1. Name and address of the administrator
For the purposes of the General Data Protection Regulation and other national data protection laws of the Member States and other data protection provisions, the controller is:
Andrei Drozdov registered ———————————————– ————–, based
Ondřičkova14, Prague 3 – Vinohrady, 130 00, Czech Republic
Contact details of the Data Protection Officer:
Name and surname: Andrei Drozdov
2. General information on the processing of personal data
2.1 Scope of personal data processing
Protecting your privacy is very important to us. If we collect, process or use your personal data as part of our offer, we do so in accordance with applicable Czech and European data protection laws.
In principle, we collect and use our users’ personal information only when it is necessary to provide a functioning website, our content and services. The collection and use of our users’ personal information is normally done only with the user’s consent. The exception applies if prior consent is not possible for factual reasons and data processing is permitted by law.
2.2 Legal basis for the processing of personal data
If we obtain the consent of the data subject for the processing of personal data, Article 6 (1) (a) shall serve as the legal basis. a) of the EU General Data Protection Regulation (GDPR).
In the case of the processing of personal data necessary for the conclusion and performance of a contract to which the data subject is a party, the legal basis of Article 6 (1) (a) shall be the legal basis. (b) GDPR. The same shall apply to the processing operat ions necessary for the implementation of the measures taken prior to the conclusion of the contract.
Where the processing of personal data is necessary in order to fulfill a legal obligation applicable to our company, Article 6 (1) (a) shall serve as the legal basis. (c) GDPR.
Where the processing of personal data is necessary for the protection of the vital interest of the data subject or of another natural person, Article 6 (1) (a) shall serve as the legal basis. (d) GDPR.
Where processing is necessary for the purposes of the legitimate interests of our company or of a third party, except where the interests or fundamental rights and freedoms of the data subject prevail over those interests, it shall serve as the legal basis for the processing of Article 6 (1) (a). (f) GDPR.
2.3 Deletion of personal data and retention period
The personal data of the data subject shall be erased or made inaccessible as soon as the purpose of their retention ceases. In addition, retention may occur where it has been laid down by European or national legislators in Union regulations, laws or regulations governing the controller. Data shall also be made inaccessible or deleted when the retention period laid down by those provisions has expired, unless further retention of the data is necessary for the conclusion or performance of the contract.
2.4 Transfer of Personal Data to Third Parties
In accordance with local laws and regulations, we may pass on your personal information to third parties, in particular the following categories of persons:
• Apartment owners
• External service providers providing services on our behalf
• The outsourced IT service providers we work with
The data is transferred for the purpose of making reservations, enabling reservation payments, sending marketing materials, or for analytical services to customers.
3. Providing websites and creating logos
3.1. Description and scope of data processing
Each time we load our website, our system automatically records data and information from the computer system that loaded the site.
The following data are collected:
• Information about the browser type and version used
• The user’s operating system
• The user’s Internet connection provider
• User IP address
• Date and time of access
• Websites from which the user’s system has accessed our website
• Websites that the user’s system loads through our website
The data is also stored in the logs of our system. This data is not stored together with other user’s personal information. In addition, we may also collect device and location data for mobile devices. This data is recorded regardless of whether you are registered with Drozdoff or have logged into your Drozdoff account.
3.2 Legal basis for data processing
The legal basis for the temporary storage of data and logos is Article 6 (1) (a). (f) GDPR.
3.3. Purpose of data processing
For example, if you connect to the platform to search for accommodation, post ads, make reservations or confirm reservations, pay for accommodation, comment or rate, or interact with other Drozdoff users, we may record information such as your IP address , the date and time of your visit and use of our platform, your browser type and your operating system, the pages you visit, and your home page. Temporary storage of the IP address in the system is necessary for displaying web pages on the user’s computer. To do this, the user’s IP address must be kept for the duration of the session. Logging is done to ensure the functionality of the website. In addition, the data is used to optimize the website and ensure the security of our IT systems. There is no evaluation of data for marketing purposes in this context. Our legitimate interest in the processing of the data in accordance with Article 6 (1) (a) shall also correspond to these purposes. (f) GDPR.
3.4 Shelf life
Data shall be erased as soon as it is no longer necessary to achieve the objective for which it is stored. In the case of registration of the data for the provision of the website, this occurs at the moment of termination of the respective session.
In case of storing data in logs, this case shall occur within 60 days at the latest. Retention of data beyond the above limits is permitted. In this case, the IP addresses of the users are deleted or anonymized so that the assignment of the client that loaded the page is no longer possible.
3.5 Possibility to object and removal
Recording data for the purpose of providing websites and storing data in logs is essential for the operation of the website. Consequently, the user has no possibility to object in this context.
4.1. Description and extent of data processing
The following information is stored and transmitted in cookies:
• Language settings
• Currency settings
• Login information
4.2 Legal basis for data processing
The legal basis for the processing of a user’s personal data using technically necessary cookies is Article 6 (1) (a). (f) GDPR.
4.3. Purpose of data processing
The use of technically necessary cookies is intended to simplify the use of the website for users. Some features of our website could not be offered without cookies. For these features, the browser must be recognized even after switching to other pages.
• Language settings
• Currency settings
• Recording search terms
User data obtained through technically necessary cookies is not used to create user profiles. The use of analytical cookies is intended to improve the quality of our website and its content. With analytical cookies, we learn how our website is being used, so we can constantly optimize our offer.
4.4. Retention period, possibility of objection and possibility of removal
5. Web analysis and monitoring
The so-called “tracking tools” on the website collect and store data for marketing and website optimization purposes. The user may at any time object to future data collection in this way at any time.
5.1 Scope of personal data processing
We use the following web analytics and tracking tools on our website:
• Google Analytics
• Google Adwords
5.2 Legal basis for the processing of personal data
The legal basis for the processing of the user’s personal data is Article 6 (1) (a). (f) GDPR.
5.3. Purpose of data processing
The processing of the user’s personal data allows us to analyze the behavior of our users on the Internet. By evaluating the data obtained, we are able to summarize information on the use of individual components of our website. This helps us constantly improve our website and its user-friendliness. Our legitimate interest in the processing of the data in accordance with Article 6 (1) (a) shall also correspond to these purposes. (f) GDPR. Thanks to the anonymization of the IP address, the user’s interest in the protection of his / her personal data is sufficiently taken into account. Specifically, we use the following web analytics and tracking tools:
Only in exceptional cases is the full IP address transferred to a Google server in the United States and is truncated here. On behalf of Drozdoff, Google will use this information to evaluate the use of our website, compile reports on website activity, and provide other Drozdoff services related to the use of the website and the Internet. The IP address passed by your browser within Google Analytics is not merged with other Google data.
You may prevent Google from recording and processing the data generated by cookies in connection with your use of the Website (including your IP address) by Google at any time by downloading and installing the following plugin: https://tools.google. com / dlpage / gaoptout? hl = en-GB.
We also use the online advertising program “Google AdWords” and Google AdWords conversion tracking. Google Conversion Tracking is an analytics service provided by Google Inc. (1600 Amphitheater Parkway, Mountain View, CA 94043, USA; “Google”). When you click on a Google-activated ad, a conversion tracking cookie is stored on your computer. These cookies expire after 30 days, do not contain personal information and are therefore not used to identify you.
If you visit a website on our website and the cookie has not yet expired, Google will recognize that you have clicked on the ad and were redirected to it. Each Google AdWords client is assigned a different cookie. Therefore, cookies cannot be tracked through AdWords client websites.
The information that is obtained through conversion cookies is used to generate conversion statistics for AdWords clients who choose to use conversion tracking. This allows clients to see the total number of users who clicked on the ad and were redirected to pages with a conversion tracking tag. However, it does not receive any information to identify users.
5.4 Retention period
Data is deleted as soon as it is no longer needed for our recording purposes.
5.5 Possibility to object and removal
If you do not want to participate in tracking, you can disagree with this use by preventing the installation of cookies by setting up your browser accordingly (deactivation option). In this case, you won’t be included in your conversion tracking statistics. You can find more information and Google’s privacy statement here: http://www.google.com/policies/technologies/ads/, https://policies.google.com/privacy?hl=en.
6.1 Scope of personal data processing
Our website uses so-called retargeting technologies. We use the following technologies:
• Goolge Analytics
6.2 Legal basis for the processing of personal data
The legal basis for the processing of the user’s personal data is Article 6 (1) (a). (f) GDPR.
6.3 Purpose of data processing
We use these technologies to make the Internet offer more interesting. These technologies will allow us to reach Internet users who have already been interested in our offers on our partners’ websites through advertising. Our legitimate interest in the processing of the data in accordance with Article 6 (1) (a) shall also correspond to these purposes. (f) GDPR. Thanks to the anonymization of the IP address, the user’s interest in the protection of his / her personal data is sufficiently taken into account.
6.4 Shelf life
Data is deleted as soon as it is no longer needed for our recording purposes.
6.5 Possibility to object and removal
You can deactivate or restrict the transmission of cookies by changing your browser settings. This can also happen automatically. If cookies are disabled for our website, it is possible that not all of the website’s features will be fully utilized.
7. Booking form
7.1 Description and scope of data processing
You can contact Drozdoff directly via the booking form on our website. If the user makes use of this option, the data entered in the input mask is passed to us and saved. These data are as follows:
• Name and surname
• Number of adults and children
• Time of Arrival
• Email address
• Residence address (street, number, city)
• Telephone number
• Required services (airport transfer and other services)
• Entered text / note
• Payment method
In addition, the following information is stored when the message is sent:
• User IP address
• Date and time of registration
For the purposes of data processing, your consent to the link to this privacy statement is obtained as part of the submission process. Alternatively, the company can be contacted via the e-mail address: email@example.com. In this case, the personal information of the user transmitted by e-mail is stored. In this context, the data is not transferred to third parties. The data is used solely for conversation processing.
7.2 Legal basis for data processing
The legal basis for data processing is, in the case of the user’s consent, Article 6 (1) (a). (a) GDPR.
The legal basis for the processing of the data transmitted in the framework of the e-mail is Article 6 (1) (a). (f) GDPR. Where the aim of the e-mail contact is to conclude a contract, Article 6 (1) (a) shall constitute an additional legal basis for the processing of data. (b) GDPR.
7.3 Purpose of data processing
Drozdoff collects, processes and uses the information you provide in the contact form solely for the purpose of processing your application. In case of contact by e-mail, there is also a need for a legitimate interest in data processing. Other data processed in the posting process is designed to prevent misuse of the contact form and to ensure the security of our IT systems.
7.4 Shelf life
The data is stored for 10 years for corporate purposes. The client may at any time request to delete data after the end of the accommodation process to the following e-mail address: firstname.lastname@example.org.
7.5 Possibility to object and removal
The user may at any time withdraw his consent to the processing of personal data. If the user contacts us by e-mail, he can at any time oppose the processing of his personal data. In this case, the conversation cannot continue. Your consent to the processing of personal data can be revoked at any time free of charge at any time and you can also express your disagreement with the storage of this data at the email address: email@example.com. In this case, all personal data that was stored during the contact is deleted.
8. Rights of the subject with personal data
If your personal data is processed, you are a data subject within the meaning of GDPR and you have the following rights to the data controller:
8.1 Right of access to personal data
You have the right to free access to personal information concerning you. You can ask the administrator to confirm that personal information about you is being processed by us.
If your data is being processed, you have the right to request from the administrator access to the following information:
• the purposes for which such personal data are processed;
• the categories of personal data concerned;
• recipients or categories of recipients to whom personal data have been or will be disclosed;
• the planned period during which personal data will be stored or, if this cannot be determined, the criteria used to determine that period;
• the existence of the right to request from the controller the rectification or deletion of personal data concerning you, or the restriction of their processing or to object to such processing;
• existence of the right to lodge a complaint with the supervisory authority;
• all available information on the source of personal data, unless it is obtained from the data subject;
• the fact that automated decision-making, including profiling, referred to in Article 22 (1) and (4) of the GDPR takes place, and at least in such cases, meaningful information on the procedure used, as well as the significance and anticipated consequences of such processing for the data subject. You have the right to access information about whether your personal information is transferred to a third country or an international organization. In this case, you have the right to be informed of the appropriate safeguards under Article 46 of the GDPR applicable to the surrender.
8.2 Right to repair
We take reasonable steps to ensure the accuracy of the personal information we store about you. It is your responsibility to ensure that the information you provide to us is correct, error-free and complete, and to notify us in a timely manner if this information changes. You have the right to correct and / or complete personal data with the controller if the personal data processed concerning you is incorrect or incomplete. The administrator is obliged to carry out the repair without undue delay.
8.3 Right to Restrict Processing
In these cases, you may request restrictions on the processing of personal information that affects you:
• if you deny the accuracy of personal information for the time needed to allow the controller to verify the accuracy of the personal information;
• processing is unlawful and you refuse to delete personal data and ask for restrictions on its use instead;
• the controller no longer needs personal data for processing purposes, but you are requesting it to identify, exercise or defend legal claims; or
• if you object to processing under Article 21 (1) of the GDPR until it has been verified that the legitimate grounds of the controller outweigh your legitimate grounds. If the processing of personal data concerning you has been restricted, such personal data, except for storage, may only be processed with your consent or for the purpose of identifying, exercising or defending legal claims, for the protection of the rights of another natural or legal person or on grounds of important public interest of the Union or a Member State.
If processing is restricted under the above conditions, the administrator will notify you in advance that the processing restriction will be lifted.
8.4 Right of erasure
Under certain conditions, you may want to delete the personal information we store about you. However, this does not apply to data which Drozdoff has to store on the basis of the public interest.
Obligation to clear data
You have the right to require the controller to delete personal data concerning you without undue delay, and the controller is obliged to delete personal information without undue delay if one of the following reasons exists:
• Personal information concerning you is no longer needed for the purposes for which it was collected or otherwise processed.
• You shall withdraw the consent on the basis of which the information referred to in (a) or Article 9 (2) (a); (a) GDPR processed, and there is no other legal reason for processing.
• You object to the processing under Article 21 (1) of the GDPR and there are no overriding legitimate reasons for processing, or you object to the processing under Article 21 (2) of the GDPR.
• The personal data concerning you has been processed illegally.
• Personal data concerning you must be deleted in order to fulfill a legal obligation laid down in Union or Member State law to which the controller applies.
• The personal data concerning you has been collected in connection with the offer of information society services under Article 8 (1) of the GDPR.
Transmission of information to third parties
Where the controller has disclosed personal data and is required to delete it pursuant to Article 17 (1) of the GDPR, it shall take reasonable steps, including technical measures, in the light of the technology available and the implementation costs, to inform the controller processing the personal data that to delete any references to such personal information, copies or replications.
The right of erasure shall not apply where processing is necessary:
• to exercise the right to freedom of expression and information;
• to fulfill a legal obligation requiring processing under Union or Member State law applicable to the AIFM, or to carry out a task carried out in the public interest or in the exercise of official authority with which the AIFM is entrusted;
• for reasons of public interest in the field of public health in accordance with Article 9 (2) (a). (h) and (i) and Article 9 (3) of the GDPR;
• for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) of the GDPR, where the right referred to in section (a) is likely to prevent or seriously jeopardize the objectives of that processing; or
• to determine, exercise or defend legal claims.
8.5 Right to information
If you have exercised a right of rectification, erasure or processing restriction against the controller, the controller shall notify the individual recipients to whom your personal data have been disclosed of any rectification or deletion of personal data or processing restrictions, unless this proves impossible or it requires disproportionate effort. You can exercise your right to be informed of these recipients.
8.6 Right to data portability
You have the right to obtain personally identifiable information about you provided by the Administrator in a structured, commonly used and machine readable format. In addition, you have the right to transfer this information to another controller without preventing the controller to whom the personal information was provided,
• processing is based on the consent referred to in Article 6 (1) (a); (a) GDPR or Article 9 (2) (a); (a) GDPR or the contract referred to in Article 6 (1) (a) of the EC Treaty; (b) GDPR; and
• processing is carried out automatically.
In exercising this right, you also have the right to have your personal data transferred directly by one controller to the controller, if technically feasible. This shall not adversely affect the rights and freedoms of others. The right to data portability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority entrusted to the controller.
8.7 Right to object to processing
For reasons specific to his specific situation, you have the right to object at any time to the processing of personal data concerning you under Article 6 (1) (a). (e) or (f) GDPR, including profiling based on these provisions. The Controller will not further process personal data unless he or she proves serious legitimate reasons for processing that outweigh your interests or rights and freedoms, or to determine, exercise or defend legal claims. If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for this marketing, including profiling with respect to this direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for that purpose. With regard to the use of information society services, and without prejudice to Directive 2002/58 / EC, you may exercise your right to object by automated means using technical specifications.
8.8 Revocation of consent
In the future, you can withdraw your consent to the collection, processing and use of personal data free of charge at firstname.lastname@example.org. The withdrawal of consent shall not affect the legality of the processing carried out on the basis of consent until its withdrawal.
8.9 Automated individual decision making, including profiling
You have the right not to be subject to any decision based solely on automated processing, including profiling, which has legal effects or affects you in a similar way. This does not apply if the decision is:
• necessary to enter into or perform a contract between you and the data controller;
• authorized by Union or Member State law applicable to the AIFM, which also provides for appropriate measures to protect your rights and freedoms and legitimate interests; or
• based on your explicit consent.
However, such decisions may not be based on the specific categories of personal data referred to in Article 9 (1) of the GDPR, unless Article 9 (2) (a) of the basic Regulation applies. a) or g) GDPR and there are no appropriate measures in place to safeguard your rights and freedoms and your legitimate interests.
In the cases referred to in points (1) and (3), the data controller shall take appropriate measures to protect your rights and freedoms and legitimate interests, at least the right of human intervention by the controller, the right to express an opinion and the right to challenge decisions.
8.10 Right to lodge a complaint with the Supervisory Authority
Without prejudice to any other means of administrative or judicial protection, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your usual residence, place of employment or the place where the alleged breach occurred, to you, the GDPR is violated. The supervisory authority to which the complaint was lodged shall inform the complainant of the progress of the complaint and its outcome, as well as of the possibility of judicial protection under Article 78 of the GDPR.
If you have further questions regarding the protection of personal data and the processing of personal data concerning you, we are available at any time at the following email address: email@example.com.