Skip to content
HYGGE Apartments
CZ

Privacy Policy

HYGGE Apartments

Your privacy matters to us. We process personal data only to the extent necessary to handle booking enquiries, arrange your stay, comply with legal obligations and ensure the secure operation of our website.

This Privacy Policy explains what personal data we process, why we need it, how long we keep it and what rights you have.

1. Who is responsible for your personal data?

The data controller is:

Adéla Skipalová
Business ID (IČO): 08648719
Registered business address: Náměstí 69, 382 73 Vyšší Brod, Czech Republic
Email: adela@hyggeapartments.cz

Operator of HYGGE Apartments, Rožmberk nad Vltavou 159, Czech Republic.

2. What personal data do we process?

When you submit a booking enquiry, we process:

  • your full name,
  • your email address and, if provided, your phone number,
  • your requested arrival and departure dates, preferred apartment and number of guests,
  • any information you voluntarily include in your message.

When communicating about and confirming your booking, we also process information necessary to arrange your stay, handle payment and communicate with you.

At check-in and during your stay, we collect the identification and accommodation details required by Czech law. Depending on the applicable legal obligation, these may include your name, date of birth, address, identity document details, nationality and dates of stay.

We collect these details at check-in, not through our website booking form.

When you use our website, certain technical data may be processed to operate and secure the website and prevent misuse of the booking form. We also use a technical hash of your IP address for spam prevention and request rate limiting.

3. Why do we process your data?

Booking enquiries and accommodation services

We use your personal data to check availability, respond to your enquiry, confirm your booking and provide accommodation services.

The legal basis is taking steps prior to entering into a contract and performing a contract under Article 6(1)(b) GDPR.

Compliance with legal obligations

We process certain data to comply with accounting and tax requirements, local accommodation tax rules and legal obligations relating to foreign guests.

The legal basis is Article 6(1)(c) GDPR.

Website security and protection of legal interests

We may process necessary technical data to protect our website and booking form against misuse, resolve technical issues and establish or defend legal claims where necessary.

The legal basis is our legitimate interests under Article 6(1)(f) GDPR.

4. How long do we keep your data?

Enquiries that do not result in a stay

We retain personal data relating to unsuccessful or cancelled booking enquiries for no longer than 12 months after our last communication, unless another lawful reason justifies longer retention.

These records are reviewed and deleted manually. Automatic deletion is not currently enabled.

Confirmed bookings and completed stays

We keep information necessary to arrange and complete your stay for as long as required for that purpose.

Information subject to statutory retention obligations, including accounting and tax documents, local accommodation tax records and records of foreign guests, is retained for the periods required by applicable law.

Technical data

Technical and security data is retained only for as long as necessary for its purpose, unless a legal obligation or justified security requirement applies.

5. Who may receive your data?

Access to personal data is limited to authorised persons and service providers whose involvement is necessary for the operation of HYGGE Apartments.

Depending on the processing activity, recipients may include:

  • Lovable, our website and cloud infrastructure provider, and its technical subprocessors,
  • database and transactional email service providers,
  • providers of email and communication services,
  • payment, accounting and other operational service providers involved in arranging your stay,
  • competent public authorities where disclosure is required by law.

For foreign guests, we fulfil our statutory reporting obligations to the Czech Police through the Ubyport system. Information relating to local accommodation tax may be made available to the competent municipality where required by law.

We do not sell your personal data to third parties.

6. International data transfers

Our website uses technical service providers whose infrastructure or processing activities may involve countries outside the European Economic Area (EEA).

According to our project's technical configuration, the website database is hosted in the United Kingdom, which is covered by a European Commission adequacy decision.

Where personal data is transferred to other countries outside the EEA, appropriate safeguards under the GDPR are applied, such as adequacy decisions or Standard Contractual Clauses.

7. Cookies and external services

We currently do not use analytics or advertising cookies and do not operate advertising tracking technologies on our website.

The fonts used on our website are hosted locally and are not loaded from Google Fonts servers.

If we introduce analytics or marketing technologies in the future, we will update this Privacy Policy and obtain consent where required.

8. How do we protect your data?

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure.

Booking enquiries are stored in a secured database with restricted access. Paper accommodation records are kept away from unauthorised persons.

9. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

  • obtain information about the processing of your personal data and request access to it,
  • request correction of inaccurate or incomplete data,
  • request deletion of your personal data where legally applicable,
  • request restriction of processing,
  • object to processing based on legitimate interests,
  • request data portability where applicable,
  • lodge a complaint with the Czech Data Protection Authority (www.uoou.gov.cz).

Where we are legally required to retain certain information, we may not be able to delete it before the statutory retention period expires.

To exercise your rights or ask a question, please contact adela@hyggeapartments.cz.

We respond within the time limits established by the GDPR, generally within one month.

10. Providing personal data and automated decision-making

Information marked as required in our booking form is necessary to process your enquiry. Without it, we may be unable to handle your booking request.

Identification details requested at check-in are required to comply with applicable legal obligations.

We do not use automated individual decision-making or profiling that produces legal or similarly significant effects concerning you.

11. Changes to this Privacy Policy

We may update this Privacy Policy if our personal data processing practices, service providers or legal requirements change.

The latest version will always be available on our website.

Last updated: 13 October 2026