Effective from 8 September 2026
1. Who handles your data
The controller of your personal data is Spektrum Reality s.r.o.. That means we decide how the data is processed, and it is us you address your requests to.
| Item | Detail |
|---|---|
| Company ID (IČO) | 09840036 |
| Registered office | Žerotínovo nám. 162/11, Přerov I-Město, 750 02 Přerov |
| Register entry | Commercial Register of the Regional Court in Ostrava, file C 84399 |
| VAT ID (DIČ) | CZ09840036 |
| Data box ID | r472ijw |
| Phone | +420 732 527 299 |
| spektrumreality@email.cz | |
| Responsible for personal data | Andrea Prokešová |
We have not appointed a data protection officer — the law does not require one, because we neither process personal data on a large scale nor monitor anyone systematically. For anything concerning personal data, write to spektrumreality@email.cz.
2. What we process, why and for how long
We collect nothing “just in case”. Every item below has a purpose, a legal basis and a deadline after which we delete it.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering your enquiry, arranging a viewing and further dealings about a property | Name, e-mail, phone, area of interest, budget, your message and the property you ask about | Steps prior to entering into a contract at your request — Art. 6(1)(b) GDPR | 3 years from our last contact |
| Protecting the forms against bots and flooding | IP address and submission times | Legitimate interest — Art. 6(1)(f) GDPR | 24 hours at most, in server memory only |
| Running and securing the website (server logs) | IP address, browser type, requested address, time of request | Legitimate interest — Art. 6(1)(f) GDPR | As set by the hosting provider, a matter of days |
| Traffic measurement (Google Analytics 4) | Pseudonymous device identifier, truncated IP address, pages visited, approximate location at city level, device type | Your consent — Art. 6(1)(a) GDPR | 14 months from your last visit |
| Proof of your choice in the cookie bar | The choice (accepted / rejected), date and policy version | Obligation to demonstrate consent — Art. 7(1) GDPR | 12 months, then we ask again |
| Handling an enquiry sent by e-mail or made by phone | Whatever you write or tell us | Legitimate interest in replying — Art. 6(1)(f) GDPR | 3 years from our last contact |
Filling in a form is voluntary. Without a name and a contact we have no way to reply, which is why those fields are required and the rest are not.
Legitimate interest means the processing is needed for ordinary operation (site security, replying to you) and we have weighed that it does not harm you. You can object to such processing at any time — see section 8.
3. Where the data comes from
From you alone — a form, an e-mail, a phone call or a message on social media. We never buy personal data and we do not harvest it from public registers or third-party lists.
4. Who else sees the data
We do not sell data and we pass it to nobody for their own purposes. We do rely on companies that run the technology for us — they act as processors, bound by contract and by our instructions.
| Who | What for | Where the data sits |
|---|---|---|
| Vercel Inc. (USA) | Hosting and delivery of the website | European Union and the United States |
| Supabase Inc. (USA) | Database of listings and photo storage | European Union (Frankfurt am Main) |
| Resend, Inc. (USA) | Sending the form e-mail to us and the confirmation to you | European Union and the United States |
| Google Ireland Limited (Ireland) | Traffic measurement — only if you consent to it | European Union and the United States |
| Partner agents and developers in Spain | Arranging a viewing or reservation of a particular property — with the data needed for that alone | Spain (European Union) |
We may also hand data to public authorities where the law requires it — for instance during an inspection or under anti-money-laundering rules.
5. Transfers outside the European Union
Some of our suppliers are based in the United States. Those transfers rely on the European Commission’s adequacy decision under the EU‑US Data Privacy Framework, or on standard contractual clauses approved by the Commission. We will send you a copy of the clauses on request.
6. Cookies and traffic measurement
Without your consent the site stores nothing on your device beyond what it needs to work, and Google’s measurement code is not loaded at all. What is stored and for how long is set out separately:
7. How we protect the data
The whole site runs over an encrypted connection (HTTPS). The administration is open only to people with their own account and password, and only to those who need it for their work. The database and photographs sit with providers that keep backups and separate access control.
Should a security breach nonetheless put your rights at risk, we will report it to the Czech Data Protection Authority within 72 hours and, where the risk is high, tell you as well.
8. Your rights
Under the GDPR you have the rights below. Exercising them is free — write to spektrumreality@email.cz or to our registered office.
- To know whether we process anything about you and get a copy of it (right of access).
- To have an inaccurate item corrected and an incomplete one completed.
- To have the data erased once it is no longer needed, you withdraw consent, or we processed it without a basis.
- To have processing restricted while a dispute over accuracy or lawfulness is resolved.
- To receive the data you gave us in a machine-readable format and take it elsewhere (portability).
- To object to processing based on legitimate interest — we then stop unless we can show compelling grounds of our own.
- To withdraw consent to traffic measurement at any time, as easily as you gave it. Withdrawal does not affect what happened before.
- Not to be subject to automated decision-making — which we do not carry out anyway (see section 10).
We reply within one month at the latest. For a complex request we may extend that by two further months and will tell you if we do. If we cannot tell who sent the request, we will ask for something that confirms your identity — otherwise we might hand your data to a stranger.
9. Complaint to the supervisory authority
If you think we are handling your data badly, tell us first — most things are settled with a single e-mail. That does not take away your right to go straight to the supervisory authority:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, phone +420 234 665 111, e-mail posta@uoou.gov.cz.
10. Automated decision-making and profiling
We do neither. No machine decides anything about you on its own, and we do not use your data for profiling or ad targeting.
11. Changes to this policy
This policy changes when the site or the law does. A new version applies from the day we publish it here; for material changes the cookie bar asks for consent again. This version is effective from 8 September 2026.