Privacy Policy
This is an informative English translation. The Czech version is legally binding. Read the Czech version.
We only collect what we need to connect you with an adviser and arrange a mortgage: name, contact details, your situation, documents for the bank. We pass data on only to the adviser assigned to you (bound by confidentiality) and, with your explicit consent, to the bank you apply to. We do not sell data to anyone. Analytics and marketing tools (Google Analytics, Meta Pixel, Microsoft Clarity) run only with your consent in the cookie banner. You have the right to erasure, correction, restriction and portability.
01.Who is the controller
Offgrid Labs s.r.o., company ID (IČO): 06479243, registered office Nad vodovodem 1524/45, Strašnice, 100 00 Praha 10, entered in the Commercial Register, Section C, File 282832, Municipal Court in Prague (Městský soud v Praze).
Contact for questions about personal data and for the Data Protection Officer (DPO): gdpr@hypogo.cz, phone 246 034 350.
02.What data we collect
We collect only the data strictly necessary for the purpose we process it for. Specifically:
| Category | Specific data | Purpose |
|---|---|---|
| Identification | First name, surname, date of birth, national ID number, ID card number | Identification under AML law, submitting the application to the bank |
| Contact | Email, phone, delivery address | Adviser follow-up, communication during the process |
| Financial | Income, expenses, liabilities, account statements | Assessing DSTI/DTI, documentation for the bank |
| Technical | IP address, browser and device type | Running and securing the website |
| Analytics and marketing | On-site behaviour, visit source, cookie identifiers (GA4, Meta Pixel, Clarity) | Measuring traffic and campaign performance, only with your consent |
| About the property | Address, value, Land Registry extract, layout | Price estimate, documentation for the bank |
03.Legal grounds for processing
- Performance of a contract (Art. 6(1)(b) GDPR): to handle your enquiry and connect you with an adviser.
- Legal obligation (Art. 6(1)(c)): AML, CNB, tax regulations.
- Consent (Art. 6(1)(a)): passing data to a specific bank, marketing communications, analytics and marketing cookies (given in the cookie banner, withdrawable at any time).
- Legitimate interest (Art. 6(1)(f)): necessary operation of the website, protection against misuse.
04.Who we share data with
We never sell your data. We pass it on only to the following categories of recipient:
- Our adviser: the specific mortgage adviser registered with the CNB, bound by confidentiality. They are not our employee; we work with them.
- Banks: the application is submitted by the adviser, not by us. With your explicit consent we pass them your documents, and they use them only with the banks you agree on together. We show you in advance what goes where.
- Property valuer: if the valuation is requested by the bank, we share only the property details with the valuer.
- Providers of measurement and marketing tools: Google (Analytics, Ads), Meta and Microsoft (Clarity), and possibly heatmap tools. Only to the extent you consent to in the cookie banner.
- Public authorities: only where required by law (the Financial Analytical Office, CNB, courts, tax office).
Data for arranging a mortgage is processed exclusively within the EU/EEA. Providers of measurement tools (Google, Meta, Microsoft) may transfer data to the US. The transfer relies on the European Commission's adequacy decision (EU–US Data Privacy Framework) or, otherwise, on standard contractual clauses. We bind all processors by contract under Art. 28 GDPR.
05.How long we keep data
- Enquiry with no mortgage arranged: for the duration of handling the enquiry; we delete or anonymise the data no later than 12 months after the last contact.
- Mortgage arranged: 10 years from the end of the contract (legal obligation under AML and the Consumer Credit Act).
- Accounting records: 10 years (Accounting Act).
- Marketing communications: until consent is withdrawn.
- Analytics and marketing data: per each tool's own settings, up to 14 months for Google Analytics.
06.Your rights
Under Articles 15–22 GDPR you have the following rights, which you can exercise by emailing gdpr@hypogo.cz. We respond within 30 days (up to 90 days for complex requests):
- Right of access: find out what we hold about you
- Right to rectification: a detail is wrong
- Right to erasure ("to be forgotten"): once the lawful purpose has ended
- Right to restriction of processing: temporarily stop us using your data
- Right to data portability: we export your data in a machine-readable format (JSON)
- Right to object: to processing based on legitimate interest
- Right to withdraw consent: at any time, without giving a reason
- Right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz)
07.Data security
We apply technical and organisational measures appropriate to the risk under Art. 32 GDPR:
- Encrypted data transfer (TLS) on the website and when passing data to the adviser
- Only authorised people have access to data, to the extent needed to handle your case
- Data runs on managed infrastructure with encrypted backups
- Contractual confidentiality for all advisers and employees
- Any incident is reported to the Office for Personal Data Protection within 72 hours (Art. 33 GDPR)
08.Changes to this policy
We may update this policy. The version date and last update are always shown in the header. We actively notify you by email of any significant change.
We keep a version history and provide earlier versions on request.