DomuHQ Logo
Data & Privacy

Your GDPR rights on DomuHQ

DomuHQ runs from the Czech Republic and complies with EU GDPR. Your rights: access, rectification, erasure, restriction, objection, portability, withdraw consent, complain to the regulator. Here is how to use each one.

5 min readIntermediateEveryoneUpdated May 30, 2026

Who DomuHQ is, legally

Data Controller, DomuHq s.r.o., IČO 23641550, Poličanská 1487, 190 16 Praha 21, Újezd nad Lesy, Czech Republic. Privacy and data-protection contact, privacy@domuhq.cz. GDPR-request form, domuhq.cz/gdpr.

Laws we follow

  • Regulation (EU) 2016/679, the EU General Data Protection Regulation (GDPR).
  • Act No. 110/2019 Coll., the Czech data-protection act.
  • Act No. 127/2005 Coll., the Czech ePrivacy act, governs cookies.
  • Regulation (EU) 2024/1689, the EU AI Act, governs the AI-based compatibility matching.

Your eight GDPR rights

  • Access, get a copy of every piece of personal data we hold on you. Self-serve via Profile, Data and Security, Download my data.
  • Rectification, correct anything inaccurate. Self-serve in profile editor for most fields; email privacy@domuhq.cz for fields you cannot edit directly.
  • Erasure, delete your data. Self-serve via Delete my account (anonymized within 24 hours, fully purged after 30 days). See [Export or delete your data](/help/export-or-delete-your-data).
  • Restriction, ask us to stop processing your data for specific purposes (e.g. marketing) without deleting the account. Use the toggles in Preferences or email privacy@domuhq.cz.
  • Objection, object to processing based on legitimate interests, including profiling for matching. Email privacy@domuhq.cz with the specific basis you are objecting to.
  • Portability, get a copy of your data in a machine-readable format you can hand to another service. The Download my data flow delivers this as PDF or JSON in-app.
  • Withdraw consent, where processing relies on consent (analytics, marketing, biometric verification), withdraw any time. Cookie banner for analytics; Preferences for marketing; email privacy@domuhq.cz for biometric.
  • Complain to the regulator, the Czech Office for Personal Data Protection (ÚOOÚ) at uoou.cz.

Automated decision-making and the AI Act

Our compatibility score is generated by an algorithm trained on personality + lifestyle answers. Under GDPR Art. 22, you have the right to information about meaningful logic involved and the right to challenge decisions made entirely by automated processing.

What this means in practice on DomuHQ:

  • We do not use AI to make decisions about you that have legal or similarly significant effects. Compatibility scores influence what gets surfaced, they do not determine your access to housing or pricing.
  • Final decisions (whether to accept an applicant, whether to connect with a roommate, whether to apply to a listing) are always made by humans, never automatically.
  • You can ask us to explain why your score with another user is what it is. Email privacy@domuhq.cz and we will return the dimension-level breakdown.
  • You can opt out of being used to train our matching model. Email privacy@domuhq.cz. Your existing matches stay, your data stops feeding future training rounds.

Where your data lives and who processes it

DomuHQ's primary infrastructure runs on Amazon Web Services in the EU, both Frankfurt and Ireland regions, inside the EEA. Backups and secondary services run on Hetzner (EU) and Cloudflare (global edge for cached static content).

We share specific subsets of your data with the following processors for the purposes listed:

  • Didit, identity verification (passport/ID + selfie).
  • Stripe, payment processing (we never see card details).
  • DeepL, in-chat EN ↔ CS translation.
  • AWS Bedrock and Rekognition, AI-based matching and content moderation.
  • Anthropic, conversational AI (DomuBot, when launched).
  • Cloudflare, CDN and edge security.
  • DataDog, error and performance monitoring.
  • Google Analytics 4, aggregated product analytics (opt-in via cookie banner).
  • Mailgun, Sinch, and Bird, transactional email and SMS.
  • Mapy.cz, map tiles and geocoding for property locations.
  • ČÚZK (Czech Cadastral Registry), property-ownership cross-check for hosts.
  • Apple, App Store transactions (iOS in-app purchases).
  • Hetzner, secondary EU infrastructure.
  • DigiSign, electronic contract signing (planned integration, not yet live).

Each processor is bound by a Data Processing Agreement and only receives the minimum data required for its function. The full list, including their data-processing terms, is on our privacy page.

Complaints

If you believe we have mishandled your data, contact us first at privacy@domuhq.cz, we try to resolve issues directly. If you are not satisfied, you can complain to the Czech Office for Personal Data Protection at uoou.cz, +420 234 665 111, posta@uoou.cz. ÚOOÚ is the competent authority for GDPR in the Czech Republic. You can complain in Czech or English.

Step-by-step

  1. 1

    Self-serve rights, Profile then Data and Security

    30 seconds

    Access, Rectification, Erasure, Portability, and Withdraw Consent (for marketing, analytics) are all reachable from Profile, Data and Security.

  2. 2

    Restriction or objection, email privacy@domuhq.cz

    5 minutes

    These rights are not self-serve because they require us to understand which processing you want stopped. Email with the specific processing. We respond within one month.

  3. 3

    Withdraw biometric consent, email privacy@domuhq.cz

    5 minutes

    Biometric verification (the Didit selfie) is processed under explicit consent. Withdraw any time. Features requiring re-verification will lock until you verify again.

  4. 4

    Challenge an automated decision, email privacy@domuhq.cz

    5 minutes

    Ask for the meaningful logic behind a compatibility score, or to opt out of being used in model training. We respond within one month with the breakdown.

  5. 5

    Complain to ÚOOÚ if unresolved

    varies

    File via uoou.cz or send written complaint to Pplk. Sochora 27, 170 00 Praha 7. They handle GDPR complaints in Czech and English.

Frequently asked questions

  • How long do you take to respond to a GDPR request?

    Within one month of receipt, as required by GDPR Art. 12. Complex requests can extend by up to two months, but we tell you within the first month if that applies.

  • Do you transfer my data outside the EU?

    No. Our primary infrastructure is AWS Ireland (EEA). Stripe's payment processing involves the US under their standard EU-approved data-transfer agreements. We do not have data warehouses outside the EU.

  • Can I see who has accessed my data internally?

    We log internal access for audit purposes. You can request an access log via privacy@domuhq.cz. Most users will see only automated system accesses; human access happens only when investigating reports or supporting a ticket you opened.

Share

Related articles

Data & Privacy

Export or delete your DomuHQ data

You can download everything DomuHQ stores about you as a single archive, or delete your account permanently. Both are self-serve in Settings.

Beginner
Profile & Verification

Complete your profile and earn the Verified badge

A complete, verified profile is the single biggest signal that gets your applications accepted and your messages replied to. Here's exactly what to fill in.

Beginner
Back to Help Center