1. 01

   WEDOS Internet, a.s., Company ID 28115708

   server infrastructure, database, backups, sending of e-mails

   Registered office: Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic · Data location: Czech Republic

2. 02

   WEDOS, a.s., Company ID 28115694 (WEDOS Global Protection service)

   protective network in front of the website and the app: filtering of attacks and bots, inspection of encrypted traffic in transit, cache of static files; stores nothing

   Registered office: Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic · Data location: EU; a visitor from outside the EU may be served by a network node outside the EU (transit only)

3. 03

   Cloudflare, Inc.

   R2 backup vault: copies of encrypted backups that Cloudflare cannot read (the key is outside Cloudflare); Turnstile: verification that a registration is submitted by a human

   Registered office: 101 Townsend St, San Francisco, CA 94107, USA · Data location: backups: EU (bucket with EU jurisdiction); Turnstile: technical data about the registering visitor may be processed in the USA — Cloudflare is certified under the EU-U.S. Data Privacy Framework

4. 04

   Apple Distribution International Ltd. (iCloud Drive)

   off-site copies of encrypted backups on the operator’s computer synchronised via iCloud; Apple does not hold the backup key, so the backups are unreadable to Apple; same rotation as on the server

   Registered office: Hollyhill Industrial Estate, Cork, Ireland · Data location: EU (Ireland); Apple may also store data in the USA (EU-U.S. DPF)

5. 05

   cron-job.org (Cron-Job.org, Germany)

   scheduled triggering of tasks (calendar sync, backups, maintenance) — it only calls Ubyo URLs and neither sends nor receives any data except the response status

   Registered office: task-scheduler operator, Germany · Data location: EU (Germany)

6. 06

   Browser push services (Google FCM, Apple, Mozilla, Microsoft)

   delivery of notifications to the user’s device if enabled; the notification content is encrypted (Web Push), the service sees only the subscription address

   Registered office: per browser vendor · Data location: per vendor

7. 07

   Not a sub-processor (for completeness)

   Service	Why	What it receives
   Police of the Czech Republic (UbyPort), the Czech data box system (ISDS), municipal authorities	independent controllers towards which the accommodation provider discharges a statutory duty	reports submitted by the accommodation provider
   Airbnb, Booking.com, Hospitable, Smoobu, Beds24, Lodgify, Hostaway, Hostex, Previo	processors of the accommodation provider, connected using the provider's own credentials	reservations (we read them), messages to guests (only on the provider's instruction)
   ARES, ADIS, EU and Czech Ministry of Foreign Affairs sanctions lists	public registers; a query or a list download only	the entity's Company ID / VAT number; no guest data
   Open-Meteo	weather forecast in the guest portal	the name of the apartment's town only

   The info@ubyo.cz mailbox (support) runs at WEDOS Internet, a.s. — it is covered by the first row; there is no further support processor.

Operator: Sierra Apartments s.r.o., Františka Diviše 1603/20A, 104 00 Prague, Czech Republic, Company ID 21803285 · data box gw6xygi, info@ubyo.cz.