Privacy Policy
Effective from 12 August 2026 · Last updated: 12 August 2026
1. Data Controller and Processor
The controller of service-user and website-visitor data is Superhostem s.r.o., company ID 29503825, registered office at Uralská 689/7, Bubeneč, 160 00 Prague 6, registered with the Municipal Court in Prague under file C 447639. Contact email: info@superhostem.cz
The Controller has not appointed a data protection officer. Privacy requests may be sent to the contact email above.
With regard to guest personal data, the Controller acts as a processor and the User as controller. Processing takes place within the contractual relationship with the User and on the User's instructions to the extent necessary to provide the service.
2. Personal Data We Process
A) User data (accommodation hosts)
- First name, last name, email address, phone number
- Billing address and VAT/company number (if applicable)
- Login credentials (passwords stored only in hashed form via Clerk)
- Subscription information and payment history
- IP address and login records
B) Guest data entered by accommodation host
This category of data is processed solely on the User's (accommodation host's) instructions to fulfil their legal obligation under Act No. 326/1999 Coll. (foreign nationals accommodation reporting):
- Guest first and last name
- Nationality
- Date of birth
- Type and number of travel document (passport, ID card, residence permit, etc.)
- Permanent or temporary residential address
- Guest email address and phone number (optional)
- Check-in / check-out dates and accommodation address
- Guest signature, signature image, or confirmation of registration form completion
- Other data required for statutory reporting or accommodation records if entered into the system by the User
C) Technical and operational data
- API access logs, email send records
- Records of reports sent to Ubyport
- iCal data synchronised with booking platforms
- Error logs, security incident records, and technical diagnostics
- Metadata about reservation processing, automations, and notifications
3. Purpose and Legal Basis of Processing
| Purpose of processing | Legal basis (GDPR) |
|---|---|
| Operating the user account and providing the service | Art. 6(1)(b) – performance of contract |
| Foreign nationals accommodation reporting to Czech Alien Police (Ubyport) | Art. 6(1)(c) – compliance with legal obligation |
| Billing accommodation taxes to municipalities | Art. 6(1)(c) – compliance with legal obligation |
| Sending registration forms to guests | Art. 6(1)(b) – contract performance / legitimate interest |
| Invoicing and accounting records | Art. 6(1)(c) – Accounting Act |
| Operational security, fraud prevention, logs | Art. 6(1)(f) – legitimate interest |
4. Recipients of Personal Data
Personal data may be shared with the following categories of recipients:
- Czech Alien Police – accommodation reporting for foreign nationals under Act No. 326/1999 Coll.
- Convex Inc. (USA) – cloud database; transfer to the USA is based on Standard Contractual Clauses (SCC) under Art. 46 GDPR
- Clerk Inc. (USA) – authentication management; transfer to the USA is based on SCC
- Resend Inc. – transactional email delivery
- Vercel Inc. – application hosting (EU/US data centres)
- Mailgun Technologies, Inc. – receipt and processing of forwarded emails for email ingest
- Stripe, Inc. – payment processing, invoicing, and customer billing portal
- Functional Software, Inc. (Sentry) – error monitoring and security incident diagnostics
- Public authorities – based on legal obligation or court order
Personal data is not sold to third parties or shared for marketing purposes without the data subject's consent.
5. International Data Transfers
Part of the processing may take place on servers outside the European Economic Area, especially in the USA. Where a recipient is covered by an adequacy decision (for example the EU–US Data Privacy Framework), we rely on that mechanism; in other cases we use Standard Contractual Clauses or other appropriate safeguards under Art. 46 GDPR. Further information about the safeguards used is available on request.
6. Data Retention
| Data category | Retention period |
|---|---|
| User account and settings | For the duration of the contract + 3 years after termination |
| Ubyport reports and guest records | 6 years (under the Foreign Nationals Residence Act) |
| Billing and accounting records | 10 years (Accounting Act) |
| Email logs and operational records | For as long as reasonably necessary for operation, security, incident resolution, and related legal obligations |
7. Data Subject Rights
In accordance with GDPR and Act No. 110/2019 Coll., you have the following rights:
- Right of access – request a copy of the personal data we process about you
- Right to rectification – request correction of inaccurate or incomplete data
- Right to erasure – request deletion of data that is no longer necessary or was processed unlawfully (subject to legal retention obligations)
- Right to restriction of processing – request restriction of processing in cases provided by law
- Right to data portability – receive your data in machine-readable format
- Right to object – to processing based on legitimate interest
- Right to withdraw consent – at any time, without affecting the lawfulness of processing prior to withdrawal
- Right to lodge a complaint – with the supervisory authority: uoou.cz
Submit requests to: info@superhostem.cz. We will respond to your request within 30 days.
Where guest personal data is processed on behalf of a User, the data subject should usually exercise their rights first with the relevant accommodation host as controller. In such cases, the Controller will provide reasonable assistance to the User.
8. Cookies and Tracking
The application uses technically necessary cookies for login, security, and core service functionality (such as Clerk session cookies). We only enable analytics and marketing cookies with your consent.
9. Personal Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- Data transmission encryption (HTTPS/TLS)
- Encryption of sensitive credentials stored in the system, including Ubyport access credentials
- Data access restricted to authorised persons under the principle of least privilege
- Regular backups and security incident monitoring
10. Changes to This Policy
This Privacy Policy may be updated periodically. We will notify you of significant changes by email or in-app notification. The date of the last update is shown at the top of this document.
11. Contact
Superhostem s.r.o., company ID 29503825, Uralská 689/7, Bubeneč, 160 00 Prague 6, file C 447639 maintained by the Municipal Court in Prague
Email: info@superhostem.cz
Supervisory authority: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7