User privacy notice

reporting.finance · Hospitality CEE, s.r.o. · version 1.0 of 30 September 2026

These notices explain how Hospitality CEE processes personal data of natural persons who have a user account in reporting.finance, and of persons whose name and email appear on invitations, password resets or contract-acceptance messages. Czech text prevails if the language versions differ. This notice covers processing where Hospitality CEE is an independent controller (DPA Article 2.3). Accounting and PMS content uploaded by a client is processed as a processor for that client; requests about that content go to the client.

1. Controller

Hospitality CEE, s.r.o., company ID 19489617, registered office Kaprova 42/14, Staré Město, 110 00 Prague 1, Czech Republic, registered at the Municipal Court in Prague, section C, file 387413. Statutory body: Anna Dempsey, executive director. Contact: privacy@reporting.finance. No data protection officer has been appointed.

2. Who this notice is for

Users of the Service (admin, editor, viewer), persons invited to an account, and persons who accept the Data Processing Agreement or the Main Agreement for a client. The employer or client that granted you access is a separate controller of that access decision.

3. Purposes and legal bases

Concluding and performing the contract with the client, including the record of acceptance of the contract documents (Terms and DPA) and the confirmation email: for the client's representatives and users, legitimate interest in concluding, performing and proving the contract (Article 6(1)(f) GDPR); where a self-employed individual is the contracting party, Article 6(1)(b) GDPR. Operating and securing the Service: sign-in, 2FA, rate limiting, access audit, abuse detection (Article 6(1)(f) – legitimate interest in platform security and protection of client data). Billing and contact data of client representatives (Article 6(1)(c) – tax and accounting law, and Article 6(1)(f)). Transactional email (invite, password reset, contract confirmation) (Article 6(1)(f); Article 6(1)(b) where a self-employed individual is the contracting party). We do not take Article 22 automated decisions with legal effects.

4. Categories of data

Name, email, position, role in the Service, language, account identifier, sign-in time and result, IP address, browser identification, two-factor (TOTP) status, audit records of imports, mapping and role changes, transactional-email content and delivery log, and for DPA acceptance also a hash of the contract text and the authority declaration. Passwords are stored only as salted hashes; TOTP secrets are stored encrypted in the database. We do not ask for your birth number or special-category data about you as a user.

5. Client accounting and PMS data

Content the client uploads (journal, documents, payroll, hotel statistics, supplier or guest names) is processed by us as processor under the DPA. Sections 3–4 do not treat that content as our controllership. Address access, rectification or erasure requests for that content to the client (your employer or contracting company). We assist the client through the Service.

6. Recipients

Google Cloud EMEA Limited and affiliates (infrastructure, region europe-west3 Frankfurt). Plus Five Five, Inc. – Resend (transactional email; sending may be from the EU, account administration and logs in the USA). Microsoft Ireland Operations Limited (Microsoft 365 support mailbox if you email us). Our employees who need access, bound by confidentiality. Public authorities where the law requires it.

7. Transfers outside the EEA

Service data at rest are in the EEA (Frankfurt). Transfers to the USA for Resend, and possibly Google or Microsoft support, rely on Commission Implementing Decision (EU) 2023/1795 (EU-U.S. Data Privacy Framework) where the recipient is certified, and on the standard contractual clauses under Decision (EU) 2021/914 as a fallback. The encrypted connection may terminate at a Google network edge outside the EEA; data are not stored there.

8. Retention

Account: for as long as the client keeps your access, then until tenant deletion (30-day export + 30-day logical deletion). DPA acceptance record: term of the contract and 10 years after it ends. Sign-in security logs: as a rule 12 months. Transactional email and delivery logs at Resend: according to Resend’s terms (typically tens of days). Invoices: the tax-law period.

9. Your rights

You have the rights of access, rectification, erasure, restriction, objection to Article 6(1)(f) processing, and portability where processing is automated and based on contract. Use privacy@reporting.finance. You may complain to the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or to the supervisory authority in another EU Member State where you live or work.

10. Legitimate interests and objection

Legitimate interests are operating and securing the Service, protecting client data and proving that contracts were concluded. You may object; we will honour the objection unless compelling legitimate grounds or legal claims prevail. An objection to necessary security may mean the account cannot be operated safely.

11. Source of data

We obtain data from you (registration, sign-in, 2FA), from the client administrator who invites you, and automatically from your device when you use the Service. Contract-conclusion data are generated in the Service.

12. Changes

The current text is at https://reporting.finance/legal/user-privacy-notice. We will notify a material change by email to the account or by a notice in the Service.