Privacy Policy (GDPR)

How Rezervato processes personal data, what rights you have, and who to contact.

Last updated: July 3, 2026

Summary – the essentials

• We operate a booking system for restaurants. We process data about our customers (the restaurants that subscribe to Rezervato) and, on their behalf, data about the guests who book a table through the system.
• We never sell your data to third parties.
• Payments are processed exclusively by Stripe – we never see or store your card numbers.
• You have the right to access your data, correct it, have it deleted, restrict its processing, receive it in a portable format, and object to its processing.
• If you are a guest of a restaurant that uses Rezervato, you should exercise your rights primarily with that restaurant – see the “I’m a guest of a restaurant” section below.

1. Who is the controller of your personal data

The controller of personal data is:

Roman Khapenkov
sole trader operating under the Trade Licensing Act (Czech Republic)
Company ID (IČO): 06261035
Registered address: Poznaňská 434/35, Bohnice, 181 00 Prague 8
Registered in the Trade Register.
Contact email for questions about personal data: info@rezervato.cz

Rezervato has not appointed a Data Protection Officer (DPO), as this is not a legal requirement given the scope and nature of our processing. For any questions about personal data, including exercising your rights, please contact the email address above.

2. What personal data we process and why

We distinguish our processing based on the capacity in which you interact with Rezervato.

2.1 You’re a customer – you run a restaurant and have an account with us

2.2 You’re a guest – you’re booking a table at a restaurant that uses Rezervato

We process the name, phone number, email, and any booking note (e.g. allergies, party size) you provide when booking on behalf of, and under the instructions of, that restaurant, in order to accept, confirm, and remind you of your booking. In this relationship, the restaurant is the controller of your data and Rezervato is the processor – see the “I’m a guest of a restaurant” section below for more.

2.3 You’re a visitor to the rezervato.cz website

When you visit our website, we process technical data (IP address, browser type, pages visited) via cookies and similar technologies, including Google tools (Google Ads, Google Analytics) and Meta (Meta Pixel), for traffic measurement, advertising, and remarketing. See the “Cookies” section below for details.

2.4 You’re a contact in our business database (email marketing)

If you’re a HoReCa business whose contact details (typically a work email) we hold in our database for the purpose of reaching out with the Rezervato offer, we process this data based on legitimate interest (direct marketing between businesses, Art. 6(1)(f) and Section 7(3) of the Act on Certain Information Society Services). You can unsubscribe from such communications at any time via the link in the email or by messaging info@rezervato.cz.

3. I’m a guest of a restaurant – where do I exercise my rights?

If you booked a table at a specific restaurant through Rezervato, your personal data (name, contact details, booking note) is processed on behalf of that restaurant, which is the controller of that data. Rezervato only processes this data for the restaurant on a purely technical basis, under a data processing agreement (Art. 28 GDPR).

You should therefore exercise your rights (access, correction, deletion, etc.) primarily with the restaurant where you made the booking – as the data controller, it is obliged to handle your request. If you can’t contact the restaurant, or you’re not sure which restaurant to contact, write to us at info@rezervato.cz and we’ll help point you in the right direction.

4. Who we share personal data with

To operate Rezervato, we use the following processors / service providers, with whom we have data processing agreements in place under Art. 28 GDPR:

• Stripe – processing of payment transactions (Stripe never passes card numbers on to us)
• Active24 – server and database hosting
• Our own SMTP server – sending booking confirmation and reminder emails (not routed through any external email marketing platform)
• Google (Google Ads, Google Analytics) – website traffic measurement and ad remarketing
• Meta (Meta Pixel) – measuring the effectiveness of Facebook and Instagram advertising, and remarketing

Some of these providers may process data outside the European Union (typically in the US). In such cases, the transfer is safeguarded by Standard Contractual Clauses approved by the European Commission, or another appropriate mechanism under Art. 46 GDPR.

We do not sell or share your personal data with third parties for their own marketing purposes.

5. How long we keep your data

• Customer account data – for the duration of the contractual relationship, plus 3 years after it ends, to handle any complaints and for statute-of-limitations purposes.
• Accounting and billing records – for the period required by law (in the Czech Republic, typically 10 years under the Accounting Act and the VAT Act).
• Guest booking data – for the period set by the restaurant as data controller, typically 12 months from the booking date unless the restaurant decides otherwise.
• Marketing contacts (newsletter, business outreach) – until consent is withdrawn or an objection is raised, but no longer than 3 years from the last contact.
• Cookies and analytics data – as set by each individual tool, see the Cookies section.

These retention periods reflect our current practice; if they change in the future, we’ll update this page.

6. Your rights

With respect to your personal data, you have the right to:

• Access – find out what data we hold about you and obtain a copy of it.
• Correction – request correction of inaccurate or incomplete data.
• Erasure (the “right to be forgotten”) – request deletion of your data where we have no other legal ground to keep processing it.
• Restriction of processing – request that we temporarily stop processing your data.
• Portability – receive your data in a structured, machine-readable format.
• Object – in particular to processing based on legitimate interest, or to direct marketing.
• Withdraw consent – at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Lodge a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection (ÚOOÚ). If you’re in Slovakia, you can also lodge a complaint with the Slovak Office for Personal Data Protection.

You can exercise your rights by emailing info@rezervato.cz. We will respond to your request within 30 days at the latest.

7. How we keep your data secure

Data transferred between your browser and our servers is encrypted (HTTPS/TLS). Only authorized employees/collaborators have access to data within the application, and only to the extent necessary for their tasks. We never store payment data on our own servers – its processing is handled entirely by the Stripe payment gateway, which is PCI DSS certified. We regularly review the application’s security through security testing.

8. Cookies and similar technologies

The rezervato.cz website uses cookies to ensure the site functions properly, to measure traffic, and to show relevant advertising. Specifically, we use:

• Necessary cookies – required for the website’s basic functioning; these cannot be disabled.
• Analytics cookies (Google Analytics) – help us understand how you use the site so we can improve it.
• Advertising cookies (Google Ads, Meta Pixel) – used to measure the effectiveness of advertising campaigns on Google, Facebook, and Instagram, and for remarketing (re-engaging people who have already visited the site).

We only use cookies that aren’t strictly necessary with your consent. We’re currently preparing a cookie banner on the website where you’ll be able to grant or withdraw consent for analytics and advertising cookies (Google Analytics, Meta Pixel) at any time. Until it launches, you can also manage cookie settings directly in your browser.

9. Changes to this policy

We may update this policy from time to time, for example in connection with legislative changes or the expansion of Rezervato’s services. We will inform you of any significant changes on the website or by email. The current version is always available on this page.