Privacy Policy (GDPR)

This is an informative translation. The legally binding version is the Czech one, governed by the law of the Czech Republic.

Last updated: 2026-08-11

1) Personal data controller

The personal data controller is Nolentra s.r.o., Company ID 24449237, with its registered office at Zahradní 541, 253 01 Hostivice, Czech Republic, registered with the Municipal Court in Prague, Section C, Insert 441357.
Contact: support@mapino.app, tel. +420 315 315 496

2) What data we process

Depending on how you use Mapino, we may process in particular:

identification and contact data (e-mail, name, account identifiers, profile photograph),
sign-in and security data (session cookie, CSRF token, sign-in information, security logs),
user content (listings, photographs, videos, documents, reviews, chat messages, saved filters and alerts),
listing inquiries submitted without signing in (name, e-mail, optional telephone number, message, listing identifier and a limited technical anti-abuse value); a signed-in user may submit the same inquiry,
tour requests submitted with an account or without signing in (name, e-mail, optional telephone number, listing identifier, time zone, preferred or confirmed times, video-call method and contact, and notes); for a signed-out request we also store a limited irreversible hash of the IP address for abuse prevention,
Rental Management data, if you use this service (property profile, owner, manager, tenant, tenancy relationship, handover protocol, rooms, defects, photographs, meters, keys, documents, dates, payment records, faults, comments, attachments and costs),
data for partner tenant screening, if it is requested and consent or another valid legal basis is provided for it (the tenant's identification and contact data, the request, status, consent, result or a reference to the result and the partner's technical response),
order and payment data (order identification, payment status, the scope of the ordered service, billing details where required),
content-notice and moderation data (the reporter's name and e-mail, exact URL and content identifier, explanation, a bounded snapshot of the relevant content, decisions, audit events, appeals and an evidentiary snapshot of communications),
technical and analytics data (IP address or its truncated form, device and browser data, cookies and service-usage events).

3) Where we obtain the data

We obtain data primarily from you, from the sign-in provider, from your device and from the operation of the platform. We obtain the contact details and message in a listing inquiry, and the contact details and times in a tour request, directly from the form you submit; both forms provide a link to this policy. Some data may also arise during communication with support or when reporting and moderating content.

4) Purposes and legal bases of processing

We process personal data in particular for the following purposes:

maintaining the user account, sign-in and operating the platform's basic features (performance of a contract),
displaying and managing listings, communication between users, alerts and the fulfilment of the ordered digital service (performance of a contract),
forwarding the listing inquiry you request to its seller or agent and displaying it in their account (taking steps at your request before a potential contract and legitimate interest in securely facilitating the communication). Submitting an inquiry does not constitute consent to marketing; any marketing communication requires a separate legal basis,
accepting, forwarding to the listing owner and managing a tour request submitted with an account or without signing in (taking steps at your request before a potential contract, performance of a contract for account features, and legitimate interest in securely facilitating the request, preventing abuse and evidencing delivery). Submitting a tour request does not constitute consent to marketing; any marketing communication requires a separate legal basis,
managing tenancy relationships, documents, handover protocols, dates, faults, recorded payments and related communication between owner, manager and tenant (performance of a contract and legitimate interest in providing the service),
transmitting a request for partner tenant screening and storing the result only to the extent necessary for the requested service (performance of a contract, consent or another legal basis depending on the specific situation),
customer support, complaints, handling requests and the defence of legal claims (performance of a contract and legitimate interest),
security, fraud prevention, moderation, enforcement of the terms and fulfilment of legal obligations (legitimate interest and legal obligation),
receiving notices of allegedly illegal content, issuing reasoned decisions, informing affected persons, handling internal appeals and evidencing the process under Regulation (EU) 2022/2065 (legal obligation and legitimate interest in defending legal claims),
accounting and tax records (legal obligation),
analytics and measurement of service usage only to the extent of the agreed cookie consent (consent),
marketing communication only where we have a valid legal basis for it (typically consent, or another regime permitted by law),
concierge and AI assistance, if the user uses it; we recommend not entering sensitive or special categories of personal data into the chat (performance of a contract and legitimate interest in operating support),
technical processing of photographs for virtual staging and support of review moderation, if these features are used or enabled (performance of a contract and legitimate interest in the quality and security of the service).

5) To whom data may be disclosed

We disclose data only to the necessary extent, in particular to the following categories of recipients and processors:

hosting and infrastructure providers (e.g. Google Cloud),
access protection, traffic distribution and network security providers to the extent actually used for the relevant service (e.g. Google Cloud Load Balancing and Google IAP for protected interfaces),
sign-in and identity providers (Google OAuth),
map data and geolocation service providers (MapTiler),
e-mail delivery providers (Brevo SMTP in the current production configuration; we update this notice and the processor register if the provider changes),
the seller, agent or other published contact for the listing to whom you send an inquiry or a tour request with an account or without signing in; they receive the contact, scheduling and other data you enter in the relevant form,
providers of AI processing of queries, photographs or moderation, if you use AI features or if AI moderation is enabled (e.g. OpenAI),
tenant screening partners, if you request such a service or activate it within Rental Management,
payment service providers shown in the order interface, if you make a paid order,
public authorities, where required by law.

6) Transfers outside the EU or the EEA

Some recipients may process data outside the EU or the EEA. In such cases we use appropriate legal mechanisms, in particular standard contractual clauses or other legally recognised safeguards.

7) Retention period

We retain data only for the period strictly necessary for the given purpose, in particular:

session and sign-in status: generally up to 30 days,
remember-me preference: generally up to 180 days,
cookie consent: generally up to 1 year,
chat messages: generally up to 180 days, unless longer retention is needed for handling disputes or for security,
notifications and technical operational records: generally up to 90 days, unless longer retention is needed,
direct contact details, the message and the limited technical value in a listing inquiry: we automatically anonymise them 90 days after the inquiry is submitted; we also anonymise their copy in the related notification. Only a minimal non-contact record of the listing, status, applied retention rule and timestamps may then remain for operational summaries and evidence that anonymisation occurred. If the sender's or recipient's account is deleted, we anonymise the data earlier where it is no longer necessary. Backups may contain an earlier state until the ordinary backup cycle expires; they are not returned to the active service and the retention rule is reapplied after a restore,
tour requests submitted with an account or without signing in: we automatically anonymise the contact details, account link, time zone, proposed and confirmed times, video-call details, notes and, for a signed-out request, the limited IP-address hash 90 days after the latest proposed or confirmed end of the tour. If the request has no future time, the period runs from its creation; after cancellation or rejection it ends no later than 90 days after that event. If the sender's or listing owner's account is deleted, we anonymise the related data earlier where it is no longer necessary. Only a minimal non-contact record of the listing, status, applied retention rule and timestamps may then remain for operational summaries and evidence that anonymisation occurred. The same backup and restore limitations apply as for listing inquiries,
reviews and listing content: for the period of publication and thereafter for a reasonable period necessary for backups, handling complaints, defending legal claims and fulfilling legal obligations,
DSA notices and moderation: the reporter's contact details, case file, audit events and communication evidence are retained only as long as necessary to handle the case and appeals, meet legal duties and defend legal claims. The exact schedule and legal-hold/anonymisation process are documented in the DSA notice page; indefinite retention is not intended,
Rental Management data, documents, handover protocols, faults, payment records and screening materials: for the duration of the service and thereafter for the period necessary to perform the contract, resolve disputes, protect legal claims, back up data and meet legal obligations; the specific retention rules must be approved by the operator before Rental Management goes into production,
accounting and tax documents: for the period set by legal regulations.

8) Your rights

You have the right to request access to your personal data, its rectification, erasure, restriction of processing, portability, and to object to processing, where the law allows.
If processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of the prior processing.
You may request an export of personal data in the account settings or by e-mail at support@mapino.app. We will process the request in accordance with the applicable procedure for data access and portability.
You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů). Current information is available at www.uoou.gov.cz.

9) Cookies and similar technologies

We use necessary cookies for security, sign-in and remembering your consent choice. We use optional preference, analytics and possibly marketing cookies only according to your choice and settings.
You can find details in the Cookies document.

10) Automated decision-making

We do not carry out automated decision-making that would, on its own, produce legal effects or similarly significant impacts on the user.
The output of partner tenant screening must not, on its own, decide whether a tenancy relationship is concluded; the final decision must always be made by a human.

11) Security

We use appropriate technical and organisational measures, in particular HTTPS, access control, security logging, protection against abuse and role-based access restrictions.

12) Changes to the policy

We may reasonably update this document. The current version is always published on the website with the date of the last update.