Guest Privacy Policy

1. Introduction

Hotel Analytics s.r.o., Company ID: 06723756, registered office at Krakovská 582/23, 110 00 Prague 1, Czech Republic, provides hosts with the Best Guest web and mobile service for guest registration. This document explains how we process your personal data as a guest, in two distinct roles described below, in accordance with the General Data Protection Regulation (GDPR).

2. Our two roles with respect to your data

(a) Check-in form data — we are the processor. The host you are staying with is the data controller with respect to this data. We process this data on the host’s behalf as a processor under Article 28 GDPR, under a data processing agreement concluded with the host (Annex 1 to the Host Terms and Conditions). This means you should exercise your data-subject rights (access, correction, erasure, etc.) primarily with the host; if you contact us directly, we will forward your request to the relevant host and assist them in handling it.

(b) Optional Best Guest account data — we are the controller. If you create your own Best Guest account (sign-in via an e-mail code, a saved profile for future stays, consent settings), we are the data controller with respect to this data. You can exercise your rights in this role directly with us (see Sections 9 and 10).

3. Categories of Personal Data and Purposes of Processing

(a) Check-in form data (processed by us as processor on behalf of the host):

• Identification data (name, surname, date of birth, nationality) — fulfillment of the host’s legal obligations; legal basis (on the host’s side, as controller): legal obligation.
• Address of residence (permanent address, address during stay) — guest registration for local fees and immigration police reporting; legal basis: legal obligation.
• Travel document data (passport or ID card number, type of document, visa number) — fulfillment of obligations under Act No. 326/1999 Coll., on the Stay of Foreigners; legal basis: legal obligation.
• Stay details (date and time of arrival and departure, purpose of stay) — legal compliance and local fee calculation; legal basis: legal obligation.
• Signature (where required by the host) — confirmation of the accuracy of the data provided by the guest; saved to your profile only if you have agreed to the Guest Terms.

(b) Optional account data (processed by us as controller):

• Contact data (e-mail) — sign-in via one-time code, account security, communication; legal basis: consent / performance of the contract to provide the account.
• Guest profile (voluntarily saved identification and contact data from previous stays) — simplifying future check-in forms; legal basis: consent.
• Consent records (consent to personal-data processing, consent to terms, marketing preferences) — recording the consent given; legal basis: compliance with the legal obligation to demonstrate consent.

4. Legal Bases for Processing Personal Data

• Consent of the data subject – used in particular when you create your account and save a profile for future stays; consent is voluntary and may be withdrawn at any time, without affecting your ability to complete a check-in form as an unregistered guest.
• Performance of a contract – necessary to provide the account feature (saved profile, sign-in).
• Legal obligation – for check-in form data, this is the host’s obligation under Act No. 326/1999 Coll. (foreigner registration) and Act No. 565/1990 Coll. (local fees); we process this data as processor, on the host’s instructions.
• Legitimate interest – securing the Service and protecting against misuse.

5. Retention Periods

• Check-in form data (house register / record book): retained by the host, as controller, for 6 years from the last entry (required by Act No. 326/1999 Coll. and Act No. 565/1990 Coll.); we process it as processor on the host’s behalf for the same period.
• Optional account data: for as long as the account exists; after you request account deletion, a 30-day grace period applies, after which the data is permanently deleted or anonymized (see Section 9).
• Signature saved to your profile: retained for the lifetime of the account, deleted together with the account.
• Technical logs: maximum 12 months.

6. Recipients of Personal Data

Your check-in form data may be shared with:

• The host you are registering with (as controller);
• Public authorities (immigration police, tax authorities) as required by law, via systems such as Ubyport and eTurista, operated by the host;
• Contabo GmbH (Aschauer Straße 32a, 81549 Munich, Germany) — hosting and data storage in EU data centers;
• Sinch Mailgun — transactional e-mail delivery (e.g., a sign-in verification code).

All third-party providers are bound by contractual agreements under Article 28 GDPR. Your personal data is stored only within the EU and is not transferred outside the EU.

7. Data Security

We have implemented technical and organizational measures to ensure an appropriate level of security for your personal data (encryption in transit and at rest, access control, backups). Further details are available on the “Security & Trust Center” page on the Service website.

We do not engage in automated individual decision-making or profiling as defined in Article 22 of the GDPR.

8. Cookies and Analytics

The bestguest.cz website uses Plausible Analytics, a cookieless analytics tool that stores no cookies and collects no personal data. The Best Guest application uses only technical storage strictly necessary for its operation (login and session data); no advertising or tracking cookies are used.

9. Your Rights as a Data Subject

You have the following rights: access, correction, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, withdrawal of consent, and the right to lodge a complaint with the supervisory authority (Office for Personal Data Protection).

How to exercise these rights for check-in form data: contact primarily the host you stayed with — they are the controller. If you contact us directly at privacy@bestguest.cz, we will forward your request to the relevant host and assist them in handling it.

How to exercise these rights for your account data: contact us directly at privacy@bestguest.cz, or use the self-service tools described below.

Exercising the right to erasure — deleting your account

You can delete your account yourself, without contacting support, on the Account page of the guest application. After you confirm your identity (a one-time code sent to your e-mail), your account is immediately deactivated and signed out everywhere, and a 30-day grace period begins. We will remind you by e-mail 7 days and 1 day before the deletion becomes final; you can restore your account at any time during the grace period simply by signing back in and confirming the restoration.

When the grace period expires, we permanently delete or anonymize your account data (profile, saved signature, consent settings). Deleting your account does not affect the record of your stay in the host’s house/record register — the host is legally required to retain it for the period listed in Section 5 regardless of the status of your Best Guest account. If you have any questions about the deletion process, contact us at privacy@bestguest.cz.

10. Contact Information

To exercise your rights or if you have any questions regarding the processing of your personal data, you can contact us at: privacy@bestguest.cz

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

11. Changes to the Privacy Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. We will inform you of significant changes via our website or, if you have an account, by e-mail.

Effective as of [EFFECTIVE_DATE].