Personal Data Protection Policy

1. Data Controller

The controller of personal data is SIBLINGS a.s., with registered office at Kladenská 699/107, Vokovice, 160 00 Prague 6, Company ID: 082 28 884, registered in the Commercial Register kept by the Municipal Court in Prague, Section B, Insert 24430 (hereinafter the Controller).

Contact for personal data protection matters: info@siblings.cz

2. What Personal Data We Process

In connection with the short-term rental of the property, the Controller processes the following categories of personal data:

  • Identification data: first name, surname, date of birth, identity document number (if required);
  • Contact data: email address, telephone number;
  • Payment data: information about the payment made (without storing the payment card number);
  • Reservation data: Property, dates of stay, number of guests;
  • Platform profile: user profile and ratings from Airbnb or Booking.com (to the extent provided by the platform);
  • Technical data: cookies when visiting the Controller’s web interface.

3. Purposes and Legal Basis of Processing

3.1 Performance of a Contract — Art. 6(1)(b) GDPR

  • Conclusion and performance of the short-term accommodation contract;
  • Management of reservations and communication with the Guest before, during and after the stay;
  • Processing of payments, billing,

3.2 Compliance with Legal Obligations — Art. 6(1)(c) GDPR

  • Keeping accounting and tax records;
  • Reporting obligation towards the Foreign Police of the Czech Republic (in the case of accommodating foreign nationals);

3.3 Legitimate Interest of the Controller — Art. 6(1)(f) GDPR

  • Protection of the Controller’s property and prevention of damage to the Property;
  • Resolution of disputes and assertion of legal claims;
  • Improving the quality of accommodation services.

3.4 Consent — Art. 6(1)(a) GDPR

  • Sending commercial communications and newsletters (only on the basis of granted consent, which may be withdrawn at any time).

4. Retention Period of Personal Data

  • Contractual documentation and correspondence: for the duration of the contractual relationship and 10 years after its termination;
  • Accounting and tax documents: 10 years from the end of the relevant accounting period;
  • Reporting obligation (Foreign Police): according to the statutory period;
  • Marketing consent: until consent is withdrawn;
  • Technical records (logs, cookies): max. 12 months.

5. Recipients of Personal Data

Personal data may be passed on to the following categories of recipients:

  • Short-term rental platforms: Airbnb Ireland UC, Booking.com B.V. (to the extent necessary for arranging the reservation);
  • Payment processor: Comgate, a.s.;
  • Accounting and tax advisors;
  • Public authorities (Foreign Police, tax administration — on the basis of a legal obligation).

Personal data is not transferred by the Controller to third countries outside the EEA. The transfer of data by the Airbnb and Booking.com platforms to third countries is governed by the personal data protection terms of those platforms.

7. Cookies

The Controller’s web interface uses cookies to ensure functionality and to analyse traffic. Detailed information about cookies and the options for setting them is available in the Cookie Policy on the Controller’s website.

8. Changes to the Policy

The Controller reserves the right to update this Policy. Users will be informed of material changes via the website or by email.

This Policy is valid from 31 March 2026.