Privacy policy

This page explains what personal data AR Tour Prague, s.r.o. processes in connection with this website, why, for how long, and what you can ask us to do about it. It is written to be read, not to be survived.

Who is responsible

The controller of your personal data is:

AR Tour Prague, s.r.o.
Ke Skalkám 22/3249, 106 00 Praha 10, Czech Republic
Company ID: 27577864 · VAT ID: CZ27577864
Office: Legerova 24, Praha 2, Czech Republic
E-mail: travel@artour.cz · Telephone: +420 721 240 204

We have not appointed a Data Protection Officer; we are not required to. Write to the address above with any question about your data and it will reach the person who can answer it.

What we process, and why

When you contact us

If you send us an enquiry — by e-mail, by telephone, or through a form on this website — we process what you choose to tell us. In practice that is your name, your e-mail address, and often your company, country and telephone number, together with the details of the trip you are asking about: destinations, services, dates, group size and any notes you add.

We use it for one purpose: to answer you and prepare a quotation, and then to run the arrangements if you go ahead. The legal basis is the performance of a contract or steps taken at your request before entering into one (Art. 6(1)(b) GDPR), and, where a form asks you to tick a consent box, your consent (Art. 6(1)(a) GDPR). Where a form is used, we record the moment consent was given so that we can show when and for what it was obtained.

Please do not send us payment card numbers, identity document numbers or health information by e-mail. We do not ask for them, and this website never collects them.

What the website records by itself

This site runs on Cloudflare. Like any web server, it logs the requests it receives — the page requested, the time, the browser's user agent and the IP address the request came from. These logs exist to keep the site available and to detect abuse, on the basis of our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR), and they are kept for a short period only.

Where this site accepts a form submission, it stores a salted one-way hash of the sender's IP address so that the same connection cannot flood us with automated submissions. A hash cannot be turned back into an address; it is used for counting, nothing else.

Analytics

We do not load any analytics until you have accepted it. If analytics is switched on, a banner appears and no measurement script is requested, and no analytics identifier is stored, unless and until you click accept. Choosing "Only essential", pressing Escape or ignoring the banner all leave analytics switched off. If the banner never appears, it is because there is nothing to consent to.

Where analytics is enabled, it is Google Analytics 4, configured with IP anonymisation on and with Google Signals and advertising personalisation explicitly disabled. We run no advertising features, no remarketing, no demographic reporting and no cross-device tracking, and we do not use this site to build advertising audiences.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a refusal and do not ask again.

Cookies and local storage

This website sets no cookies of its own. It does not need them: there is no login for visitors, no shopping basket and no session to keep.

Your cookie choice is remembered in your browser's local storage rather than in a cookie — recording a refusal of cookies by setting a cookie would be absurd. You can clear it at any time through your browser's settings for this site, and the banner will ask again.

If you accept analytics, Google Analytics then sets its own cookies in your browser. Declining, or clearing your browser storage, prevents or removes them.

Who else sees your data

We do not sell personal data, and we do not share it for anyone else's marketing.

Your data is handled by our IT service providers acting on our instructions — the hosting and content-delivery provider that runs this website and its database (Cloudflare), our e-mail provider, and, only where you have accepted analytics, Google. Some of these providers are established outside the European Economic Area; where that is the case, transfers are covered by the European Commission's standard contractual clauses.

Where a trip is actually arranged, we necessarily pass the details a supplier needs to deliver it — a hotel needs the names of the guests it is expecting, a coach operator the pick-up time and the number of passengers. We pass what is needed for that service, and no more.

We may also disclose data where the law requires it, for example to a public authority acting within its powers.

How long we keep it

Enquiries and the correspondence around them are kept for up to three years from our last exchange, which matches the general limitation period under Czech law for claims arising from the arrangements. Accounting and tax documents are kept for ten years, as the VAT Act requires. Server logs are kept for a short operational period. Where processing rests on your consent, we stop as soon as you withdraw it.

Your rights

Under the GDPR you can ask us to:

• tell you what personal data we hold about you, and give you a copy;

• correct anything inaccurate, or complete anything incomplete;

• delete your data, where we have no continuing reason to keep it;

• restrict what we do with it while a question about it is resolved;

• hand over the data you gave us in a portable, machine-readable form;

• stop processing carried out on the basis of our legitimate interest, where your situation gives you grounds to object.

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect anything done lawfully before you withdrew it.

Write to travel@artour.cz. We answer within one month; if a request is genuinely complex we may take longer, and we will tell you why within that first month. There is no charge unless a request is manifestly unfounded or excessive.

We take no decisions about you by automated means, and we do not profile you.

If you are not satisfied

You can complain to the Czech data protection authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic — www.uoou.gov.cz. We would rather you told us first, so that we can put it right.

Changes to this policy

If we change how this site handles personal data, we change this page at the same time. This version is dated 9 August 2026.