Privacy and cookies policy

01 · ControllerWho processes your data

The controller of personal data is CIB GROUP, a.s., Company ID 272 11 185, with its registered office at Vodičkova 709/33, 110 00 Prague 1, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, File No. 9748.

Contact for questions about personal data protection: info@cib.cz, telephone +420 296 249 311, or in writing to the registered office address.

This policy describes how we process personal data in connection with this website and the communication arising from it. The processing of personal data of the tenants of our apartments is described in the separate section GDPR: notice to tenants. Processing under other contracts is governed by the relevant contract and by the information you receive when it is concluded.

02 · Data and purposesWhat data we process and why

Contact form, email and telephone

• Data: name and surname, email, telephone (optional), the selected topic and the text of the message, and any other data you choose to provide in your message.
• Purpose: handling your enquiry and the subsequent communication, for example an offer of premises for lease, apartment management or cooperation.
• Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); in other cases, our legitimate interest in responding to the enquiry (Article 6(1)(f) GDPR).
• How a message travels: a message sent via the form is stored in the website's secure database in a data centre in the EU and, at the same time, is sent by email to the CIB GROUP staff whom the enquiry concerns. It can be read only by authorised staff in the website administration.
• Retention in the website database: 12 months from submission, after which the message is automatically deleted.
• Retention in email and further communication: for the time needed to handle the enquiry and the subsequent communication. If no contractual relationship arises from it, we will erase the data no later than 1 year after the last communication. If a contractual relationship arises, retention is governed by the contract and by statutory periods (for example accounting and tax periods).
• Spam protection: we keep the IP address and time of submission for no longer than 24 hours, solely to prevent the bulk sending of messages. This protection does not use cookies or third party tools.

Providing your data is voluntary. Without contact details, however, we cannot reply to you.

Visiting the website

On every visit, the hosting provider processes technical data about the request (IP address, time, requested page, browser type) in server logs. This processing serves to ensure the operation and security of the website and is based on our legitimate interest (Article 6(1)(f) GDPR).

The website does not measure traffic, does not use analytics or advertising tools and does not profile anyone. No automated decision making takes place.

03 · RecipientsWho we share data with

We do not sell personal data or pass it on to anyone for marketing purposes. Only the following have access to it:

• CIB GROUP companies that your enquiry concerns (for example a specific project or apartment management),
• providers of website hosting and email services,
• the supplier who technically manages and operates the website for us (hosting and database),
• public authorities, where required by law.

Processors act only on our instructions and are bound by confidentiality.

Transfers outside the EU

The website runs on the GitHub Pages service of GitHub, Inc. (USA), and the website administration server runs on a service of Cloudflare, Inc. (USA). Both companies are certified under the EU-US Data Privacy Framework. The transfer of technical request data (IP addresses) therefore takes place on the basis of the European Commission's adequacy decision (Article 45 GDPR). If data were processed outside the EU by another provider, this would take place only under the conditions of Chapter V GDPR. The database containing messages from the contact form is stored in a data centre in the EU.

04 · CookiesCookies and storage on your device

This website does not use any cookies and does not store any information on your device (not even via localStorage or sessionStorage). We do not use analytics, advertising or tracking tools. That is why we do not ask for your consent to cookies: under Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications, consent is required only for storage that is not necessary for the operation of the website.

When a page loads, the website uses several technical services. They receive only the IP address and the data needed to deliver the file. They do not set cookies or write anything to the browser.

On pages with an interactive map (Properties, About Us), additionally:

Links to Google Maps, social networks and the websites of our projects open only after you click them. The policies of their operators then apply on their pages.

The recording of the charity concert on the About Us page loads from youtube-nocookie.com (YouTube, Google) only after you click the video preview. Until then our website does not communicate with YouTube and the preview image is stored on our own website. Once the video starts, Google's policies apply.

If in the future we wish to use cookies that are not strictly necessary (for example for traffic measurement), we will ask for your consent in advance. Refusing will be as easy as consenting, and you will be able to withdraw your consent at any time.

05 · AdministrationWebsite administration

The website content is edited by authorised administrators in a secure administration area. They log in with a username, a password and a one time code from an authenticator app (two factor authentication). An administrator's session is stored only in their browser's session storage (sessionStorage) and ends when the window is closed. The administration does not use cookies. This does not apply to website visitors.

For security reasons, we record the administrator's name, time, IP address, country and browser type for logins and changes in the administration. The legal basis is our legitimate interest in protecting the website (Article 6(1)(f) GDPR). We keep the last 100 records; older ones are deleted on a rolling basis.

06 · Apartment tenantsGDPR: notice to tenants

As landlords of apartments, our companies have a statutory right and obligation to process certain personal data of persons living in our apartments. It is therefore not strictly necessary to obtain the consent of individual persons to the processing of their data. Personal data are used for the proper management of apartment buildings, for billing the costs of services connected with the use of the apartment and for recovering debts owed by tenants.

For the duration of the tenancy

• Name and surname, address, date of birth or, where applicable, birth number of the tenant (contracting party), SIPO connection number or the number of the account the tenant uses to pay rent, contact details.
• Name and surname, address, date of birth or, where applicable, birth number of persons living in the apartment other than the tenant, contact details.
• The relationship between the tenant and the other residents, as this information may be material to protecting the rights of the tenant and the other residents.

After the end of the tenancy (i.e. after the apartment has been handed over)

• Name and surname, address and date of birth or, where applicable, birth number of the former tenant and, in the case of a joint tenancy (spouses or, where applicable, registered partners), of both joint tenants.
• Data on the number of persons residing in the apartment during the tenancy (for the purposes of billing and complaints).
• Personal data of any guarantors and joint debtors of the tenant (tenants).
• Contact details.

Personal data of former tenants are kept on record for at least 5 years, calculated from the end of the year in which the tenancy ended. Personal data of other persons and contact details are kept on record and processed until any arrears of rent and payments for services connected with the tenancy have been paid in full.

Access to the personal data processed

• Employees of CIB GROUP, a.s. (the company that manages all our apartments), according to their job roles.
• Employees of an external accounting firm and an audit firm, to the extent necessary for accounting and billing.
• Lawyers and staff of law firms in cases where a legal dispute is in progress between the tenant and us.
• Management companies in the individual locations; these have access only to the personal data of tenants in the relevant location.
• External companies carrying out heat and water meter readings, to the extent necessary for carrying out the readings and billing them.

The personal data collected, recorded and processed are not used for marketing activities or passed on to third parties for any purpose other than those listed above.

Prepared for the companies forming part of CIB GROUP (CIB Rental, s.r.o., CIB VODIČKOVA CENTRE s.r.o., CIB Property, s.r.o., Balabenka Office Building, s.r.o., and all owners' associations belonging to CIB GROUP). Updated 21 March 2022.

Download notice to tenants (PDF, in Czech)

07 · SecurityHow we protect data

The website runs exclusively over an encrypted HTTPS connection. Access to the administration is protected by a password and two factor authentication, and login attempts are limited. Only persons who need personal data to handle your request have access to it.

08 · Your rightsWhat rights you have

• the right of access to your personal data (Article 15 GDPR),
• the right to rectification of inaccurate data (Article 16),
• the right to erasure (Article 17),
• the right to restriction of processing (Article 18),
• the right to data portability (Article 20),
• the right to object to processing based on legitimate interest (Article 21).

You can exercise your rights by email at info@cib.cz or by letter to the registered office address. We will respond without undue delay and within one month at the latest.

If you believe that we are not handling your data properly, you can lodge a complaint with the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

09 · Effective dateChanges to this policy

We may update this policy, for example when the website gains a new feature. You will always find the current version on this page.

Effective from 20 October 2026