1. 01

   Two roles

   Whose data	Our role	Who is responsible
   app users (accommodation providers, managers, cleaning team members), website visitors	controller	us
   guests and other individuals recorded in the app by the accommodation provider	processor	the accommodation provider as controller; us under the Data Processing Agreement

   Sections 2–6 describe processing in which we are the controller. Section 7 is addressed to guests.

2. 02

   User data: what, why, on what basis, for how long

   Data	Purpose	Legal basis	Retention
   name, e-mail, telephone, password hash, 2FA settings, profile photograph, customer number	running the account, verifying the e-mail address on registration, signing in, password recovery; the customer number serves as the payment reference and as identification on invoices and in communication with support	performance of a contract (Art. 6(1)(b))	for the life of the account + 30 days
   billing details (name, Company ID, VAT number, address), invoices, payments	billing, accounting, VAT	performance of a contract; legal obligation (Art. 6(1)(c))	10 years from the end of the year of issue
   provider details needed for reporting: name and address of the establishment, IDUB, UbyPort and data box credentials, iCal links, platform API keys, account numbers and payment references for the tourist charge	submitting reports and synchronising on your behalf	performance of a contract	for the life of the account; credentials are encrypted and you can delete them yourself at any time
   sign-in records (time, IP address, browser); operational log of account events: successful and rejected actions with the error text and code, sign-ins, e-mails sent, results of calls to external services (without guests' personal data); security audit log including support access to the account (who, when, to which account, what was done)	support (tracing an event by its error code), account security, evidence, defence against attacks	legitimate interest (Art. 6(1)(f))	sign-ins and the event log 12 months; the audit log 3 years
   submission records (time, content, result, delivery receipt)	evidence that a report was submitted	performance of a contract	as for the related guest data (Section 7)
   e-mail communication with support	handling the request	performance of a contract; legitimate interest	3 years from resolution
   the contract, the record of acceptance of the terms (time, version, IP), material correspondence	establishment and defence of legal claims	legitimate interest	3 years after the contract ends; where a claim is raised, until it is resolved
   operational and contractual notices sent by e-mail to the account owner's sign-in address and shown in the app (failed submission, end of the trial period, invoices and reminders, changes to the price list or the terms, maintenance, the date the account will be deleted)	providing the service and performing the contract; these are not marketing messages and cannot be unsubscribed from	performance of a contract	for the life of the account
   marketing messages about Ubyo news sent to existing customers	information about the service	legitimate interest; Section 7(3) of Act No. 480/2004 Coll.; can be refused via the link in every e-mail	until refused
   identifiers used to detect duplicates: Company ID, IDUB, iCal links, property identifiers from connected platforms, the apartment address — we compare these across accounts	preventing a repeated trial period and double reporting of the same apartment	legitimate interest (Art. 6(1)(f))	for the life of the account; after the account is deleted we keep only one-way hashes of these identifiers together with the customer number for 12 months — the data cannot be reconstructed from a hash

   Every error message in the app carries a short error code; give it to support and we will trace the event in the operational log. Every support access to your account (support mode) is recorded in our security audit log.

   Data of cleaning team members and managers (name, e-mail, telephone, sign-ins) is processed in the role of processor for the accommodation provider. The cleaning team does not see guest data, only dates and the state of the apartment.

3. 03

   Who we pass data to

   • WEDOS, a.s. — WEDOS Global Protection (Hluboká nad Vltavou, Czech Republic) — a protective network through which all traffic of the website and the app passes: it filters attacks and bots and inspects encrypted traffic in transit. It stores nothing; a visitor from outside the EU may be served by a node outside the EU.
   • WEDOS Internet, a.s. (Hluboká nad Vltavou, Czech Republic) — hosting of the app, the database, backups, sending of e-mails. Data is stored in the Czech Republic.
   • Cloudflare, Inc. (San Francisco, USA) — R2 backup vault in the EU: the backup copies are encrypted with a key Cloudflare does not have, so it cannot read them; and Turnstile — a check that a new account registration is submitted by a human (technical data about the visitor's browser and address; Cloudflare is certified under the EU-U.S. Data Privacy Framework).
   • Police of the Czech Republic (UbyPort), the data box information system, municipal authorities — only when you trigger the submission (or switch on automatic submission); they are independent controllers.
   • Platforms and PMS (Airbnb, Booking.com, Hospitable, Smoobu, Beds24 and others) — only if you set up the connection yourself; we send data to them only as part of messages to guests that you send.
   • Open-Meteo (weather forecast in the guest portal) — receives only the name of the apartment's town, no personal data.
   • Public authorities where required by law; legal counsel in the event of a dispute.

   We do not store data outside the European Union; the only exception is the transit of traffic through the WEDOS Global protective network for visitors accessing us from countries outside the EU, and the technical data of the Turnstile check at registration (Cloudflare, USA, EU-U.S. Data Privacy Framework). The current list of sub-processors: ubyo.cz/zpracovatele. We notify users of any change by e-mail 14 days in advance.

4. 04

   Security

   Encrypted connection (HTTPS), passwords stored only as a hash (bcrypt), credentials for UbyPort, data boxes and platforms encrypted with AES-256-GCM using a key held outside the web root — the app's administrators cannot see them, optional two-factor authentication for users, separation of individual clients' data, sign-in attempt limits, encrypted daily backups (14 days) and a monthly archive (3 months), validation of uploaded files. Each administrator of the app has their own account with mandatory two-factor authentication, their activity is audited, and they access guest data only in support mode (at your request or to resolve an operational problem; every access is recorded in the audit log). We report a security breach to the Czech Office for Personal Data Protection within 72 hours and to the users concerned without undue delay.

5. 05

   Cookies and the website

   The app uses only strictly necessary cookies and browser storage (sign-in, CSRF protection, remembering a device for 2FA, saved display settings). No consent is required for these. Both the website and the app load fonts from our own server, not from Google. We use no third-party analytics or advertising tools on ubyo.cz and no measurement cookies. We measure traffic with our own cookie-free tool: for each visit we store the page, time, language, device and browser type, the country and city derived from the IP address using a local database (the IP address itself is not stored, only its daily one-way fingerprint to distinguish visits), the referrer where available and the reading time. Individual records are deleted after 90 days; only aggregate figures with no link to a person remain. The server also keeps standard access logs (IP address, time, page) for as long as is necessary to ensure operation and security, and for no longer than 12 months.

6. 06

   Your rights

   You have the right of access to your data, to rectification, erasure, restriction of processing and portability, the right to object to processing based on legitimate interest, and the right to lodge a complaint with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz).

   You can handle most of this yourself in the app: account details in the settings, export of all your data and closing your account under Account → Data and privacy. After you close your account you have 30 days to download your data; we will tell you the deletion date by e-mail and until then you can reverse the closure in the app. Send other requests to info@ubyo.cz; we reply within 30 days. Where a request is manifestly unfounded or repetitive, we may charge a reasonable fee or refuse it. We cannot erase data that we are required to keep by law (invoices) or that we need to defend legal claims. The app performs no automated decision-making with legal effect; a sanctions-list match is only an alert for the accommodation provider, who decides.

7. 07

   Guest data — information for guests

   If you are completing online check-in with an accommodation provider who uses Ubyo, the following applies:

   • The controller of your data is the accommodation provider, whose name and contact details you can see in the check-in form and in your reservation. Address requests for access, rectification or erasure to them; we will assist them.
   • Why: the provider is required by law to keep a registration book (Act No. 565/1990 Coll., on local charges) and, for foreign nationals, a house book, and to report the stay to the Police of the Czech Republic within 3 working days (Act No. 326/1999 Coll., on the Residence of Foreign Nationals). This is compliance with the provider's legal obligation; your consent is not required. The tick box in the check-in form confirms that the details are true; it is not consent.
   • What: given name and surname, date of birth, nationality, address of residence, travel document number (for foreign nationals also the visa number and the purpose of stay), the dates of the stay, a signature; e-mail and telephone for communication about the stay. No copy of the document is made.
   • Where from: from you at check-in; the name, dates and contact details also from the reservation the provider received through a platform (Airbnb, Booking.com, another system) or from the provider.
   • Sanctions screening: the name is compared against the published EU and Czech sanctions lists so that the provider does not breach the ban on providing services to sanctioned persons. The comparison runs inside the app, is not sent anywhere, and only the provider sees the result.
   • For how long: 6 years from the end of the stay (the statutory period for both books); the app then anonymises the data automatically. Longer only if the accommodation provider requests it in writing (e.g. because of an inspection or proceedings under way) — the provider then bears the legal ground.
   • To whom: the Police of the Czech Republic (foreign nationals only, through the UbyPort system), the municipal authority (documentation for the charge), the WEDOS hosting provider in the Czech Republic (storage). To no one else; no transfers outside the EU.
8. 08

   Changes

   We may update this policy; we inform users of material changes by e-mail. Effective from 1 October 2026. Version 3.

Operator: Sierra Apartments s.r.o., Františka Diviše 1603/20A, 104 00 Prague, Czech Republic, Company ID 21803285 · data box gw6xygi, info@ubyo.cz.