Terms of Service

These Terms of Service ("Terms") govern access to and use of the UbyHost web application, related software, documentation, and hosted infrastructure (collectively, the "Service") operated by Josef Pechar, identification number (IČO) 24005169, a self-employed person (osoba samostatně výdělečně činná) under the laws of the Czech Republic (the "Operator"). By creating an account, logging in, or otherwise using the Service, you (the "Host") confirm that you have read, understood, and agree to be bound by these Terms and the Data Processing Agreement at /dpa (which is incorporated by reference for Guest Data). If you do not agree, you must not use the Service. Where you accept on behalf of a legal entity, you represent that you have authority to bind that entity. The Service is offered primarily to accommodation providers and other business users; if you are a consumer within the meaning of Act No. 634/1992 Coll., as amended (including Act No. 261/2021 Coll.), mandatory consumer protections apply to the extent they cannot be validly excluded.

"Host" means the natural or legal person that registers for and uses the Service to manage accommodation. "Guest" means a person whose data the Host collects through the Service. "Guest Data" means personal and other data relating to Guests entered or generated through the Service. "Legal Entity" means the host-configured entity shown to Guests as data controller. "UbyPort" means the Czech police foreigner reporting system and related interfaces. "Account" means the Host's registered workspace. "Content" means data, text, images, and files submitted by the Host or Guests through the Service.

The Service is provided by Josef Pechar, IČO 24005169 (the Operator). The Operator is the provider of the software and hosted environment. Each Host (or the Legal Entity configured per property) remains the accommodation provider and, unless expressly agreed otherwise in writing, the data controller for Guest Data under Regulation (EU) 2016/679 (GDPR) and Czech implementing legislation. Operator contact details and public register information are published on the /legal page.

UbyHost is a software-as-a-service tool that helps accommodation providers maintain house book records, collect guest details via web forms, manage stays, and prepare or transmit reports toward UbyPort. Features may change, be added, or removed at the Operator's discretion. The Service may integrate with third-party systems (including government systems). The Operator does not provide accommodation, legal, tax, or immigration advice, and does not act as the Host's agent toward authorities unless explicitly stated.

The Host is solely responsible for compliance with obligations of an accommodation provider under Czech law, including Act No. 326/1999 Coll. on residence of foreign nationals, related decrees, house book rules, and GDPR duties as data controller. The Operator provides technical infrastructure and processes Guest Data on the Host's documented instructions to deliver the Service — as a data processor under GDPR Article 28 pursuant to the Data Processing Agreement at /dpa. Nothing in these Terms transfers statutory duties of the Host to the Operator. The Operator is not a joint controller unless expressly agreed in a separate written agreement.

The Host must provide accurate registration information and keep it current. Usernames and passwords are personal or assigned to authorised staff only. The Host is responsible for all activity under its Account, including actions by employees, contractors, and anyone who gains access through the Host's credentials or guest links. The Host must use strong passwords, enable and maintain two-factor authentication when the Service requires it (including mandatory authenticator-based 2FA on production deployments), safeguard recovery codes, limit access appropriately, and notify the Operator promptly if unauthorised access is suspected. The Operator may require password changes, additional verification, or Cloudflare Turnstile checks on login and guest PIN flows to prevent abuse.

The Host shall not: (a) use the Service for unlawful purposes or submit false, misleading, or incomplete Guest Data; (b) attempt to gain unauthorised access to the Service, other accounts, or underlying systems; (c) interfere with or disrupt the Service, including by automated scraping, denial-of-service, or introducing malware; (d) reverse engineer, decompile, or create derivative works of the Service except where mandatory law permits; (e) resell, sublicense, or make the Service available to third parties except as permitted by the Host's own accommodation operations; (f) use the Service to harass, defame, or infringe third-party rights; (g) remove proprietary notices; or (h) use demo or test modes to submit real Guest Data to production police endpoints without proper configuration. Breach may result in immediate suspension under Section 19.

The Host warrants that it holds all licences, registrations, and permissions required to operate accommodation and to collect and process Guest Data. The Host must: verify Guest identity and data accuracy before reporting; obtain signatures where required; maintain paper or other legally required records alongside digital copies; meet reporting deadlines; present records at inspections; configure Legal Entities, properties, and UbyPort credentials correctly; and comply with GDPR transparency, retention, and security obligations toward Guests. The Host is solely liable for fines, claims, or enforcement actions arising from the Host's failure to comply with accommodation, immigration, or data protection law.

Guest Data is processed to operate the Service on the Host's instructions. The Host, as controller, determines purposes and means of processing vis-à-vis Guests and must provide lawful basis, privacy notices, and data subject rights responses. The Operator implements appropriate technical and organisational measures for the hosted environment but does not guarantee that the Host's use of the Service satisfies the Host's GDPR obligations. The Operator may access Guest Data only to provide the Service, ensure security, comply with law, or as otherwise instructed. The Host shall not instruct processing that violates applicable law. Details of subprocessors, cookies, retention, and security are described in these Terms and in the Privacy Policy at /privacy.

Where enabled, the Service may format and transmit reports toward UbyPort or related channels on the Host's request. The Operator does not guarantee that any submission will be received, accepted, validated, or deemed compliant by the Czech Police, Ministry of the Interior, or any authority. Outages, schema changes, credential issues, network failures, and manual review by authorities are outside the Operator's control. The Host must independently verify submission status, retain proof of reporting, and maintain contingency procedures (including manual filing where required). Demo, sandbox, or test data must not be relied upon as official police records.

The Service, including software, design, logos, documentation, and all related intellectual property rights, is and remains the exclusive property of the Operator and its licensors. No rights are granted except as expressly set out in these Terms. The Host retains ownership of Content it uploads, but grants the Operator a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, display, and process Content solely to provide and improve the Service, comply with law, and enforce these Terms.

Subject to these Terms and payment of applicable fees (if any), the Operator grants the Host a limited, non-exclusive, non-transferable, revocable licence to access and use the Service for the Host's internal accommodation operations during the subscription or authorised period. The licence does not permit use beyond the scope of the Host's own properties and staff. The Operator may update the Service; material reductions in core functionality will be communicated where reasonably practicable.

The Service is provided on a commercially reasonable efforts basis. The Operator does not guarantee uninterrupted or error-free operation, specific uptime percentages, or response times unless agreed in a separate written SLA. Maintenance, upgrades, and emergency work may cause temporary unavailability. The Operator is not liable for failures caused by third-party networks, hosting providers, UbyPort, internet connectivity, or force majeure. Support is provided through channels the Operator makes available from time to time; no support email is guaranteed unless published on the /legal page.

The Service may include beta, preview, or experimental features identified as such. They are provided as-is and may be modified or withdrawn without notice. Demo or sample data loaded for training is fictitious or anonymised where possible and is configured not to trigger real police submissions; the Host must confirm environment settings before live use. The Host is responsible for distinguishing demo workspaces from production data.

If fees apply to the Host's plan, they are due as stated at signup, in-app, or in a separate order form. Prices may change on notice for future billing periods. Unless mandatory law requires otherwise, fees are non-refundable once a billing period has started. Failure to pay may result in suspension or termination. Taxes (including VAT) are the Host's responsibility where applicable. If the Service is currently offered without charge, the Operator may introduce fees on reasonable notice; continued use after the effective date constitutes acceptance of the new pricing.

To the maximum extent permitted by applicable law, the Service is provided "as is" and "as available" without warranties of any kind, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, accuracy, non-infringement, or that the Service will meet the Host's requirements or regulatory outcomes. The Operator does not warrant that Guest Data will be preserved indefinitely, that exports will be accepted by authorities, or that the Service is free from vulnerabilities. Mandatory statutory rights of consumers (if applicable) remain unaffected.

To the maximum extent permitted by Czech law, the Operator shall not be liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profit, revenue, goodwill, data, or business opportunity, even if advised of the possibility. The Operator's aggregate liability arising out of or relating to the Service or these Terms shall not exceed the greater of (a) amounts paid by the Host to the Operator for the Service in the twelve (12) months preceding the claim, or (b) CZK 5,000, except where liability cannot be limited under mandatory law (including intentional harm or gross negligence where such limits are impermissible). For business users, the parties acknowledge that these limitations are a material allocation of risk. Nothing excludes liability for death or personal injury caused by negligence where exclusion is unlawful.

The Host shall indemnify, defend, and hold harmless the Operator, its contractors, and affiliates from and against all claims, damages, losses, fines, penalties, costs, and expenses (including reasonable legal fees) arising from: (a) Guest Data or Content submitted by the Host or Guests; (b) the Host's breach of these Terms or applicable law; (c) the Host's accommodation operations or regulatory non-compliance; (d) disputes between the Host and Guests; or (e) misuse of the Service under the Host's Account. The Operator may assume exclusive defence and control of any matter subject to indemnification; the Host will cooperate fully.

The Operator may suspend or terminate access immediately if the Host breaches these Terms, poses a security risk, fails to pay fees, or if required by law or a competent authority. The Operator may terminate for convenience on thirty (30) days' notice. The Host may stop using the Service at any time; export data beforehand where the Service provides export tools. Upon termination, the licence ends and the Operator may delete Account data after any applicable retention period, except where law requires longer storage. Provisions that by nature should survive (including Sections 11, 16–18, 22, and 24) survive termination.

Retention periods for Guest Data follow the Host's legal obligations and in-app settings. The Host is responsible for timely export, archival, and deletion in line with GDPR and Czech accommodation law (including typical six-year house book retention). The Operator may retain backups for a limited period for disaster recovery and then purge them. The Operator is not obliged to maintain data indefinitely after termination. The Host should maintain independent backups of critical records.

The Operator may use hosting providers, infrastructure vendors, and other subprocessors to deliver the Service, provided they are bound by confidentiality and data protection obligations consistent with these Terms. The Host authorises such subcontracting for processing Guest Data on the Host's instructions. The Operator remains responsible for subprocessors' performance to the extent required by GDPR Article 28. A summary of subprocessor categories is published in the Privacy Policy at /privacy.

The Operator may amend these Terms to reflect legal, technical, or business changes. Material changes will be notified by posting the updated Terms at /terms and, where practicable, through the Service or Account email on file at least thirty (30) days before they take effect. The effective date will be shown at the top of the page. Continued use after the effective date constitutes acceptance. If the Host disagrees, it must stop using the Service before the effective date and export its data.

Neither party is liable for failure or delay due to events beyond reasonable control, including natural disasters, war, terrorism, labour disputes, government actions, epidemics, power or internet failures, or outages of UbyPort or third-party services, provided the affected party uses reasonable efforts to mitigate impact.

These Terms are governed by the laws of the Czech Republic, excluding conflict-of-law rules that would apply another jurisdiction. For business users, the parties irrevocably submit to the exclusive jurisdiction of the courts of the Czech Republic seated in Prague (Praha). If the Host is a consumer, mandatory consumer jurisdiction rules under EU and Czech law apply where they cannot be waived. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

These Terms, together with the /legal notice, the Data Processing Agreement at /dpa, the Privacy Policy at /privacy, and any order form expressly incorporated, constitute the entire agreement regarding the Service. If any provision is invalid, the remainder stays in effect and the invalid part is replaced by a valid provision closest to the intent. Failure to enforce a right is not a waiver. The Host may not assign these Terms without the Operator's consent; the Operator may assign in connection with a business transfer. Notices to the Host may be given electronically through the Service.

Information in the Service, documentation, or help content is for general operational guidance only. It does not constitute legal, immigration, tax, or data protection advice. The Host must obtain its own professional advice on house books, foreigner reporting, GDPR, and accommodation regulations. The Operator is not responsible for decisions the Host makes based on such materials.

Questions about these Terms should be directed to the Operator using contact details on the /legal page. For Guest Data subject requests, Guests must contact the Host as data controller.