Privacy Policy

1. Controller of personal data

The controller of personal data is:

• Nikola Tomková

• IČO: 04304438

• registered office: Reinerova 47/12, České Budějovice 5, 370 06

• natural person carrying on business under the Trade Licensing Act

• premises / place of accommodation: VIVIEN Apartments, Nádražní 108/43, České Budějovice

• website: www.vivienapartments.cz

• e-mail for personal data enquiries: info@vivienapartments.cz

• phone: +420 702 153 573

Hereinafter the “controller” or “operator”. The operator provides accommodation under the trade name VIVIEN Apartments.

2. What personal data we process

We process only personal data that is necessary for reservation, providing accommodation, complying with legal obligations, protecting our rights, and ensuring the safe operation of the accommodation.

a) Data needed for reservation and communication

• first name and surname

• e-mail address

• phone number

• address

• reservation details

• stay dates

• number of guests

• guest requests or notes

• communication by e-mail, booking portals, phone, or other communication tools

b) Data needed for accommodation and statutory records

In connection with accommodation we may also process data required to meet the host’s statutory duties, in particular:

• date of birth

• permanent residence or home address

• nationality

• identity document number and type

• length of stay

• guest signature, if required

• other data required by law for the register of accommodated persons

For foreign guests the host is obliged to keep records and, in cases set by law, to report the stay to the Police of the Czech Republic. The guest book or equivalent record is retained for the period required by law.

c) Payment, accounting and tax data

• details of the payment made

• billing details

• bank details, if needed for example for a refund

• data stated on accounting and tax documents

d) Data relating to damage, complaints and protection of rights

If damage occurs, house rules are breached, or a complaint, claim or other dispute arises, we may process data needed to handle the situation and protect our rights.

• description of the event

• photographs of the damage

• communication with the guest

• reservation details

• payment details

• materials for the insurer, legal counsel or public authorities

e) CCTV footage

CCTV may operate in selected shared or outdoor areas of the property. Cameras are not used to monitor guest privacy and are not placed inside apartments or in spaces where guests reasonably expect privacy.

f) Electronic access system and access codes

In connection with self-service entry to the building and apartments, the operator may process technical data from the electronic access system, in particular information about use of an access code and the time of entry or attempted entry. Access codes are valid only for the stay and after check-out they are invalidated or deleted.

3. Why we process personal data and on what legal basis

Handling the reservation and providing accommodation

We need the data to accept and confirm the reservation, communicate with the guest, enable the stay, handle payment, and provide the stay itself.

Legal basis: performance of a contract.

Compliance with legal obligations

Some data must be processed because the law requires it. This mainly concerns the register of accommodated persons, reporting of foreign guests, accounting, taxes and local fees.

Legal basis: compliance with a legal obligation.

Protection of property, safety and the operator’s rights

Some data is processed to protect property, prevent damage, handle breaches of house rules, complaints, claims, insurance events or legal claims.

Legal basis: legitimate interest of the controller.

CCTV system

CCTV operates only in selected shared or outdoor areas and serves to protect property, personal safety, prevent unauthorised entry, and handle damage or security incidents.

Legal basis: legitimate interest of the controller.

Electronic access system

Access-system data is processed to ensure guest safety, protect property, control unauthorised entry, and handle possible security or damage incidents.

Legal basis: legitimate interest of the controller.

Sending commercial communications

If a guest gives consent, or if the law allows it, we may use contact details to send information about our services, news or special offers. The guest can always unsubscribe from commercial communications.

Legal basis: consent, or legitimate interest to the extent permitted by law.

Website operation and cookies

When visiting the website we may process technical data necessary for the site to work. Analytical or marketing cookies are used only when we have a corresponding legal basis.

Legal basis: legitimate interest for technical website operation; consent for analytical or marketing cookies where required.

4. To whom we may disclose personal data

We may disclose personal data to the following categories of recipients to the extent necessary:

• providers of reservation systems

• booking portals such as Booking.com, Airbnb or other platforms, if the reservation was made through them

• payment service providers and banks

• accountants and tax advisers

• website and IT service providers

• providers of communication tools

• providers of electronic locks, access systems or CCTV systems, where necessary for operating and securing the system

• the city or municipality in connection with local fees

• the Police of the Czech Republic in cases set by law

• an insurer, legal counsel or public authority where necessary to handle damage, disputes or protect rights

• other persons where necessary to perform a contract, meet a legal obligation or protect legitimate interests

We do not disclose personal data to third parties without a legal basis.

5. Transfers of personal data outside the European Union

Some service providers, especially technology or booking platforms, may also process personal data outside the European Union. If such a transfer occurs, it takes place only under the conditions set by the GDPR, for example on the basis of appropriate contractual safeguards, an adequacy decision, or another legal mechanism under the GDPR.

6. How long we keep personal data

We keep personal data only for as long as necessary for the given purpose, or for the period required by law.

• reservation and stay data for the duration of the contractual relationship and then for as long as needed to protect rights and handle any claims.

• accounting and tax documents for the period required by law.

• data in the guest book or equivalent register for the period required by law.

• CCTV footage ordinarily for 7 days. After that period recordings are automatically deleted or overwritten, unless a specific recording must be kept longer to handle damage, a security incident, an insurance event, a complaint, a dispute or another legitimate need.

• access codes are invalidated or deleted after check-out. Access-related data may be kept only for as long as strictly necessary if needed to handle a security incident, damage, complaint, dispute or to protect the operator’s rights.

• data processed on the basis of consent until consent is withdrawn, unless another legal basis for further processing exists.

7. CCTV system

At VIVIEN Apartments a CCTV system may operate in selected shared and outdoor areas.

Cameras are placed mainly in shared circulation areas, for example in the corridor covering the building entrance or entry area, and outdoors, especially in the garden covering the entrance and garden area.

The CCTV system is used solely to protect property, guest and other persons’ safety, prevent unauthorised entry, and handle possible damage or security incidents.

Cameras are not placed inside apartments, bathrooms, bedrooms or other spaces where guests reasonably expect privacy. The CCTV system is not intended to monitor guests’ private life.

Monitored areas are marked with information signs.

CCTV footage is ordinarily kept for 7 days. After that period recordings are automatically deleted or overwritten, unless a specific recording must be kept longer because of a damage event, security incident, insurance event, complaint, dispute or protection of the operator’s rights.

Access to CCTV footage is limited to authorised persons of the operator, namely Nikola Tomková and Pravoslav Tomek, or another person only where necessary for technical administration of the system, handling a security incident, damage, insurance event or complying with a legal obligation.

CCTV footage is not routinely disclosed to third parties. It may be disclosed only to the extent necessary, in particular to the Police of the Czech Republic, an insurer, legal counsel or another competent authority, where needed to handle a specific event or where required by law.

8. Electronic access system and access codes

In connection with self-service entry to the building and apartments, the operator may process technical data from the electronic access system, in particular information about use of an access code and the time of entry or attempted entry.

This data is processed to ensure guest safety, protect property, control unauthorised entry, and handle possible security or damage incidents.

An access code is a digital key intended solely for persons named in the reservation and duly registered at online check-in. The code must not be passed on, shared or made available to third parties.

Access codes are valid only for the stay and after check-out they are invalidated or deleted. Access-related data may be kept only for as long as strictly necessary if needed to handle a security incident, damage, complaint, dispute or to protect the operator’s rights.

9. Cookies

The VIVIEN Apartments website may use cookies and similar technologies.

Cookies are used mainly to ensure the website works correctly, remember certain settings, measure website traffic and, where applicable, for marketing purposes.

Technical cookies necessary for the website to function may be used without the visitor’s consent.

Analytical, marketing or other optional cookies are used only when we have a corresponding legal basis, in particular the visitor’s consent given via the cookie banner, where such consent is required by law.

The visitor may change or withdraw consent to optional cookies at any time if the website uses such cookies.

Specific cookie settings depend on the tools actually used on the website. If third-party analytical or marketing tools are used, visitors will be informed via the cookie banner or corresponding website settings.

10. Security of personal data

The controller takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or unauthorised disclosure.

Access to personal data is limited to persons who need it for reservation, accommodation, guest communication, compliance with legal obligations, accounting, technical administration or protection of the operator’s rights.

Access to reservation systems, e-mail, accounting records, check-in forms, access systems and other systems is protected by appropriate security means.

11. Rights of guests and website visitors

Anyone whose personal data we process has, under the GDPR, in particular the following rights:

• right of access to personal data

• right to rectification of inaccurate or incomplete data

• right to erasure of personal data where the conditions are met

• right to restriction of processing

• right to object to processing based on legitimate interest

• right to data portability where it applies

• right to withdraw consent where processing is based on consent

• right to lodge a complaint with the supervisory authority

The supervisory authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, website: www.uoou.gov.cz.

12. How to exercise your rights

A guest or website visitor may exercise their rights by e-mail: info@vivienapartments.cz.

When handling a request we may ask for identity verification if needed to protect personal data and prevent disclosure to an unauthorised person.

We respond to requests within the statutory time limit.

13. Automated decision-making

Processing of personal data does not involve automated individual decision-making or profiling that would have legal or similarly significant effects on the guest.

14. Final provisions

This privacy policy is valid from 1 May 2026.

The operator may update this policy, in particular if the law, the way personal data is processed, the technologies used or the operating conditions of the accommodation change.

The current version of the policy is always available at www.vivienapartments.cz.