Privacy Policy

Effective from 17. 7. 2026

1. Data controller

The data controller is SEWMA, s.r.o., IČO: 26406420, se sídlem Praha, Česká republika. Data protection contact: info@rential.cz.

2. What data we process

Account data (name, email, phone, billing details and IBAN), property, payment and document data, technical data (IP address, logs, mobile device token for push notifications) and tenant data entered by the user - for which we act as a processor. Sensitive identifiers (phone numbers, tenant identifiers, bank tokens) are encrypted with AES-256.

3. Bank data and Open Banking

When connecting a bank we never receive your online banking credentials. Connections are made through Enable Banking Oy (a licensed account information service provider under PSD2, supervised by the Finnish FSA) or a bank's official API (Fio). We process transaction data on a read-only basis (date, amount, counterparty account, message) solely to match rent payments. You can revoke access at any time in your bank or by disconnecting the bank in the app.

4. Purpose and legal basis

We process data to provide the service (performance of contract), for invoicing (legal obligation), and for account security and abuse prevention (legitimate interest). Marketing messages are sent only with consent, which can be withdrawn at any time.

5. Processors and transfers

We use vetted processors: Stripe (payments), GoSMS (SMS), Enable Banking (bank connections), an EU hosting provider. We do not transfer data outside the EU/EEA without adequate safeguards (standard contractual clauses) and we never sell it.

6. Retention

Account data is kept for the duration of the account. Invoicing records are kept for the statutory period (up to 10 years). After account closure, other data is deleted or anonymised within 30 days unless a legal obligation prevents it.

7. Your rights (GDPR)

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Consent can be withdrawn at any time. Requests are handled within 30 days at info@rential.cz.

8. Cookies

We use necessary cookies for login and app functionality. Analytics cookies are used only with your consent given via the cookie banner.

9. Security

We use transport encryption (HTTPS/TLS), encryption of sensitive data at rest (AES-256), secure password hashing (bcrypt), access controls and audit logs. Any personal data breach posing a risk to your rights will be reported to the supervisory authority within 72 hours and to affected persons without undue delay, as required by GDPR.

10. Mobile application

With your consent, the mobile app may send push notifications (e.g. about a received payment); for this we process a device token. Notifications can be disabled at any time in your phone or app settings.

11. Supervisory authority and changes

You have the right to lodge a complaint with the Czech Office for Personal Data Protection (uoou.cz) or your local authority. We may update this policy; material changes will be communicated by email or in the app.