Data processing agreement

The controller is the host, meaning the holder of a Chalupario account, who puts the data of their guests into the service and determines the purpose and means of processing. The processor is Solushnis, s.r.o., company ID 24993786, the operator of Chalupario; full identification is in the footer of this page.

The roles follow from the law: the duty to keep the house book under s. 101 of Act No. 326/1999 Coll. and the accommodation register under s. 3g of Act No. 565/1990 Coll., and to report the stay of foreign nationals, lies with the host, not with us. We store the same data and make it available on the instructions of the host.

The agreement is concluded electronically by acceptance at registration or by continued use of the service after it takes effect; the written form required by Article 28(9) GDPR is met that way.

The subject matter is the processing of the personal data of the guests of the host to the extent necessary to provide the Chalupario service under the terms of use.

The nature of the processing is collection, storage, organisation, consultation, alteration, export and erasure of data in the application and in its automated processes: confirming reservations, emails to guests, matching payments from bank notification emails, issuing documents and exports for the statutory registers.

The purpose is managing reservations and occupancy, communicating with guests, issuing documents and preparing the records the host keeps by law. We do not use this data for our own purposes and we do not sell it.

The processing lasts for as long as the account of the host exists. After it ends, section 11 applies.

Data subjects: the guests of the host and other persons named on a reservation or in the online check-in, including the person who pays for the stay or asks for a document for it.

Identification and contact data: first and last name, email, phone, country and language of communication.

Data for the statutory registers of the host, filled in during the online check-in: date of birth, type and number of the identity document, permanent address and, for foreign nationals, purpose of stay and visa number. The online check-in link is signed and time limited; it carries no personal data itself.

Data about the stay, payments and documents: dates and property, number of persons, when the online check-in was completed, when and under what reference the stay was reported to the foreign police, amounts and payment method, variable symbol, billing details entered on the reservation (name, address, company ID, tax ID) and any text the guest or the host enters. We also store the full body of emails sent to guests and the incoming bank notification emails used to match a payment, including the name and account number of the counterparty.

The service does not process or store payment card data. It requires neither special categories of data under Article 9 GDPR nor data on convictions under Article 10 GDPR; the host should not enter such data into free text fields.

We process the data only on documented instructions from the host, as Article 28(3)(a) GDPR requires. An instruction means the configuration and use of the service, this agreement, the terms of use, and written requests sent from the contact email of the account.

We process data beyond those instructions only where Union or Czech law requires us to. In that case we inform the host of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.

If we consider an instruction to infringe GDPR or other data protection rules, we tell the host immediately and may suspend the instruction until it is resolved.

If, contrary to this agreement, we determine the purpose and means of processing ourselves, we are the controller for that processing with every consequence set out in Article 28(10) GDPR.

Persons involved in the processing are bound by confidentiality that survives the end of their involvement. Access to the production environment is limited to those who need it to run and support the service.

We enter the account of a host only at their request or while handling an incident, through a short lived delegation token; every token issued is recorded in the audit log.

Transfers between the browser, the application and the interface are encrypted. Sign-in sessions use secure httpOnly cookies, passwords are stored only as cryptographic hashes, and an account can be protected with two-factor authentication or a passkey.

The application interface accepts only requests carrying a signed token verified against a public key. Every query and every operation is scoped to the data of the account owner, so the data of individual hosts is kept separate.

The online check-in link is signed, time limited and can be revoked at any time. Changes to data are recorded in an audit log with a hash that reveals a later edit of a record.

The database is backed up by a regular logical dump into object storage with a thinned archive, uploaded files by a daily copy; the infrastructure provider keeps its own disk snapshots on top of that.

We hold no security certification and claim none. We assess whether the measures are appropriate under Article 32(1) GDPR and change them as the service develops; we will not introduce a change that materially lowers the level of security.

The host gives general authorisation to engage other processors under Article 28(2) GDPR. Engaged today: Railway (hosting of the application, the database, the object storage and the backups), Postmark (sending emails to guests and receiving bank notification emails), Cloudflare (DNS and routing of email to the info@ and gdpr@ addresses), Sentry (server-side error records) and the Solushnis AI platform together with its language model providers, today Anthropic and OpenAI, and only when the AI features are used.

No payment service provider processes guest data today: payments are entered by hand or matched from bank notification emails. Adding a payment gateway would be a change under the next paragraph.

We announce an intended addition or replacement of another processor at least 30 days in advance in the application or by email. The host may object within the same period; if no agreement is reached, the host may stop using the service as of the day the change takes effect.

We engage another processor only under a contract imposing on it the same data protection obligations we owe under this agreement. We remain liable to the host for the performance of its obligations under Article 28(4) GDPR.

Taking into account the nature of the processing, we assist the host by appropriate technical and organisational measures in handling guest requests for access, rectification, erasure, restriction of processing, portability and objection, as Article 28(3)(e) GDPR requires.

The application gives the host tools to do this directly: editing and deleting a guest record and a reservation, and exports of the guest book and of documents. Anything those tools cannot do we handle on a request sent from the contact email of the account without undue delay, usually within ten working days, so that the host can meet its own deadline toward the guest.

If a guest brings a request directly to us, we do not handle it ourselves: we pass it to the host without undue delay and point the guest to the host.

We assist the host in ensuring compliance with the obligations under Articles 32 to 36 GDPR, meaning security of processing, notification and communication of a breach, the data protection impact assessment and prior consultation with the supervisory authority, taking into account the nature of processing and the information available to us, as Article 28(3)(f) GDPR requires.

On request we provide a description of the processing, the categories of data, the recipients and the security measures, to the extent the host needs for its record of processing activities and for dealing with the supervisory authority.

If we become aware of a personal data breach, we notify the host without undue delay, as Article 33(2) GDPR requires. The 72-hour deadline toward the supervisory authority under Article 33(1) GDPR is met by the host as controller; we supply the information we hold without delay.

The notification describes the nature of the breach, the categories and approximate number of records concerned, the likely consequences and the measures taken or proposed, to the extent known at the time. Missing information follows in phases without undue further delay.

After the provision of the service ends we either erase the guest data or return it to the host and then erase it, at the choice of the host, as Article 28(3)(g) GDPR provides. The host states the choice within 30 days of termination; if it does not, we erase the data once that period passes.

Return uses the export formats the application offers: the guest book, documents and the list of reservations. The host can produce these exports at any time while the account exists.

Erasure does not cover data we are required by law to keep, nor copies in backups, which expire gradually under the backup retention schedule; we do not restore data from backups for any purpose other than disaster recovery. A retention schedule for the remaining operational records is still being introduced; until it is finished we delete those on request.

On request we make available to the host all information necessary to demonstrate that we meet the obligations under Article 28 GDPR, and we allow an audit including an inspection conducted by the host or an auditor it mandates, as Article 28(3)(h) GDPR requires.

An audit takes place at most once in twelve months, on at least 30 days notice, during working hours, and in a way that does not disrupt the service or the security of the data of other hosts; the auditor is bound by confidentiality. We allow an audit more often where the supervisory authority orders it or where a breach has occurred. The host bears the cost of the audit unless it reveals a material breach of this agreement.

We process the data primarily in the European Union. A transfer outside the EU and the EEA can happen at the language model providers and at the error telemetry, on the standard contractual clauses of that provider under Article 46(2)(c) GDPR.

The location of the infrastructure differs between providers and we do not guarantee that all processing takes place solely in the EU. We transfer to a third country only within Chapter V GDPR and only to the extent described in the privacy policy.

Liability between the parties follows the terms of use, including the cap on damages at the amount paid for the service over the last 12 months. The cap does not apply where the law excludes it.

The cap in the previous paragraph does not cover claims of data subjects under Article 82 GDPR or administrative fines. We are liable for the processing where we have not complied with obligations directed specifically at processors, or where we have acted outside or contrary to the instructions of the host.

Liability for the output of the AI features and for documents created in the service is governed by the terms of use; this agreement does not change it.

The agreement is governed by Czech law, in particular Regulation (EU) 2016/679 and Act No. 110/2019 Coll., on personal data processing. The supervisory authority is the Office for Personal Data Protection under s. 50 of Act No. 110/2019 Coll. (uoou.gov.cz).

This agreement forms part of the terms of use and supplements them. Where it differs from section 6 of the terms of use, this agreement prevails.

This agreement is version 1.0, effective from 6 September 2026. Material changes are announced at least 14 days in advance in the application or by email; you may object by terminating the account before the change takes effect. Earlier versions are available on request.