection of rights.
• We retain application data while the service is provided and, after it ends, as agreed with the customer, unless there is a statutory reason for further retention.
• We retain data processed on the basis of consent until consent is withdrawn or the stated period of consent expires.

5. Recipients and processors

Personal data may be processed by suppliers who help us with website operation, hosting, analytics, form submission, email communications, invoicing, accounting and customer support.

In particular, we use these infrastructure and online service providers: Vercel for hosting and analytics, Google for Google Analytics and FormSubmit.co for contact form submission.

6. Transfers outside the EU

Where a supplier processes data outside the European Union or European Economic Area, this takes place only in accordance with the GDPR, in particular on the basis of an adequacy decision, standard contractual clauses or other appropriate safeguards.

When selecting suppliers, we consider security, contractual protection and minimisation of the data transferred.

7. Data subject rights

• The right of access to personal data.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure where the statutory conditions are met.
• The right to restriction of processing.
• The right to data portability.
• The right to object to processing based on legitimate interests.
• The right to withdraw consent where processing is based on consent.
• The right to lodge a complaint with the Czech Office for Personal Data Protection.

8. Exercising your rights

You may exercise your rights by emailing kontakt@hotelovezavady.cz. To protect personal data, we may request reasonable verification of the applicant’s identity.

We handle requests without undue delay, normally within one month, unless the GDPR allows an extension in view of the complexity or number of requests.

9. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or misuse.

Application access should be individual and protected by a strong password or another appropriate security measure. The customer is responsible for managing their users’ access.

10. The customer’s role when using the application

When using the application, the customer may enter personal data of employees, suppliers or other people. In such cases, the customer generally acts as the controller of that data and determines the purposes and means of processing.

The provider may act as a processor of that data. For production use of the application, we recommend entering into a separate data processing agreement under Article 28 of the GDPR.