Privacy Policy

Controller: Smart Assets s.r.o., Company ID 21461104 Effective from: 24 October 2026 Version: 24 October 2026

I. Who we are

1.1 The controller of personal data processed in connection with the Nemify service, available at https://nemify.cz (the "Service"), is:

Smart Assets s.r.o.
Registered office: Veletržní 819/75, Holešovice, 170 00 Prague 7
Company ID: 21461104
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 402238
Data box: szu9b6y
Contact e-mail for data protection: info@nemify.cz

(the "Controller").

1.2 This Privacy Policy governs how the Controller collects, uses and protects the personal data of natural persons who use the Service (the "Users"), and the personal data of third parties that the Service processes when compiling a report (Article 2.1(f)).

1.3 Personal data is processed in accordance with the GDPR and Act No. 110/2019 Coll., on the Processing of Personal Data.

1.4 The Controller is not obliged to appoint a Data Protection Officer (DPO). Users may contact the Controller on data protection matters via the contact e-mail.

II. What personal data we process

2.1 The Controller processes the following categories of personal data:

a) Identification and contact data:

• e-mail address,
• first name and surname (if provided).

b) Search, order and payment data:

• the property address entered by the User, its coordinates and, where applicable, the unit number,
• date and time of the search and of the order,
• language of the ordered report,
• amount and date of payment, order status,
• payment identifiers from Stripe (checkout session and payment identifiers); the Controller does not process payment card details,
• the times at which consents were given when ordering (consent to the terms and conditions, consent to the commencement of performance, consent to marketing where given) and the version of the wording the User agreed to.

c) User account data:

• e-mail address and name (if provided),
• preferred language,
• order history and access to previously generated Paid Reports,
• consent to marketing communications and the times it was given or withdrawn (if given),
• login sessions and one-time login links.

d) Technical and operational data:

• IP address; in the Controller's database it is stored only as a hash with a secret key, solely for request rate limiting and abuse prevention, and the raw IP address is not stored in the database,
• web browser type and version, device operating system, referring URL, date and time of access, which are recorded by the hosting provider in the course of operating the Service,
• technical data about application errors (see Article 5.1(i)).

e) Communication data:

• content of e-mail communication between the Controller and the User,
• complaints, enquiries and their resolution.

f) Data on owners and right holders of the searched property (for a Paid Report):

• name, surname and address of the owner, or the name and identifier of a legal entity,
• ownership share and type of ownership,
• data on easements, pledges and other rights and restrictions recorded in the title deed,
• title deed data (title deed number, cadastral area, parcel, unit), for a unit possibly also the title deed data of the whole building.

The Controller obtains this data from the Land Registry (ČÚZK) on the basis of an order for a Paid Report. It is personal data of third parties who are not Users of the Service. The Controller stores it, transfers it to Anthropic for the purpose of generating the AI analysis (Article 5.1(e)) and includes it in the PDF of the Paid Report.

2.2 The Controller does not process:

• payment card details (exclusively Stripe),

• special categories of personal data under Article 9 GDPR.

  2.3 The Service is not intended for children under 15 years of age and the Controller does not knowingly collect personal data from them. The Controller does not verify the age of Users. Data on minor co-owners may form part of a title deed (Article 2.1(f)).

III. Purposes and legal bases of processing

a) Conclusion and performance of the contract for the Service

• Purpose: generation of the Free and Paid Report, delivery, payment processing, account management, login, customer support, refunds.
• Legal basis: performance of a contract under Article 6(1)(b) GDPR.
• Retention period: see Section VI.

b) Accounting and compliance with legal obligations

• Purpose: accounting, keeping payment records.
• Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR (Sections 31-32 of Act No. 563/1991 Coll., on Accounting).
• Retention period: 10 years from the end of the accounting period.

c) Protection of the Controller's legitimate interests

• Purpose: security of the Service, request rate limiting, prevention of abuse and fraud, error monitoring, defence of legal claims.
• Legal basis: legitimate interest of the Controller under Article 6(1)(f) GDPR.
• Retention period: see Section VI.

d) Data on owners of the searched property

• Purpose: compiling the ordered Paid Report and its AI analysis.
• Legal basis: legitimate interest of the Controller and the User in providing information from a public register (the Land Registry) under Article 6(1)(f) GDPR.
• Retention period: as Paid Report data (Section VI).

e) Marketing communications

• Purpose: informing about news of the Service and other proptech products of the Controller (mortgage calculators, property monitoring, rent comparators, legal templates and others).
• Legal basis: consent of the data subject under Article 6(1)(a) GDPR.
• Retention period: until consent is withdrawn or the account is deleted.

f) Analytics and improvement of the Service

• Purpose: measuring traffic, page performance and progress through the order process, improving the Service.

• Legal basis: consent of the data subject under Article 6(1)(a) GDPR. Without consent to analytics cookies, analytics is not loaded in the browser and no analytics events are sent from the server.

• Retention period: 12 months.

  3.2 Providing personal data for the purpose of performing the contract under (a) is a contractual requirement.

  3.3 Giving consent to marketing communications and to analytics is voluntary.

IV. Where we obtain personal data and to whom we pass the address

4.1 The Controller obtains Users' personal data directly from the User (search and order form, login, communication) or automatically when the Service is used (technical data).

4.2 The property address entered by the User and the coordinates and identifiers derived from it are passed to the public registries and data providers used by the Service (ČÚZK, the Prague Institute of Planning and Development, Mapy.com, OpenAQ), solely for the purpose of generating the report. These entities process the data under their own rules.

4.3 The Controller does not obtain personal data from public registers or from third parties for the purpose of creating user profiles. It obtains data on the owners of the searched property (Article 2.1(f)) from the Land Registry (ČÚZK) solely on the basis of an order for a specific Paid Report.

V. Who has access to the data - processors

5.1 The Controller uses the following processors:

a) Vercel Inc. (hosting and operation of the application) - 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Transfer to the USA on the basis of standard contractual clauses under Article 46 GDPR and the Data Privacy Framework.

b) Vercel Inc. - Vercel Blob (document storage) - 340 S Lemon Ave #4133, Walnut, CA 91789, USA. PDFs of reports (property address, cadastral data and, for a Paid Report, owner data) are stored in private storage. Transfer to the USA on the basis of standard contractual clauses under Article 46 GDPR and the Data Privacy Framework.

c) Railway Corp. (database) - 2261 Market Street #4059, San Francisco, CA 94114, USA. Transfer to the USA under SCCs.

d) Stripe Payments Europe, Limited (payment system) - 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Processing within the EEA; partial operations in the USA under SCCs. Stripe processes the Customer's e-mail address, payment data and the following order data: the internal report identifier, the internal user identifier (for a signed-in User), the report language and whether consent to marketing and to analytics was given. The Controller does not process or store payment card details.

e) Anthropic PBC (AI analysis) - 548 Market Street, San Francisco, CA 94104, USA. Transfer to the USA on the basis of standard contractual clauses under Article 46 GDPR. To generate the AI analysis of a Paid Report, the property address, the title deed data including the names, addresses and shares of the owners and the data on rights in rem (Article 2.1(f)) and the summary analysis results are transferred. The data is passed to Anthropic solely for the purpose of generating this analysis.

f) Resend, Inc. (e-mail service) - 2261 Market Street #4667, San Francisco, CA 94114, USA. Sending login links and transactional e-mails (payment confirmation, report delivery, refund). SCCs.

g) Mapy.com / Seznam.cz, a.s. (address search and autocomplete) - Prague, Czech Republic. The address text the User types into the search field is transferred. Processing within the EU/EEA.

h) OpenAQ, Inc. (air quality data) - USA. Only the geographic coordinates of the property are transferred, no personal data of the User.

i) Vercel Analytics + Vercel Speed Insights + Sentry (traffic analytics, page performance metrics and error monitoring) - USA. SCCs. Vercel Analytics and Speed Insights are loaded, and analytics events are sent from the server, only after consent to analytics cookies has been given. Analytics events may contain a shortened internal report or user identifier; when an event is sent from the server, Vercel Analytics also passes the IP address and the request headers to Vercel. Sentry processes, on the basis of legitimate interest, only technical data about errors; e-mail addresses, IP addresses, form contents, cookies and user data are removed from reports before sending, and only a limited set of headers (e.g. browser type, language) is sent. Details on cookies are set out in the Cookie Policy.

j) Cloudflare, Inc. (bot protection - Turnstile CAPTCHA) - 101 Townsend Street, San Francisco, CA 94107, USA. When the login and sign-up forms load, the User's IP address, browser fingerprint and timing of interactions with the CAPTCHA challenge are transferred for the purpose of distinguishing a human User from automated attacks (legitimate interest of the Controller under Article 6(1)(f) GDPR). Transfer to the USA on the basis of standard contractual clauses under Article 46 GDPR (SCCs 2021/914).

5.2 The Controller uses the above Processors on the basis of data processing agreements under Article 28 GDPR.

5.3 Transfers of personal data outside the EU/EEA take place on the basis of standard contractual clauses or the Data Privacy Framework.

5.4 Users may obtain the current list of Processors at the Controller's contact e-mail.

5.5 Apart from the Processors and the entities listed in Article 4.2, the Controller may disclose personal data to third parties only to comply with a legal obligation, to defend legal claims or in the course of a complaint or legal review.

VI. Retention periods

6.2 After the retention period expires, the Controller deletes or anonymises the data. Automatic deletion runs once a day.

6.3 When a user account is deleted, the Controller deletes the account and login sessions. Paid orders remain as accounting records; the e-mail address in the order record is replaced with a pseudonymous value in the format deleted-<orderId>@invalid. The report content (title deed data, AI analysis and PDF) is removed unless the same report has another buyer.

VII. Your rights as a data subject

The User has the following rights:

a) Right of access (Article 15 GDPR)
b) Right to rectification (Article 16 GDPR)
c) Right to erasure (Article 17 GDPR) - except where legal obligations apply (e.g. 10-year archiving of accounting records).
d) Right to restriction of processing (Article 18 GDPR)
e) Right to data portability (Article 20 GDPR)
f) Right to object (Article 21 GDPR)
g) Right to withdraw consent (Article 7(3) GDPR)
h) Right to lodge a complaint with a supervisory authority (Article 77 GDPR):

Office for Personal Data Protection (ÚOOÚ)
Pplk. Sochora 27, 170 00 Prague 7
E-mail: posta@uoou.cz
Web: https://www.uoou.cz

7.2 How to exercise your rights: by sending a request to info@nemify.cz or to the Controller's registered office. Registered Users may also use the "Delete account" function in the account settings, which deletes the account immediately with the consequences described in Article 6.3. The Controller will handle the request within 30 days, extendable by 2 months in complex cases.

7.3 If there is doubt about the identity of the applicant, the Controller may request proof of identity.

7.4 Exercising rights is free of charge. In the case of manifestly unfounded or repetitive requests, the Controller may charge a reasonable fee or refuse the request.

VIII. Marketing communications

8.1 The Controller sends marketing communications only on the basis of prior express consent under Act No. 480/2004 Coll., on Certain Services of the Information Society, and Article 6(1)(a) GDPR. As of the effective date of this Policy, the Controller does not send marketing communications; it only records consents given.

8.2 Consent is given by ticking a box that is not pre-ticked, when signing in to an account, when ordering a Paid Report or in the account settings. When signing in, consent is recorded only after the e-mail address has been verified by clicking the login link.

8.3 Scope of consent: news of the Service, new proptech products and services of the Controller (mortgage calculators, property monitoring, rent comparators, legal templates), special offers and discounts.

8.4 The User may withdraw consent at any time in the account settings or by sending an e-mail to info@nemify.cz. If the Controller starts sending marketing communications, each of them will contain an unsubscribe link.

8.5 Withdrawal of consent is free of charge and takes effect within 5 working days.

IX. Cookies and analytics tools

9.1 Detailed information on the use of cookies is provided in the separate Cookie Policy.

X. Security of personal data

10.1 The Controller has adopted appropriate technical and organisational measures: HTTPS/TLS, regular updates, access control, database backups, log monitoring, staff training.

10.2 In the event of a personal data breach, the Controller proceeds in accordance with Articles 33 and 34 GDPR (notification to the ÚOOÚ within 72 hours, informing affected Users in the case of high risk).

XI. Changes to this Privacy Policy

11.1 The Controller reserves the right to update this Policy at any time.

11.2 The Controller will announce significant changes by a notice on the website at least 30 days before they take effect; it may also inform registered Users by e-mail.

11.3 The current version of the Policy is always available on the website, stating the effective date and version number.

---

This English version is provided for convenience only. In case of any discrepancy, the Czech version prevails.