Effective from 24 September 2026
1. Data controller
The controller of your personal data is Zdeněk Ňorek, a sole trader, company ID (IČO) 23511192, registered at U Kamýku 284, 142 00 Prague 4, Czech Republic. Establishment: Apartmán Sklenářka, 517 64 Orlické Záhoří.
Contact for personal data matters: rezervace@apartmansklenarka.cz, phone +420 733 610 253. We have not appointed a data protection officer, as our activities do not require one.
2. What data we process and why
- Reservation – first name, surname, e-mail, phone, address, dates of stay, number of adults and children and children's ages, special requests, information about a dog; for companies the company name, company ID and VAT ID. Purpose: concluding and performing the accommodation contract, communication about your stay, issuing a receipt. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Payment – amount, payment method and status, transaction identifier. We never receive your card number – you enter it directly with the payment gateway. Legal basis: performance of a contract and a legal obligation (accounting).
- Online check-in and guest register – first name, surname, date and place of birth, nationality, permanent address, type and number of identity document, for foreign nationals the purpose of stay and visa number, e-mail, phone, IP address and time the form was submitted. Purpose: the guest register for the local accommodation fee and, for foreign nationals, reporting the stay to the foreign police. Legal basis: legal obligation (Art. 6(1)(c) GDPR; Czech Act No. 565/1990 Coll. on local fees and Act No. 326/1999 Coll. on the residence of foreign nationals).
- Contact form and e-mail – name, e-mail, message text, IP address. Purpose: answering your enquiry and protecting the form against abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- AI assistant on the website – the text of your question and the answer, a random session identifier, language; your location only if you allow it in your browser (to calculate a route). Answers are generated by a language model from Anthropic and no decisions are made about you. Legal basis: legitimate interest. Please do not enter sensitive data into the chat.
- Marketing messages – name, e-mail, history of stays. Purpose: offers to former guests. Legal basis: legitimate interest for our own customers (Section 7 of Czech Act No. 480/2004 Coll.), otherwise consent. You can unsubscribe at any time using the link in every e-mail.
- Website operation and security – IP address, browser information, time of access. Purpose: protection against attacks and abuse, error diagnostics. Legal basis: legitimate interest.
The data needed for a reservation and the guest register are mandatory – without them we cannot provide accommodation or meet our legal obligations. All other data are provided voluntarily. If you book through an intermediary (e.g. Booking.com), we receive the data needed for your stay from them. We do not make automated decisions about you and do not carry out profiling.
3. How long we keep your data
- reservations: 10 years after departure, after which we anonymise them (the dates and price remain, no longer linked to you),
- online check-in data (guest register, register of foreign guests): 6 years after departure,
- accounting and tax documents: for the period required by accounting and tax law,
- contact form messages: 12 months,
- AI assistant questions: 12 months,
- contacts for marketing messages: until you unsubscribe, at most 5 years after your last stay,
- data from an unfinished payment: 90 days,
- operational and security logs: for as long as necessary to keep the website secure,
- cookie consent: 12 months.
4. Who we share your data with
We never sell your data. We share them only to the extent necessary with processors who provide technical services for us and follow our instructions:
- Supabase, Inc. – database and server side of the website, data stored in the EU (Frankfurt am Main),
- Netlify, Inc. (USA) – website hosting,
- Resend (USA) – sending reservation e-mails,
- WEDOS Internet, a.s. (Czech Republic) – e-mail mailbox,
- Google Ireland Ltd. – map display and route calculation,
- Anthropic PBC (USA) – AI assistant on the website.
Payment providers act as independent controllers – Stripe Payments Europe, Ltd. (Ireland; card payments), GoPay s.r.o. (Czech Republic; card payments and bank transfers) and Confirmo (cryptocurrency payments) – as does Booking.com B.V. (Netherlands) if you book through it. Where required by law, we provide data to the municipal office of Orlické Záhoří (accommodation fee), the Czech Police – foreign police service (reporting stays of foreign nationals), the tax office or courts.
Transfers to providers based in the USA are made on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission.
5. Your rights
You have the right:
- to access your data and obtain a copy,
- to have inaccurate data corrected,
- to erasure, where we no longer need the data and no legal obligation prevents it (typically the guest register),
- to restriction of processing,
- to data portability for data you provided to us under a contract,
- to object to processing based on legitimate interest, including marketing messages (we will always comply in that case),
- to withdraw consent where processing is based on consent,
- to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
Send your request to rezervace@apartmansklenarka.cz. We will handle it without undue delay and within one month at the latest.
6. Security
We protect your data with technical and organisational measures: encrypted connections (HTTPS), access to administration only for authorised persons with their own login, database-level access control and regular backups.
7. Cookies
The essential cookie "cookieConsent" (12 months) stores your choice and does not require consent. We use analytics cookies (Google Analytics) and marketing cookies (Google Ads) only with your consent, and only when measurement is enabled on the website. You can change your consent at any time in the cookie settings in the website footer.
8. Changes to this policy
We may update this policy. The current version is always available on this page; we will notify guests with upcoming reservations of significant changes by e-mail.