Privacy policy
Updated 5 November 2026
Controller and contact
The controller is My Location s.r.o., company ID 24504602, Malešická 2934/10a, Žižkov, 130 00 Praha, Czechia, registered with the Municipal Court in Prague, section C, file 442329. Contact [email protected] for privacy questions and rights requests.
Data we process
Enquiries include your name, phone number, optional email, property details or investment budget, preferred language, comments and subsequent correspondence. You provide these details directly. Do not send identity documents, national identification numbers or sensitive information. Infrastructure and spam protection providers may process IP addresses, browser details, request times and security signals.
Purposes and legal bases
We use enquiries to answer your request, prepare an estimate and discuss services. Where you request steps before entering a contract, the basis is GDPR Article 6(1)(b). For communication with company representatives and other business correspondence, the basis is our legitimate interest in handling that communication under Article 6(1)(f). Website security and spam prevention also rely on Article 6(1)(f). We do not use enquiries for advertising mailouts. Marketing would require a separate assessment and, where applicable, separate consent.
Retention
Enquiries that do not result in a contract are kept for 12 months after the last communication, then deleted. If a contract is concluded, subsequent processing and retention follow contractual purposes and applicable legal obligations. Information needed for a specific dispute or legal duty may be retained for the necessary period. Infrastructure logs follow the providers’ own retention rules; the 12-month period does not automatically apply to them.
Recipients
Authorised company personnel and relevant suppliers may access data as needed: Hetzner for hosting; Cloudflare for website delivery, security, Turnstile and form email delivery; Google/Gmail for email receipt and storage. Legal advisers and public authorities may receive information where necessary. We do not sell data or forward form submissions to Telegram or WhatsApp.
Processing outside the EEA
Suppliers may use infrastructure outside the European Economic Area. Hosting the server in Germany does not exclude other international processing. Any transfers must rely on an applicable adequacy decision or other GDPR safeguards, such as standard contractual clauses. You can request information about specific recipients and safeguards by email.
Your rights
Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may complain to the Czech data protection authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. We normally respond within one month and notify you of any lawful extension.
Required information and automation
Your name, phone number and marked enquiry details are needed to handle the request; the form cannot be submitted without them. Other fields are optional. Reading this policy is not consent to marketing. We do not use automated decision-making or profiling with legal or similarly significant effects. Automated spam checks may reject a technical request; contact us by email if this happens.
Security and updates
We use HTTPS, server-side validation, request rate limits and spam protection. Forms have no separate application database; enquiries are delivered by email. We update this policy when services or processing change. See the Cookies page for browser storage information.