1. Data controller
The controller is Ubytování Kvilda s.r.o., Company ID 29902622, registered office at Zdíkovec 19, 384 73 Zdíkov. For privacy matters, contact info@upickukvilda.cz or +420 602 883 385.
2. Data we process
We process the booking contact’s identification and contact details, the dates, room, price, payment information and record of acceptance of the terms. For every staying guest, we process first and last name, registered residence or corresponding address abroad, date of birth, nationality, identity-document type and number, and the local-fee amount or reason for exemption. Document numbers are encrypted in the database. The IP address is stored only as a non-reversible hash to evidence submission and protect the system.
3. Purposes and legal bases
The accommodation operator receives a paid-booking confirmation by email containing the registered guests’ details, including identity-document type and number. This enables the operator to verify the details on arrival and enter them into the physical guest register. We do not send copies or photographs of identity documents.
- handling the booking and providing accommodation – performance of a contract and pre-contractual steps,
- accounting, local fees and guest registration – compliance with legal obligations,
- legal claims, fraud prevention and system security – the controller’s legitimate interests.
We do not use the data for newsletters or marketing without separate, voluntary consent.
Contact and booking details are required to enter into and perform the accommodation contract. Guest-register and local-fee details are required by law. Without the required details, the online booking cannot be completed; you may contact us to resolve an exceptional situation individually. Our own Mi-JaNET analytics and the embedded Google map are optional and rely on consent, which may be withdrawn at any time in the cookie settings.
4. Recipients
Data may be shared as necessary with the web-hosting and email providers, the mobile operator delivering transactional SMS messages, the ČSOB payment gateway, Google as the provider of reCAPTCHA and the optional embedded map, the accountant and IT administrator. The SMS gateway is operated on a local Teltonika device; it is not used for marketing. Our own analytics and the embedded map run only with consent. Mi-JaNET analytics does not receive booking or payment page data and does not send IP addresses to an external geolocation service. When the optional ARES lookup is used, only the entered Czech Company ID is sent to the public ARES register and the company name and registered office are returned. Data is also disclosed to public authorities where required by law. Appropriate data-processing arrangements are used with processors. If a provider transfers data outside the EEA, the transfer must rely on an adequacy decision or other safeguards under Chapter V GDPR; information about the applicable safeguard is available from us on request and in the provider’s privacy policy.
5. Retention
Booking data is kept for the performance of the contract and normally for a further 3 years to protect legal claims. Accounting and tax documents are retained for the statutory period, normally 5 or 10 years. Guest-register and local-fee records are kept for 6 years from the last entry. Completed SMS and arrival-email queue records are removed after 90 days. Failed, incomplete and test orders are deleted or anonymised within 90 days unless a security incident requires longer retention.
Consent-based Mi-JaNET analytics uses random browser and visit IDs, device and language categories, referring domains and approximate countries. Visit identifiers are retained for up to 13 months and anti-abuse hashes for 24 hours. Aggregate daily counts are retained for historical statistics. No full IP address is stored in this analytics database and no booking data is linked to these IDs.
6. Your rights
You may request access, correction, erasure, restriction and portability and may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Send requests to the email above. You may also lodge a complaint with the Czech Office for Personal Data Protection at uoou.gov.cz.
7. Automated security assessment
Google reCAPTCHA v3 automatically assesses the risk of a form submission. A low security score may prevent automated submission but has no other legal or similarly significant effect. A legitimate booking can be made by telephone or email if needed. The system also automatically checks capacity, date collisions and minimum-stay rules.
Last updated: 10 October 2026