Effective from 21 October 2026
Protecting your personal data is important to us. This policy explains what personal data we process, why, on what legal basis, how long we keep it, who we share it with and what rights you have. It applies to visitors to the www.cityblock.cz website, to people interested in apartments and commercial premises in the City Block Kleinerova project, to our customers and business partners, and to the persons who represent them.
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Czech Act No. 110/2019 Coll., on the Processing of Personal Data, and other related legislation.
1. Who processes your data
The controller of your personal data is:
- Name: LANDKER Reality s.r.o.
- Company ID (IČO): 23926694
- Registered office: Na příkopě 1047/17, Staré Město, 110 00 Prague 1
- Registration: registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 435269
- Data protection e-mail: reality@landker.cz
- Phone: +420 733 567 872
- Data box ID: s3pv923
(hereinafter “we” or the “controller”)
The developer of the City Block Kleinerova project is Byty u Gymnázia s.r.o., Company ID 10735011, with its registered office at Rybná 682/14, Staré Město, 110 00 Prague 1. If we share your data with the developer (see Article 4), it processes the data as an independent controller.
We have not appointed a data protection officer because we are not required to do so by law. Please direct all questions and requests to the contacts above.
2. What personal data we process
We process only the data we need for the given purpose:
- Identification data: first name and surname; for entrepreneurs, company name, company ID and VAT number.
- Contact data: e-mail, phone, address.
- Content of communication and preferences: what you write to us in the form or by e-mail or tell us by phone, and which type of apartment or premises you are interested in.
- Contractual and payment data: details of the reservation, contract, invoicing and payments if you purchase a unit, including the data required for checks under the anti-money laundering act.
- Website usage data: IP address, device and browser type, pages visited, time of visit, traffic source and data stored in cookies. We collect analytics data only with your consent.
We obtain the data directly from you. If your employer or business partner provides us with your data (for example as a contact person), we process it to the same extent and in accordance with this policy. Website usage data is collected automatically when you visit the website.
Not providing data in the form has no legal consequences, but without your contact details we cannot reply to you or record your interest. Data required to conclude and perform a contract and data required by law are mandatory; without them the contract cannot be concluded.
3. Why we process data, on what basis and for how long
| Purpose of processing | Legal basis | Retention period |
|---|---|---|
| Handling an enquiry or question received through the form, by e-mail or by phone, and recording your interest in the project | Taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR); for questions unrelated to a contract, our legitimate interest in replying (Art. 6(1)(f) GDPR) | For the duration of the communication and for 3 years after the last contact. If we conclude a contract, for the period stated for concluding and performing the contract. |
| Sharing data with the developer where necessary for communication about the project (units, schedule, contractual documentation) | Taking steps prior to entering into a contract and performance of a contract (Art. 6(1)(b) GDPR); in justified cases, legitimate interest (Art. 6(1)(f) GDPR) | For the period necessary for the given purpose, at most for the period stated for handling an enquiry or performing a contract |
| Concluding and performing a contract, communication about the purchase of a unit | Performance of a contract (Art. 6(1)(b) GDPR); for contact persons, our legitimate interest in communicating with the persons designated by the customer (Art. 6(1)(f) GDPR) | For the term of the contract and 4 years after its termination (the general three-year limitation period plus one year as a reserve) |
| Customer due diligence under the anti-money laundering act if you purchase a unit | Compliance with a legal obligation (Art. 6(1)(c) GDPR), Act No. 253/2008 Coll., on Certain Measures against the Legitimization of the Proceeds of Crime and Financing of Terrorism | 10 years from the end of the business relationship |
| Keeping accounts and meeting tax obligations | Compliance with a legal obligation (Art. 6(1)(c) GDPR), the Accounting Act and the VAT Act | 10 years from the end of the tax period in which the transaction took place |
| Establishing, exercising and defending legal claims | Legitimate interest (Art. 6(1)(f) GDPR) | For the duration of the limitation periods, at most 10 years; in the event of a dispute, until it is concluded |
| Website security and abuse prevention (server logs, form spam protection) | Legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR) | 30 days |
| Measuring traffic and improving the website (analytics cookies) | Your consent (Art. 6(1)(a) GDPR and Section 89(3) of the Electronic Communications Act) | Until consent is withdrawn, at most for the period stated for each cookie in Article 6 |
| Sending news and offers about the project by e-mail (commercial communications) to people who have consented to this in the form | Your consent (Art. 6(1)(a) GDPR, Section 7(2) of Act No. 480/2004 Coll.) | Until you unsubscribe or withdraw your consent, at most 5 years from when consent was given or from your last demonstrable activity (whichever is later) |
| Proving that consent to commercial communications was given and withdrawn | Legitimate interest (Art. 6(1)(f) GDPR) | 3 years from the withdrawal of consent or from sending the last commercial communication |
Where we process data on the basis of legitimate interest, we have assessed that this interest is not overridden by your interests or fundamental rights and freedoms. You may object to such processing at any time (see Article 7).
When the retention period expires, we delete or anonymize the data.
4. Who we share data with
We do not sell your data. We disclose it only to the extent necessary:
- To the project developer, Byty u Gymnázia s.r.o., where necessary for communication about the project (units, schedule, contractual documentation). The developer processes the data as an independent controller.
- To processors who provide technical and other services for us and with whom we have concluded a data processing agreement under Art. 28 GDPR. They may use the data only on our instructions.
- To external advisers (accountant, tax adviser, attorney) who are bound by confidentiality.
- To public authorities (for example the tax office, a court or the police) where required by law.
Our processors and other recipients:
| Recipient | Purpose | Location and safeguards for transfers outside the EU |
|---|---|---|
| Byty u Gymnázia s.r.o., Company ID 10735011, Rybná 682/14, 110 00 Prague 1 | Project developer, communication about units and contractual documentation (independent controller) | Czech Republic |
| Apadore s.r.o., Company ID 22083138, Neklanova 105/7, 128 00 Prague 2 | Hosting, administration, maintenance and technical operation of the website | Czech Republic |
| Moonshot Ventures Inc. (Basin service) | Receiving and delivering form messages, spam protection | Canada; European Commission adequacy decision on the protection of personal data in Canada (2002/2/EC) |
| Google Ireland Limited (Google Analytics, Google Tag Manager) | Traffic measurement, only with consent | Ireland; any transfer to the USA based on the EU-U.S. Data Privacy Framework |
| Microsoft Ireland Operations Limited (Microsoft Clarity) | Analysis of website behavior, only with consent | Ireland; any transfer to the USA based on the EU-U.S. Data Privacy Framework |
| Microsoft Ireland Operations Limited (Microsoft 365) | E-mail communication and document storage | Ireland; any transfer to the USA based on the EU-U.S. Data Privacy Framework |
5. Transfers of data outside the European Union
We process data primarily in the European Union and the European Economic Area. Some of our suppliers (in particular cloud service providers with a registered office or parent company in the USA) may access the data from third countries. In such cases we transfer data only where an adequate level of protection is ensured: to countries for which the European Commission has decided that they provide adequate protection (for the USA, this applies to companies certified under the EU-U.S. Data Privacy Framework pursuant to Commission Implementing Decision (EU) 2023/1795), or on the basis of standard contractual clauses approved by the European Commission (Art. 46 GDPR). We will provide you with a copy of the relevant safeguards on request.
6. Cookies and similar technologies
Cookies are small text files that a website stores in your browser. We use them in the following categories:
- Necessary cookies: ensure the basic functions and security of the website and remember your cookie settings. The website does not work properly without them, so we do not need your consent for them (Section 89(3) of the Electronic Communications Act).
- Analytics cookies: help us understand how visitors use the website so that we can improve it. We use them only with your consent.
On your first visit, we ask for your consent in the cookie banner. You can give consent for some categories only or reject all; rejecting is as easy as accepting. You can change your choice or withdraw your consent at any time via the “Cookie settings” link in the website footer. You can also delete or block cookies in your browser settings.
| Cookie name | Provider | Category | Purpose | Expiry |
|---|---|---|---|---|
| cc_cookie | cityblock.cz | Necessary | Storing your choice in the cookie banner | 6 months |
| _ga, _ga_* | Analytics | Distinguishing visitors and measuring traffic (Google Analytics 4) | 2 years | |
| _clck, _clsk, CLID | Microsoft | Analytics | Analysis of website behavior (Microsoft Clarity) | 1 year, 1 day |
7. Your rights
In connection with the processing of your personal data, you have the following rights:
- Right of access (Art. 15 GDPR): you can ask us whether and what data we process about you and obtain a copy.
- Right to rectification (Art. 16 GDPR): you can ask us to correct inaccurate data or complete incomplete data.
- Right to erasure (Art. 17 GDPR): you can ask us to erase data if we no longer need it, you withdraw your consent, you have validly objected or we process it unlawfully. We cannot erase data that we are required to keep by law.
- Right to restriction of processing (Art. 18 GDPR): for example while we verify the accuracy of the data or your objection.
- Right to data portability (Art. 20 GDPR): we will provide the data you have given us, which we process by automated means on the basis of consent or a contract, to you or to another controller in a structured, machine-readable format.
- Right to object (Art. 21 GDPR): you may object at any time to processing based on legitimate interest.
- Right to withdraw consent (Art. 7(3) GDPR): you may withdraw your consent at any time: for cookies via the “Cookie settings” link in the website footer, for commercial communications by clicking the unsubscribe link in each e-mail, otherwise by e-mail to reality@landker.cz. Withdrawal does not affect processing carried out before it.
- Right not to be subject to automated decision-making (Art. 22 GDPR): we do not carry out automated decision-making or profiling with legal or similarly significant effects.
You can exercise your rights by e-mail, in writing or via data box using the contacts in Article 1. We will reply without undue delay and no later than one month after receiving your request. In complex cases we may extend this period by a further two months; we will inform you if we do. Handling your request is free of charge. To make sure we do not disclose data to the wrong person, we may ask you to verify your identity.
Right to lodge a complaint. If you believe that we process your data in breach of the law, you may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz. We would appreciate it if you contacted us first and gave us the opportunity to resolve the matter.
8. How we protect your data
We have adopted appropriate technical and organizational measures to protect your data against unauthorized access, loss, destruction or misuse. The website is available only over an encrypted connection (HTTPS), only authorized persons bound by confidentiality have access to the data, and we use secure services with two-factor authentication.
9. Children
Our services are not intended for persons under 15 years of age, and we do not knowingly process their data.
10. Changes to this policy
We may update this policy, for example when legislation or the tools we use on the website change. The current version is always published on this page together with its effective date. We will inform you of significant changes on the website or, where appropriate, by e-mail.
This policy is effective from 21 October 2026.