Privacy
Mestanova.cz is a city guide: a map, places, offers and events. This page explains what personal data we process along the way, why, for how long, and what your rights are.
Who processes your data
The controller of your personal data is Mestanova group, registered at Zlin, Czech Republic. For anything about your data, write to [email protected] or use the Contact us form and choose Privacy.
What we process and why
Visiting the site
When you open the site, our server and the Cloudflare network that delivers it process your IP address, browser type, the page address and the time. The site cannot work or be protected from attacks without this; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days, the application's error logs after 8 weeks.
Taps on the home page buttons are counted only as daily totals, with nothing that links them to you. Advertising is counted the same way: how many pages carried a campaign, how often its billboard came into view in the 3D city and how many people clicked it. So that each person counts once a day, their IP address is kept with the abuse counts (see Security) for at most 2 days.
Google Analytics, only with your consent
If you choose Accept in the cookie bar, we load Google Analytics 4. Google then uses cookies to measure which pages people visit and how they use the site, and sees your IP address and device details while doing so. The legal basis is your consent (Art. 6(1)(a) GDPR and section 89(3) of the Czech Electronic Communications Act). Without consent Google Analytics is not loaded at all. You can withdraw consent at any time with the Cookie settings link in the footer. Google Analytics keeps the data for at most 14 months. The site's administrators are never counted.
Your account
To sign up you give your email address, name and a password; we never store the password, only a one-way fingerprint of it (a hash). Your account also holds your place ratings, saved places, chosen language and the time you last signed in. We process this to provide the account (performance of a contract, Art. 6(1)(b) GDPR). Ratings appear on the site only as an average, never with your name. You can delete your account and everything in it at any time on the My account page.
Managing a business
When you ask to manage a place, you give your role in the business, optionally a phone number, a description we can check you against, and you may attach a document. We need this so a place is handed only to its real owner (performance of a contract and our legitimate interest in protecting businesses from misuse). The attached document is deleted as soon as we decide on the claim. The rest of the claim stays with your account until you delete it. Texts, photos and offers you publish as a manager are public until you remove them.
When you book a campaign, we keep its details (the package, its days, the line of text or the poster, the price and your note) to run it and invoice it (performance of a contract). They stay with the place; if you delete your account, the link to you and your note go.
The Contact us form
You give an email address, optionally your name, and a message; with them we record the IP address you send it from (see Security). We use them only to handle and answer it (legitimate interest; for privacy requests, a legal obligation). Answered messages are deleted after 3 years.
Emails from us
We send only emails that belong to your account and your requests: email verification, password reset, the outcome of a request, the state of your campaigns. No newsletters, no advertising. The emails are sent through Brevo, which records their delivery, opening and link clicks.
Security
Sign-ins to the administration and changes made in it, managers' edits to their businesses, claims to manage a business, messages from the contact form and deleted accounts are written to an activity log: who, what, when and from which IP address. IP addresses in it are deleted after 12 months. To prevent abuse we count sign-in attempts, form submissions, taps on the home page, clicks on advertising and views of billboards in 3D by IP address or email; these counts are deleted within 2 days. Signing in uses a session cookie, deleted after 14 days without use.
Data about businesses and places
The places on the site come from public sources (OpenStreetMap, the Czech National Register of Healthcare Providers kept by ÚZIS, Overture Maps, photos from Wikimedia Commons) and from business owners. For sole traders and medical practices they may include a name, a business address and contact details, which are personal data. We publish them so people can find local businesses and services (legitimate interest). If they are about you and you want them corrected or removed, or you object to their publication, write to us; we will comply unless there is a compelling reason to keep them public.
Who we share data with
We do not sell data. These processors handle it for us, only on our instructions:
- Hetzner Online GmbH, Germany: the server the site runs on.
- Cloudflare, Inc.: delivering the site and protecting it from attacks.
- Brevo, France: sending emails.
- Google Ireland Limited and Google LLC: Google Analytics, only with your consent.
- A cloud storage provider: keeps the backups (see Backups).
Your browser downloads the map tiles directly from OpenFreeMap (openfreemap.org), which therefore sees your IP address.
Some processors, Google and Cloudflare among them, may also process data in the USA. Such transfers rely on the EU-U.S. Data Privacy Framework, which they have joined, and on standard contractual clauses.
Backups
Every night we back up the site's database and uploaded files to cloud storage away from our server, so nothing is lost if the server fails. Daily backups are kept for 30 days and monthly ones for 6 months. If you delete your account, your data leaves the backups within 6 months at the latest.
Cookies and browser storage
Cookies the site needs to work, or that only remember a choice you made, are used without consent. Google Analytics cookies only with it.
| Name | What it does | How long |
|---|---|---|
mestanova_session | Signing in and protecting forms | 14 days |
lang | The language you chose | 1 year |
city | The city you visited last | 1 year |
mestanova_consent | Your choice in the cookie bar | 6 months |
mestanova_no_analytics | Administrators only: keeps them out of the statistics | 1 year |
_ga, _ga_… | Google Analytics, only with consent | 2 years |
In browser storage the site remembers the light or dark look (mestanova.theme) and the choice between map and 3D (mestanova.scene-mode). They stay on your device until you clear them and are never sent anywhere.
Your rights
You can ask to see, correct, erase or take a copy of your data, to restrict its processing, and object to processing based on our legitimate interest. You can withdraw consent to Google Analytics at any time. Contact us as described above; we answer within a month. You can also complain to the Czech data protection authority (uoou.gov.cz).
We make no automated decisions and no profiling with legal effects.
Changes
When we change this notice we update the date at the top, and we announce significant changes on the site.