Privacy policy
Last updated: 26 September 2026
1. Who we are
Elencia s.r.o., Křižíkova 703/97d, 186 00 Prague 8 – Karlín, Czech Republic, Company ID 23411376, is the controller of the personal data described in this policy. Contact: contact@elencia-dmc.com, +420 228 811 866.
This policy covers our website, enquiries, quotes, bookings, invoicing and payments. Our concierge service (telephone, SMS, WhatsApp) is covered by a separate notice: Privacy policy – Concierge service.
2. What data we process
- Contact data: name, email address, telephone number, company, and the content of your enquiry (including via our contact form).
- Booking data: names of travellers or participants, travel dates, services booked, and the information needed by our suppliers to deliver them (for example date of birth or passport details when required by an airline, hotel or authority).
- Special requests: dietary requirements or accessibility needs you choose to share. Where such information reveals health data, we process it only with your explicit consent and only to arrange the services requested.
- Billing and payment data: billing name and address, company and VAT details, invoices, and payment status. Card payments are processed by our payment provider GoPay; we never receive or store your card number.
- Website data: cookies and usage data, as described in our Cookie Policy.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
| Answering your enquiry and preparing a quote | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) |
| Booking and delivering the services, coordinating with suppliers | Performance of the contract (Art. 6(1)(b) GDPR) |
| Invoicing, accounting and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Processing payments and preventing fraud | Performance of the contract and legitimate interest (Art. 6(1)(b) and (f) GDPR) |
| Handling claims and defending legal rights | Legitimate interest (Art. 6(1)(f) GDPR) |
| Health-related special requests | Your explicit consent (Art. 9(2)(a) GDPR) |
| Website analytics and marketing cookies | Your consent (Art. 6(1)(a) GDPR) |
| Sending you news or offers | Your consent, which you can withdraw at any time (Art. 6(1)(a) GDPR) |
4. Who receives your data
Suppliers delivering your trip or event (hotels, venues, transport companies, guides, restaurants, activity providers) receive the data they need to deliver their service. They act as independent controllers.
Service providers acting on our behalf (processors):
- Odoo — website and contact form
- Google (Google Analytics) — website audience measurement, only with your consent
- Microsoft (Microsoft 365) — email and document storage
- Notion — project and booking management
- Missive — shared inbox
- Odys — production of individual travel itineraries
- Make — automation between our tools
- Fakturoid — invoicing
- eSignatures.com — electronic signature of contracts
- GOPAY s.r.o. — payment processing (GoPay also acts as an independent controller for its own legal obligations as a payment institution)
Some of these providers are established outside the European Economic Area. Where that is the case, transfers are covered by an adequacy decision of the European Commission or by Standard Contractual Clauses, together with appropriate technical and organisational measures.
We do not sell your personal data.
5. How long we keep it
- Enquiries that do not lead to a booking: 3 years from the last contact.
- Booking and contract data: for the duration of the contract and then 3 years (limitation period for claims under Czech law).
- Invoices and accounting records: 10 years, as required by Czech tax law.
- Health-related special requests: deleted after the end of the trip or event.
- Cookies: see our Cookie Policy.
6. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you may withdraw it at any time, without affecting processing carried out before withdrawal.
Write to contact@elencia-dmc.com. We answer within one month.
You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz) or with the supervisory authority of your country of residence.
7. Changes
We may update this policy. The version in force is always the one published on this page, with its date of last update.