Host Privacy Policy

This document describes the processing of personal data of hosts (users who manage their accommodation through the Service). If you are a guest — filling in a registration (check-in) form or creating your own Best Guest account — the separate Guest Privacy Policy applies to you.

1. Introduction

Hotel Analytics s.r.o., Company ID: 06723756, registered office at Krakovská 582/23, 110 00 Prague 1, Czech Republic (hereinafter referred to as “we” or “the Controller”) provides the Best Guest web and mobile service for efficient management of guest registrations and the fulfillment of legal obligations in the field of short-term accommodation. The protection of your personal data is our priority. This policy describes how we process the personal data of hosts in accordance with the General Data Protection Regulation (GDPR).

2. Our role: Controller

With respect to the data described in this document (account, billing, communication, marketing), we act as the data controller.

With respect to your guests’ personal data collected through the Service (identification data, travel documents, stay details, etc.), you are the controller and we act as a processor under Article 28 GDPR — see the Data Processing Agreement, Annex 1 to the Host Terms and Conditions. The processing of this data is described in the Guest Privacy Policy, which we recommend you make available to your guests.

3. Categories of Personal Data and Purposes of Processing

We process the following categories of your personal data:

  • Account and billing data (payment history, billing information, company ID) — application operation, service support, complaint handling; legal basis: contract performance.
  • Contact data (email address, telephone number) — communication with the user, support, marketing; legal basis: contract performance; marketing: consent.
  • Technical data (device identification, browser type, login data) — service security, misuse detection, analysis; legal basis: legitimate interest.

We process personal data only on the following legal grounds:

  • Performance of a contract – processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract (e.g., account creation, registration management).
  • Legal obligation – processing is required for compliance with legal obligations applicable to us (e.g., accounting and tax regulations).
  • Legitimate interest – processing is necessary for our legitimate interests, such as improving service functionality, securing the system, or maintaining records for legal protection, provided your rights and freedoms are not overridden.
  • Consent – for marketing communications, we process data on the basis of your consent, which you may withdraw at any time.

5. Retention Periods

  • Accounting and tax documents: 10 years (under the VAT Act).
  • User account data: duration of the contract plus the period for claiming rights (up to 4 years after contract termination).
  • Marketing consent data: until withdrawal of consent.
  • Technical logs: maximum 12 months.

6. Recipients of Personal Data

Your personal data may be shared with:

  • PayU S.A. (registered office at ul. Grunwaldzka 186, 60-166 Poznań, Poland), which, as an independent controller, processes the data necessary to process card payments (in particular payment details and the payer’s identification data) for the purpose of settling payment for the Service;
  • Contabo GmbH (Aschauer Straße 32a, 81549 Munich, Germany) — hosting and data storage in EU data centers;
  • Sinch Mailgun — transactional e-mail delivery.

All third-party providers are bound by contractual agreements under Article 28 GDPR and process data only to the extent necessary for the operation of our services. All data is stored within the EU.

7. Data Security

We have implemented technical and organizational measures to ensure an appropriate level of security for your personal data. These measures are regularly reviewed and updated in line with the latest security standards. Further details are available on the “Security & Trust Center” page on the Service website.

Automated decision-making and profiling: Our company does not engage in automated individual decision-making or profiling as defined in Article 22 of the GDPR. Your personal data is not transferred outside the EU.

8. Cookies and Analytics

The bestguest.cz website uses Plausible Analytics, a cookieless analytics tool that stores no cookies and collects no personal data — therefore no cookie consent banner is required.

The Best Guest application uses only technical storage strictly necessary for its operation (login and session data); no advertising or tracking cookies are used.

9. Your Rights as a Data Subject

In connection with your personal data, you have the following rights:

  • Right to access your personal data
  • Right to correct inaccurate or incomplete personal data
  • Right to erasure (“right to be forgotten”) under the conditions set out by GDPR
  • Right to restriction of processing in cases specified by GDPR
  • Right to data portability to another controller
  • Right to object to processing on the basis of legitimate interest
  • Right to withdraw consent to data processing
  • Right to lodge a complaint with the supervisory authority (Office for Personal Data Protection, ÚOOÚ)

Exercising the right to erasure — deleting your account

You can delete your account yourself, without contacting support, under Settings → Security in the administration application. After you confirm your identity (password, or a one-time code sent to your e-mail), your account is immediately deactivated and signed out everywhere, and a 30-day grace period begins. We will remind you by e-mail 7 days and 1 day before the deletion becomes final; you can restore your account at any time during the grace period simply by signing back in and confirming the restoration. If you are the sole owner of a workspace, any active subscription is canceled upon confirmation and the workspace is closed at the end of the grace period.

When the grace period expires, we permanently delete or anonymize your personal data. Data that we are legally required to keep — in particular accounting documents — is retained for the statutory periods listed in Section 5. If you have any questions about the deletion process, contact us at privacy@bestguest.cz.

10. Contact Information

To exercise your rights or if you have any questions regarding the processing of your personal data, you can contact us at: privacy@bestguest.cz

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

11. Changes to the Privacy Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. We will inform you of significant changes via our website or by email.

Effective as of [EFFECTIVE_DATE].