Privacy Policy

1. Data Controller

The data controller is Lubomír Unar, ID No. 05000386, registered at č.p. 220, 768 75 Loukov, Czech Republic, operator of the Resovu service available at resovu.com (hereinafter "Controller"). The Controller is not required to appoint a Data Protection Officer (DPO) under Art. 37 GDPR, as the core activities do not involve large-scale processing of special categories of data or large-scale systematic monitoring. For all data protection inquiries, contact: resovu@resovu.com. The supervisory authority is the Czech Office for Personal Data Protection (www.uoou.cz).

2. Scope of Data Collected

We process the following categories of personal data: Account data: email address, full name, company name, business address, tax identification numbers (for invoicing), chosen language and timezone. Booking data: customer names, email addresses, phone numbers, booking dates and times, selected services, booking notes, custom form field responses, payment status. Stay data (accommodation): dates of the stay and number of guests; where the host needs them for the statutory guest register and for reporting to the authorities, also name, date and place of birth, sex, nationality, address of residence, type and number of identity document, visa number and purpose of stay. The scope is determined by the law of the country where the accommodation is located. Loyalty points, reviews and receipts: balance and movements of loyalty points, reviews the customer writes, and receipts the business issues to the customer. Payment data: transaction identifiers, invoice details, subscription plan information. Payment card numbers are processed exclusively by Stripe and are never stored on Resovu servers. If a guest agrees to their card being saved when booking accommodation (automatic balance payment or refundable damage deposit), we keep only the Stripe customer and card identifiers, the card brand, the last four digits, the time and wording of the consent, and a record of charges and holds. Technical data: IP addresses (for security and rate limiting), browser type and version, operating system, device type, referral URLs, pages visited, session duration, cookies (as described in Section 8). Form spam protection: We protect forms on the Resovu website and businesses' booking forms against spam with our own technical measure: when a form is submitted, the browser performs a short computation and the server verifies its result, a hidden check field and the time taken to fill in the form. We use neither cookies nor third-party services for this; we store only a one-time fingerprint of the verification challenge (containing no personal data) and your IP address for at most 3 hours to limit the number of submissions (legitimate interest, Art. 6(1)(f) GDPR). Communication data: email addresses and phone numbers used for sending booking confirmations, reminders, and system notifications. Staff data: staff member names, email addresses, working hours, assigned services, and calendar availability. Data is collected directly from Users during registration and service usage, from Users' customers during the booking process, from the User's browser through cookies and similar technologies (with consent where required), and from third-party services (e.g., Google Calendar data when sync is enabled).

3. Purpose of Processing

We process personal data for the following purposes: Providing and administering the Resovu service, including managing bookings, customers, staff, and services. Processing payments and managing subscriptions through Stripe. Sending booking confirmations, reminders, and system notifications via email (Resend) and SMS (through the SMS provider the business has connected itself, e.g. BulkGate or seven.io). Improving the quality of the service through analytics and usage statistics (only with consent via cookie banner). Ensuring the security of the service, including rate limiting, fraud detection, and abuse prevention. Fulfilling legal obligations, particularly accounting, tax, and data retention requirements. Providing customer support and responding to inquiries. Error monitoring and service reliability through Sentry (technical error diagnostics only; session replay is disabled and personal data is stripped from error reports before they are sent). Generating invoices and maintaining accounting records. For accommodation, on the host's instruction: keeping the guest register and preparing data for reporting to the authorities, synchronizing availability with booking portals, and charging the balance or placing a deposit hold on the guest's saved card to the extent the guest has agreed to.

4. Legal Basis for Processing

We process personal data based on the following legal grounds: Performance of a contract (Art. 6(1)(b) GDPR): Processing necessary for the provision of the Resovu service, including account management, booking processing, payment handling, and sending transactional communications (confirmations, reminders). Legitimate interest (Art. 6(1)(f) GDPR): Service security (rate limiting, abuse prevention, form spam protection), error monitoring (Sentry), service improvement through aggregated analytics, and ensuring system integrity. We have conducted a balancing test to ensure our legitimate interests do not override data subjects' rights. Consent (Art. 6(1)(a) GDPR): Marketing communications and, on the resovu.com website, analytics tools (Google Analytics 4, Microsoft Clarity) and marketing tools (Meta Pixel). Consent can be withdrawn at any time via “Cookie settings” in the website footer or by email to resovu@resovu.com. Legal obligation (Art. 6(1)(c) GDPR): Accounting and tax records retention (at least 10 years under Czech VAT and accounting law), responding to law enforcement requests, and compliance with court orders.

5. Third-Party Data Sharing

We only share personal data with trusted service providers necessary for operation: Supabase (database hosting, EU), Stripe (payment processing), Vercel (application hosting), Resend (transactional emails), Google (calendar sync, optional; Google Analytics 4 and Google Tag Manager for website analytics), Sentry (error monitoring). We have a Data Processing Agreement (DPA) with each processor. Analytics and marketing tools on the resovu.com website – Google Analytics 4 via Google Tag Manager (Google Ireland Ltd.), Microsoft Clarity (Microsoft Corporation, USA) and Meta Pixel (Meta Platforms Ireland Ltd.) – only run with consent, as described in section 8. Under its terms, Microsoft also uses Clarity data for its own purposes and is an independent controller to that extent. For the Meta Pixel, we are joint controllers with Meta for collecting and transmitting the data; any further processing is carried out by Meta as an independent controller. Data from these tools may be transferred to the USA; such transfers are safeguarded under the EU-US Data Privacy Framework or by standard contractual clauses. We do not run these tools in the Resovu dashboard or on business pages. Some personal data may be transferred to countries outside the EU/EEA (primarily the USA) through subprocessor services (Stripe, Resend, Sentry, Google). These transfers are secured by Standard Contractual Clauses (SCCs) approved by the European Commission and/or adequacy decisions under the EU-US Data Privacy Framework. Details of individual processor safeguards can be found in the GDPR — Subprocessors List section. SMS reminders: SMS are sent only if the business (User) connects its own SMS provider account (e.g. BulkGate or seven.io). Resovu then passes the recipient's phone number and the reminder text to that provider on the business's instruction. The SMS provider processes this data as the business's processor under its own contract with the business, not as a Resovu sub-processor; its own privacy policy applies. Other recipients: We convert the business's address into coordinates for display on a map using the Nominatim service (OpenStreetMap Foundation, United Kingdom); only the address entered is transmitted. The map on business pages is loaded from OpenStreetMap servers (OpenStreetMap Foundation, United Kingdom), to which the visitor's browser passes its IP address in the process. We show the map on the basis of the business's legitimate interest in showing where it is located, with the attribution © OpenStreetMap contributors. The operator of Resovu also receives notifications of new support tickets and technical alerts via Telegram; these notifications contain neither the content of the ticket nor customer data. Services that the business connects itself (its own SMS provider, PriceLabs, booking portals via iCal calendar, webhooks or Zapier) receive data on the business's instruction as its own processors or recipients, not as Resovu sub-processors.

6. Data Retention Period

We retain personal data for the following periods: Account data: For the duration of the User's account plus 30 days after account deletion. Accounting and invoicing data is retained for the period required by law, at least 10 years (Czech VAT Act No. 235/2004 Coll. and Accounting Act No. 563/1991 Coll.). Booking data: Configurable by the User (tenant) in the Resovu dashboard. The default retention period is 365 days. After the retention period, personal data in bookings is automatically anonymized by the system's PII purge cron job, while statistical data is preserved in anonymized form. Guest registration data (accommodation): Deleted 7 days after departure. If the law of the country where the accommodation is located requires the guest register to be kept longer (e.g. Czech Republic 6 years, Austria 7 years, Spain 3 years, Slovakia 2 years, Germany 15 months, United Kingdom 12 months, France 6 months), the data is deleted when that period expires. Data of cancelled stays is deleted immediately. Guest's saved card: The reference to the card at Stripe is removed no later than 7 days after departure (and not before the deposit is released or captured). The card brand, the last four digits and the consent record are deleted together with the booking data when the retention period expires. Rate limiting and form protection data: IP addresses stored in the rate limiting system and one-time fingerprints of form protection verification challenges are automatically purged after 2 hours. Purging runs every hour, so no record is kept for longer than 3 hours. Analytics data (only with consent): Google Analytics 4 retains data for 14 months. Microsoft Clarity retains recordings for 30 days and heatmaps and aggregate statistics for 9 months. Meta Pixel data is retained according to Meta's terms. The lifetime of individual cookies is listed in section 8. Error monitoring data: Sentry retains technical error data for 90 days. Session replay is disabled, and personal data (email addresses, phone numbers, payment identifiers) is automatically stripped from error reports before they are sent. Communication logs: Email and SMS delivery logs are retained for 30 days for troubleshooting purposes. The SMS provider chosen by the business keeps its own logs under its own terms. After account deletion, all personal data is deleted within 30 days, except where legal requirements mandate longer retention. Users can request earlier deletion by contacting resovu@resovu.com, subject to legal retention obligations.

7. Your Rights

In accordance with GDPR, you have the following rights: Right of access (Art. 15): You have the right to obtain confirmation of whether personal data concerning you is being processed, and if so, to access that data and receive a copy. Right to rectification (Art. 16): You have the right to request correction of inaccurate personal data or completion of incomplete data. Right to erasure / right to be forgotten (Art. 17): You have the right to request deletion of your personal data when it is no longer necessary for the purpose for which it was collected, when you withdraw consent, or when there is no other legal basis for processing. Right to restriction of processing (Art. 18): You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of data. Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format (CSV export is available in the Resovu dashboard). Right to object (Art. 21): You have the right to object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds. Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular the Czech Office for Personal Data Protection (UOOU, www.uoou.cz). To exercise any of these rights, contact us at resovu@resovu.com. We will respond within 30 days. Identity verification may be required. There is no fee for exercising these rights, unless requests are manifestly unfounded or excessive.

8. Cookies and similar technologies

The resovu.com website (marketing pages, blog, sign-up and sign-in): Necessary cookies are always active. We run analytics and marketing tools only with your consent. – In the EU/EEA and the United Kingdom, neither Google Tag Manager nor any of these tools loads until you give consent. We use Google Consent Mode v2 in basic mode, so not even anonymous signals are sent to Google before consent. – Outside these countries, the tools load immediately and you can opt out. – We determine the region from the IP address. If it cannot be determined, we proceed as in the EU. The Resovu dashboard and business pages (public profile, booking, vouchers, payments, cancellation and withdrawal, reviews, customer portal, online check-in and the widget on the business's website): Resovu does not run any of its own analytics, recording or advertising tools here and uses only necessary cookies. – If a business connects its own Google Analytics 4 or Meta Pixel, a banner with the business's name is shown. These tools only start after your consent. – The business is the controller of this data and gives details in its own privacy policy (linked in the footer of its pages). – Consent given on resovu.com and consent given to a business are not carried over to each other. Necessary cookies (always active): – cc_cookie: your cookie choice on resovu.com, 182 days – cc_tenant_*: your cookie choice on the business's pages, 182 days – sb-*-auth-token: sign-in, for the session – locale: language, 1 year – admin_locale: dashboard language, 1 year – rv_lang_*: the language you chose on a business's pages, 1 year – geo_consent_region: region for the consent mode, 182 days – _rpc: remembers your customer portal choice when booking; stores only a hash of the email, not the email itself, 60 days – rv_wl_offer: offer of a place from the waitlist, 1 day Analytics cookies (only with consent): – _ga, _ga_*: Google Analytics 4, traffic statistics, 2 years. GA4 does not store IP addresses. – _clck (1 year), _clsk (1 day): Microsoft Clarity. Records mouse movement, clicks and scrolling so we can see where the website is confusing. The content of form fields is masked and does not enter the recording. Marketing cookies (only with consent): – _fbp: Meta Pixel, measuring ad effectiveness, 90 days Similar technologies: For minor settings we also use browser storage (localStorage), for example to remember that you declined the offer of another language. If we start using another tool, we will add it here before we switch it on. You can change or withdraw your choice at any time via “Cookie settings” in the footer. Cookies already stored can be deleted in your browser settings.

9. Children's data

Only a person over 18 may open a Resovu account. Businesses that use Resovu — children's clubs, courses and camps among them — may however collect data about children in their booking form, typically a child's name. Where they do, that business is the controller of those records and Resovu processes them solely on its instructions, as a processor. The age at which a child can consent on their own varies across the countries we serve (16 in Germany, Poland, Hungary and Slovakia; 15 in Czechia and France; 14 in Spain; 13 in Norway); below it, consent is the guardian's to give and the business is responsible for obtaining it. If you believe a business is processing your child's data without a proper basis, write to resovu@resovu.com and we will put you in touch with the controller, or erase the data on their instruction.

10. Automated Decision-Making

Resovu does not engage in automated decision-making or profiling within the meaning of Article 22 GDPR that would produce legal or similarly significant effects on data subjects. Automated processing is limited to: rate limiting (abuse protection based on IP address), sorting and filtering of bookings, automated sending of confirmations and reminders. None of these processes produce decisions with legal effects.