R RentControl

Privacy policy (GDPR)

This is an English translation provided for convenience. In case of any discrepancy, the Czech version prevails. Last updated: September 2026.

1. Data controller

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data. We have not appointed a data protection officer, as we are not required to do so.

2. Who this policy applies to

3. What data, why and on what legal basis

3.1 App users

Name, e-mail, password (stored only in encrypted form), when signing in with Google the account identifier and profile picture, landlord profile data (address, phone, date of birth, bank account number – if you fill them in to generate contracts) and operational data (logins, IP address). Purpose: providing the app. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in secure operation (Art. 6(1)(f)). Retention: for as long as the account exists; after it is cancelled we delete the data; it disappears from backups as they are routinely rotated.

3.2 People enquiring about our services (website enquiries)

Name, e-mail, phone, apartment details (city, layout, letting date) and the text of the message. Purpose: handling the enquiry, preparing an offer and negotiating a contract. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). We record the enquiry in our app and in our internal CRM system, and we also receive it by e-mail. Retention: if no contract is concluded, no longer than 3 years from the last contact.

3.3 Clients and their tenants

Identification and contact details, data about the property, contracts, payments, meter readings and billing, bank account number, and for tenants/subtenants also the data required for the lease agreement (date of birth, ID document number, permanent address). Purpose: performance of the property management, guaranteed rent or brokerage contract, bookkeeping and compliance with legal obligations (including client identification under Czech Act No. 253/2008 Coll.). Legal basis: performance of a contract, legal obligation and legitimate interest in defending legal claims. Retention: for the duration of the contract and then for the period required by law (accounting records 10 years, identification data under Act No. 253/2008 Coll. 10 years) and for the limitation periods.

3.4 Electronic signature of documents

When a contract, amendment or report is signed electronically, we record the name, signature image, date and time, IP address, browser identification, verification method (last 4 digits of the phone number) and document fingerprint. This data serves as evidence of the signature for as long as the document exists.

3.5 Website visitors

Technical data (IP address, browser type, pages visited) and cookie data – see section 7.

4. Security

We take appropriate technical and organisational measures. Data is stored on servers in the Czech Republic, transmission is encrypted (HTTPS) and the most sensitive tenant identifiers (birth number, ID document number, bank account number) are stored encrypted in the database.

5. Recipients and processors

We do not sell personal data. To the extent necessary, our processors and recipients have access to it:

Some of these recipients (Google, Meta) may transfer data to the USA; such transfers take place on the basis of the EU–US Data Privacy Framework or standard contractual clauses.

6. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. You may withdraw any consent you have given at any time. Please send your requests to info@rentcontrol.cz; we will handle them within one month at the latest. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz).

7. Cookies and measurement

You can delete or block cookies at any time in your browser settings.

8. The app user as controller – data processing agreement

If a user enters personal data of their tenants and other persons into the app, the user is their controller and we are the user’s processor. By registering, the user concludes with us a data processing agreement under Art. 28 GDPR with the following content:

The user is responsible for having a legal basis for processing their tenants’ data (typically performance of the lease agreement) and for informing them about the processing.

9. Changes to this policy

We may update this policy, in particular when our services or the law change. The current version is always available on this page.