1. 01

   Subject matter, purpose and instructions

   1.1The Processor processes personal data for the Controller to the extent necessary to provide the App: keeping the registration book and the house book, preparing and submitting reports on accommodated foreign nationals to the Police of the Czech Republic (UbyPort) using the Controller's credentials, documentation and returns for the local charge, online check-in of Guests including electronic signature, comparison of Guests' names against EU and Czech sanctions lists, records of reservations, sending messages to Guests on the Controller's instruction, cleaning schedules and operational records.

   1.2The Processor processes the data solely on documented instructions from the Controller. Instructions consist of the Main Contract, this agreement, and the Controller's settings and actions in the App (entering data, switching on automatic submission, triggering a submission, setting up a connection, setting the retention period, inviting other people). Other instructions are to be sent by the Controller in writing to info@ubyo.cz; the Processor is not obliged to carry out an instruction that goes beyond the functions of the App, and may charge for it under Article 8.

   1.3The Processor shall inform the Controller if, in its opinion, an instruction infringes the GDPR or other legislation; it may suspend the instruction until the matter is clarified.

   1.4While the Account is locked after the trial period or Blocked for late payment (Articles 4.3 and 5.5 of the Terms and Conditions), the Processor suspends processing: it merely stores the data and allows the Controller to export it; Guest forms, portals and automatic submission of reports do not run. During that time the Controller meets its statutory duties towards Guests and the authorities by other means. If the Blocking concerns only the Apartments of one Legal Entity (Article 5.5 of the Terms and Conditions), the first sentence applies only to processing relating to those Apartments.

2. 02

   Nature and scope of the processing

   Data subjects: the Controller's Guests and persons accommodated with them (including children); persons invited into the App by the Controller (Managers, cleaning team members); the Controller's contact persons.

   Categories of data: identification data (given name, surname, date of birth, nationality, address of residence); data from the travel document (type and number of the document, issuing state, visa number and type, purpose of stay); data about the stay (Apartment, dates, number of persons, platform and reservation number, reservation price, amount of the charge, grounds for exemption); contact data (e-mail, telephone, language, content of messages); the Guest's handwritten signature (as an image) and the time the check-in was completed; the result of the sanctions-list comparison; for invited persons, their name, e-mail, telephone and sign-in records.

   Special categories of data (Article 9 GDPR) are not processed; the Controller undertakes not to enter them into the App, and likewise not to enter birth numbers or copies of documents. If it does so nonetheless, it is solely responsible for that.

   Operations: storage, organisation, display to the Controller and the persons it has invited, automatic comparison against sanctions lists, transmission to the Police of the Czech Republic and to the municipality on the Controller's instruction, sending of messages to Guests on the Controller's instruction, backup, anonymisation, erasure.

   Duration: for the term of the Main Contract and thereafter in accordance with Article 6.

3. 03

   Obligations of the Processor

   a) processes the data only for the purposes set out in Article 1 and on the Controller's instructions, not for its own purposes; the exceptions are anonymous aggregate statistics from which no Guest or Controller can be identified, and the retention of data required of the Processor by law or needed to establish or defend legal claims; b) ensures that only persons bound by a duty of confidentiality have access to the data, and only to the extent necessary to operate and support the App; access by an administrator of the App to the Controller's data (support mode) takes place only at the Controller's instigation or to resolve an operational problem, and is recorded in the Processor's security audit log (who, when, to which Account and for how long); c) implements the technical and organisational measures set out in Article 7; d) engages another processor only on the conditions set out in Article 4; e) assists the Controller in handling data subjects' requests (access, rectification, erasure, portability, restriction, objection) primarily through the functions of the App (search, rectification, export of a Guest's data, erasure once the period has elapsed). A request that a Guest sends to the Processor by mistake will be forwarded to the Controller within 5 working days; the Processor does not answer it on the merits itself; f) notifies the Controller of a personal data breach affecting its data without undue delay and no later than 48 hours after becoming aware of it, with the information available at that time (the nature of the breach, the data concerned, the likely consequences, the measures taken), and supplements it as matters develop. Notification to the supervisory authority and to Guests is made by the Controller; g) provides the Controller with reasonable assistance with a data protection impact assessment and with prior consultation of the supervisory authority, where the GDPR requires it; h) upon completion of the processing, proceeds in accordance with Article 6; i) provides the Controller with the information necessary to demonstrate compliance with this agreement and allows for audits under Article 9; j) maintains a record of processing activities under Article 30(2) GDPR.

4. 04

   Sub-processors

   4.1The Controller gives general authorisation for the engagement of sub-processors. The current list is at ubyo.cz/zpracovatele; as at the effective date:

   Sub-processor	Registered office	Activity	Data location
   WEDOS Internet, a.s., Company ID 28115708, Masarykova 1230, 373 41 Hluboká nad Vltavou	Czech Republic	web hosting, database, backups, sending of e-mails	Czech Republic
   WEDOS, a.s., Company ID 28115694, Masarykova 1230, 373 41 Hluboká nad Vltavou (WEDOS Global Protection)	Czech Republic	protective network in front of the Application (filtering of attacks, traffic inspection in transit, cache of static files); stores no data	EU; for access from outside the EU, transit through a network node outside the EU
   Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA	USA	vault of encrypted backups (R2, unreadable by Cloudflare); “not a robot” verification at registration (Turnstile)	backups EU; for Turnstile technical visitor data in the USA (EU-U.S. Data Privacy Framework)

   4.2The Processor shall give notice by e-mail of any intended addition or replacement of a sub-processor at least 14 days in advance. Before the change takes effect the Controller may raise a reasoned written objection; if the parties fail to reach agreement, the Controller may terminate the Main Contract with effect as of the date of the change, and the Processor shall refund the proportionate part of the unused subscription. If the Controller raises no objection, it is deemed to agree to the change.

   4.3The Processor shall impose on the sub-processor, by contract, obligations corresponding to this agreement, and remains liable to the Controller for the sub-processor's performance.

   4.4The following are not sub-processors: the Police of the Czech Republic, municipal authorities and the data box system (independent controllers towards which the Controller discharges a statutory duty); booking platforms and PMS that the Controller has connected itself using its own credentials (they are processors of the Controller, not of the Processor, and the Controller is responsible for their terms and conduct); public registers (ARES, ADIS) and the weather service, to which no Guest data is passed; sanctions lists, which the App merely downloads and compares locally.

   4.5The data is processed and stored exclusively within the European Union. A transfer to a third country is possible only subject to appropriate safeguards under Chapter V of the GDPR and after notice under Article 4.2.

5. 05

   Obligations of the Controller

   5.1The Controller is responsible for the lawfulness of the processing: for the existence of a legal basis, for meeting the duty to inform Guests (Articles 13 and 14 GDPR) and invited persons, for the accuracy, minimisation and currency of the data, and for the lawfulness of its instructions. The Processor is not liable for the consequences of the Controller's instruction.

   5.2The Controller handles data subjects' requests and communicates with the supervisory authority itself; the Processor provides assistance under Article 3(e) to (g).

   5.3The Controller shall ensure that invited persons (Managers, cleaning team members) work with the data only within their permissions and are bound by a duty of confidentiality; it is liable for their conduct as for its own.

   5.4The Controller is responsible for downloading the export under Article 6.3 before the Main Contract ends. If the Controller needs to keep the data of a stay for longer than the period under Article 6.1 (in particular because of an inspection or proceedings under way), it downloads them by export before that period elapses, or requests in writing that they be kept without a time limit under Article 6.1.

   5.5The Controller shall notify the Processor without undue delay of any circumstances that may jeopardise performance of this agreement (in particular suspected misuse of credentials) and shall provide the necessary assistance.

6. 06

   Retention, return and erasure

   6.1The App retains Guest data, records of reports and delivery receipts for 6 years from the end of the stay, which corresponds to the period for the registration book (Section 3g(4) of Act No. 565/1990 Coll.) and the house book (Section 101(4) of Act No. 326/1999 Coll.). Once the period has elapsed, the App anonymises the data automatically: it removes the name, date of birth, address, document and visa numbers, signature, contact details and the content of messages; it keeps only data with no link to an individual (dates, nationality, number of persons, amount of the charge, submission result). The period cannot be extended or shortened in the App. At least 30 days before anonymisation the App notifies the Controller by e-mail and offers an export. At the Controller’s written request, the Processor may switch off automatic anonymisation for its Account (retention without a time limit for the duration of the Main Contract); the Controller bears the legal ground for the longer retention and responsibility for it.

   6.2Sign-in records of invited persons are deleted 12 months after the sign-in; messages to Guests are deleted together with that Guest's data.

   6.3After the Main Contract ends, the Controller has 30 days to download all data in a machine-readable format (JSON/CSV) and in printable form (the registration book, an overview of reports with delivery receipts). The Processor then irreversibly deletes the Controller's personal data from the operational database; it disappears from backups through rotation — daily backups within 14 days, the monthly archive backup within 3 months. Backups serve only to restore operation after an incident or to restore an individual Controller's data at its written request (only that Controller's data is restored, outside the operational database, and the action is logged); when restoring operation from a backup, the Processor deletes deleted accounts again. The Processor confirms the erasure to the Controller by e-mail to the address of the Account owner.

   6.4The statutory duty to keep the registration book and the house book continues after the Main Contract ends and is discharged by the Controller. If it fails to download the export within the period under Article 6.3, it bears the consequences itself.

7. 07

   Technical and organisational measures

   • Encrypted transmission (TLS) between the browser, the App and third-party systems.
   • Passwords stored only as a hash (bcrypt); the Controller's credentials for UbyPort, the data box system and platforms encrypted with AES-256-GCM using a key stored outside the server's web root; the App's administrators cannot see them.
   • Logical separation of individual Controllers' data, enforced in every query; the cleaning team's portal has no access to Guest data; the Manager role has limited permissions.
   • Optional two-factor authentication, sign-in attempt limits, sessions with a time limit, CSRF protection, security headers, validation of uploaded files.
   • Encrypted daily backups (14 days) and a monthly archive (3 months) stored separately from the operational database.
   • Accounts of the App's administrators: each administrator has their own account with mandatory two-factor authentication, their activity is audited and they access Guest data only in support mode under Article 3(b); submission records with delivery receipts.
   • Regular software updates and security review (most recently September 2026); access to server administration and to the App administrator role is limited to a restricted group of the Processor's personnel.

   The Processor may change the measures provided that it does not thereby reduce the overall level of security.

8. 08

   Costs of assistance

   Assistance under Article 3 within the functions of the App is included in the price. Assistance beyond that scope (individual extracts, manual handling of requests, consultations, assistance with an audit or with proceedings brought about by the Controller's conduct) is provided by the Processor at the hourly rate set out in the Price List, for each hour commenced; the Processor estimates the scope in advance and the Controller confirms it.

9. 09

   Audit

   No more than once every 12 months, or following a notified security breach affecting its data, the Controller may request evidence of compliance with this agreement. The Processor shall reply within 30 days with a written description of the measures and an extract of the records concerning the Controller. An on-site audit is possible only where the date is agreed in writing at least 30 days in advance, during business hours, at the Controller's expense, by an auditor bound by a duty of confidentiality, and in a manner that does not jeopardise the operation of the App or other controllers' data.

10. 10

    Liability

    10.1Each party is liable for damage caused by breach of its obligations under the GDPR (Article 82). As between the parties, the Processor's liability towards the Controller is limited in the same way as under the Main Contract (Article 11 of the Terms and Conditions).

    10.2The Controller shall indemnify the Processor against data subjects' claims, fines and costs incurred by the Processor as a result of a breach of the GDPR or of this agreement by the Controller or persons it has invited, or as a result of an unlawful instruction of the Controller.

11. 11

    Final provisions

    Changes to this agreement are governed by Article 14.2 of the Terms and Conditions. If the Main Contract ends, this agreement remains in force until the data is erased under Article 6. Governing law: Czech law. Effective from 20 October 2026. Version 4.

Operator: Sierra Apartments s.r.o., Františka Diviše 1603/20A, 104 00 Prague, Czech Republic, Company ID 21803285 · data box gw6xygi, info@ubyo.cz.