Privacy policy
Version 1.0, effective from the day orders open (until then this is a draft). Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. This English text is a translation for information; the Czech version (PRIVACY-cs) is binding.
1. Controller
The controller of personal data is David Musijenko, ID No. (IČO) 08884501, Studentská 1024, 250 91 Zeleneč, the contact e-mail will be published before orders open. I have not appointed a data protection officer; write to me at the e-mail above about any question.
2. What data I process, why and for how long
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| E-mail, name, where given telephone and billing address | concluding and performing the contract, communication, complaints | Art. 6(1)(b) – contract | 3 years from delivery of the report; during a complaint or dispute, until it ends |
| Order data: parcel, cadastral area, link to the advert, map point or coordinates, intended use (footprint, storeys, basement, floor area, description), purchase stage, the date by which you must decide, chosen tier, record of the request to start performance (text and time) | performing the contract, proving that duties towards a consumer were met (§ 1839 OZ) | Art. 6(1)(b) and (f) – legitimate interest in proving compliance and defending legal claims | 3 years from delivery of the report; during a complaint or dispute, until it ends |
| The report (without birth numbers) | performing the contract, handling complaints and defending legal claims | Art. 6(1)(b) and (f) – legitimate interest in defending legal claims | 3 years from delivery of the report; during a complaint or dispute, until it ends |
| Payment data (amount, date, transaction ID; I do not see card data, the payment gateway processes it) and tax records | performing the contract, tax duties | Art. 6(1)(b) and (c) | for the period set by tax law |
| The official land-register extract for the plot and, where needed, for the access-route parcels (I obtain it myself through ČÚZK remote access; an extract the customer may send is used only as a cross-check and kept the same way), with birth numbers blacked out | preparing the report; showing what the report was based on in a complaint (complaints are possible for 2 years, § 2618 OZ) | Art. 6(1)(f) – legitimate interest in preparing the ordered report properly and in defending legal claims | 2 years and 1 month from delivery of the report; during a complaint or dispute, until it ends |
| Archived captures of the sources the report cites (map captures, the plot's advert and the comparable listings, each with its capture time and sha256 fingerprint) | preparing the report; showing what the report was based on in a complaint (complaints are possible for 2 years, § 2618 OZ) | Art. 6(1)(f) – legitimate interest in preparing the ordered report properly and in defending legal claims | 2 years and 1 month from delivery of the report; if a complaint or dispute is pending, until it ends |
| Other working files (notes, intermediate calculations, captures the report does not cite) | preparing the report | Art. 6(1)(f) – legitimate interest in preparing the ordered report properly | 90 days from delivery of the report |
| The customer's name checked against sanctions lists, result of the check | complying with the ban on making funds available to listed persons (Art. 2 of Council Regulation (EU) No 269/2014) | Art. 6(1)(f) – legitimate interest in complying with sanctions law | 3 years from the check |
| E-mail for news | marketing about similar services | Art. 6(1)(f) (customers, § 7(3) of Act No. 480/2004 Coll.) or consent (Art. 6(1)(a)) | until you unsubscribe or withdraw consent |
| Consent to use an anonymised sample report (section 15.2 of the terms) | showing the service on the website | Art. 6(1)(a) – consent | until consent is withdrawn |
| Answers to the written questionnaire on day 7 after delivery (section 10.4 of the terms) | improving the service and correcting errors in reports | Art. 6(1)(f) – legitimate interest in service quality | 3 years from delivery of the report |
| The day-30 accuracy e-mail and your answer (section 10.5 of the terms) | finding out whether the office, network operator or seller confirmed what the report said | Art. 6(1)(a) – consent (a separate unticked box in the order) | one e-mail; the answer until consent is withdrawn, at most 3 years from delivery of the report |
3. Third parties' data from the land-register extract
3.1 An LV extract contains personal data of owners and other entitled persons (name, address, possibly birth number, liens and other rights). I obtain this data from the land register (a public register): I obtain the official extract for the ordered plot myself through ČÚZK remote access (dálkový přístup). If the customer sends me an extract of their own, I use it only to cross-check mine. I process it only for the report the customer ordered, on the basis of legitimate interest (Art. 6(1)(f) GDPR). The report shows this data only to the extent necessary: the type and number of owners without names and the entries in parts B1, C, D and E of the extract (registered rights, plomby, pending proceedings, titles of acquisition); it gives no names of natural persons. I do not hand over the extract itself to the customer.
3.2 I never show birth numbers in reports. I black them out in every stored copy of the extract without undue delay after receipt and then erase the unredacted copy.
3.3 I do not enter personal data from the LV into artificial-intelligence tools unless it has first been blacked out or replaced with placeholders.
3.4 If you are a person recorded on the LV, you have the same rights towards me as other data subjects (section 5), in particular the right to object. I do not inform you individually because that would require disproportionate effort (Art. 14(5)(b) GDPR): this is a one-off processing of data that is public in the land register, the report takes over only the minimal extent under section 3.1 (type and number of owners, registered rights), without names of natural persons, birth numbers are blacked out and the extract is erased after the period in section 2. This policy is therefore published. The source of the data is the land register of the Czech Republic (the official extract from ČÚZK remote access); an extract the customer may send serves only as a cross-check.
3.5 Owners of the access-lane parcels. For the parcels over which the plot is reached from a public road, I find out the owner type (terms, sections 3.2 and 7.3). The source is the land register of the Czech Republic (a public register): an LV extract or the "Informace o parcele" (parcel information) output that I obtain through ČÚZK remote access (dálkový přístup). I use the Nahlížení do katastru nemovitostí viewer only to identify the ordered parcel free of charge before payment. In doing so I see the owner's name and address and the registered rights. I process them only for the report ordered, on the basis of legitimate interest (Art. 6(1)(f) GDPR). The report takes over only the owner type (municipality, state, natural or legal person), without names. I keep an LV extract for such a parcel like the extract for the plot (section 2), captures the report cites as archived captures of sources, and other records as other working files (section 2). Sections 3.2 to 3.4 also apply to these persons.
3.6 Comparable listings. For the comparison of the asking price with listings (terms, section 3.2) I store 10 to 20 plot listings from the same municipality (if there are fewer, from the nearest municipalities), each one individually, with its link, capture time and sha256 fingerprint. The source is publicly accessible property-listing portals. A listing page may contain the name, phone number and e-mail of the broker or seller and the name of the agency. I process them only as part of the stored capture, on the basis of legitimate interest in a verifiable comparison (Art. 6(1)(f) GDPR). The report takes over only the price, area, municipality, link, capture time and a quote of the listing text about building, without contact data. I keep the captures as archived captures of sources (section 2). I do not inform these persons individually because it would involve a disproportionate effort (Art. 14(5)(b) GDPR): the data were published in the listing, and the report does not take them over. Sections 3.3 and 3.4 also apply to these persons.
3.7 The plot's farm user (LPIS land register). To check whether the plot may be leased or under a farm tenancy (terms, section 3.2), I look up in the public land register LPIS, which the Ministry of Agriculture publishes on the eAGRI portal, whether the plot lies in a registered land block and who is recorded as its farm user. If the user is a natural person (including one in business), I see their name and possibly other identification data that the register publishes. I process them only for the ordered report, on the basis of legitimate interest in preparing the ordered report properly (Art. 6(1)(f) GDPR). The report takes over only whether the plot lies in a registered land block and, if it does, who its farm user is: for a legal entity, its name and ID number (IČO) if publicly available; for a natural person (including one in business), only the words “fyzická osoba” (natural person), without the name and without any other data about them. I keep the register captures the report cites as archived captures of sources and other records as other working files (section 2). I do not inform these persons individually because that would require disproportionate effort (Art. 14(5)(b) GDPR): this is a one-off processing of data that the state publishes in the land register, and the report takes over neither the name of a natural person nor any other data about them. This policy is therefore published. The source of the data is the public land register LPIS (eAGRI, Ministry of Agriculture). Sections 3.3 and 3.4 also apply to these persons.
3.8 Third-party replies you forward to me. If you forward me a reply from an office, a network operator or the seller (for example in answer to the day-30 e-mail, section 10.5 of the terms, or with a question about the report, section 10.2), it may contain personal data of other persons (the name and contact details of an official or of the seller). I process them only to answer you and to correct errors in reports, on the basis of legitimate interest (Art. 6(1)(f) GDPR), keep them together with your e-mail, at most 3 years from delivery of the report, and take them over into no report. I do not inform these persons individually because that would require disproportionate effort (Art. 14(5)(b) GDPR): the data were given to me by the customer and I use them for nothing else. Section 3.3 also applies to this data, and these persons have the rights under section 5.
4. Recipients and transfers outside the EU
4.1 These processors help me process the data: the web host, the e-mail provider, the storage provider and providers of text and data processing tools (including artificial-intelligence tools). I have a data processing agreement with each of them. The payment gateway is run by a payment institution that processes payment data as an independent controller under its own terms. I will send you the list of specific recipients on request.
4.2 If a processor is based outside the European Economic Area, I transfer data only on the basis of a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework) or standard contractual clauses (Articles 45 and 46 GDPR). I will send you a copy of the safeguards used on request.
4.3 I do not pass data to anyone else, except public authorities where the law requires it.
5. Your rights
You have the right of access to your data, rectification, erasure, restriction of processing, portability and the right to object to processing based on legitimate interest (Articles 15 to 21 GDPR). You can withdraw consent at any time (by e-mail or via the link in every marketing message); withdrawal does not affect the lawfulness of processing before it. Send requests to the contact e-mail address (published before orders open); I handle them within one month. You also have the right to complain to the Czech data protection authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.
6. Further information
6.1 Your e-mail and the parcel details are needed to conclude and perform the contract; without them the order cannot be processed.
6.2 I do not carry out automated decision-making or profiling with legal effects under Art. 22 GDPR.
6.3 I send marketing messages only with your consent, or if you are my customer, they concern similar services and you did not refuse them when ordering (§ 7(3) of Act No. 480/2004 Coll.); you can unsubscribe in every message.
6.4 I protect the data with access-restricted storage and encrypted transfer.