The company PUSTEVNY, s.r.o., ID: 27775658, located at Trojanovice 477, 744 01 Trojanovice, registered in the Commercial Register maintained by the Regional Court in Ostrava, section C, file 41548, fully recognizes the importance of personal data protection in the information society. The ability to process personal data, including data necessary for the identification of individuals, is crucial for the functioning of various business activities and forms a fundamental pillar for businesses working with new technologies. To ensure the smooth operation of all business activities of the company, we adhere to the relevant legislative requirements. These include, among other things, ensuring the protection of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), (hereinafter referred to as “GDPR”), as well as all implementing regulations adopted at the national level in the field of personal data protection.

This document contains basic information about what personal data we process in relation to our customers and website users, as well as information about what entitles us to such processing, to whom we may transfer personal data, and also what rights our customers have as data subjects.

1. What principles do we follow?
We process personal data only in accordance with the law and solely based on one of the specified legal bases for processing, which we elaborate on below.
We process personal data only for specified processing purposes.
We ensure the accuracy and up-to-dateness of the processing of personal data.
We adhere to the principle of data minimization, meaning that we process only the personal data that is strictly necessary for the specified processing purposes.
We follow the principle of transparency in processing and always provide our customers with complete information about the processing and their rights.
We ensure appropriate security standards to protect the data we process, so that there is no risk of loss, destruction, or any unauthorized handling.
If we no longer need personal data for any of the specified purposes, we ensure their immediate deletion in accordance with the law.
2. Personal Data We Process
If you decide to use our services, we will process the following categories of personal data:

2.1 IN THE CASE THAT YOU ARE A CITIZEN OF THE CZECH REPUBLIC AND THE PURPOSE OF YOUR STAY IS RECREATION:
identifying information, including your first and last name, ID card number or travel document number;
contact information, including particularly your email address, phone number, home address, and billing address;
information related to your inquiries and requests, newsletter settings, and evaluations of the services provided;
data about your orders, including information about the goods and services you have ordered from us, the method of their fulfillment and payment, including the payment account number, and possibly information about complaints;
data about your orders, including information about the goods and services you have ordered from us, the method of their fulfillment and payment, including the payment account number, and possibly information about complaints;
data obtained through the use of customer service, or data collected after visiting the hotel facility, including primarily records of phone calls made through the customer hotline and recordings from surveillance cameras captured during the visit to the hotel facility;
information related to the use of specific hotel facility services, including the use of parking spaces (in which case we also process the vehicle’s license plate), the rental of sports equipment, and mountain scooters (in which case we also require proof of identity with an ID card or other identification).
2.2 IN THE CASE THAT YOU ARE A CITIZEN OF THE CZECH REPUBLIC AND YOUR STAY IS PROVEN TO BE FOR A PURPOSE OTHER THAN RECREATION:
identifying information, including your first and last name;
contact information, including particularly your email address, phone number, home address, and billing address;
information related to your inquiries and requests, newsletter settings, and evaluations of the services provided;
data about your orders, including information about the goods and services you have ordered from us, the method of their fulfillment and payment, including the payment account number, and possibly information about complaints;
data about your orders, including information about the goods and services you have ordered from us, the method of their fulfillment and payment, including the payment account number, and possibly information about complaints;
data obtained through the use of customer service, or data collected after visiting the hotel facility, including primarily records of phone calls made through the customer hotline and recordings from surveillance cameras captured during the visit to the hotel facility;
information related to the use of specific hotel facility services, including the use of parking spaces (in which case we also process the vehicle’s license plate), the rental of sports equipment, and mountain scooters (in which case we also require proof of identity with an ID card or other identification).
2.3 IN THE CASE THAT YOU ARE A FOREIGN NATIONAL:
identifying information, including your first and last name, date of birth, nationality, and identification card or travel document number;
contact information, including particularly your email address, phone number, home address, and billing address;
information related to your inquiries and requests, newsletter settings, and evaluations of the services provided;
data about your orders, including information about the goods and services you have ordered from us, the method of their fulfillment and payment, including the payment account number, and possibly information about complaints;
data about your orders, including information about the goods and services you have ordered from us, the method of their fulfillment and payment, including the payment account number, and possibly information about complaints;
data obtained through the use of customer service, or data collected after visiting the hotel facility, including primarily records of phone calls made through the customer hotline and recordings from surveillance cameras captured during the visit to the hotel facility;
information related to the use of specific hotel facility services, including the use of parking spaces (in which case we also process the vehicle’s license plate), the rental of sports equipment, and mountain scooters (in which case we also require proof of identity with an ID card or other identification).
3. Na základě čeho osobní údaje zpracováváme?
V rámci naší činnosti zpracováváme osobní údaje pro různé účely a v různém rozsahu buď:

without your consent based on the legal basis of contract fulfillment, our legitimate interest, or for the purpose of fulfilling a legal obligation, or based on your consent.
3.1 USER VISIT TO THE WEBSITE
When you visit our website, we process data about your activity on the website based on our legitimate interest (i.e., without your consent) for the purpose of:

to create website traffic statistics, including individual pages and overviews; our legitimate interest here is to assess the effectiveness of our website and optimize it;
to evaluate information that will enable us to improve the website, with our legitimate interest being to enhance functionality for customers and provide higher quality services;
to prevent attacks on the website and ensure data security; our legitimate interest here is to ensure the seamless functionality of the website and the security of data sent by users.
For these purposes, we process personal data for the duration necessary to record traffic statistics, and for a maximum of 1 month.

You have the right to object to processing carried out based on legitimate interest.

3.2 PLACING AN ORDER
If you place an order with us, we will carry out the following methods of processing:

3.2.1 Contract Fulfillment
If you place an order for services as an individual, we process your personal data for the purpose of preparing, concluding, and fulfilling the contract, including your identifying and contact information, as well as details about your orders.

If you place an order for services as a legal entity, we process the same data for the same purpose based on our legitimate interest, which lies in concluding and fulfilling the contract with the person you represent.

The preparation, conclusion, and fulfillment of contracts with our customers means that we need your data for the following reasons:

to ensure the seamless completion of your order on the website;
to carry out all necessary communication related to this order;
to ensure payment for this order, whether in cash or through partners who operate our payment system;
to provide accommodation services at the hotel facility and related services (e.g., wellness);
to ensure services related to your stay through partners who provide these services for us (e.g., sports and leisure activities);
to handle complaints;
to address all your related requests.
For this purpose, we process personal data for the duration necessary to fulfill the contract or to address related requests, such as complaints. After this period, we will retain the data based on our legitimate interest for the purpose of protecting legal claims and our internal records and control, for the duration of the statute of limitations and for one year after its expiration, considering claims made at the end of the statute of limitations. In the event of the initiation of judicial, administrative, or other proceedings, we will process personal data to the necessary extent for the duration of such proceedings and the remaining part of the statute of limitations after their conclusion. Our legitimate interests here are the protection of legal claims and ensuring the proper provision of our services.

Máte právo vznést námitku proti zpracování prováděnému na základě oprávněného zájmu.

3.2.2 Fulfillment of Legal Obligations
The company further processes selected personal data to fulfill legal obligations imposed by law, for which consent from the data subject is not required. We process your identifying and contact information, including information regarding your requests and details about your orders, also for the purpose of fulfilling legal obligations according to the following regulations:

of Act No. 89/2012 Coll., Civil Code,
of Act No. 634/1992 Coll., on Consumer Protection,
of Act No. 235/2004 Coll., on Value Added Tax,
of Act No. 563/1991 Coll., on Accounting,
of Act No. 326/1999 Coll., on the Residence of Foreigners in the Czech Republic,
of Act No. 565/1990 Coll., on Local Fees.
For these purposes, we use personal data for a maximum of 10 years in accordance with the relevant tax regulations.

3.2.3 Legitimate Interest
If you are our regular customer, we may send you related offers of goods and services in accordance with applicable legislation based on our legitimate interest, which is the realization of business activities. This does not change the fact that you always have the option to easily unsubscribe from these offers, whether by contacting our customer service or by directly using the unsubscribe link in the email.

For this purpose, we process personal data for the duration of your subscription to the newsletter.

You have the right to object to processing carried out based on legitimate interest.

3.3 CONSENTS TO PROCESSING
We also carry out certain types of processing based on your consent. In the operation of our website, you may encounter this in several situations, such as when you wish to receive special offers and newsletters regarding the full range of the company’s products, if you are interested in personalized advertising tailored to you, or its display on social media or third-party websites.

In any case, granting consent is always voluntary, and we do not condition the operation of our services on it. You can withdraw your consent at any time, depending on the type of processing to which the consent relates, which we describe below. If you have any questions, you can always reach out to our employees through the contact details provided in section 8, Exercising Your Rights. However, the legality of the processing prior to the withdrawal of consent is not affected.

Sending Promotional Offers and Newsletters

If you are not our customer and still wish to receive a complete offer of our services, special promotions, and discounts, you have the option to subscribe to our newsletter by consenting on our website. This also applies if you are our regular customer and wish to receive information about the full range of our products.

Data Transfer and Display of Personalized Advertising on Social and Advertising Networks

We improve our website using cookies, and the information collected may be shared for the purpose of targeting advertisements to social and advertising networks. You can refuse website customization and data sharing for advertising targeting by changing your browser settings (more information on the use of cookies can be found here). By continuing to use the website without changing your settings, you consent to advertising targeting, for which we will use data about your behavior on the website.

3.4 PROCESSING OF PERSONAL DATA OF SERVICE RECIPIENTS
If a service is ordered for a third party different from the customer, we process their personal data to the extent specified in section 2, based on legitimate interest for the purpose of preparing, concluding, and fulfilling the contract with our customer, as well as for the purpose of fulfilling legal obligations, particularly under Act No. 235/2004 Coll., on Value Added Tax, Act No. 563/1991 Coll., on Accounting, Act No. 565/1990 Coll., on Local Fees, and Act No. 326/1999 Coll., on the Residence of Foreigners in the Czech Republic.

For this purpose, we process personal data for the duration necessary to fulfill the contract or to address related requests, such as complaints. After this period, we will retain the data based on our legitimate interest for the purpose of protecting legal claims and our internal records and control, for the duration of the statute of limitations and for one year after its expiration, considering claims made at the end of the statute of limitations. In the event of the initiation of judicial, administrative, or other proceedings, we process your personal data to the necessary extent for the duration of such proceedings and the remaining part of the statute of limitations after their conclusion. Our legitimate interests here are the protection of legal claims and ensuring the proper provision of our services. For the purposes of fulfilling legal obligations, we retain personal data for a maximum of 10 years in accordance with the relevant tax regulations.

You have the right to object to processing carried out based on legitimate interest.

3.5 COMMUNICATION WITH CUSTOMERS
When using the contact form or communicating with our customer service department, this involves processing without your consent based on contract fulfillment (preparation of a contractual relationship), our legitimate interest in conducting business activities, and also fulfilling legal obligations, during which we process your identifying and contact information, as well as information regarding your requests and details about your orders. This is done for the following purposes:

to receive and address your requests;
to keep records of your requests and monitor their fulfillment.
Personal data is retained for this purpose for the duration necessary, which is the same as the retention period in the case of fulfilling a contractual relationship (if the communication relates to an order being fulfilled, its complaint, etc.), or for a period of 3 months from the submission of your request (if it is a request not related to an order).

You have the right to object to processing carried out based on legitimate interest.

3.6 VISIT TO THE COMPANY’S HEADQUARTERS, STORE, OR ITS SURROUNDINGS
When visiting the hotel facility or its surroundings, recordings may be made from the surveillance camera system, which may capture you. This processing is carried out based on the company’s legitimate interest for the purpose of protecting our property and ensuring the safety of individuals present at the company’s headquarters and its surroundings.

Personal data for this purpose is retained for the duration necessary, specifically for 14 days.

You have the right to object to processing carried out based on legitimate interest.

4. To whom do we transfer your personal data and who processes it?
All mentioned personal data is processed by us as the data controller. We determine and are responsible for all purposes of processing your personal data collected through the website and the forms provided here, as well as through other communication tools (email or telephone communication).

We also use the services of other processors for personal data processing, who process personal data only according to our instructions and for the purposes specified here. These processors are:

technology and support providers, including website operations (Agnis s.r.o., ID: 26795736, BT MEDIA INVEST s.r.o., ID: 01421824);
providers of accounting software (MJ Soft, ID: 66799724);
providers of marketing support tools (AdVisio marketing, ID: 04305116).
if we receive your consent to display personalized advertising on social media or third-party websites, further:social media operators (Facebook Ireland Limited, located at 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland);
providers of marketing tools such as Google AdWords, Google Analytics, and Google My Business (Google Ireland Limited, located at Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland).
5. Where do we obtain personal data?
In most cases, we process personal data that you provide directly when ordering services or when communicating with us through the specified web forms or by directly contacting our employees. We may also obtain personal data from business partners operating online brokerage services in the tourism sector (e.g., www.booking.com, www.hrs.com) in accordance with the terms and conditions of the respective service. Additionally, we may obtain personal data directly from you through surveillance camera recordings from the hotel facility or its surroundings.

6. Data Transfer Outside the EU
We select and use suppliers for the processing of personal data who are based within the European Union. Therefore, your personal data is not transferred outside the territory of the EU.

7. We respect your rights regarding the processing of personal data. What are they?
In relation to the processing of personal data, the company respects the rights of customers as data subjects, including the right to access personal data, which includes the right to information about the processing of personal data, the right to rectification, the right to erasure (the right to be forgotten), the right to restrict processing, the right to data portability, the right to object to processing based on the legitimate interest of the data controller, and the right to lodge a complaint with the supervisory authority. Below you will learn what these rights mean for you and how to exercise them.

**Right to Access**
As a customer, you have the right to know what data we process about you, for how long, for what purpose, who the processors of your personal data are, and where we obtain the data. You can also request a copy of this personal data, which we will provide to you free of charge after your identification. In the case of repeated requests, we may charge a fee for processing.

**Right to Rectification**
If you believe that the data we process is inaccurate or incomplete, you have the right to have it corrected or supplemented.

Right to Erasure
We regularly review the purposes for which we process data and the retention periods. If the specified period for processing has elapsed, we will promptly erase the relevant data. If you believe that we should no longer process your data, you have the right to request erasure if the following conditions are met:

the personal data is no longer needed for any of the specified purposes;
we processed your data based on your consent, which you, as a customer, have revoked, and we have no other legal basis for processing;
we process your data based on legitimate interest, to which you have objected, and we assess that we no longer have any legitimate interests;
the processing is no longer in accordance with legal regulations.
If the processing of personal data is still necessary to fulfill legal obligations or to assert the company’s legal claims, the right to erasure will not apply.

Right to Restrict Processing
Upon exercising your right to restrict processing, we will temporarily mark your personal data, which will cease to be processed for a limited period. This may occur under the following circumstances:

as our customer, you contest the accuracy of your personal data, in which case the processing will be restricted for the time necessary to verify the accuracy of this data;
in exceptional cases, we find that personal data is being processed without a legal basis; however, as our customer, you prefer to restrict processing rather than erase it (typically in situations where you plan to provide us with the data in the future);
we no longer need the data for the specified processing purposes; however, you as our customer request it for the establishment or defense of your legal claims;
you have raised an objection to processing, in which case the processing will remain restricted for the period during which we verify whether our legitimate interests prevail or not.
Right to Data Portability
We process some of your personal data based on contract fulfillment as well as your consent. Under these circumstances, the GDPR grants you the right to data portability. Therefore, if you submit a request related to this right, we will provide you with the data in a machine-readable, structured, and commonly used format.

Right to Object to Processing
As a data controller, we carry out certain processing based on legitimate interest. You have the right to object to these types of processing. If the processing involves marketing activities, your personal data will cease to be processed immediately upon the exercise of the objection. In other cases, we will assess whether our legitimate interests still prevail and will promptly inform you whether there are still grounds for continuing our processing or if the processing has been terminated.

**Right to Lodge a Complaint**
The GDPR also grants data subjects the right to lodge a complaint with a supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7. You can submit a complaint here if you believe that we are processing your data unlawfully or in violation of legal regulations.

8. Exercising Your Rights
In case you want to exercise your rights regarding the processing of personal data or have any questions about our processing of personal data, please feel free to contact us using the details provided below:

Customer Service:
Email: dpo@mpm-quality.cz

Data Protection Officer:
Email: dudova@mpm-quality.cz

We will process all requests within the statutory deadline of one month at most. In the case of more complex requests, we may extend this period by an additional two months. However, you will be promptly informed of this fact.