Version dated 25 October 2026
1. Who controls your data
The controller of personal data of prospective management customers and contractual partners is Matyáš Rind, Business ID 19727305, with its registered office at Nezamyslova 1291, 460 01 Liberec, Czech Republic, trading as ÚTULNA. For privacy matters, write to info@utulna.eu or the postal address above, or call +420 774 202 977.
This information concerns website visitors, people submitting enquiries, property owners and their contact persons. The legal framework is Regulation (EU) 2016/679 (GDPR), Czech Act No. 110/2019 Coll. on Personal Data Processing and, for storing and reading information on devices, Act No. 127/2005 Coll. on Electronic Communications.
2. What data we obtain and from where
The enquiry form collects your full name, email, telephone number and, optionally, the property’s location, type and layout and your message. The first three fields are required in this form to establish contact and prepare an offer; providing them is not a statutory obligation. If you do not wish to use the form, you can email us directly. Optional fields may be left blank. Do not send national identification numbers, document copies or sensitive data unless expressly and lawfully requested for a specific later task.
During cooperation we also process contractual and billing details, property identification and address, payment and operational documents, correspondence and, where applicable, photos of the property’s condition. The scope depends on the service actually agreed. You normally provide the data yourself; owners may provide representatives’ contact details, and relevant business information may be obtained from public registers. We inform these contact persons by the first contact at the latest, or within other deadlines under Article 14 GDPR.
When you visit the website, the technical infrastructure processes information such as your IP address, request time, requested page, browser information and error or security logs necessary to deliver and protect the website. Calculator inputs do not themselves constitute an order.
3. Purposes and legal bases
- Handling enquiries, consultations and preparing offers: steps at your request before entering into an agreement, Article 6(1)(b) GDPR. We do not require consent for this purpose.
- Property management, contractual communication and billing: performance of an agreement with a natural person, Article 6(1)(b) GDPR. For contacts at legal entities or representatives, our legitimate interest in contractual communication applies under point (f).
- Accounting, taxes and other mandatory duties: compliance with a legal obligation, Article 6(1)(c), especially accounting and tax legislation insofar as it applies to the controller.
- Protecting rights, handling complaints and disputes, and website security: a legitimate interest in documenting cooperation, protecting property, enforcing or defending claims and preventing abuse, Article 6(1)(f). We always assess necessity and the impact on your rights.
Submitting an enquiry is not consent to newsletters or advertising. The form does not subscribe you to marketing messages. Separate consent would be requested wherever required by law and may be withdrawn at any time without affecting the lawfulness of prior processing.
4. How long we need the data
We do not retain data indefinitely. The following storage limitation rules apply:
- Enquiries not resulting in an agreement: during discussions and for no more than 12 months after the last substantive communication, unless limited retention is necessary for a specific legal claim. If cooperation begins, necessary data become part of the contractual documentation.
- Agreement and related correspondence: during cooperation and afterwards to the extent necessary to protect rights throughout applicable limitation periods, usually three years from when a particular right can first be exercised. In a dispute, until its final resolution and settlement; special statutory periods take precedence.
- Accounting and tax documents: for the statutory period applicable to the type of document and the controller’s status; for example, accounting documents generally five years and VAT tax documents ten years where the legislation applies. Only data needed to fulfil the obligation are retained for that period.
- Technical and security logs: as long as necessary for operation and incident detection and investigation; the precise period depends on the log type and infrastructure provider’s settings. Information specific to your data is available on request. Backups are deleted within the provider’s restoration cycle and are not intended for renewed ordinary use of deleted data.
When the purpose and legal basis expire, data should be erased or irreversibly anonymised. Statutory archiving does not justify further marketing use.
5. Who may access the data
Only people who need data for the relevant task may access it. Recipients may include hosting and website operation providers, email and IT services, accounting or legal advisers and, where necessary, suppliers involved in agreed management, such as cleaning or maintenance. Processors may act only under contractual instructions and with appropriate security. Public authorities receive data where required by law.
The website and enquiry database are operated on the Base44, Inc. platform. Its processing terms are in the Data Processing Agreement; supplier and security information is in the Trust Center. Storing an enquiry in the database does not itself make it public.
Airbnb, Booking.com and other agreed portals may be involved in actual booking management. For their own purposes, these platforms generally act as separate controllers under their own terms. Enquiries are not shared with them merely because a visitor completes this form. We disclose specific recipients relating to your data when you exercise your right of access.
6. Transfers outside the European Economic Area
Using Base44 and some of its subprocessors may involve storage or processing outside the EEA, particularly in the USA. You therefore cannot assume that all data stay only in the Czech Republic or EU.
Transfers must comply with Chapter V GDPR: depending on the recipient, an adequacy decision under Article 45 or appropriate safeguards under Article 46, especially standard contractual clauses and necessary supplementary measures. Consent to this policy alone does not replace those safeguards. You can request information about a specific transfer and a copy of the applicable safeguards, with protection for third-party rights where necessary, at our contact email. The platform’s processing terms linked above provide further details.
7. Guest data at managed properties
The owner or other actual accommodation provider generally determines the purposes of bookings, guest registration and statutory accommodation duties. If ÚTULNA processes these data only on their instructions, it acts as a processor and must have an agreement under Article 28 GDPR. The relevant accommodation provider informs guests about legal bases and retention periods, which may include duties under Act No. 565/1990 Coll. on Local Fees and Act No. 326/1999 Coll. on Residence of Foreign Nationals.
Where ÚTULNA processes limited data for its own statutory duties or to protect its rights, it acts as a separate controller for those purposes. Roles depend on actual activity, not just contractual labels. Guest requests concerning processing for an accommodation provider are forwarded to the relevant controller with necessary cooperation.
8. Cookies, technical services and measurement
The website may use technical storage necessary for secure operation and delivery of a requested service; such storage does not require consent under Section 89(3) of the Electronic Communications Act. This does not automatically authorise advertising use of technical data.
Base44 application analytics are disabled in this version of the website. No advertising pixels or Google Analytics have been added. Before any optional tracking is enabled, the specific providers, purposes and retention periods must be disclosed and prior freely given consent obtained where required by law, with equally easy refusal and withdrawal. Consent must not be inferred from browsing alone.
The website loads fonts from Google Fonts and images from Base44/Wix infrastructure. Delivery transmits your IP address and necessary technical information to the provider. This is not an advertising subscription; the purpose is to display the website, and the basis for necessary processing is the legitimate interest in a functional, readable website. Infrastructure processing is also subject to the information above about recipients and transfers. Browser settings let you manage stored data; blocking necessary storage may limit functionality.
9. Your rights
Subject to GDPR conditions, you may request access and a copy of your data, correction of inaccuracies, erasure and restriction of processing. Portability applies to automated processing based on consent or an agreement. Erasure is not absolute, for example where statutory retention or protection of rights is necessary.
You may object at any time to processing based on legitimate interests on grounds relating to your particular situation. We must then demonstrate compelling legitimate grounds overriding your rights or a need for legal claims; otherwise, processing stops. Objections to direct marketing are honoured without further assessment. Where consent is the basis, you may withdraw it at any time.
Send requests to info@utulna.eu or our postal address. We respond without undue delay and within one month of receipt at the latest. Complex or numerous requests may justify an extension of up to two further months; we explain the extension and reasons within the first month. If there are reasonable doubts, we may request only proportionate information to verify identity. Requests are normally free; GDPR sets exceptions for manifestly unfounded or excessive requests.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects within Article 22 GDPR. The income calculator is a non-binding indicative model, not such a decision.
10. Complaints and updates
You may complain to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or another competent supervisory authority under Article 77 GDPR. You do not have to contact us first.
If purposes or material circumstances change, we update this information and notify you before further processing where required by law. Publishing this policy is not a request for blanket consent or a limitation of your rights.
Legal references and further information
GDPR, especially Articles 5, 6, 12–22, 28 and 44–49 · Czech Act No. 110/2019 Coll. · Electronic Communications Act, Section 89 · Czech data protection authority: cookies and consent requirements.