HOA Management

Privacy policy

Last updated: 22 October 2026. This is a translation; the Czech version is binding.

This policy describes how the controller processes personal data of natural persons under Regulation (EU) 2016/679 (the GDPR) and Czech Act No. 110/2019 Coll. on personal data processing. It applies to visitors of the profispravcesvj.cz website, prospective clients, clients (building associations and housing cooperatives) and unit owners who use the ProfiSprávceSVJ online portal and mobile app.

1. Controller

The controller is:
Bc. Martin Pohl
Company ID (IČO): 17256712
Address: Hrnčířská 221, Zdiměřice, 252 42 Jesenice, Czech Republic
E-mail: svj@martinpohl.cz
Phone: +420 777 441 416

The controller has not appointed a data protection officer, as Article 37 GDPR does not require it. You can contact the controller directly about any data protection matter.

2. Categories of data

  • Identification and contact data: name, surname, academic title, address, e-mail, phone.
  • Unit and ownership data: unit number, ownership share, number of occupants, association details (name, company ID, address).
  • Financial data: advance payment schedules, payments, arrears and overpayments, data for the annual statement, bank details.
  • Consumption data: readings of water, heat and shared electricity meters.
  • Communication data: content of requests sent through forms, e-mail and phone communication, comments in the portal's ticketing.
  • Voting data: participation and results of assembly and per rollam votes, timestamps.
  • Technical data: IP address, browser type, technical portal logs for security.

3. Purposes and legal bases

  • Performance of the management contract (Art. 6(1)(b) GDPR): owner records, accounting, service charge statements, repair fund, organising votes and meetings, communication with owners.
  • Legal obligations (Art. 6(1)(c) GDPR): accounting under Act No. 563/1991 Coll., archiving tax documents, obligations under the Civil Code (Act No. 89/2012 Coll.) and Act No. 67/2013 Coll. on services.
  • Legitimate interest (Art. 6(1)(f) GDPR): portal security, fraud prevention, protection of legal claims, direct marketing of similar services to existing clients.
  • Consent (Art. 6(1)(a) GDPR): commercial communication to new prospects, optional marketing cookies. Consent can be withdrawn at any time.
  • Pre-contractual steps (Art. 6(1)(b) GDPR): handling enquiries sent through the contact and call-back forms.

4. Retention

  • Contact form data: 6 months after the last communication if no contract follows.
  • Client and unit owner data: for the duration of the contract and 10 years after it ends (archiving of accounting and tax records).
  • Voting records and assembly resolutions: for the life of the association, at least 10 years (Section 1206 et seq. of the Civil Code).
  • Technical portal logs: 12 months for security.
  • Data processed on the basis of consent: until withdrawn, at most 3 years.

5. Recipients and processors

The controller may share personal data with the following recipients. Processors are bound by a data processing agreement under Article 28 GDPR.

  • Hosting of the website and the server side of the portal: Vercel Inc. The portal's server functions run in a data centre in Frankfurt (Germany); the company is based in the USA.
  • Portal database: Neon (data centre in Frankfurt, Germany).
  • Sign-in, database, uploaded photos and documents: Supabase Inc. (data centre in Ireland).
  • Sending e-mails (sign-in codes, invitations, notifications): Brevo (Sendinblue SAS), France.
  • DNS, bot protection of forms (Turnstile) and backup storage in the EU: Cloudflare, Inc.
  • Source code and the automated job that creates the nightly backup: GitHub, Inc. (Microsoft).
  • Website chatbot: Google LLC (Gemini API). It receives only the messages you type into the chatbot.
  • Cookie-free website visit statistics: Umami Software, Inc.
  • Booking consultations, if you book one: Cal.com, Inc.
  • Payment services: Stripe Payments Europe, Ltd.
  • Mobile app notification delivery: Expo (650 Industries, Inc.), Apple Inc. and Google LLC.
  • Third-party sign-in, if you choose it: Apple Inc., Google LLC and Seznam.cz, a.s.
  • Accountants, legal advisers and other professional consultants (under contract).
  • Public authorities (tax office, courts) as required by law.
  • A new manager of the association when the contract ends, only the documents and data needed to continue management.

Electronic signatures of documents are handled by our own OpenSign instance, which we run in the Czech Republic. An overview of processors and processing locations is also on the Data security page.

Transfers outside the EU/EEA. Databases, uploaded files and backups are stored in EU data centres, and the portal's server functions also run in the EU. Some processors (Vercel, Cloudflare, GitHub, Google, Umami, Cal.com, Expo, Apple) are based in the USA or use sub-processors outside the EU, so using them may involve transferring personal data to the USA or other third countries. Such transfers are governed by these providers' data processing terms and rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, or on the Commission's standard contractual clauses.

6. Your rights

  • Right of access (Art. 15 GDPR).
  • Right to rectification (Art. 16 GDPR).
  • Right to erasure in the cases set out in Art. 17 GDPR.
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR).
  • Right to object to processing based on legitimate interest or for direct marketing (Art. 21 GDPR).
  • Right to withdraw consent at any time (Art. 7(3) GDPR).
  • Right to lodge a complaint with the supervisory authority, the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

You can exercise your rights in writing at the controller's address or by e-mail to svj@martinpohl.cz. The controller replies within 30 days of receiving the request and may ask for additional information to verify your identity.

7. Cookies and analytics

The website uses only strictly necessary cookies for basic functionality (portal sign-in, form security). These cookies do not require consent under Section 89 of Act No. 127/2005 Coll. on electronic communications. The website does not set third-party analytics or marketing cookies without consent.

We measure visits on every page of the website and portal with Umami. Umami uses no cookies, stores nothing on your device and collects no personal data. It works only with aggregate figures, such as how many people visited a page, from which country and on what type of device, and does not track you across websites.

8. ProfiSprávceSVJ mobile app

The iOS and Android app is the mobile version of the client portal and works with the same data as the web portal. In addition:

  • Sign-in. You can sign in with e-mail and password, a code sent by e-mail, a passkey, or a Google, Seznam or Apple account. With Google, Seznam or Apple we receive your e-mail address, and from Apple also your name if Apple shares it. With Apple's "Hide My Email" we receive only a relay address from Apple.
  • Photos and documents. The app uses the camera and photo library only when you attach a photo to a request, and the file picker only when you upload a signed document. Photos and documents are stored with Supabase together with the request or document and are visible to those who can see your association's requests in the portal (manager, committee and members of the building).
  • Notifications. If you turn on notifications in Settings, we store a device identifier for notification delivery (push token). Notifications are delivered by Expo and the Apple Push Notification service, or Google. You can turn them off at any time in the app or phone settings.
  • Face ID and fingerprint. The biometric lock is evaluated only on your device. We never receive biometric data.
  • Data on the device. For offline use the app stores recently loaded lists and unsent requests on the device. A phone number for SMS backup, if you enter one, stays only on the device.
  • Analytics and advertising. The mobile app uses no analytics or advertising tools, does not track you across apps and websites, and we do not sell data.
  • Account deletion. You can delete your account in the app under Settings, Delete account. This deletes the sign-in account and stored notification identifiers and revokes Sign in with Apple. Your name and contact on the association member record are anonymised. Data we must keep by law as the association's manager (for example accounting records and voting records) remains for the period stated in section 4. You can also request deletion by e-mail to svj@martinpohl.cz.

9. Security

The controller has put in place appropriate technical and organisational measures: encrypted transport (HTTPS, enforced with HSTS), encryption at rest by the database and storage providers, separation of each association's data and role-based access control (checked on the server and by per-row rules in the database), passwords stored only as a hash, limited validity of one-time codes and links, bot protection of forms, and encrypted nightly backups stored separately from the production database. Sent sign-in e-mails and invitations are logged for security.

Details on where we store data, how we back it up and what we do in an outage are on the Data security page.

10. Automated decision-making

The controller does not carry out automated individual decision-making or profiling within the meaning of Article 22 GDPR.

11. Changes to this policy

The controller may update this policy to reflect the law and the scope of services. The current version, with its date, is always available on this page.

If you have any questions about data protection, contact us at svj@martinpohl.cz.

Back to home