The company Aluf Group sro, IČO: 06746977, with its registered office at Biskupcova 2436/59, Žižkov, 130 00 Prague 3, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 288182, as a controller of personal data ("administrator"), processes personal data in accordance with the rules on the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Regulation on Personal Data Protection ("GDPR Regulation"). The administrator processes personal data necessary for the proper performance of its activities.


Contact details of the administrator: 
contact address: Biskupcova 2436/59, Žižkov, 130 00 Prague 3, 
contact e-mail:,
contact phone: +420 774 067 754, +420 608 375 047;


The Data Protection Officer within the meaning of Article 37 of the GDPR Regulation is not appointed.


Personal data of data subjects in the scope of identification and contact personal data, resp. other personal data (in particular: name, surname, title, address (residence, delivery or other contact address), passport or other identity card number, date of birth, telephone, e-mail address, signature, account number, payment number cards, vehicle registration number, date and time of arrival and departure, as well as information concerning the reservation or stay, participation in the loyalty program including membership number, name and surname of fellow passengers, IP address (in connection with Wi-Fi connection ), or if the data subject participates in activities organized by the controller on social networks such as Facebook or Instagram, the controller may collect information according to the choices the data subject sets or how he will contribute to them; also the business company, place of business, ID number and VAT number) is processed by the administrator for the following purposes (or some of them) and on the basis of the following legal basis (legal reason for processing):


i. fulfillment of contractual obligations of the administrator incl. fulfillment of the obligation to provide performance under the contract and making payment (legal reason for processing: fulfillment of the contract); period of storage of personal data: for the duration of the contract;


ii. fulfillment of legal obligation incl. a) keeping and processing the accounting agenda, b) keeping a house book according to the Act on the Residence of Foreigners, resp. c) keeping a register in accordance with the Act on Local Fees (legal reason for processing: fulfillment of a legal obligation); period of storage of personal data: personal data are processed for the period specified by the relevant legal regulations;


iii. the possibility of asserting and enforcing the legal claims of the administrator or a third party, resp. protection of legal claims (legal reason for processing: legitimate interest of the controller or a third party); period of storage of personal data: personal data are processed within 1 year from the end of the limitation period, resp. further for the time necessary for the purposes of implementing the protection of legal claims;


iv. camera system for the purposes of protection of property and property interests of the administrator, life and health of persons (legal reason for processing: legitimate interest of the administrator or third parties); period of storage of personal data: personal data are processed for a period of 10 days, or for the necessary period in the event of a resolved incident;


v. provision of Internet connection via Wi-Fi network (legal reason for processing: fulfillment of the contract); period of storage of personal data: for a period of 3 years.


vi. offering the store, services and products of the controller company, sending business messages (legal reason for processing: consent given by the data subject); period of storage of personal data: 3 years;


vii. marketing communication and marketing research, including obtaining an opinion on the degree of satisfaction with the services / services provided by the controller in order to achieve the improvement of the services / services provided (legal reason for processing: consent given by the data subject); period of storage of personal data: 3 years;


viii. loyalty program (legal reason for processing: consent given by the data subject); storage time

personal data: 3 years;

ix. direct marketing - offering trade, services and products of the company, sending business messages for clients (guests) in the sense of offering information society services according to the relevant legal regulation (Act on certain information society services).


The controller obtains personal data a) from the data subject (guest), b) from publicly available sources, resp. c) from other sources (especially from cooperating third parties).

Beneficiaries, categories of beneficiaries:


the personal data of the data subjects may be transferred in particular to the following categories of recipients:


i. public authorities (eg Police of the Czech Republic, tax administrator, customs administration, executors, insolvency administrators, courts, bodies active in criminal proceedings, etc.)


ii. third parties with whom the controller has a written contract on the processing of personal data (eg IT service providers, accounting service providers, auditors, tax advisors, lawyers, e-mail service providers, etc.)


iii. business partners of the administrator

iv. other entities (eg insurance company)

v. other entities in accordance with applicable law.


The controller will process personal data manually and automatically directly through its employees authorized for this processing, or also through processors who have been authorized by the controller to process on the basis of a personal data processing contract.


The controller does not intend to transfer personal data to a third country or to an international organization. However, the processing of personal data abroad may occur in connection with the involvement of authorized processors, especially in the provision of IT services or other technical areas.


Under the conditions of the GDPR Regulation, the data subject has the right to access his personal data processed by the controller, the right to correct or delete them, or the right to restrict processing, as well as the right to object to processing, or the right to data portability (in case of automated processing). ).


If the legal reason for processing was consent, this consent can be revoked at any time free of charge. Withdrawal of consent does not affect the processing of personal data before its revocation, as well as the processing of personal data for another legal reason.


If the data subject considers that the processing of his personal data violates legal regulations / GDPR regulations, he has the right to file a complaint about the administrator's action with a supervisory authority, while the supervisory authority for the Czech Republic is the Office for Personal Data Protection. Sochora 27, 170 00 Prague 7 (


In the event that the administrator's website contains links to third-party websites, the administrator is not responsible for the collection, use, sharing, resp. any further handling of data (incl. personal data) by such third parties.



 Aluf Group s.r.o.