Operator identification
Operator of spectrumtours.cz and provider of SPECTRUM tours services:
Pavel Votruba, Czech sole trader
Registered/business address: Fričova 2500/5, 120 00 Prague 2 – Vinohrady, Czech Republic
Business ID: 76615766
VAT status/ID: tax treatment is reflected in the final consumer price shown before booking
Register entry: Czech Trade Licensing Register, Business ID 76615766
Responsible trade/supervisory authority: the competent Czech trade licensing authority according to the operator’s registered establishment
Email: info@spectrumtours.cz
Phone: +420 704 300 672
Support hours: by appointment
Privacy notice
Controller: Pavel Votruba, Fričova 2500/5, 120 00 Prague 2 – Vinohrady, Czech Republic, Business ID 76615766, privacy contact info@spectrumtours.cz.
Depending on the interaction, we process contact details, inquiry and booking details, date/language/participants, voluntary message content, booking/payment/refund identifiers, correspondence and complaints, security logs and IP addresses, consent choices, privacy-redacted website events after consent, and photographs where a separate legal basis exists.
We do not store full card details. Do not send sensitive information unless necessary for accessibility or safety.
Proposed retention:
- inquiries: 12 months after the last communication;
- bookings: 3 years after the service;
- payment/accounting records: the statutory period, up to 10 years unless longer retention is required;
- complaints/legal claims: through the proceeding and applicable limitation period;
- operational email: 3 years, longer where needed for a dispute or law;
- ordinary security logs: 30 days;
- first-party session analytics: until the browser session ends;
- consent evidence: 24 months from the latest choice or as needed to prove compliance;
- marketing images: until consent withdrawal or the agreed licence ends.
Recipients may include Hetzner Online GmbH (EU/EEA hosting), INTERNET CZ/FORPSI (domain/DNS), Resend, Inc. (transactional email and possible US transfer under contractual safeguards), Stripe if online payment is activated, professional advisers and public authorities where required.
Roundcube/Postfix/Dovecot are self-hosted. Off-site backups are encrypted before upload to Google Drive. Social and review platforms generally receive data when the user follows their link or uses their service.
Where data are transferred outside the EEA, an adequacy decision, Standard Contractual Clauses or another valid mechanism and supplementary measures are used as appropriate.
Data-subject rights include access, rectification, erasure, restriction, portability, objection, consent withdrawal and complaint to the Czech Data Protection Authority. Requests go to info@spectrumtours.cz and identity may be reasonably verified.
Google API Services and YouTube data
Spectrum Tours uses Google API Services, including the YouTube Data API and YouTube Analytics API, only for its own official Spectrum Tours Prague channel. With explicit Google OAuth authorization, Spectrum OS Automation may access channel and video identifiers, titles/descriptions, publication/privacy state, ratings/comments/captions where operationally required, and YouTube Analytics such as views, watch time, average view duration, subscriber changes and monetary analytics when available. The application may upload and manage Spectrum Tours videos/Shorts and read provider state back for verification. It does not access unrelated third-party YouTube channels.
Google OAuth credentials are stored only in protected server-side secret storage. Access tokens are refreshed from a protected offline authorization grant and are not written into public analytics datasets, source control or ordinary application logs. Provider identifiers and analytics are used for first-party publishing operations, audit/read-back evidence, Marketing Intelligence and attribution. They are not sold, used for advertising profiling of third parties or shared outside processors/advisers who are necessary to operate Spectrum Tours and are bound by applicable confidentiality/data-protection duties.
Google/YouTube authorization can be revoked at any time from the Google Account permissions page. After revocation, Spectrum OS Automation stops future API access. Stored analytics/provider evidence is retained only for the operational/measurement periods described in this policy and may be deleted earlier when no longer required. Requests concerning Google-derived data can be sent to info@spectrumtours.cz. Spectrum Tours' use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.