Bezpečnost dat

Information about personal data processing during online check-in

the accommodation provider is the controller of the guest’s data. Checkinn.cz provides the technical platform and processes data as a processor according to the controller’s instructions.

Purposes of processing: online check-in, verification and management of the stay, reception checks, internal property notes, exports, city tax records, compliance with the property’s legal obligations including UbyPort reporting, and service security.

Legal basis: the property, as controller, determines the legal basis. Mandatory check-in data is normally processed to perform the accommodation contract, comply with legal obligations, and pursue legitimate interests in operation and security. Mandatory data is not processed on the basis of consent.

Form acknowledgement: by selecting the checkbox, the guest confirms having read this information; this is not consent to process mandatory data and is not a signature on a foreign guest registration form.

Data covered: first and last name, date of birth, nationality, document type and number, visa or residence authorization, permanent address, arrival and departure dates, purpose and source of stay, email and phone when provided, any recorded city-tax exemption reason, and related technical or audit records. An exemption reason may reveal health, disability, or social circumstances; the controller must establish an Article 9 GDPR condition and must not retain excessive supporting documents.

Recipients: authorized property staff, Checkinn.cz as processor, necessary technical infrastructure providers, and public authorities where required by law, particularly the Czech Police for UbyPort reporting.

Retention: incomplete check-ins are retained only for the technically necessary period under the configured retention policy. For completed stays, the service applies a default operational retention lock of six years from the stay date; this does not determine the statutory period for every data item. The property remains responsible for retaining statutory records for the period required by applicable law. A deletion request may not result in immediate deletion where continued retention is legally required.

Your rights: depending on the processing, you may request access, correction, deletion, restriction, or portability, or object to processing. For a specific stay, contact the property as controller first. A public form for receiving the request and securely forwarding it to the responsible controller is available here: GDPR request.

Supervisory authority: you also have the right to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.