Privacy Policy

Privacy Policy (hereinafter the "Policy")

I. Data Controller

  1. The data controller is:
    Company: Croiss-bookme s.r.o.
    Registered office: Emanuela Podgorného 147/16, Dubina, 700 30 Ostrava, Czech Republic
    Company ID (IČO): 244 16 096
    Registered in the Commercial Register kept by the Regional Court in Ostrava, Section C, Insert 102469
    (hereinafter the "Controller")
  2. Contact details for data protection matters:
    E-mail: saunacafee@gmail.com
    Phone: 607 859 059

II. What Personal Data We Process

  1. Booking and contact details: first and last name, e-mail address, phone number, booking notes, selected room, stay dates and number of guests.
  2. Payment data: the Controller does not process or store card numbers itself — payments are processed by the GoPay payment gateway (see Article V).
  3. Guest register: upon arrival, name, surname and identity document details as required by the Act on the Residence of Foreign Nationals and the Act on Local Fees.
  4. Technical and analytics data: IP address, device and browser type, cookies — only with your consent (see Article VI).

III. Purpose and Legal Basis of Processing

  1. Performance of a contract (Art. 6(1)(b) GDPR) — processing your booking, communication about your stay, arranging payment.
  2. Compliance with a legal obligation (Art. 6(1)(c) GDPR) — maintaining the guest register, accounting and tax records.
  3. Legitimate interest of the Controller (Art. 6(1)(f) GDPR) — basic operation and security of the website.
  4. Consent (Art. 6(1)(a) GDPR) — optional analytics cookies (see Article VI), which you may withdraw at any time.

IV. Data Retention Period

  1. Accounting and tax records: for the period required by accounting and tax legislation (typically 10 years).
  2. Guest register: for the period required by the applicable legislation on the residence of foreign nationals and local fees.
  3. Booking and contact data not covered above: for 3 years from the end of your stay, unless a longer period is required by law.
  4. Consent to analytics cookies: until withdrawn, for a maximum of 12 months from consent.

V. Recipients and Processors of Personal Data

  1. GoPay s.r.o. — processing of online payments for your stay.
  2. Booking.com B.V. / Airbnb Ireland UC — only for bookings made through these platforms, to the extent necessary for availability synchronization and booking fulfilment.
  3. The Controller's accounting service provider — for bookkeeping and invoicing purposes.
  4. Web hosting provider — technical operation of the website.
  5. Public authorities — to the extent required by law (e.g. foreign police, tax administration).
  6. Personal data is not transferred outside the European Union, except where required by the use of the services listed above, in compliance with GDPR.

VI. Cookies

  1. The website uses necessary cookies required for its basic operation (e.g. keeping the booking form state), which do not require consent.
  2. The website may also use analytics cookies to understand website traffic — these are only stored after you give consent via the cookie banner, and you may decline or withdraw consent at any time.

VII. Your Rights

Under the GDPR, you have the right to:

  1. access your personal data,
  2. rectify inaccurate data,
  3. erasure of your data ("right to be forgotten"), unless a legal retention obligation applies,
  4. restrict processing,
  5. data portability,
  6. object to processing based on legitimate interest,
  7. withdraw consent, where processing is based on consent,
  8. lodge a complaint with the Office for Personal Data Protection (www.uoou.cz) if you believe your data protection rights have been violated.

You may exercise your rights using the contact details listed in Article I.

VIII. Final Provisions

  1. This Policy is valid and effective as of 12 August 2026.
  2. The Controller reserves the right to update this Policy as needed.