Privacy Notice
Effective from 1 November 2026 · Version 2026-11-01
1. Who controls your data and how to contact us
The controller of personal data processed when providing accommodation at Chalupa EDEN is Jakub Koželuh, business identification number (IČO) 73527858 (referred to below as "we" or the "controller").
- Accommodation property: Chalupa EDEN, Nové Chalupy 101, 384 62 Nová Pec, Czech Republic.
- Contact for personal data matters: info@chalupa-eden.cz.
- Please send requests and enquiries about personal data processing to the controller's email address above.
This notice covers accommodation enquiries and bookings, guest records, online check-in at checkin.obecnovapec.cz, communications concerning your stay and its final billing. It does not cover separate advertising or analytics services on other websites or any CCTV systems.
2. What data we collect and where it comes from
Depending on the nature of the stay and the applicable legal obligations, we process guests' identification details (first name, surname, date of birth, residential address, nationality and legally required identity document details), the dates and actual course of their stay, information required for the local accommodation fee, and contact details of the person making the booking or a participant to whom a check-in link is sent.
We also process services ordered, amounts and payment status, the payment reference (variable symbol, or VS), billing details, any payer information received with a bank transfer, electricity meter readings linked to the stay, related correspondence, and records of form submissions, document acknowledgements and handling of the stay. For foreign nationals, further information within the scope of the statutory registration form may be added for legally required records and reporting. Copies of identity documents are not required for this online check-in.
We obtain information from you, the person making the booking or another group participant, and, where applicable, the booking service through which the reservation was made. Information also arises when we provide services, communicate with you and receive payments. For minors, information may be provided by their legal representatives. If someone enters details of other guests, we ask them to share this notice with those guests; this does not mean that we regard it as proven that every guest has actually been informed.
3. Why we process data and our legal bases
Purpose Legal basis and scope
Handling enquiries and bookings, providing accommodation, processing payments and related communications. Article 6(1)(b) GDPR where you are a party to the contract or request steps before entering into a contract. For other participants who are not parties to the contract, processing is limited to what is necessary for our legitimate interest in organising the group stay under Article 6(1)(f), or is based on a legal obligation described below.
Keeping records of and remitting the local accommodation fee. Article 6(1)(c) GDPR; in particular, Czech Act No. 565/1990 Coll., on Local Fees, and the applicable generally binding municipal ordinance. We record the information required by law, including the amount of the fee or the reason for an exemption.
Keeping records of foreign guests and reporting their accommodation to the Police of the Czech Republic. Article 6(1)(c) GDPR; in particular, Czech Act No. 326/1999 Coll., on the Residence of Foreign Nationals, within the scope of accommodation providers' obligations.
Keeping income records and related tax documentation. Article 6(1)(c) GDPR; in particular, Czech Act No. 586/1992 Coll., on Income Taxes, and Act No. 280/2009 Coll., the Tax Code. The controller is not registered for VAT.
Protecting rights, handling complaints, damage and outstanding payments; securing the application and documenting its use. Article 6(1)(f) GDPR. Our legitimate interests are protecting rights and property and preventing misuse of the service. We retain only the information needed and take guests' rights into account.
We do not request consent for processing that is necessary to perform a contract or comply with a legal obligation. Ticking the acknowledgement of this notice is neither consent to advertising nor a separate legal basis for statutory record-keeping. We do not use check-in data to send advertising messages.
4. Which information we need
We need contact and booking information to arrange and organise your stay. Without it, it may not be possible to enter into or handle a booking. Information required for statutory records must be provided to the extent prescribed by the applicable law; failure to provide it may prevent us from fulfilling our obligations when accommodating you. Other information beyond this scope is voluntary. Please do not send information or copies of documents that we do not require for the stated purposes.
5. Who may receive or access data
Only the controller, Jakub Koželuh, operates the booking administration system. Database and application hosting and related email services are provided by SvetHostingu.cz s.r.o., business identification number 23591102, Krakovská 1108/5, 700 30 Ostrava–Hrabůvka, Czech Republic, acting as a processor. Technical processing includes storage, transmission, backups, security and necessary technical support.
Under the provider's GDPR addendum, its infrastructure may also involve subprocessors, in particular Master Internet, s.r.o., and České Radiokomunikace a.s. Authorised staff of these providers may have necessary technical access under their contractual and security rules. The controller does not give an external accountant or other persons access to the administration system.
We disclose legally required information to the competent municipal authority administering the local fee, the Police of the Czech Republic and other authorised bodies where required by law. Banks and any booking portals may act as independent controllers for their own services, in accordance with their own privacy notices.
Possession of a group check-in link does not allow a participant to view personal information previously submitted for other guests. However, the person making the booking may receive organisational information and the final bill for the whole group.
6. Transfers outside the European Economic Area
The application, database and email services are hosted by SvětHostingu. According to its published GDPR addendum, data and backups are located in data centres in the Czech Republic. The controller does not use any additional foreign cloud storage for this system. If the providers, data location or transfer arrangements change, the legal conditions will be assessed and this notice updated before the change.
7. How long we retain data
Retention periods depend on the purpose and type of record. A longer statutory period applies only to the data and documents needed for that obligation, not automatically to everything in the application or all correspondence.
Record or purpose Retention period
Register for the local accommodation fee. 6 years from the date of the last entry in the register (Section 3g(4) of Czech Act No. 565/1990 Coll.).
Register of foreign guests (domovní kniha). 6 years from the last entry. Paper documents replacing the register are retained for 6 years after the foreign national's accommodation ends (Section 101(4) of Czech Act No. 326/1999 Coll.).
A foreign national's registration form, where the accommodation provider must retain it. 6 years from the date the foreign national is accommodated, subject to Section 100(e) of Czech Act No. 326/1999 Coll.
Income records and related tax documentation. Until the time limit for assessing the relevant tax has expired. The period is determined by the nature of the records and Section 148 of the Czech Tax Code, including any extension, restarting or suspension of the time limit. Providing accommodation alone does not make these records subject to the ten-year retention period for VAT documents.
Enquiries, bookings and ordinary correspondence. Until the enquiry has been resolved and discussions about the stay have ended; where a booking is made, until the contract has been performed, final billing completed and mutual obligations settled. After that, only documentation needed for tax or other statutory records, or to protect specific rights as described in the next row, is retained.
Documentation for complaints, outstanding payments, damage and evidence of legal acts, including document acknowledgements. For as long as a specific right can be asserted and the evidence is necessary. This is determined by the applicable limitation or other statutory period and its actual running; where proceedings are commenced, their duration is also taken into account. It does not mean that complete guest lists are automatically retained for every possible dispute. Working copies no longer needed for any purpose are not retained further.
Ordinary server logs. The hosting provider retains them for 30 days. A record needed to resolve a specific security incident or legal claim may be retained separately while the matter is being resolved and for as long as necessary to substantiate the relevant right.
Technical backups of the database, files and email. 30 days within the hosting provider's backup cycle. Data deleted from the live system may therefore remain in technical backups until removed through that cycle. Backups are used to restore operations, not to extend the ordinary use of the data.
Email correspondence in the mailbox. The email provider stores messages until the mailbox user deletes them. The controller deletes messages according to their purpose: after an enquiry is resolved or a stay settled, or later where a legal obligation or the need to substantiate a specific legal claim continues. The technical ability to leave a message in the mailbox does not mean it is retained indefinitely. Technical email backups are subject to the thirty-day cycle above.
Where a specific record is needed for ongoing proceedings or a claim, the necessary part may be retained longer while that reason continues. Once all processing purposes have ended, we delete or irreversibly anonymise the data, taking account of the managed backup cycle. The thirty-day period for technical logs and backups does not replace the statutory retention periods for guest registers and tax documentation, nor does it determine how long data is kept in the live database.
8. How online check-in works technically
The application uses a technical session cookie to open the form securely and protect submissions. The hosting and email services may maintain technical records, such as an IP address, request time or email handover status. The application also records operational events and uses a pseudonymised form of the IP address to protect administrator login.
The private link allows information to be added to a particular booking; please forward it only to authorised participants. Previously submitted forms are accessible to authorised application operators. Final bills and organisational messages are sent to the booking's contact email address. Automated emails and calculations do not constitute decision-making under Article 22 GDPR producing legal or similarly significant effects: the accommodation provider can review and amend the information and billing.
9. Your rights and how to exercise them
You may request access to your personal data and a copy, correction of inaccuracies, and, where the GDPR conditions are met, erasure or restriction of processing. For automated processing based on a contract or consent, a right to data portability may arise.
You may object to processing based on legitimate interests on grounds relating to your particular situation. We will assess the objection and act in accordance with Article 21 GDPR. Erasure or an objection does not in itself remove statutory obligations to retain required records.
If any additional processing is based on your consent, you may withdraw it at any time; withdrawal does not have retroactive effect. Processing described as contractual or legally required is not based on such consent.
Please send requests to the controller's contact in section 1. We will respond without undue delay and within one month at the latest. If a lawful extension of up to two additional months is needed, we will inform you of it and the reasons within the first month. Where there are reasonable doubts, we may request proportionate verification of your identity. Requests are generally handled free of charge; the GDPR provides exceptions for manifestly unfounded or excessive requests.
You have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, email posta@uoou.gov.cz, website uoou.gov.cz. You do not have to contact the controller before lodging a complaint.
10. Availability and updates
We provide this notice through a link in the check-in form before information is submitted; it is also available on request. Where information is obtained from another person, the controller also fulfils the information obligation towards the guest concerned within the scope and time limits of Article 14 GDPR, generally within one month, but no later than the first communication or first disclosure where either occurs earlier and is relevant. Any statutory exemptions are assessed individually.
This notice is effective from 1 November 2026. Version: 2026-11-01.