Last updated: 4 October 2026

This Privacy Policy explains how Guide Prague Org (“we”, “us”, “our”), the operator of guide-prague.org (the “Website”), collects, uses, and protects your personal data, and what rights you have under the EU General Data Protection Regulation (GDPR) and applicable Czech law.

Who is responsible for your data

The data controller is:

If you have any questions about this policy or how we handle your data, contact us at the email address above.

What data we collect, why, and on what legal basis

1. Contact form

When you use our contact form, we collect the first name, last name, email address, phone number and the message you provide. We use this only to read and reply to your enquiry.

Legal basis: your consent and/or our legitimate interest in responding to messages you send us (Art. 6(1)(a) and 6(1)(f) GDPR). Providing a phone number is optional.

2. Analytics (Google Analytics 4)

With your consent, we use Google Analytics 4 (provided by Google Ireland Limited / Google LLC) to understand how visitors use the Website — for example which pages are popular and how people arrive — so we can improve our content. This may include your approximate location (derived from your IP address, which Google shortens), device and browser type, pages viewed, and interactions such as scrolling and outbound clicks.

Analytics cookies (_ga, _ga_<id>) are only set after you accept analytics cookies in our cookie banner. We use Google Consent Mode: until you accept, analytics is disabled and no analytics cookies are stored. We do not use analytics data for advertising and do not enable advertising or remarketing signals.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time — see “Cookies and how to change your choice” below.

3. Server and error logs

Our hosting provider automatically records standard technical information when you visit, such as your IP address, browser and device type, the pages requested, and the date and time. This is used to operate the site securely and diagnose problems.

When a page cannot be found or fails to load, because of an error on our side or in your browser, our site automatically keeps a short technical report: the page, the time, your IP address, the country our hosting provider derives from it, and your browser type. These reports exist only to keep the Website working and secure: they help us find and fix faults and spot attacks and misuse.

Your browser may also send us an automatic report when a page tries to load something our security settings do not expect. This is a standard browser security feature; such a report records the page, your IP address, the country derived from it, and your browser type.

These reports are never used for advertising or marketing, and never sold. Only site administrators can read them, and they are deleted automatically (see “How long we keep your data”).

Legal basis: our legitimate interest in the security and reliable operation of the Website (Art. 6(1)(f) GDPR).

4. Fonts

The Website’s typefaces are delivered together with the Website itself. No request is made to Google or to any other font service, so loading them transmits no data to a third party.

5. Accounts and sign-in

Anyone can create an account, but you do not need one to read the Website. If you create one, we store only what an account needs: your name and email address, and a username if you set one. Your password is stored only as a one-way hash, never in readable form, so not even we can see it. If you sign in with Google, Google shares your name, email address and profile picture with us; we use Google only to sign you in. If you add a passkey or two-factor authentication, we store only what is needed to check it: the public part of the passkey, an encrypted authenticator secret, and backup codes.

So that you can see where you are signed in and sign out your other devices, each sign-in keeps a session record with the IP address and browser type it was started from. We send only the emails your account needs: to confirm your address, reset your password, sign you in with a link or code, and alert you to security events (a security alert shows the browser and IP address of the sign-in, so you can recognise it). We do not send newsletters or advertising.

You can delete your account at any time in your account settings; we email you a link to confirm it. Site administrators can see account details, sessions and the activity log described below, so that they can help you and keep the Website secure, and they can block an account that is misused.

Troubleshooting view: to investigate a reported problem, an administrator can briefly see the Website exactly as a particular user sees it — a standard technical support feature. It never reveals your password, it ends automatically after at most 10 minutes, and every use is recorded in the activity log.

Legal basis: providing the account you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

6. Account security and recognised devices

If you have an account and sign in, we keep information about recognised devices so we can alert you when your account is accessed from a browser we do not recognise.

  • Recognised devices (account holders only): for each browser you sign in from, we store a random device identifier, the browser’s user-agent string, and the first and last sign-in times. A device unused for more than 180 days can no longer be recognised and its record may be deleted. All recognised-device records are deleted automatically if the account is deleted.

Legal basis: our legitimate interest in protecting user accounts and detecting potentially unauthorised access (Art. 6(1)(f) GDPR).

7. Account activity and security log

To keep accounts safe, we keep a technical record of security-relevant events: sign-ins and sign-outs, failed sign-in attempts, requests for a password reset or a sign-in link or code, changes to an email address, password, two-factor settings, passkeys, linked accounts or sessions, and administrators’ actions on accounts. Each record holds the event, the time, the account (if known), the IP address, the country derived from it, and the browser type. This is what lets us notice a break-in attempt, stop it, and help you if your account is ever misused.

A failed attempt or request is recorded even if no such account exists, together with the email address or username that was entered — that is how someone trying to guess their way into accounts can be recognised. To slow down automated attacks, we also briefly count requests per IP address. You can see your own recent activity in your account settings; only site administrators can see the full log. These records are never used for advertising or marketing, and never sold; they are deleted automatically (see “How long we keep your data”).

Legal basis: our legitimate interest in protecting accounts and the Website against unauthorised access and abuse (Art. 6(1)(f) GDPR).

8. Content embedded from partners

Some articles show content from our partners: booking and tour widgets (Travelpayouts, GetYourGuide and Tripster), a Buy Me a Coffee donation button, and Google Maps. Like any content embedded in a web page, it loads directly from the partner’s servers, so the partner receives the technical information every website receives — your IP address, your browser type and the address of the page — and may set its own cookies. The partners do not tell us who you are: if you book through a partner’s widget or link, we may earn a commission, and we see only anonymous statistics (for example, that a booking was made). The partners’ own privacy policies apply to what they collect.

Tripster’s servers are in Russia. Its widgets appear only on our Russian-language pages. When such a page loads, the technical information described above (never your account details) reaches Tripster in Russia, which the EU does not recognise as providing an adequate level of data protection.

Legal basis: our legitimate interest in financing the Website through partner commissions and in showing maps of the places we describe (Art. 6(1)(f) GDPR).

Cookies and how to change your choice

We use a small number of cookies:

  • Strictly necessary — a cookie (cc_cookie) that remembers your cookie preferences. This is always active and cannot be switched off.
  • Strictly necessary — a cookie (__Secure-better-auth.device_id) set only when you sign in to an account. It contains only a random identifier and no directly identifying information. Its only purpose is to recognise a browser you have signed in from before, so we can email you a security alert if your account is accessed from a device we do not recognise. It expires 180 days after your last sign-in and is never used to log you in, skip a security step, or perform analytics. If you do not sign in, this cookie is never set.
  • Strictly necessary — sign-in cookies (their names begin with __Secure-better-auth.), set only when you sign in or start signing in. They keep you signed in (for up to 7 days, renewed while you use the Website) and protect individual security steps such as two-factor authentication, passkeys and signing in with Google (a few minutes each). They are deleted when you sign out.
  • Functional — a cookie (NEXT_LOCALE) that remembers the language you chose when it differs from your browser’s language. It is deleted when you close the browser.
  • Functional — a cookie (sidebar_state) that remembers whether the menu in your account area is collapsed (7 days).
  • Strictly necessary — a short security session from our hosting provider, created only if its protection against automated traffic asks your browser to prove it is a real browser (a brief checkpoint page). It is valid for 1 hour.
  • Analytics — Google Analytics cookies (_ga, _ga_<id>), set only if you accept them.

None of these cookies is used for advertising or to follow you across other websites; the analytics cookies are set only with your consent. Partner widgets embedded in some articles may set their own cookies — see “Content embedded from partners” above.

You can change or withdraw your consent at any time by clicking the “Cookie settings” link in the footer of any page, then saving your preferences. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

Who we share data with

We do not sell your personal data. We use trusted service providers (“processors”) who process data on our behalf and only for the services they provide to us:

  • Vercel Inc. — website hosting and delivery, including protection against attacks.
  • Supabase — database (hosted in the EU, in Frankfurt) that stores contact-form submissions, account information, recognised-device records, and the logs described above.
  • Resend — delivery of account and security emails.
  • Google — analytics (with your consent). If you sign in with Google, Google processes that sign-in under its own privacy policy.

Partners whose content is embedded in our articles receive data directly from your browser, as described under “Content embedded from partners”.

International data transfers

Some of these providers (such as Google, Vercel and Resend) are based in, or process data in, the United States. Where personal data is transferred outside the European Economic Area, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses and/or the EU–US Data Privacy Framework. Partners whose content is embedded in our articles may process data outside the European Economic Area under their own policies. One of them, Tripster, is in Russia, for which there is neither an EU adequacy decision nor any other safeguard; this happens only when one of our Russian-language pages with a Tripster widget loads (see “Content embedded from partners”).

How long we keep your data

We keep data only as long as it is needed for its purpose, and much of it is deleted automatically:

  • Contact-form messages: kept only as long as needed to handle your enquiry and any follow-up, then deleted.
  • Analytics data: retained according to our Google Analytics settings; aggregated reports may be kept longer.
  • Server and error logs: our hosting provider’s request logs are kept for a short period; the technical reports in our own log are deleted automatically after at most 90 days (reports of pages that could not be found after 14 days), and the browser security reports after 12 months.
  • Accounts: kept until you delete your account. Session records are deleted 7 days after the session expires.
  • Account activity and security log: routine events (such as successful sign-ins and sign-outs) for 90 days; security events (such as failed sign-ins and changes to an email address, password or security settings) for 12 months; administrators’ actions on accounts for 24 months. Records are deleted automatically when their period ends, and are kept for that period even if the account is deleted.
  • Recognised-device records: a device that has not been used for more than 180 days can no longer be recognised and its record may be deleted. All recognised-device records are deleted automatically when the associated account is deleted.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to processing;
  • receive your data in a portable format;
  • withdraw consent at any time (for example, for analytics cookies).

You can delete your account yourself at any time in your account settings. Its security records (see “Account activity and security log”) are then kept only until their retention period ends, because they may be needed to investigate a security incident or misuse — for example, if someone else had used your account.

To exercise any of these rights, contact us at info@guide-prague.org.

You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz). You may also contact the data protection authority in your country of residence.

External links

Our Website links to external sites, including our social media pages on Facebook, Instagram, and Pinterest. These are ordinary links — we do not embed their tracking on our pages — but once you follow a link, that third party’s own privacy policy applies. Partner widgets embedded in our articles are different — see “Content embedded from partners” above.

Children

The Website is intended for a general audience and is not directed at children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last changed. Material changes will be reflected on this page.