Last updated: October 31, 2025
privacy policy
I. Data Controller and Contact Details
The data controller within the meaning of Article 4(7) of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) is:
Ondřej Diblík
Company ID (IČO): 43052886
Address: Petržílkova 2704/36, 158 00 Prague 5, Czech Republic
E-mail: info@apartmanhubert.cz
Phone: +420 603 447 903
Data Protection Officer (DPO):
The controller has not appointed a separate Data Protection Officer. As an individual operating a single accommodation facility, I am not required under Article 37 of the GDPR to designate a DPO. I personally handle all matters related to data protection. Any questions regarding your personal data can be addressed directly to the contact details above.
Supervisory Authority:
Office for Personal Data Protection (ÚOOÚ)
Address: Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
Website: www.uoou.cz
Phone: +420 234 665 111
II. Scope, Purpose and Legal Basis of Personal Data Processing
We process your personal data only to the extent necessary for the following purposes:
Reservation and Accommodation Services
Purpose: To conclude and perform an accommodation contract.
Processed data: name, surname, permanent address, phone number, e-mail, dates of stay, number of guests, special requests.
Legal basis: Article 6(1)(b) GDPR – performance of a contract.
Recipient: Trevlix, s.r.o. (reservation system).Guest Book and Foreigner Reporting
Purpose: To fulfil legal obligations of the accommodation provider.
Processed data: name, surname, address, date of birth, nationality, ID/passport number and type, arrival and departure dates.
Legal basis: Article 6(1)(c) GDPR – compliance with Act No. 326/1999 Coll. on the Residence of Foreigners, and Act No. 565/1990 Coll. on Local Fees.
Retention period: 6 years.
Recipient: Police of the Czech Republic (upon request).Accounting and Tax Obligations
Purpose: To comply with obligations under accounting and tax laws.
Processed data: name, address, company ID/VAT number, invoice and payment details.
Legal basis: Article 6(1)(c) GDPR – compliance with Acts No. 563/1991 Coll. and No. 586/1992 Coll.
Retention period: 5–10 years.Guest Communication and Service Improvement
Purpose: Confirmation of reservations, handling inquiries, and collecting feedback.
Legal basis: Article 6(1)(b) (contract performance) and Article 6(1)(f) (legitimate interest in maintaining service quality).
Retention period: 5 years.Direct Marketing – Information about Our Services
Purpose: Sending offers of similar services to existing guests.
Processed data: name, e-mail address.
Legal basis: Article 6(1)(f) GDPR – legitimate interest in informing previous guests about updates.
Retention period: Until unsubscribed.
Right to object: You may object to such processing at any time.Website Analytics (Google Analytics)
Purpose: Improving website functionality and user experience.
Processed data: IP address, cookies, on-site behaviour.
Legal basis: Article 6(1)(a) GDPR – consent.
Recipient: Google Ireland Limited / Google LLC.
Data transfer to the USA: Based on Standard Contractual Clauses (SCC).
Provision of Personal Data
Providing your personal data is necessary for concluding and performing the accommodation contract. Without providing this data, the reservation cannot be completed and accommodation cannot be provided. Data required by law are mandatory – failure to provide them would make it impossible to conclude the contract.
Indirect Data Collection
If you made a reservation through an external platform (e.g. Booking.com), we receive your data from that platform. Typically, this includes your name, contact details, and stay information.
III. Processing of Children’s Data
We accommodate children accompanied by their parents or guardians. Personal data of children (name, date of birth, ID details) are processed only to the extent necessary to provide accommodation and comply with legal obligations. Such data are provided by the parent or guardian and are not used for marketing or profiling purposes.
IV. Transfers to Third Countries
Data are transferred outside the EU only when using Google Analytics. Google relies on Standard Contractual Clauses under Article 46 GDPR. Please note that different data protection standards may apply in the USA; however, SCCs ensure an adequate level of protection.
V. Doba Uchovávání
Types of data, retention periods, legal basis / reason:
Guest book: 6 years – legal obligation.
Accounting documents: 5–10 years – accounting and tax obligations.
Reservations and communication: 5 years – archiving and dispute resolution.
Marketing contacts: until unsubscribed – voluntary subscription.
Google Analytics: 26 months – service configuration.
Non-binding inquiries: deleted after processing – no contract concluded.
After these periods expire, data are securely deleted or anonymised.
VI. Cookies
Essential cookies (e.g. trevlix_session, PHPSESSID) do not require consent. Analytical cookies (_ga, _gid, _gat) require explicit consent and can be withdrawn at any time. Data may be transferred to the USA. Blocking essential cookies will prevent completion of the reservation process.
VII. Your Rights
You have the following rights under the GDPR:
right of access, rectification, erasure, restriction, data portability,
right to object to processing,
right to withdraw consent,
and the right to lodge a complaint with the supervisory authority (ÚOOÚ).
Requests can be sent to info@apartmanhubert.cz and are handled within 30 days.
VIII. Data Security
We use antivirus protection, encrypted backups, HTTPS, strong passwords, and restricted access to data. Paper documents are kept securely locked. In case of a data breach, you will be notified within 72 hours.
IX. Automated Decision-Making
We do not carry out automated decision-making or profiling.
X. Final Provisions
These principles are in accordance with the GDPR and Czech legislation (Acts on the Residence of Foreigners, Local Fees, and Accounting). Updates will be published on our website and marked with their effective date.