Privacy Policy

1. Who manages the data?

The controller of your personal data is:

2. What Data Do We Process and Why?

We process only the data necessary to process your reservation, handle payments, and fulfill our legal obligations.

Reservation Details

First name, last name, email address, phone number, and billing address. We need this information to make a reservation, communicate with you, and provide lodging services (performance of the contract).

Financial Data

We retain your billing information for 10 years, as required by the Accounting Act and the VAT Act. The system automatically matches payments with our bank account to issue a tax invoice.

3. Analytics and Cookies (Why You Don't See an Annoying Cookie Bar on Our Site)

You won't find any third-party tracking elements (such as Google Analytics or Facebook Pixel) on our website, and we don't store any cookies for normal browsing.

Analytics (Matomo)

We measure website traffic using the open-source tool Matomo, which runs exclusively on our own secure servers in the Czech Republic. The tool is fully anonymized (we mask IP addresses), operates in a strict cookieless mode, and is used exclusively for our basic technical statistics. The data never leaves our infrastructure.

Technically Necessary Cookies

• The reservation system temporarily saves your session so that you don't lose your selected date before you complete the form.
• The payment gateway stores necessary technical cookies solely for the purpose of securing transactions and preventing fraud (in accordance with the PSD2 Directive). These technical cookies do not require active consent.

4. Payment Processing

Online payments are processed for us by the certified payment gateway Stripe.

• We do not have access to your credit card information, and we do not store it anywhere.
• All communication with the payment gateway is strongly encrypted and takes place directly between your browser and Stripe.
• Stripe processes your data (such as your IP address or email address) primarily for the purpose of detecting fraud and ensuring transaction security.

5. Security and Infrastructure

We take your data seriously. We operate our own high-availability server infrastructure within the EU. The systems are isolated at the network level (DMZ), protected by a hardware firewall, and all data traffic and storage are encrypted. We minimize our reliance on third-party cloud services and prefer on-premises solutions that give us full control over our data.

6. Your Rights

Under the GDPR, you have the right to:

• Request information about what personal data we process about you.
• Request access to this information and have it updated or corrected.
• Request the deletion of this personal data (unless we are prohibited from doing so by law, such as a requirement to archive invoices).
• If you have any doubts regarding compliance with obligations related to the processing of personal data, please contact us or the Office for Personal Data Protection (ÚOOÚ).

These policies are effective as of June 15, 2026.