Privacy policy | Roubenka Háj

Data controller

Gabriela Černá

Sole trader registered under the Czech Trade Licensing Act

Address: Horní Nivy 56, 356 01 Dolní Nivy
Company ID (IČO): 62637401
Email: info@roubenka-haj.cz
Website: https://www.roubenka-haj.cz

Given the scale of our processing we have not appointed a data protection officer. Please contact the controller directly in all data protection matters.

What data we process

Reservation data

First name and surname of the person booking
Email address and phone number
Dates of stay, number of adults, children and pets
Notes and special requests you provide yourself
Payment details – variable symbol, deposit and balance amounts, payment dates

Online check-in data (guest book)

We are required by law to collect this data; without it we cannot accommodate you.

First name and surname of every guest
Date of birth
Nationality
Type and number of passport or identity card
Permanent residence address
For non-EU nationals, visa or residence permit number where required
Purpose and duration of the stay

User account data

Email address
Password (stored only as an irreversible hash)

Guest profile

Reservations giving the same e-mail address or phone number are kept under one guest profile. These are not new data — they are the same reservations — but linking them across the years is described separately, because it creates a record of one person.

Your name and contact details as you last gave them
A list of your stays and an internal rating of each one (not rated / fine / problem)
The operator's internal note about you, where one has been written — you do not see it in the application, but you are entitled to a copy of it

Technical data

IP address and access logs
Content of messages you send us through the contact form

Purpose of processing

Handling your reservation and communicating about the stay and its changes
Keeping the guest book we are obliged to maintain as an accommodation provider
Reporting the accommodation of foreign nationals to the Police of the Czech Republic through the Ubyport system
Issuing and archiving tax and accounting documents
Registration and management of a user account
Answering enquiries sent through the contact form
Securing the website and protecting it against misuse
Recognising a returning guest and keeping an operational record of how the stays went

Legal basis for processing

Performance of the accommodation contract and steps taken before entering into it – Art. 6(1)(b) GDPR. Reservation data is processed on this basis. Providing it is a contractual requirement; without it the reservation cannot be concluded.
Compliance with a legal obligation – Art. 6(1)(c) GDPR in conjunction with Sections 101 and 102 of Czech Act No. 326/1999 Coll. on the residence of foreign nationals (keeping the guest book and the reporting duty towards the Police of the Czech Republic).
Compliance with a legal obligation under Czech Act No. 563/1991 Coll. on accounting and Act No. 235/2004 Coll. on value added tax.
Legitimate interest – Art. 6(1)(f) GDPR – in particular website security, protection against misuse and the defence of legal claims.
Consent – Art. 6(1)(a) GDPR – only for processing that is neither necessary for the reservation nor required by law. Consent is always voluntary and can be withdrawn at any time.

We do not require and do not need your consent for the reservation and the stay itself – that data is processed on the basis of the contract and of legal obligations. The confirmation in the form only serves as evidence that you were informed about the processing.

How long we keep the data

Reservation data – for the duration of the stay and 3 years thereafter (limitation period for contractual claims).
Guest book data – 6 years from the last entry, as required by Section 101 of Act No. 326/1999 Coll.
Tax and accounting documents – 5 years under the Accounting Act, 10 years for VAT documents.
User account data – while the account exists and 3 years after its deletion.
Contact form messages – 1 year after the enquiry is resolved.
Technical logs – 12 months at most.
Data processed on the basis of consent – until consent is withdrawn.

Who we share the data with

We do not pass your data to anyone without a legal or contractual reason. The recipients are:

Police of the Czech Republic – mandatory accommodation report for foreign nationals via the Ubyport system (Section 102 of Act No. 326/1999 Coll.).
The municipal authority – only to the extent required to pay the local stay fee.
The server hosting provider running this website, acting as a processor.
The email service provider used to send reservation confirmations, acting as a processor.
Our accountant and tax adviser, to the extent needed for bookkeeping.
Google (Google Ireland Limited and Google LLC, USA) – pages with a map (the home page, the contact page and the trip tips) load it from Google Maps, so on those pages your browser connects to Google's servers and discloses your IP address to them. On the trip tips page the map loads only once you scroll down to it. The other pages of the website do not connect to Google. Transfers to the USA rely on the EU–US Data Privacy Framework.

We do not sell your data and do not pass it on for third-party marketing. We do not transfer booking or check-in data outside the European Economic Area. We carry out no automated decision-making or profiling.

Your rights

The right of access to your data and to a copy of the data processed.

The right to rectification of inaccurate data and to erasure.

The right to restriction of processing and to object to processing based on legitimate interest.

The right to data portability to another controller.

The right to withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out beforehand.

Send your requests to the email address given under Contact; we will handle them within one month at the latest.

The right to erasure does not apply to data we are legally required to keep – in particular the guest book and accounting documents. In that case we delete the data once the statutory period expires.

You have the right to lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.cz.

Data security

All communication with the website is encrypted over HTTPS.
Passwords are stored only as an irreversible hash, never in readable form.
Guest data is accessible only to the controller and to people running the accommodation.
The database is backed up regularly and the backups are stored securely.

Cookies

We only use technical cookies essential for the website to work – keeping you signed in, remembering your language and preserving a partially filled form. Under Section 89(3) of Act No. 127/2005 Coll. these cookies require no consent.
We use no analytics or advertising cookies and do not track you across websites.