Personal Data Processing Notice

This information explains how we handle the data of website visitors, interested parties, customers, company contact persons and event participants. The processing required to process an inquiry or reservation is not subject to marketing consent. You can withdraw voluntary consent at any time.

The controller is Prague Stream s.r.o., Company ID No. 17984556, Perucká 2481/5, Vinohrady, 120 00 Prague 2, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 379692. We are a VAT payer; VAT ID CZ17984556. Website: https://www.praguestream.com. For questions about personal data and exercising your rights, write to info@praguestream.com or to our registered office. Reservations, enquiries and questions: +420 792 759 529. Management, marketing and cooperation: +420 775 571 119.

We process name, e-mail, telephone, billing and identification data, content of communication, requests and data about the offer, reservation, ordered services, payments and complaints. For companies, also the data of their contact persons. We do not require a list of all participants on a regular cruise, unless it is necessary for a specific service or legal obligation.

We obtain data from you when you make an inquiry, order, communicate or sign up for marketing. The details of the contact person or participant may be forwarded to the extent necessary by the person booking the event; in such a case, we will inform the person concerned about their processing within the legal deadline at the latest. We also obtain payment data from the bank or through a card payment provider.

For promotional photos and videos, we process the likeness and possibly the voice of persons who have given permission and consent to the respective use. The website may generate operational data, such as IP address, time of request, type of device and browser.

We do not normally require health information. To order catering, it is sufficient to describe the required food without identifying a specific person. Do not send diagnoses. If it is necessary to deal with a personal health limitation, we will determine the appropriate legal basis according to Article 9 of the GDPR before registering it and explain the processing separately.

We use the data to respond to the request, agree on its details by phone, prepare an offer, make a reservation, implement a cruise, event, catering or voucher and communicate about their progress. For a natural person who is a party to a contract or applies for a contract, the basis of Article 6 paragraph 1 letter b) GDPR, i.e. the contract and steps at its request before concluding the contract. For contact persons of companies and organisational contacts, the basis is a legitimate interest according to Article 6, paragraph 1 letter f) GDPR for the negotiation and proper implementation of the service and business communication.

The requested contact information is required to process the request. We require billing data to the extent necessary for a specific transaction and documents. Without the necessary data, we may not be able to process the request or provide the service. A phone call or a message about your specific reservation is not conditional on subscribing to the newsletter.

We process accounting and tax documents and other records required by law on the basis of Article 6 paragraph 1 letter c) GDPR. For adequate registration of complaints, proof of agreement, settlement of damages, assertion or defence of legal claims and security of the website, we rely, depending on the situation, on legal obligation or legitimate interest according to Article 6, paragraph 1 letter f) GDPR. The legitimate interest is to protect our rights, customers' rights, property and safety. You can object to processing based on legitimate interest.

The newsletter contains news, inspiration and offers of Prague Stream's own services. We usually send it once, at most twice a month. Offers from other independent brands or partners are not automatically included.

We send the newsletter to interested parties who are not yet our customers only on the basis of prior voluntary consent in accordance with Article 6 paragraph 1 letter a) GDPR and § 7 paragraph 2 of Act No. 480/2004 Coll. Consent is granted by actively checking a separate optional box expressly intended for newsletter subscription; it is not a condition for processing a request or reservation. We record the consent, including its wording, time and method of granting. We do not consider mere confirmation of familiarization with this information as marketing consent.

If we have received an electronic contact from the customer in connection with the sale of a service, we can use it for offers of our own similar services also in accordance with § 7 paragraph 3 of Act No. 480/2004 Coll., if the customer had a clear and simple option to refuse such use when receiving the contact and did not refuse it. In this regime, the legal basis under the GDPR is our legitimate interest in the direct marketing of our own similar services. A mere request, participation in an event or a historical invoice does not prove the fulfilment of all these conditions.

We mark each marketing message and indicate the sender. Unsubscribing is free, simple, without logging into an account and available in every message; you can also use info@praguestream.com. After withdrawing consent or objecting to direct marketing, we do not send further marketing. It does not affect the communication necessary for your order or the processing required by law. We do not sell or provide your contacts to other entities for their own marketing.

In order to evaluate and improve the newsletter, we use Ecomail to measure the opening and clicking of links by individual recipients, only if they have given voluntary consent in advance for this separate purpose in accordance with Article 6 paragraph 1 letter a) GDPR and the rules for the protection of end devices. The measurement uses a tracking image and tagged links; may include recipient and campaign identifier, time of opening or click, specific link and technical data such as IP address and browser type. Consent is not a condition for subscribing to the newsletter. Without it, we send messages without this tracking. Consent to measurement can be revoked separately via the subscription settings indicated in the message or at info@praguestream.com; then we turn off further measurements. We do not use the data to make decisions with legal or similarly significant effects.

If there are to be recognizable guests in the photo or video for our promotion, before taking it for this purpose and publishing it, we will request specific individual permission for the likeness and possible consent to the processing of personal data in accordance with Article 6 paragraph 1 letter a) GDPR. For minors, we deal with permission and consent with the legal representative, taking into account the child's age and competence. The organiser of the event cannot give this consent automatically for all guests.

Consent will determine the records, purpose, scope of use and channels, especially the website and selected social networks of Prague Stream. Use in paid advertising is handled by a separate option. We do not publish photos with a profile tag, name or other identifiers without appropriate permission. Consent is not a condition of service and can be revoked at info@praguestream.com.

Once consent is withdrawn, we will cease further use and remove the recordings from channels under our control to the extent required by law. Withdrawal of consent does not affect the lawfulness of prior processing. Social networks may also process data as independent controllers, and publicly available content may be copied by others. We cannot guarantee the complete removal of copies beyond our control; we will take the steps required of us by law. Links to our current social media profiles are available at https://www.praguestream.com. The specific networks and scope of publication are determined by the permission and consent granted.

Data is available to authorised employees and contractors only to the extent necessary for their work. We only pass on necessary organisational information to suppliers of catering, decorations and other services; for example, portion requests may not include guests' names. Data can be obtained by accountants, legal and insurance advisers, banks, card payment providers and public authorities if required by law. Recipients act according to their role as processors or independent controllers.

We create the website using Lovable. Its data protection policy is set out by Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden, privacy@lovable.dev and dpo@lovable.dev; published processing agreement states Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA. Information: https://lovable.dev/privacy; processing terms: https://lovable.dev/data-processing-agreement; subprocessors: https://lovable.dev/subprocessors.

We use GoDaddy for website technical services. For GoDaddy.com, the European announcement is made by GoDaddy.com, LLC; the data protection contact address is 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, USA, privacy@godaddy.com. The representative in the EU is GoDaddy Deutschland GmbH, c/o Spaces, Gertrudenstraße 30--36, 50667 Köln, Germany. Information: https://www.godaddy.com/en-uk/legal/agreements/privacy-policy; processing terms: https://www.godaddy.com/en-uk/legal/agreements/data-processing-addendum.

We provide email communication through Gmail within Google Workspace; we manage documents in Google Drive. For Google Workspace for Czech customers, according to the current contract list, the provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland, unless the concluded contract specifies otherwise. To this extent, Google processes the content on the basis of the relevant processing conditions. Information: https://policies.google.com/privacy?hl=cs and https://cloud.google.com/terms/data-processing-addendum.

Newsletter distribution, subscriber management and approved measurement of campaigns are provided by Ecomail.cz, s.r.o., IČO 02762943, Na Příkopě 388/1, 110 00 Prague 1 as processor. The processing agreement and the list of subcontractors are part of the terms and conditions: https://ecomail.cz/obchodni-podminky/.

Card payments through the terminal are provided by SumUp Limited, registration number 505893, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland D02 K580. It also acts as an independent controller when processing payments and fulfilling its own legal obligations. Information: https://www.sumup.com/cs-cz/soukromi/.

We use iDoklad of the company Seyfor, a. s., IČO 01572377, Drobného 555/49, Ponava, 602 00 Brno, Czech Republic, to issue and store invoices. Acts as a processor in relation to our customers' data when providing the billing interface and storage; defines separate purposes in its terms and conditions. Information and processing conditions: https://www.idoklad.cz/zasady-ochrany-osobnich-udaju.

Use of international technology services may involve processing or accessing data outside the EEA, particularly in the US. Such transfer takes place only on an appropriate legal basis according to Chapter V of the GDPR: for example, on the basis of a valid decision on adequate protection, with a certified recipient within the relevant framework, or standard contractual clauses and necessary additional measures. This is not a general consent to send data anywhere.

Internationale Dienste and their subcontractors may involve access or processing outside the EEA, particularly in the US. The applicable contractual terms are governed by EU Standard Contractual Clauses or another applicable mechanism under Chapter V of the GDPR. The relevant lists and terms are available at https://workspace.google.com/terms/subprocessors.html, https://lovable.dev/subprocessors, https://www.godaddy.com/en-uk/legal/agreements/data-processing-addendum, https://ecomail.cz/obchodni-podminky/ and in the SumUp and iDoklad policies listed above. You can request information and a copy of the applicable safeguards at info@praguestream.com.

We keep enquiries that do not lead to a booking and necessary communication for a maximum of 12 months from the last material communication, unless there is another specific reason, for example an ongoing dispute. As a rule, we keep the data about the performed service necessary for the protection of rights for a period of three years after its end; in the event of a dispute, damage or a longer relevant limitation period, we keep the necessary documents for an appropriate period of time. It does not mean comprehensive preservation of every piece of data or the entire correspondence.

We keep tax documents for VAT for ten years from the end of the tax period in which the transaction took place. We keep accounting records according to their type and accounting law; standard accounting documents five years from the end of the relevant accounting period, financial statements ten years. If the document is subject to multiple obligations, we observe the applicable longer deadline. Special circumstances may extend the statutory period.

We use marketing contacts based on consent until it is revoked, but no longer than three years after it was granted or the last explicit renewal. Simply opening an email or making another purchase does not automatically renew consent. In the case of a customer exception, the period is a maximum of three years from the last purchase, always provided that all legal conditions are met and until a possible rejection.

We keep the proof of consent and its revocation to a reasonably limited extent, usually three years after the end of the relevant marketing processing to prove legality. We keep a minimum record of rejected contact for as long as it is necessary to prevent further unwanted contact, and we regularly review its necessity; we do not use it for marketing.

We use promotional records for the period of specific consent, a maximum of three years, or until it is revoked. We do not keep unused records without promotion authorization in the promotion database. We keep individual data on opening and clicking through the newsletter for a maximum of 12 months from the relevant event or until the consent to measurement is revoked; we delete or irreversibly anonymise them after the end, unless the law requires us to retain limited evidence. Truly anonymous aggregate statistics are no longer personal data.

For the routine operational and security logs that we manage, we set a maximum period of 90 days. We only keep the records needed to resolve the incident or legal claim for the necessary time.

Necessary cookies and similar storage are used to operate and secure the website, ensure requested functions and remember cookie settings. Consent is not required to store and read truly necessary technologies. For the subsequent processing of personal data, we use an appropriate legal basis, in particular a legitimate interest in safe operation or the fulfilment of a requested function.

You can change your cookie settings at any time via the cookies bar on our website. If optional technologies are used on the website, the bar allows their acceptance, rejection and choice of individual purposes; they are activated only after the corresponding consent has been granted. You can withdraw consent just as easily. The use of essential features of the website is not conditional on consent to optional technologies.

Under the terms of the GDPR, you have the right to access your data and its copy, correction, erasure, restriction of processing and portability. Portability refers to automated processing based on consent or contract and does not automatically apply to all data.

You have the right to object to processing based on legitimate interest for reasons relating to your particular situation. You can object to direct marketing at any time and without giving a reason; after that we will stop processing your data for this purpose. Consent can be revoked at any time without changing the legality of the previous processing.

We usually deal with requests within one month of receipt. For legal reasons, the deadline can be extended by another two months; we will inform you about the extension and its reason within the first month. To the extent necessary, we can verify your identity. Deletion is not absolute and does not apply, for example, to data that we must retain by law or for the legitimate defence of legal claims.

You may lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, https://uoou.gov.cz. You do not have to contact the controller first.

We do not perform exclusively automated decision-making that would have legal or similarly significant effects for you. Newsletter tracking takes place within the scope and under the conditions of Article 5; it does not itself determine your contractual rights or access to the service. We deal with binding changes to orders and individual requests with human control.

Within Prague Stream, only authorised persons whose work requires it have access to data. We secure accounts with two-factor authentication. We do not provide access to unauthorised persons; the necessary processing by the supplier according to Article 7 is not excluded. We will post changes to this information with the new date. An update in itself does not constitute a new marketing consent or legalize previous unauthorised processing.