This Privacy Policy explains how Guide Prague Org (“we”, “us”, “our”), the operator of guide-prague.org (the “Website”), collects, uses, and protects your personal data, and what rights you have under the EU General Data Protection Regulation (GDPR) and applicable Czech law.

Who is responsible for your data

The data controller is:

If you have any questions about this policy or how we handle your data, contact us at the email address above.

What data we collect, why, and on what legal basis

1. Contact form

When you use our contact form, we collect the first name, last name, email address, phone number and the message you provide. We use this only to read and reply to your enquiry.

Legal basis: your consent and/or our legitimate interest in responding to messages you send us (Art. 6(1)(a) and 6(1)(f) GDPR). Providing a phone number is optional.

2. Analytics (Google Analytics 4)

With your consent, we use Google Analytics 4 (provided by Google Ireland Limited / Google LLC) to understand how visitors use the Website — for example which pages are popular and how people arrive — so we can improve our content. This may include your approximate location (derived from your IP address, which Google shortens), device and browser type, pages viewed, and interactions such as scrolling and outbound clicks.

Analytics cookies (_ga, _ga_<id>) are only set after you accept analytics cookies in our cookie banner. We use Google Consent Mode: until you accept, analytics is disabled and no analytics cookies are stored. We do not use analytics data for advertising and do not enable advertising or remarketing signals.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time — see “Cookies and how to change your choice” below.

3. Server logs

Our hosting provider automatically records standard technical information when you visit, such as your IP address, browser and device type, the pages requested, and the date and time. This is used to operate the site securely and diagnose problems.

Legal basis: our legitimate interest in the security and reliable operation of the Website (Art. 6(1)(f) GDPR).

4. Fonts

The Website loads typefaces from Google Fonts (Google LLC). When a page loads, your browser requests these fonts from Google’s servers, which means your IP address is transmitted to Google. This happens to display the site correctly.

Legal basis: our legitimate interest in presenting the Website consistently (Art. 6(1)(f) GDPR).

5. Account security and recognised devices

If you have an account and sign in, we keep information about recognised devices so we can alert you when your account is accessed from a browser we do not recognise.

  • Recognised devices (account holders only): for each browser you sign in from, we store a random device identifier, the browser’s user-agent string, and the first and last sign-in times. A device unused for more than 180 days can no longer be recognised and its record may be deleted. All recognised-device records are deleted automatically if the account is deleted.

Legal basis: our legitimate interest in protecting user accounts and detecting potentially unauthorised access (Art. 6(1)(f) GDPR).

Cookies and how to change your choice

We use a small number of cookies:

  • Strictly necessary — a cookie (cc_cookie) that remembers your cookie preferences. This is always active and cannot be switched off.
  • Strictly necessary — a cookie (better-auth.device_id) set only when you sign in to an account. It contains only a random identifier and no directly identifying information. Its only purpose is to recognise a browser you have signed in from before, so we can email you a security alert if your account is accessed from a device we do not recognise. It expires 180 days after your last sign-in and is never used to log you in, skip a security step, or perform analytics. If you do not sign in, this cookie is never set.
  • Analytics — Google Analytics cookies (_ga, _ga_<id>), set only if you accept them.

You can change or withdraw your consent at any time by clicking the “Cookie settings” link in the footer of any page, then saving your preferences. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

Who we share data with

We do not sell your personal data. We use trusted service providers (“processors”) who process data on our behalf:

  • Vercel Inc. — website hosting and delivery.
  • Supabase — database that stores contact-form submissions, account information, and recognised-device records.
  • Google — analytics (with your consent) and fonts.

International data transfers

Some of these providers (such as Google and Vercel) are based in, or process data in, the United States. Where personal data is transferred outside the European Economic Area, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

How long we keep your data

  • Contact-form messages: kept only as long as needed to handle your enquiry and any follow-up, then deleted.
  • Analytics data: retained according to our Google Analytics settings; aggregated reports may be kept longer.
  • Server logs: kept for a short period for security and troubleshooting.
  • Recognised-device records: a device that has not been used for more than 180 days can no longer be recognised and its record may be deleted. All recognised-device records are deleted automatically when the associated account is deleted.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to processing;
  • receive your data in a portable format;
  • withdraw consent at any time (for example, for analytics cookies).

To exercise any of these rights, contact us at info@guide-prague.org.

You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz). You may also contact the data protection authority in your country of residence.

External links

Our Website links to external sites, including our social media pages on Facebook, Instagram, and Pinterest. These are ordinary links — we do not embed their tracking on our pages — but once you follow a link, that third party’s own privacy policy applies.

Children

The Website is intended for a general audience and is not directed at children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last changed. Material changes will be reflected on this page.