How we handle your data

The data controller is the operator of the Althanský palác guesthouse in Znojmo:

Penzion Althanský palác
Horní nám. 9/3, 669 02 Znojmo, Česká republika
info@althanskypalac.com · +420 603 986 445

The data controller is the operator of the guesthouse: EGO 93, s.r.o., company ID 49282093, VAT ID CZ49282093, registered office Resselovo náměstí 76, Chrudim I, 537 01 Chrudim, Czech Republic (responsible person Jana Philipp, +420 603 986 445, info@althanskypalac.com).

We process only what a given action needs, and only to perform a contract, in our legitimate interest in running the guesthouse, or to meet a legal duty (e.g. the guest register and accounting).

• Booking a stay — happens in the Puxis reservation system (hopen.cz), which is an independent controller of the booking-form data (name, contact, dates, payment). Puxis terms: Puxis privacy policy
• Contact and enquiry forms — the name, e-mail, message text and, for an event enquiry, the date, guest count and other details you fill in are stored on our server (see Supabase below) so reception can see them in the website's admin, and are also e-mailed to reception through the Resend service (a processor). We reply to the e-mail you give. If sending fails, the page offers the message for you to send from your own mail program.
• Guest area (/hoste) — the access value reception gives you (password, e-mail or phone) is stored only as a SHA-256 hash, never in readable form, together with a working label (e.g. room number) and a validity window. After unlocking you receive one functional cookie (see below).
• Breakfast and wine-bath requests in the guest area — date, variant and your note, tied to the access value so reception can act on them.
• IANČA, our AI guide (the chat in the guest area and Telegram) — your messages are sent through the Vercel AI Gateway to a language-model provider to generate the answer. Conversations are stored for 90 days so reception can follow up when a problem comes up in them; an automatic check by an independent model flags complaints concerning the pension for staff attention. Please do not type payment details or health information into the chat.
• Server logs — the Vercel hosting records IP address, time and requested page for security and error diagnosis; short-term, not linked to you as a person.

Without your consent the site uses only three functional cookies: __Host-ap_guest (guest-area sign-in, at most 7 days or until your access expires), __Host-ap_admin (administrator sign-in, 8 hours) and ap_consent (your analytics choice, 12 months). The first two are HttpOnly and Secure; the guest area does not work without them.

Analytics: only after you click “Accept analytics” in the cookie bar does Google Analytics 4 load (processor Google Ireland Ltd.) and set the _ga and _ga_* cookies (up to 13 months). It measures pages visited and site usage anonymously; GA4 does not store your full IP address. We use no advertising or remarketing features. Google's policy: privacy policy →

You can change or withdraw your consent at any time via the “Cookie settings” link in the footer. If you decline, no measurement cookies are set and nothing is sent to Google.

• Vercel Inc. — website hosting and server functions (USA/EU, standard contractual clauses). privacy policy →
• Puxis / hopen.cz — the reservation system embedded on the Booking page; its window loads its own content and any cookies directly from Puxis. privacy policy →
• Google Maps — the map on the Contact page loads only after you click “Show map”; until then nothing goes to Google. privacy policy →
• Google Ireland Ltd. — traffic measurement (Google Analytics 4), only after your consent in the cookie bar. privacy policy →
• OpenStreetMap — map tiles in the public audio guide; when the map is shown, the OSM Foundation server sees your IP address. privacy policy →
• Resend, Inc. — the service that delivers contact- and enquiry-form messages to reception by e-mail (USA/EU, standard contractual clauses). privacy policy →
• Supabase (database hosted in the EU, Frankfurt) — storage for the guest area and the form messages: hashes of access values, breakfast and spa requests, conversations with IANČA (90 days), contact- and enquiry-form messages (12 months), content managed by reception. Only the website's server can reach it.

The policy we have set:

• Guest-area access records (hash + label): until expiry and 30 days after, then deleted.
• Breakfast and bath requests: 12 months from creation.
• Conversations with IANČA: 90 days from the last message, then deleted.
• Contact- and enquiry-form messages: 12 months from submission in the website's admin; the ensuing e-mail correspondence for the duration of the exchange and then as accounting and tax law requires where a contract was concluded.
• Server logs at Vercel: per their standard, in the order of days.

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability and to object. Where processing rests on consent, you may withdraw it at any time.

Write to us at info@althanskypalac.com

You may lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).