The complete legal documents for Najato.cz. Choose a document on the left. The text is a template — we recommend a review by your lawyer before going live.
This policy describes what personal data we collect when you use Najato.cz, the purposes for which we process it, how long we keep it, and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing.
The controller of your personal data is a self-employed individual (sole trader):
No Data Protection Officer (DPO) has been appointed, as the nature and scope of processing does not require it. For data-protection matters, contact us at podpora@najato.cz.
Depending on how you use the service, we process in particular:
Data about tenants and other third parties that you enter into the app is processed by us as a processor on your behalf — you are the controller of that data. You are responsible for having an appropriate legal basis for its processing and for duly informing those individuals. On our side, processing takes place only to the extent necessary to provide the service and according to your instructions; the processing terms are set out in the “Data Processing (GDPR)” document.
We do not share personal data with third parties for their own purposes. However, we use vetted processors that provide us with sub-services:
We have data-processing agreements under Article 28 GDPR in place with all of our processors. Data is processed primarily within the EU/EEA.
Processors established in the United States (Stripe, Cloudflare, Railway) may involve a transfer of personal data to a third country. For Stripe and Cloudflare such transfers are covered by the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework, to which they are certified; in all cases they are additionally covered by standard contractual clauses under Article 46 GDPR. Railway stores data in a data center in the EU (Amsterdam). We will provide a copy of the safeguards used on request.
We keep personal data only for as long as necessary for the given purpose. Indicative retention periods:
You can also request erasure earlier — see your rights.
In relation to your personal data you have the right to:
You can exercise some of your rights directly in the app: under Profile → Privacy & data you can download a machine-readable copy of your data (export), correct your details, or close your account. After closing, the account is first deactivated and permanently deleted after a grace period; until then it can be restored.
You can also exercise your rights at podpora@najato.cz. You also have the right to lodge a complaint with the supervisory authority — the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz.
We use only strictly necessary (technical) cookies required for sign-in and session persistence. In your browser’s local storage we keep your preferences, such as the chosen language. We do not use third-party advertising or analytics cookies that would require consent.
To measure traffic we use Cloudflare Web Analytics. It uses no cookies and no browser fingerprinting, stores nothing on your device and does not track you across websites. It processes only aggregated visit data (the page visited without URL parameters, the referring source, device type and approximate country). This data does not allow us to identify you, so no consent is required; the legal basis is our legitimate interest in improving the service.
On the marketing pages of the website (e.g. najato.cz, the Guides section, the public Rentals listing and the Help Center) we additionally use — only if you consent via the cookie banner — Google Analytics 4, Google Ads and Sklik (operated by Seznam.cz, a.s.) to measure traffic and target advertising. These services store cookies in your browser and may track you across websites. The legal basis is your consent (Art. 6(1)(a) GDPR); none of these scripts load until you give it. You can withdraw consent at any time via the “🍪” icon in the bottom-left corner of the page. These scripts are not loaded in the signed-in app; the only exception is a one-off message confirming a completed registration (a so-called conversion event), and only if you gave consent before registering.
Transfers of data to Google (Google Ireland Limited, Ireland, or Google LLC, USA) and Seznam.cz, a.s. (Czech Republic) to a third country may therefore occur; for Google this is covered by standard contractual clauses under Article 46 GDPR.
We take appropriate technical and organisational measures to protect your data: passwords are stored only as a cryptographic hash, data is transmitted over an encrypted connection (HTTPS), and access to data is limited to what is necessary.
We may update this policy; the current version is always available on this page. We will notify you of material changes by appropriate means. The effective date is shown in the header.
For any questions about personal data protection, contact us at podpora@najato.cz.
Questions about the terms, privacy, or exercising data subject rights can be sent to our contact. We respond within 30 days at the latest.