Privacy policy

01

1. Who processes your data

• Address: Petřín 711/18, 360 01 Karlovy Vary, Czech Republic
• Company ID: 23981083
• Czech data box: rdwz2ru
• E-mail: info@carlsbad-apartments.cz
• Telephone: +420 777 770 656, +420 725 565 825

02

2. What data we process and why

• Accommodation bookings: first name and surname, e-mail, telephone, dates of stay, number of guests and any note to the booking. You enter these in the Previo reservation system so that we can confirm free dates and prepare your stay.
• Parking requests: first name and surname, e-mail, telephone, the dates and, optionally, the car number plate and a note. They are stored on our server in Germany and the staff use them to confirm or decline the request; a copy is sent to our e-mail address. Parking is booked only alongside a stay with us.
• Gift vouchers: the purchaser’s first name and surname and e-mail and, optionally, their telephone number, the recipient’s name and a dedication; for payment by bank transfer, the account holder’s name and the number of the account the payment came from. They are stored on our server in Germany and serve to issue and deliver the voucher, match it with the payment and, if you withdraw from the contract, refund the money. The purchaser gives us the recipient’s name and the dedication solely so that we can print them on the voucher.
• Voucher redemption requests: first name and surname, e-mail, telephone, dates of stay, number of guests and, optionally, a note. The staff use the request to create an accommodation booking; a copy is sent to our e-mail address. We delete the request itself from the voucher records once it has been dealt with; the record of where we sent the confirmation disappears together with the rest of the voucher’s personal data. The details of the booking created are then kept like those of any other accommodation booking.
• Traffic measurement (only with consent): a pseudonymous identifier stored in a cookie, IP address, pages visited, approximate location at city level, device and browser type, and where you came to the site from. It serves aggregate statistics, not the identification of an individual.
• Booking and the accommodation contract: first name and surname, contact details, dates, number of guests and any billing details. Without them we cannot prepare the stay.
• Statutory guest register: name, date of birth, address of permanent residence, number and type of identity document, period of accommodation and purpose of stay. We enter these in the register and the house book before or upon arrival.
• Guests from abroad: the details from the registration form, which we pass to the foreign police.
• Accounting and tax: the details stated on invoices and proof of payment.
• Operation and security of the website: the hosting provider keeps ordinary operational logs, which also contain the IP address.

03

3. Legal basis and retention

• Performance of a contract and steps prior to entering into it (Art. 6(1)(b)): enquiries, bookings and the stay itself. We keep the data for the duration of the stay and thereafter for the limitation period, as a rule three years from its end. A garage parking request is kept for a shorter time — no more than twelve months after the end of the booked dates, after which the site deletes it by itself.
• Performance of the gift voucher contract (Art. 6(1)(b)): ordering, issuing, delivering and redeeming the voucher, and refunding the money on withdrawal. An order that was not paid and has lapsed is deleted by the site, personal data included, within 30 days of being sent. For a voucher that has come to an end — used up, cancelled or expired — the site deletes names, contact details and the dedication 12 months after its end; only an accounting record with the code, value, dates and order number remains.
• Compliance with a legal obligation (Art. 6(1)(c)): the register kept under the Czech Local Charges Act and the house book kept under the Act on the Residence of Foreign Nationals are retained for six years from the last entry. Accounting and tax documents for five to ten years under the Accounting Act and the Value Added Tax Act; this also applies to documents for the sale and redemption of gift vouchers.
• Legitimate interest (Art. 6(1)(f)): replies to enquiries that do not lead to a booking, protection against possible claims, and the security of the website. Enquiries not followed by a booking are deleted no later than twelve months after the last communication. The recipient’s name and the dedication on a gift voucher also rest on legitimate interest: the recipient does not enter into a contract with us, we hold their name only because the purchaser wishes to have it on the voucher, and we delete it together with the voucher’s other personal data.
• Consent (Art. 6(1)(a)): traffic measurement in Google Analytics. Without your consent nothing is measured and not a single request goes to Google. Consent is valid for twelve months and you can withdraw it at any time via the “Cookie settings” link in the footer; withdrawal does not affect the lawfulness of processing carried out beforehand.

04

4. Who we pass data to

• Web server operator: Merrido, info@merrido.com. The server is located in a Hetzner Online GmbH data centre in Germany. The garage parking requests and the gift voucher records sit on that same server.
• E-mail service provider: [TO BE COMPLETED: name of the e-mail mailbox provider]. Our e-mail correspondence with you passes through it, including the e-mails with gift vouchers.
• Google Ireland Limited (only with consent to traffic measurement): operates Google Analytics 4. Processing takes place partly in the United States at Google LLC, on the basis of the European Commission’s adequacy decision (the EU–US Data Privacy Framework) and standard contractual clauses. We have disabled data sharing for advertising purposes and Google Signals, and the retention period is set to 14 months.
• The Previo reservation system (previo.cz): you fill in your booking in a frame that this system embeds in the site from booking.previo.app. The booking data — name, contact details, dates, number of guests and any note — is processed by its operator as a processor under a contract pursuant to Article 28 of the GDPR. System operator: [TO BE COMPLETED: business name and company ID of the operator of Previo under the contract concluded].
• Accountant or tax adviser: [TO BE COMPLETED: name of the accounting firm, or state that the operator keeps the accounts itself].
• The bank holding our account for gift voucher payments: it processes the payment details — the account holder’s name and account number, the amount and the payment reference — as a separate controller under its own rules.
• The administrator of the local stay charge, i.e. the City of Karlovy Vary municipal authority: to the extent of the guest register, in the event of an inspection.
• The Police of the Czech Republic, foreign police service: registration forms for guests from abroad, within three working days of arrival.
• The tax office and other public authorities: only to the extent required by law.
• Booking.com: if you book through that portal, its operator also processes your data as a separate controller under its own policy. From it we take only the data needed for the stay.

05

5. Cookies

• Technically necessary cookies: they store your choice from the consent banner (the `ca_souhlas` cookie, valid twelve months after consent and six months after refusal). Our site stores nothing else in your browser of its own accord.
• Server logs: the hosting provider stores operational records including the IP address for a limited period — older records are automatically overwritten by newer ones, within a matter of months.
• The Previo reservation system: the booking frame comes from booking.previo.app and stores a session identifier cookie on its own domain (valid 24 hours). It also places two temporary items in your browser on our domain, needed for the return from the payment gateway; they disappear when the tab is closed. All of it is technically necessary for a service you have requested yourself, and therefore no consent is required.
• Analytics cookies (only with consent): `_ga` and `_ga_<measurement ID>`, valid 24 months, set by Google Analytics 4. If you withdraw consent, measurement stops and we delete these cookies.
• A map (under consideration): if we embed a third-party map in the site, we will state here which cookies it sets and how to give or withdraw consent.

06

6. Your rights under the GDPR

• Right of access: you can ask what data we hold about you and receive a copy of it.
• Right to rectification: we will correct inaccurate or incomplete data.
• Right to erasure: we will delete data for which the reason for processing has ceased and where no statutory period prevents it.
• Right to restriction of processing: while we are dealing with your objection or a dispute over accuracy, we will not work with the data further.
• Right to data portability: data you have provided to us and that we process by automated means on the basis of a contract will be handed over to you in a machine-readable format.
• Right to object to processing based on legitimate interest: unless we demonstrate compelling grounds, we will end the processing.
• Right not to be subject to automated decision-making: we carry out none; your booking is decided by a person.
• Right to lodge a complaint with the supervisory authority.

07

7. Contact and supervisory authority

• E-mail: info@carlsbad-apartments.cz
• Telephone: +420 777 770 656, +420 725 565 825
• Address: Carlsbad Apartments, Petřín 711/18, 360 01 Karlovy Vary
• Controller: Line & Co. s.r.o., company ID 23981083