Privacy Policy
Last updated: 11 October 2026
This translation is provided for information only. The Czech version is the legally binding one. Czech version
Contents
Your rights under the GDPR at a glance
Right of access
Right to rectification
Right to erasure
Right to data portability
1. Data controller
1.1. The controller of your personal data is Anastasia Dremkova, IČO (Czech business identification number): 17411408, with registered office at Korunní 2569/108f, Vinohrady, 101 00 Praha 10, a self-employed natural person (sole trader) operating under the Czech Trade Licensing Act (živnostenský zákon) and registered in the Trade Register (the “Controller”, “we” or “us”).
1.2. Controller’s contact details:
- Email: info@hledamuklid.cz
- Phone: +420 732 550 990
- Address: Korunní 2569/108f, Vinohrady, 101 00 Praha 10
1.3. The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation, the “GDPR”) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
2. Purposes of processing personal data
2.1. We process your personal data for the following purposes:
A) Providing the platform’s services
- Creating and managing your user account
- Connecting clients with cleaning service providers
- Delivering messages and requests between clients and providers
- Publishing the text of a request (type of cleaning, location, date, description) in the Requests section and sending it by email or SMS to providers nearby — anonymously, without the client’s name or contact details
- Sharing contact details: when a provider (a cleaner or a company) accepts a client’s request or direct offer, we pass the client’s name, phone number and email to that provider, and the provider’s name and phone number to the client (performance of a contract — the client asks for this by sending the request or offer). Only the provider who accepted the job receives the contact; if they return it, the next provider in the queue receives it
- Profile statistics for providers (number of views and contacts)
- Handling reports of inappropriate content and protecting user safety
- Communication between platform users
- Displaying profiles and reviews
B) Payments
- A hold (pre-authorisation) of CZK 39 on the client’s card via Stripe when a request or direct offer is sent; capture of the amount once it is accepted, release of the hold if nobody accepts the job or the client withdraws it
- Providers’ purchases of credits (one-off payment via Stripe) and records of their use and refunds
- Managing providers’ subscriptions (TOP profile, Partner) via Stripe and, where applicable, RevenueCat
- Payment records and accounting documents
- The platform does not process payments for cleaning — these are made directly between the client and the provider
C) Communication and support
- Answering your questions and requests
- Sending important service notices
- Handling complaints and disputes
D) Marketing (only with your consent)
- Sending newsletters and marketing communications
- Personalised offers and recommendations
- Satisfaction surveys
E) Security and legal obligations
- Preventing fraud and misuse of the platform
- Complying with legal obligations
- Protecting the rights and legitimate interests of the Controller
3. Legal basis for processing
3.1. We process your personal data on the following legal bases under Article 6(1) GDPR:
| Purpose of processing | Legal basis |
|---|---|
| Providing services, account management | Performance of a contract (Art. 6(1)(b) GDPR) |
| Accounting, tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Fraud prevention, security | Legitimate interest (Art. 6(1)(f) GDPR) |
| Marketing, newsletter | Consent (Art. 6(1)(a) GDPR) |
3.2. You may withdraw your consent to the processing of personal data for marketing purposes at any time, without affecting the lawfulness of processing carried out before the withdrawal.
4. Categories of personal data processed
4.1. We process the following categories of personal data:
Identification data
First name, surname, date of birth (for service providers), IČO (for self-employed persons), profile photo
Contact data
Email address, phone number, home/business address, billing address
Login data
Email as username, password (encrypted), login records
Payment data
Holds and payments for sharing contact details (amount, status, date), purchases and use of credits, type and validity of providers’ subscriptions, payment history (card details are processed by Stripe, not by us), older bookings paid through the platform
Activity data
Ratings and reviews, communication with other users, service history
Technical data
IP address, browser type, operating system, cookies, device data
We do not collect identity documents
Since 7 October 2026 we no longer ask cleaning providers for a copy of their ID card or passport. We award the “Verified in person” badge after a short video call or a personal meeting during which we do not photograph or store anything — we only record that the verification took place. Copies of documents uploaded earlier have been deleted or will be deleted no later than 31 October 2026.
4.2. We do not process special categories of personal data (sensitive data) within the meaning of Article 9 GDPR and we do not carry out any biometric or automated recognition.
5. Recipients of personal data
5.1. We may share your personal data with the following categories of recipients:
| Recipient | Purpose | Country |
|---|---|---|
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payment gateway — holds and payments for sharing contact details, providers’ credits and subscriptions (card details are processed only by Stripe) | Ireland / USA (EU–US Data Privacy Framework) |
| RevenueCat, Inc. | Records of payments and subscriptions and summary account overviews (email, name, role, language, city, numbers of requests, offers and credits; no card details) | USA (standard contractual clauses) |
| INTERNET CZ, a.s. | Hosting of the application, database, uploaded files and encrypted backups (the Platform’s servers) | Czech Republic |
| Supabase, Inc. | Former database hosting; since 6 October 2026 only password verification at the first login after the migration to the new system. The copy of the data will be deleted no later than 31 December 2026. | EU (Frankfurt) |
| Resend, Inc. | Sending emails (account verification, notifications about messages and requests, password reset) | EU / USA (SCC) |
| Twilio Inc. | Phone number verification by SMS code, SMS notifications to providers | USA (EU–US Data Privacy Framework) |
| Cloudflare, Inc. | Protecting registration and forms against bots (Turnstile) | USA (EU–US Data Privacy Framework) |
| Seznam.cz, a.s. | Address and city suggestions (Mapy.cz) | Czech Republic |
| Microsoft Corporation, Meta Platforms Ireland Ltd. | Traffic measurement (Clarity) and advertising (Meta Pixel) — only with your cookie consent | EU / USA (EU–US Data Privacy Framework) |
| Telegram Messenger Inc. | Internal notifications for the platform administrator (new registrations, reports) | UK / UAE (SCC) |
| Google LLC | Analytics (anonymised) | USA (SCC) |
| Other users | Display of profiles and reviews; anonymous request text; the client’s name, phone number and email to the provider who accepted their request or offer, and the provider’s phone number to that client | Czech Republic |
5.2. When transferring data to third countries outside the EU/EEA, we ensure an adequate level of protection through standard contractual clauses (SCC) or other approved mechanisms.
5.3. We never sell your personal data to third parties.
6. Data retention period
6.1. We keep personal data only for as long as necessary to fulfil the purposes of processing:
| Type of data | Retention period |
|---|---|
| Active account data | For the life of the account + 3 years |
| Accounting and tax documents | 10 years (legal obligation) |
| Ratings and reviews | For as long as the profile exists |
| Marketing consents | Until consent is withdrawn |
| Communication (support) | 3 years from the last contact |
| Cookies and analytics | Max. 13 months |
6.2. Once the retention period expires, the data are securely deleted or anonymised.
7. Your rights as a data subject
7.1. Under the GDPR you have the following rights:
Right of access (Art. 15 GDPR)
You have the right to obtain confirmation as to whether we process your personal data and, if so, to access the data and information about the processing.
Right to rectification (Art. 16 GDPR)
You have the right to have inaccurate personal data corrected and incomplete data completed.
Right to erasure (Art. 17 GDPR)
Under certain conditions you have the right to have your personal data erased (the “right to be forgotten”).
Right to restriction of processing (Art. 18 GDPR)
You have the right to request restriction of the processing of your personal data.
Right to data portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used format (JSON/CSV).
Right to object (Art. 21 GDPR)
You have the right to object to processing based on legitimate interest or carried out for direct marketing purposes.
7.2. You can exercise your rights:
- By email to: info@hledamuklid.cz
- Through the contact form
- In your account settings
7.3. We will respond to your request without undue delay and within 30 days at the latest. In complex cases this period may be extended by a further 2 months.
7.4. Right to lodge a complaint: If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority:
Úřad pro ochranu osobních údajů (ÚOOÚ – the Office for Personal Data Protection, the Czech data protection supervisory authority)
Pplk. Sochora 27, 170 00 Praha 7
www.uoou.cz | posta@uoou.cz
9. Security of personal data
9.1. We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction:
- Encryption: All communication is encrypted using TLS/SSL (HTTPS)
- Passwords: Passwords are stored in hashed form (bcrypt)
- Access: Only authorised persons have access to the data
- Payments: Payment data (card holds, credits, subscriptions) are processed by the certified provider Stripe (PCI DSS Level 1)
- Backups: The database and uploaded files are backed up every night; the copy kept outside the main server is encrypted (AES-256). Backups are kept for 14 days.
- Backup policy: Regular encrypted backups
- Monitoring: Ongoing monitoring of security incidents
9.2. In the event of a security incident posing a risk to your rights and freedoms, we will inform you in accordance with Article 34 GDPR.
10. Changes to this Privacy Policy
10.1. We may update this policy from time to time. We will inform you of material changes by email or by a notice on the platform.
10.2. We recommend reviewing this policy regularly. The date of the last update is shown at the top of the document.
10.3. By continuing to use the platform after a change to the policy, you agree to the updated version.
Legislation
This Privacy Policy has been prepared in accordance with:
- Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR)
- Czech Act No. 110/2019 Coll., on the Processing of Personal Data
- Czech Act No. 480/2004 Coll., on Certain Information Society Services
- Czech Act No. 127/2005 Coll., on Electronic Communications