PRIVACY POLICY
Data Controller in respect of User (Hotel) data processing:
Wootera Digital Technologies, s.r.o., Company ID: 19160526, registered office: Oldřichova 255/20, Nusle, 128 00 Prague 2
Contact: cleanqr@wootera.com
Data Processor for hotel guest personal data (acting as processor for Hotels as controllers): see DPA (Annex No. 1 to GTC).
2.1 Who does this Policy apply to?
This Policy applies to:
- Users (Hotels) — legal or natural persons using the CleanQR service.
- Hotel Staff — employees and associates of the hotel whose data is entered into the system.
- Hotel Guests — cleanQR does not require guests to register or identify themselves. When they use the form, the service processes technical data and content they submit (see Section 2.2 C).
2.2 What data do we process and why?
A) Users — account registration and operation
| Category of Data | Legal Basis (GDPR Art. 6) | Purpose | Retention Period |
|---|---|---|---|
| Business identification (name, company ID, address) | Art. 6(1)(b) — performance of contract | Conclusion and performance of the agreement | Duration of agreement + 3 years |
| User contact email | Art. 6(1)(b) — performance of contract | Communication, sending Service notifications | Duration of agreement + 3 years |
| Billing details (where applicable for the paid version) | Art. 6(1)(c) — legal obligation | Tax and accounting obligations | 10 years pursuant to accounting legislation |
B) Hotel staff (employees entered into the system)
| Category of Data | Legal Basis | Purpose | Retention Period |
|---|---|---|---|
| Name / display name | Art. 6(1)(f) — legitimate interest (system operation) | User identification in the system | Duration of agreement, then deleted within 30 days |
| Email address | Art. 6(1)(f) — legitimate interest | Login, system notifications | Duration of agreement, then deleted within 30 days |
| Identification of the user who created or last modified a record | Art. 6(1)(f) — legitimate interest | Record attribution and administration | For the lifetime of the record |
C) Hotel guests (persons scanning the QR code)
Guests do not register or identify themselves; the only direct association within cleanQR is the room number. The following data is processed when a guest uses the form:
| Data | When | Purpose | Retention |
|---|---|---|---|
| IP address | With every cleaning choice and issue report | Protection against misuse and spam; limiting the number of reports | Up to 90 days, after which it is automatically deleted |
| Hash of the device identifier | With a cleaning choice | Ties the choice to the device that submitted it | For the duration of the agreement with the Hotel |
| Cleaning choice, day, time, and number of changes | With a cleaning choice | Operation of the Service | For the duration of the agreement with the Hotel |
| Issue category, report text entered by the guest, form language, and time | With an issue report | Delivery to the front desk; the text is emailed to Hotel staff | For the duration of the agreement with the Hotel |
The Hotel may associate the room number and report text with its accommodation records. For that content, the Hotel is the controller and cleanQR acts as its processor. IP addresses are retained for no longer than 90 days and are then automatically deleted. The device identifier hash and other record data are retained for the duration of the agreement with the Hotel.
2.3 Who do we share data with?
We do not sell your personal information. We do not share personal data with third parties for their own commercial purposes, advertising, or targeted advertising.
Data may be shared only with these providers where necessary for the stated purpose:
| Provider | Use | Data received |
|---|---|---|
| Cloudflare, Inc. | Website and server hosting, delivery, and security | Network and request data, including IP address, user agent, and requested URL |
| Database infrastructure provider | Storage of Service data | Account, operational, guest-action, and issue-report data described in this Policy |
| Twilio SendGrid | Sending email | User email for password reset and welcome messages; Hotel staff addresses, room number, category, and report text for issue notifications |
| Stripe Payments Europe | Payments and subscriptions | Billing and payment data entered by the User in Stripe Checkout or the customer portal |
| Google Ireland Limited | GA4 on the public website after consent; reCAPTCHA in administration | IP address, browser/device data, website use, and interactions on sign-in-related pages |
| Sentry | Server error reporting | Error and request diagnostics that may include IP address, user agent, and request URL |
Data may also be disclosed to public authorities where required by law. We do not sell personal information or share it for third-party advertising.
2.4 Security
Data transmission is protected by the encrypted HTTPS (TLS) protocol. Access to data is restricted to authorised persons. The Provider implements reasonable technical and organisational measures pursuant to Article 32 GDPR.
Note: The Provider is not liable for a data breach caused by a cyber attack or third-party infrastructure failure (hosting), provided the above-mentioned reasonable measures have been implemented.
2.5 Your Rights (Data Subject Rights)
As a data subject, you have the following rights under the GDPR:
| Right | What it means |
|---|---|
| Right of access (Art. 15) | Obtain confirmation of whether we process your data and a copy of that data. |
| Right to rectification (Art. 16) | Request correction of inaccurate or incomplete data. |
| Right to erasure (Art. 17) | Request deletion of data where the grounds for processing no longer exist. |
| Right to restriction of processing (Art. 18) | Request temporary restriction of processing in cases provided for by law. |
| Right to data portability (Art. 20) | Receive your data in a structured, machine-readable format. |
| Right to object (Art. 21) | Object to processing based on legitimate interest. |
| Right to withdraw consent | Where processing is based on consent, consent may be withdrawn at any time. |
Requests should be submitted to: cleanqr@wootera.com. We will respond without undue delay, ordinarily within 30 days.
2.6 Right to Lodge a Complaint with the Supervisory Authority
You have the right to lodge a complaint with the Office for Personal Data Protection (ÚOOÚ):
Office for Personal Data Protection
Pplk. Sochora 27, 170 00 Prague 7
www.uoou.cz | data mailbox: qkbaa2n
2.7 Changes to this Policy
Users will be notified of material changes to the Privacy Policy by email or through the Service interface.
This Privacy Policy takes effect on 1 April 2026.