This Privacy Policy explains how we collect and use your personal data when you visit bestpragueguide.com, send us an inquiry, book a tour, or take a tour with us. We have written it in plain English because most of our guests are international visitors.

1. Who we are (the data controller)

The person responsible for your personal data (the "data controller") is Uliana Formina, trading as Best Prague Guide — a self-employed sole trader (OSVČ) registered in the Czech Republic.

Company ID (IČO): 07345640
Registered address: Lehovecká 1145, Prague, Czech Republic
Email: info@bestpragueguide.com

We provide private (individual) walking and car tours in Prague and across the Czech Republic. We are established in the Czech Republic, so we are not required to appoint an EU representative under Article 27 GDPR, nor a Data Protection Officer. For any question about your personal data, contact us at the email above.

2. What personal data we collect

(a) Booking and inquiry data. When you complete the contact/booking form on our website, you typically provide your name, email address, phone number, and the message or tour details you send us. The form delivers this information to us by email. You may also contact us directly via WhatsApp or email.

(b) Payment data. We offer only two ways to pay: card payment online in advance via Stripe (for example through a secure payment link), and cash on the day of the tour (EUR, USD or Czech koruna). If you pay online, Stripe processes your card payment; we do not see or store your full card number. We receive only confirmation of payment and limited transaction information needed for our accounting records.

(c) Technical and usage data. When you browse our website, limited technical data (such as IP address, browser and device information, and pages viewed) may be processed for security and for measuring website traffic. This is explained in our Cookie Policy.

We do not collect special categories of personal data, and our services are not directed at children (see Section 10).

3. How and why we use your data, and our legal basis

Receiving and answering your inquiry; planning, confirming and delivering your tour — legal basis: performance of a contract / pre-contractual steps (Article 6(1)(b) GDPR).
Processing your advance card payment through Stripe — performance of a contract (Article 6(1)(b)).
Keeping invoices and accounting/tax records — legal obligation (Article 6(1)(c)).
Analytics cookies (Google Analytics 4 via Google Tag Manager) — your consent (Article 6(1)(a)), together with §89 of Czech Act No. 127/2005 Coll. and the ePrivacy Directive.
Advertising cookies (Google Ads conversion tracking) — your consent (Article 6(1)(a)), together with §89 of Czech Act No. 127/2005 Coll. and the ePrivacy Directive.
Cookieless, aggregated website statistics (Umami) — our legitimate interest in privacy-friendly audience measurement (Article 6(1)(f)); consent-exempt because it is cookieless and does not identify you.
Website and server security (hosting and security logs) — our legitimate interest (Article 6(1)(f)).

Providing the booking/inquiry form data is not a statutory requirement, but it is necessary for us to respond and provide a tour. We do not carry out automated decision-making or profiling with legal or similarly significant effects (Article 22 GDPR).

4. Cookies and tracking

Our website uses analytics and advertising cookies that run only after you consent, plus a cookieless privacy-friendly statistics tool. Full details — including the consent banner and how to change or withdraw consent — are in our Cookie Policy.

5. Who we share your data with (recipients and processors)

We do not sell your personal data. We share it only with the providers we need to run the business:

Stripe (Stripe Payments Europe, Limited / Stripe, LLC) — our payment processor; processes your online card payment under its own privacy policy.
Google (Google Ireland Limited / Google LLC) — provides Google Analytics 4, Google Tag Manager, and Google Ads (conversion tracking), which run only after you consent.
Hetzner Online GmbH (Germany) — our web hosting provider and data processor; hosts the website on EU-based infrastructure.

We may also disclose data where required by law or to defend legal claims. We do not pass your booking data to third-party booking platforms as part of this website's processing.

6. International data transfers

Most of your data stays within the EU. Google and Stripe may transfer data to the United States; both self-certify under the EU–U.S. Data Privacy Framework (DPF) and additionally rely on the European Commission's Standard Contractual Clauses (SCCs) as a safeguard. The validity of the DPF was upheld by the EU General Court in September 2025 and is under appeal before the Court of Justice of the EU (Case C-703/25 P, pending as of mid-2026); the SCCs serve as a backup. Hetzner is in Germany (EU), so hosting involves no transfer outside the EU.

7. How long we keep data

Invoices and accounting/tax records: We are a person identified for VAT (osoba identifikovaná k DPH) and must keep accounting and tax records for the periods set by Czech law (for example, 5 years for supporting accounting documents under §31 of the Accounting Act No. 563/1991 Coll., and up to 10 years for documents connected to VAT transactions under the VAT Act No. 235/2004 Coll.). To avoid under-retaining records we are legally required to keep, we retain accounting and tax records for the statutory period — generally up to 10 years from the end of the relevant period.
Inquiry and booking correspondence not resulting in a paid booking: kept only as long as needed to handle your inquiry and a limited period afterwards, then deleted.
Server and security logs: kept for a short period, then deleted.
Cookie consent records: your consent choice is stored for 6 months (see Cookie Policy).

When the applicable period ends, we securely delete or anonymise the data.

8. Your rights under the GDPR

You can exercise any of these by emailing info@bestpragueguide.com, free of charge:

Right of access (Article 15)
Right to rectification (Article 16)
Right to erasure (Article 17), subject to records we must keep by law (e.g. invoices)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object (Article 21)
Right to withdraw consent at any time (Article 7(3)) — for anything based on consent, such as analytics and advertising cookies. Use the "Cookie settings" link in our website footer.
Right not to be subject to automated decision-making (Article 22) — we do not do this.

Right to complain: you may lodge a complaint with the Czech supervisory authority — Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic; phone +420 234 665 111; email posta@uoou.gov.cz; website https://uoou.gov.cz. We would appreciate the chance to resolve your concern directly first.

9. Data security

We apply appropriate technical and organisational measures, including reputable providers (Stripe, Hetzner), encrypted HTTPS connections, and access limited to what is necessary. No internet transmission is completely secure, but we take reasonable steps to protect your information.

10. Children's data

Our tours and website are intended for adults. We do not knowingly collect personal data from minors (the digital age of consent in the Czech Republic is 15). If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new "Last updated" date.

12. Contact

Uliana Formina — Best Prague Guide. Email: info@bestpragueguide.com. IČO: 07345640 · Lehovecká 1145, Prague, Czech Republic.