Legal documents and policies
Last Updated: January 2026
Effective Date: January 2026
Cabintale.com ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our service. We comply with the General Data Protection Regulation (GDPR), Czech Republic's Personal Data Processing Act (Act No. 110/2019), and all applicable data protection laws.
Important Distinction: As a SaaS (Software as a Service) provider, our relationship with your role in data processing differs depending on which personal data we're discussing:
This policy addresses both relationships.
This Privacy Policy applies to:
This policy applies to all users globally, with special protections for European Economic Area (EEA) residents under GDPR.
Company Name: Cabintale
Business Type: SaaS Provider - Availability Calendar & Booking Management System
Location: Brno, Czech Republic
Data Controller Contact:
Email: support@cabintale.com
Role Description: Cabintale provides a platform that enables property managers and rental businesses to manage guest availability, bookings, and reservations. Our platform processes data on behalf of our users (property managers) to deliver these services.
When you create and maintain a Cabintale account, we collect:
Essential Information:
Optional Information:
How Collected:
Legal Basis: Performance of contract (Art. 6(1)(b) GDPR) and legitimate interest in account security (Art. 6(1)(f) GDPR)
When you use Cabintale to manage guest bookings, your customers' information is processed. We collect:
Guest/Customer Data (that you provide through the platform):
Important: You (the account owner) determine what guest data you collect. We process this data only according to your instructions and for the specific purpose of facilitating your bookings and guest communications.
How Collected:
Legal Basis: Performance of contract with you (Art. 6(1)(b) GDPR) – we process guest data on your instructions to deliver the service you've contracted for
Data Processing Agreement: For all customer data processing, we maintain a Data Processing Agreement (DPA) with you under GDPR Article 28, outlining our obligations as a processor.
What We Store:
What We DO NOT Store:
How Payment Data Is Handled:
All payment processing is handled by our third-party payment providers (e.g., Stripe, PayPal). We never directly receive or store your sensitive payment information. Our payment providers are GDPR-compliant and PCI DSS certified.
Legal Basis: Performance of contract (Art. 6(1)(b) GDPR) and legal obligation to maintain financial records (Art. 6(1)(c) GDPR)
On Marketing Website (cabintale.com):
On Admin Dashboard (admin.cabintale.com):
Collection Method: Automatically via server logs and analytics tools
Legal Basis: Legitimate interest in website optimization, fraud prevention, and security (Art. 6(1)(f) GDPR)
Note: We do not use session recording, heatmaps, or behavioral tracking on the admin dashboard. No recording of user interactions occurs.
Legal Basis: Performance of contract (Art. 6(1)(b) GDPR) and legitimate interest in customer support (Art. 6(1)(f) GDPR)
We use your personal data to:
We process your customers' data exclusively for:
We DO NOT:
With your explicit consent on the marketing website, we may use aggregated, anonymized data to:
This analysis is performed on aggregated data only and cannot identify you or your guests.
We use personal data to:
Legal Basis: Legitimate interest in platform security (Art. 6(1)(f) GDPR)
We will use your email address to:
Marketing Communications: We will only send marketing emails if you have explicitly opted in. We do not send unsolicited marketing emails. You can unsubscribe from marketing communications at any time by clicking the unsubscribe link in any email.
When you collect and store customer/guest data in Cabintale, you are the Data Controller for that information. This means you are responsible for:
Our role: We act as your Data Processor. We follow your instructions and only process guest data as needed to deliver our service. We do not control how guest data is used; that decision is yours.
Recommendation: We strongly recommend reviewing your own privacy policy with guests to explain what data you collect and how you use it. Consider informing guests that their data is stored on Cabintale's platform.
We share your personal data only in the following circumstances:
1. With Your Explicit Consent
2. As Required by Law
3. With Essential Service Providers (Data Processors)
All third-party processors are contractually required to:
Your customers' data is NEVER shared with third parties except:
We do not:
While your account is active, we retain your personal data (name, email, account settings) to maintain the service. This data is necessary for your account to function.
If you delete your Cabintale account:
Exception: We may retain anonymized or aggregated data that cannot identify you for statistical purposes.
Timeline: Deletion is completed within 7 business days of your request.
Guest/customer data is retained only for as long as:
Once you delete guest data or your account is deleted, the data is permanently removed.
While we maintain regular backups for disaster recovery and data protection:
We implement comprehensive technical and organizational security measures to protect your personal data:
While we implement strong security measures, no system is completely secure. We cannot guarantee absolute protection against:
By using Cabintale, you acknowledge that data security involves inherent risks.
As an individual whose data we process, you have the following rights under GDPR and Czech data protection law:
You have the right to request a copy of the personal data we hold about you, including:
How to request: Email support@cabintale.com with the subject "Data Access Request"
Response time: Within 30 days
You have the right to correct inaccurate or incomplete personal data. You can:
Response time: Changes are made immediately for self-service updates; up to 30 days for requests requiring verification
You have the right to request deletion of your personal data, except where:
How to request: Email support@cabintale.com with the subject "Data Deletion Request"
Account deletion: You can delete your entire account and associated data through your account settings or by contacting support.
Response time: Within 30 days; deletion is completed within 7 business days of approval
You can request that we limit how we use your personal data while:
How to request: Email support@cabintale.com with the subject "Request to Restrict Processing"
Response time: Within 30 days
You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV) and to transmit it to another service provider without hindrance.
Available data:
How to request: Email support@cabintale.com with the subject "Data Portability Request"
Format: Data will be provided as a CSV file
Response time: Within 30 days
You have the right to object to processing based on legitimate interest or statistical purposes.
How to request: Email support@cabintale.com with the subject "Objection to Processing"
Response time: We will stop processing within 30 days unless we have a compelling legal reason to continue
For any processing based on consent (e.g., marketing emails, analytics), you can withdraw consent at any time:
Impact: Withdrawal applies only to future processing; past processing remains lawful.
We do not use your personal data for automated decision-making or profiling that produces significant effects on you (e.g., credit decisions, eligibility decisions).
Cabintale's infrastructure and data are processed in the European Economic Area (EEA), specifically in Czech Republic or other EEA locations. Personal data is not transferred outside the EEA except where:
If we do transfer data outside the EEA, we ensure appropriate safeguards are in place:
You will be notified if such transfers occur.
Cabintale is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, you may only use Cabintale with parental/guardian consent.
If we discover we have collected data from a child under 16 without verifiable parental consent, we will delete that data immediately.
In the event of a data breach that poses a risk to your rights and freedoms:
You will be notified via email using the address associated with your account.
We may update this Privacy Policy occasionally to reflect:
Notification: We will notify you of material changes by:
Effective date: Changes become effective 30 days after notification, unless you disagree. Your continued use of Cabintale after the effective date constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy, our privacy practices, or want to exercise any of your data protection rights, please contact:
Data Protection Contact:
Email: support@cabintale.com
Address: Brno, Czech Republic
Response time: We aim to respond to all inquiries within 5-7 business days.
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority (Office for Personal Data Protection – UOOU in Czech Republic, or your relevant supervisory authority).
Last Updated: January 2026
This document outlines GDPR-specific terms for Cabintale's processing of personal data. These terms complement our Privacy Policy and apply to all users.
For your account data (your name, email, etc.):
For your customers' data (guest/end-user information you collect):
As a processor, we process your customer data exclusively according to the following instructions:
You remain responsible for: Determining the lawful basis for collecting guest data, obtaining guest consent where required, and maintaining compliance with GDPR in your own privacy notices.
By using Cabintale, you accept that our standard Data Processing Agreement applies to the processing of your customer data. The DPA incorporates the following GDPR Article 28 required terms:
1. Subject Matter, Duration, Nature, and Purpose of Processing
2. Types of Personal Data and Categories of Data Subjects
3. Obligations and Rights of the Controller (You)
You, as the Data Controller, must:
4. Security Measures (Processor's Responsibility)
We, as the Data Processor, implement and maintain:
These measures are appropriate to the risk level posed by processing personal data in our service.
5. Sub-Processors
We may engage the following sub-processors to assist in providing the service:
Notification: We will notify you 30 days in advance before engaging new sub-processors. You have the right to object to new sub-processors, in which case we will either:
All sub-processors are contractually required to meet the same data protection standards as Cabintale.
6. International Data Transfers
All personal data is stored and processed within the European Economic Area (EEA). We do not transfer personal data outside the EEA without your explicit written authorization and appropriate safeguards (Standard Contractual Clauses, Binding Corporate Rules, or adequacy decisions).
7. Data Subject Rights – Processor Assistance
We will assist you in responding to data subject requests (access, rectification, deletion, restriction, portability, objection) by:
Response time: We aim to assist within 5-7 business days of your request.
Important: You remain responsible for verifying the identity of the data subject and for responding to requests within the GDPR 30-day deadline. We will assist you, but the legal responsibility is yours.
8. Data Protection Impact Assessment (DPIA)
If you need to conduct a DPIA for processing activities using Cabintale, we will:
We maintain documentation available for DPIA purposes.
9. Breach Notification
If we discover or become aware of a personal data breach affecting your customer data:
Your responsibility: You remain responsible for notifying affected individuals and relevant authorities as required by GDPR.
10. Audit and Compliance Verification
You have the right to:
Process:
Frequency: We conduct regular internal audits and security assessments.
11. Data Retention and Deletion
Your responsibility: You must retain a copy of customer data if you need it for legal, contractual, or other legitimate business purposes after deletion from Cabintale.
12. End of Processing – Return or Deletion of Data
Upon termination of your account or our service relationship:
Our right to retain: We may retain minimal information to defend legal claims or meet tax/legal obligations, but this will be limited in scope and duration.
We have implemented the following data protection measures throughout our service:
We process your account data based on:
The lawful basis is determined by you, as the controller. We process only according to your instructions. Common lawful bases you might rely on:
Your responsibility: Document the lawful basis in your privacy policy and ensure you have a valid legal ground for collecting guest data.
We process your account data based on legitimate interests in:
Balancing test: These legitimate interests outweigh your privacy rights because:
We do not knowingly collect or process special categories of personal data, including:
If you collect such data from guests (e.g., health information for vacation rentals), you are solely responsible for:
We recommend: Do not collect special category data through Cabintale unless absolutely necessary.
| Data Type | Retention Period | Purpose | Legal Basis |
|---|---|---|---|
| Account credentials (email, hashed password) | Duration of account | Account authentication | Performance of contract |
| Account settings (name, preferences) | Duration of account | Service provision | Performance of contract |
| Billing records | 6 years after deletion | Tax compliance | Legal obligation |
| Technical logs (IP, device info) | 90 days | Security, fraud prevention | Legitimate interest |
| Email communications (support, billing) | 3 years | Record-keeping, dispute resolution | Legitimate interest |
| Data Type | Retention Period | Purpose | Legal Basis |
|---|---|---|---|
| Guest/customer information | Duration of your account + period you specify | Booking management | Performance of contract/your direction |
| Booking history | Duration of your account | Guest reference, dispute resolution | Legitimate interest |
| Communications with guests | Duration of your account | Record-keeping | Legitimate interest |
Your control: You determine retention periods for customer data. Upon deletion request or account closure, all data is deleted within 7 business days.
These GDPR terms are governed by:
Jurisdiction:
For data protection inquiries, requests, or complaints:
Email: support@cabintale.com
Location: Brno, Czech Republic
Response timeframe: 5-7 business days for standard inquiries; up to 30 days for formal data subject requests
Escalation: