We collect as little data as we can. We have been guiding people into the dark since 2013, and for that we really only need your name, a way to reach you and your date. This page explains exactly what we do with your data and what rights you have. It follows the EU General Data Protection Regulation (GDPR).
Who is responsible for your data
For this website:
Světlo ve tmě s.r.o., Lomec 61, 286 01 Úmonín, Czech Republic
Company ID 05955891, registered at the Municipal Court in Prague, file C 273699
For your booking, your stay and gift vouchers:
Člověk ve tmě s.r.o., Chudenická 1059/30, Hostivař, 102 00 Praha 10, Czech Republic
Company ID 21298823, registered at the Municipal Court in Prague, file C 399717
For the stays it provides:
Světlo a tma s.r.o., Příkop 843/4, Zábrdovice, 602 00 Brno, Czech Republic
Company ID 21298611, registered at the Regional Court in Brno, file C 138289
Each company is responsible for the data it needs for its own task: Světlo ve tmě s.r.o. for this website, and the company you book your stay or voucher with for your booking. The companies share one booking system. For any privacy question, write to info@chamberrest.eu or call +420 608 08 33 33. We have not appointed a data protection officer, as we are not required to.
When you visit the website
The website runs on WordPress on a server we rent from DigitalOcean, LLC (101 Avenue of the Americas, New York, USA). The data centre is in the USA. Transfers there rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses (Art. 45 and 46 GDPR).
With every visit our web server (nginx) automatically keeps a log: your IP address, date and time, the page requested, the page you came from and your browser details. We need this for the website to work and to detect attacks and errors. The legal basis is our legitimate interest in running the site securely (Art. 6(1)(f) GDPR). Logs are deleted automatically after about four weeks.
Our fonts are stored on our own server, so loading a page sends no request to Google Fonts. The list of available dates and the prices are fetched by our server directly from our booking system; none of your data is sent. The video about the Cabin of Love loads only when you click “Play the video” – it then comes from youtube-nocookie.com, run by Google Ireland Ltd.
Cookies and statistics
Strictly necessary cookies (for example to remember your cookie choice or to send a form securely) do not require consent.
To understand which pages people read, we use Google Analytics 4 from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies only if you agree to statistics in the cookie banner (Art. 6(1)(a) GDPR). Without consent, the page sends only anonymous signals without cookies (consent mode). Google may also process data in the USA; Google is certified under the EU–US Data Privacy Framework. You can change your choice at any time in the cookie settings.
When you book a stay
In the booking form you give us your name, e-mail address, phone number and possibly a message, plus your choices: length of stay, number of people, meals, date and, if relevant, the cabin. We also note which page you sent the form from. Our server passes this straight to our booking system (servers of Contabo GmbH in Germany), which then sends you e-mails with the payment details and the confirmation of your date.
We need this data to answer your request and to prepare and run your stay. The legal basis is the contract with you or the steps leading to it (Art. 6(1)(b) GDPR). We mainly need your phone number in case of an emergency during your stay. Our booking calendar shows only your first name and the first letter of your surname; if you would rather not, we enter you under another name (Art. 6(1)(f) GDPR).
We have no health questionnaires. If you choose to tell us something about your health or send us a doctor’s confirmation, we use it only to work out whether a stay in the dark is suitable for you and share it with no one. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.
When you order a gift voucher
For a voucher we need your name and e-mail address, the recipient’s name and, if you like, a dedication. This order also goes to our booking system. The legal basis is the voucher contract (Art. 6(1)(b) GDPR). We use the recipient’s name only to print it on the voucher and to redeem it later (Art. 6(1)(f) GDPR).
Newsletter
Only people who want the newsletter get it. On the page that appears after you send a booking or a voucher order, we ask whether you would like it; you answer with a button. If you do not click when booking, you will find the same question in the deposit request, with a link to decline the newsletter in one click – Czech law allows this for existing customers (Section 7(3) of Act No. 480/2004 Coll.). The newsletter starts only after you have paid any amount. The legal basis is your consent (Art. 6(1)(a) GDPR), or, for customers who did not decline in the deposit request, our legitimate interest (Art. 6(1)(f) GDPR).
You can also sign up under the articles in our journal without ordering anything. You confirm through the link in the e-mail we send you straight away; until you confirm we send nothing, and an unconfirmed address is deleted after 7 days. The newsletter has three topics: offers and available dates, news from the retreat and participants’ experiences. Every e-mail links to your newsletter settings, where you can keep only some topics or unsubscribe from everything. We keep an unsubscribed address permanently, but only on a “do not send” list, so that you receive nothing more (Art. 6(1)(f) GDPR).
For every consent and unsubscription we keep a record: when it happened, from which IP address and page, with which browser and the wording you saw (Art. 7(1) GDPR). We keep the record for as long as we write to you and for 4 years afterwards. The newsletter is sent through Amazon SES from Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, from servers in the EU (Stockholm).
Payment and accounting
- Bank transfer: our bank and yours
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg
- Wise: Wise Europe SA, Rue du Trône 100, 1050 Brussels, Belgium
- Card (gift voucher): Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe receives your name, e-mail address and the amount; you enter your card details directly with Stripe.
PayPal, Wise and Stripe process your data under their own responsibility, partly also outside the EU. Czech law requires us to keep invoices and payment records, in particular under the Accounting Act (No. 563/1991 Coll.; Art. 6(1)(c) GDPR): accounting records for 5 years, annual accounts for 10 years.
E-mails
If you write to us, we use your message and address to reply. Our mailboxes are hosted by Seznam.cz, a.s., Radlická 3294/10, 150 00 Praha 5, Czech Republic (Email Profi service).
Who else receives your data
We do not sell your data or pass it on for advertising. Access is limited to the three companies named above and our booking system, our hosting providers DigitalOcean, LLC (website, USA) and Contabo GmbH (booking system, Germany), our e-mail provider Seznam.cz, a.s., Amazon Web Services EMEA SARL for the newsletter, Google Ireland Ltd. for statistics (only with consent), the payment providers you choose, our accountants where invoices require it, and authorities where the law obliges us.
How long we keep your data
- Server logs: about four weeks
- Booking requests that do not become a stay: 12 months
- Data about stays and vouchers: usually 3 years after the stay ends or the voucher expires
- Invoices and accounting records: 5 or 10 years under Czech law
- Name, e-mail, phone and year of stay of former participants and voucher buyers: until 31 December of the fifteenth year after the first booking, so that we recognise you if you book again (Art. 6(1)(f) GDPR)
- Newsletter: until you unsubscribe; unconfirmed sign-ups 7 days; consent records 4 years afterwards
Your rights
You have the right at any time to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased where we are not required to keep it (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), to object to processing based on legitimate interest (Art. 21), and to withdraw consent at any time for the future (Art. 7(3)). Just write to info@chamberrest.eu. We make no automated decisions and do no profiling.
If you think we are not handling your data properly, please tell us first. You can also complain directly to the Czech data protection authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz – or to the supervisory authority in your own country.
Last updated: 25 October 2026