Privacy policy

Article 1Who controls your data

The controller of your personal data is me:

In all matters concerning the protection of personal data you can contact me at the e-mail address or phone number above, or by post at the office address.

I have not appointed a data protection officer (DPO), because I am under no obligation to do so under Article 37 GDPR. I deal with all data protection enquiries personally.

Article 2What data I process and where it comes from

2.1 Data from the contact form

The only place on this website where personal data is collected is the contact form. I process the following data that you enter into it:

Sending the form is entirely voluntary. If you do not fill in the required data, the form will not be sent and I will not be able to reply to you - there is no other consequence.

Please do not send me sensitive data in your message (data about your health, your birth number, document numbers and the like). I do not need it for a first contact.

2.2 Technical data connected with running the website

The hosting provider (see Article 5) automatically creates operational records of visits to the website. These may contain your IP address, the type of browser, the time of access and the address of the page visited. These records serve solely to ensure the operation, stability and security of the website, and I do not normally access their content. The provider usually keeps them for 30 days.

2.3 What this website does NOT do

For the sake of completeness I state expressly that this website:

• uses no cookies - neither analytical, nor marketing, nor preference cookies;
• uses no tools for measuring visits (Google Analytics, Meta Pixel, Hotjar and the like);
• contains no third-party advertising or tracking scripts;
• carries out no profiling or automated decision-making that would have legal effects for you or similarly significantly affect you (Article 22 GDPR);
• does not store the data from the form in any database on the website - the form only sends the message to my e-mail.

Article 3Why I process the data and on what legal basis

3.1 If we start working together

If we enter into a real estate brokerage contract, I will process your data beyond the scope of this policy as well - in particular:

• for the performance of the contract (Art. 6(1)(b) GDPR);
• for compliance with legal obligations (Art. 6(1)(c) GDPR), in particular under Act No. 563/1991 Coll., on Accounting, tax legislation, and Act No. 253/2008 Coll., on Certain Measures against the Legalisation of Proceeds of Crime and the Financing of Terrorism (the AML Act), which requires me as a real estate broker to identify the client and to keep the data and documents obtained for 10 years.

These obligations apply only to a concluded transaction. They do not apply to the mere sending of the contact form - I do not have to identify a visitor to the website, and I do not.

Article 4How long I keep the data

Once the period has expired, I delete the data. You may also ask for erasure earlier (see Article 7).

Article 5Who receives the data

I do not sell your data and I do not pass it on to anyone for marketing purposes. Only the following processors, who provide the technical operation for me, have access to it, and solely to the extent necessary to provide their service:

I may also pass the data on to:

• public authorities, where the law requires me to (for example the Financial Analytical Office under the AML Act, the tax authorities, the courts or the Police of the Czech Republic);
• a lawyer, accountant or tax adviser, where this is necessary to enforce or defend legal claims or to meet my statutory obligations.

I have a data processing agreement under Article 28 GDPR in place with all processors.

Article 6Transfers of data outside the EU

Some of the processors listed above are based in the United States of America, so part of the processing may take place outside the European Economic Area. This transfer is covered by the following safeguards:

• the processors listed are certified under the EU-U.S. Data Privacy Framework, that is, a framework for which the European Commission, by its decision of 10 July 2023, recognised an adequate level of protection of personal data (Article 45 GDPR);
• at the same time they are bound by standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR), which apply independently of that certification.

The content of the website itself and the server-side processing take place in the European region Frankfurt am Main.

If the legal framework for transfers of data to the USA changes, I will update this policy accordingly.

Article 7Your rights

In relation to your personal data you have the following rights:

• Right of access (Art. 15 GDPR) - you can ask me whether I process your data and which data, and request a copy of it.
• Right to rectification (Art. 16 GDPR) - if the data is inaccurate or incomplete, I will correct or complete it.
• Right to erasure (Art. 17 GDPR) - you can ask for the data to be deleted if the reason for which I process it no longer applies. I cannot erase data where the law requires me to keep it (for example accounting or AML documents).
• Right to restriction of processing (Art. 18 GDPR) - you can ask me to stop working with the data temporarily, for example while I verify its accuracy.
• Right to data portability (Art. 20 GDPR) - data that I process by automated means on the basis of a contract or consent will be provided to you in a machine-readable format.
• Right to object (Art. 21 GDPR) - you can object at any time to processing based on legitimate interest. I will then stop the processing, unless I demonstrate compelling legitimate grounds for continuing it. An objection to processing for direct marketing purposes I will always uphold, without exception.
• Right not to be subject to automated decision-making (Art. 22 GDPR) - no such decision-making or profiling takes place here.
• Right to withdraw consent (Art. 7(3) GDPR) - if you ever give me consent (for example to being sent offers), you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

How to exercise your rights

Write to me at ales.hanzlicek@outlook.com or at the office address. I will deal with it without undue delay, at the latest within one month of receiving the request; in complex cases the period may be extended by a further two months, of which I will inform you. Dealing with the request is free of charge. For manifestly unfounded or repeated requests I may, under Art. 12(5) GDPR, charge a reasonable fee or refuse the request.

So that I do not hand the data over to the wrong person, I may ask you to verify your identity.

Article 8The right to lodge a complaint

If you believe that I process your data in breach of the law, I would be glad if you contacted me directly first - most things can be resolved quickly. However, you always have the right to lodge a complaint with the supervisory authority:

Article 9Data security

I have taken appropriate technical and organisational measures to protect the data against loss, misuse and unauthorised access, in particular:

• all communication with the website is encrypted (HTTPS/TLS);
• the e-mail mailbox and the devices on which I work with the data are protected by a strong password and two-factor authentication;
• only I have access to the data; the processors listed in Article 5 access it only to the extent of their service;
• I work only with providers who give sufficient guarantees under Article 28 GDPR;
• I regularly update the software and devices I use.

No measure can guarantee absolute security. Should a security breach with a high risk to your rights nevertheless occur, I will inform you in accordance with Article 34 GDPR.

Article 10Children

Neither the website nor my services are intended for persons under the age of 15. I do not knowingly collect personal data from them. If I find that such data has been provided to me without the consent of a legal guardian, I will delete it.

Article 11Links to other websites

The website may contain links to third-party sites (for example property portals or maps). I am not responsible for their content or for the way they handle personal data. I recommend reading their own privacy policies.

Article 12Changes to this policy

I may amend this policy in the future, for example when legislation or the technical solution used by the website changes. The current wording can always be found on this page, with its effective date and version number. I will announce substantial changes visibly on the website.