Processing of personal data

Scope and source of the processed data

Klínové Boudy, s. r. o. as the controller of personal data (hereinafter also the “controller”) requires, in connection with the provision of accommodation services, the provision of the following personal data of accommodated persons (data subjects):

1. first name and surname;
2. address of permanent residence or place of permanent residence abroad;
3. date of birth;
4. identity card or travel document number;
5. citizenship;
6. e-mail address;
7. telephone contact.

The controller requires and processes this data only for clients who agree to a reservation of a stay on a specific date. For clients who only enquire about a stay and do not subsequently make a binding reservation and send a binding confirmation of the stay order, the controller does not require or process personal data.

The provision of personal data for accommodation purposes is a legal requirement or a requirement that must be stated in the contract (confirmation of the stay order), and here the data subject is obliged to provide the personal data pursuant to § 3(4) of Act No. 565/1990 Coll. (on local fees), as amended. If this data is not provided, it is not possible to accommodate the data subject or to draw up an Accommodation Contract.

The controller obtains personal data directly from the data subjects, with the exception of the processing “Accommodation reservation — receipt of information from internet reservation portals”, where the controller obtains part of the personal data from entities operating internet reservation portals. The client will find information about these personal data controllers, including their contact details, on the website on which the reservation was made. Owing to their larger number and the mutual transfer of data between them, they are not listed here.

Purpose of processing personal data

Klínové Boudy, s. r. o. as the controller of personal data, in connection with the provision of its services, collects, processes and stores the personal data of the data subject under the conditions and within the limits laid down by the applicable legislation for the following purposes:

To comply with a legal obligation, the controller is required to request data 1) – 5) in accordance with the generally binding decree on local fees, as amended, issued by the town of Špindlerův Mlýn. For the purposes of the legitimate interests of the accommodation provider, the controller then requests an e-mail address and telephone number from clients. This data is necessary for effective communication between clients and the accommodation provider.

Processing period

Personal data will be processed for the time strictly necessary to ensure mutual rights and obligations, i.e. always at least until the end of the stay, and then for the period during which the controller is obliged / authorised to retain the data in question under the GDPR and other generally binding legal regulations.

How we process personal data

a) Processing. The processing of personal data takes place manually, in electronic or paper form, always with high technical, organisational and personnel security within the meaning of the requirements of the GDPR. Only the executives of the controller’s company, and subsequently the bodies that require this data by law (e.g. the Municipal Authority of Špindlerův Mlýn, the Police of the Czech Republic, the Alien Police Department), come into contact with clients’ personal data. The processing is carried out only by the executives of the controller’s company in person.

b) Storage. For effective communication with clients, the following personal data is stored: first name and surname, address, e-mail and telephone. These are stored in electronic and paper form with security in place. Dates of birth are recorded and kept in electronic and paper form with secure storage.

c) Archiving. The data is kept for a period of 6 years following the year in which the entries were made, in accordance with the fulfilment of the legal obligation under Act No. 565/1990 Coll. (on local fees), as amended, and Act No. 326/1999 Coll. (on the residence of foreign nationals in the Czech Republic), as amended, whereby tax documents are kept for a period of 10 years from the end of the tax period in which the performance took place, pursuant to § 35 and § 35a of Act No. 235/2004 Coll. (on value added tax), as amended.

Rights of the data subject

The data subject has all the rights granted by the GDPR and other legal regulations, which are in particular:

• the right of access;
• the right to erasure;
• the right to restriction of processing;
• the right to portability;
• the right to an explanation;
• the right to object to the processing;
• the right to lodge a complaint with the controller or to contact the Office for Personal Data Protection.

More information about the rights of the data subject is available on the website of the Office for Personal Data Protection: uoou.cz.

All of the personal data referred to above is processed and stored in accordance with the conditions of the GDPR and is not made available or provided to any other persons, except in the event of a possible inspection by the municipality for which the local fees are collected, or by the Police of the Czech Republic, the Alien Police Department. Personal data will also not be transferred outside the EU or to any international organisation.