Privacy Policy

This notice explains what personal data we collect on this page, why we collect it, who receives it and what you can ask us to do with it. It covers this page only.

Who is responsible

The controller of your personal data is N.E.O.PEOPLE z.s., IČO 22662626, Na pokraji 540/2, Prosek, 190 00 Praha 9, Czech Republic, registered under file L 17871 at the Municipal Court in Prague.

You can reach us about anything in this notice at 1234@1234neoresidence.org.

What we collect, and why

Your answers to the RESIDENT PROFILE

The fourteen questions you answer, the email address and phone number you give at the contact step, and a record of the acknowledgement shown to you at the moment you sent it. We use them to prepare your Resident Profile, to understand who the residence is for, and to contact you personally about a possible place in it. Legal basis: taking steps you asked for, at your request, before a possible agreement about a place in the residence (Article 6(1)(b) GDPR) — this is different from consent, and is not something you can separately withdraw while keeping the conversation going; you can still ask us to delete your Resident Profile at any time (see Your rights, below).

Answers you started but did not finish

Each answer is stored as you give it, which means it reaches us before you have reached the acknowledgement at the end of the questionnaire. So the basis above is not what we rely on for these partial answers, and we are not going to claim that it is. We keep them, together with the number of the question you had got to, for two reasons: it lets you continue where you stopped, and it is the only way we can see which question people find hard. Legal basis: our legitimate interest in a questionnaire that works and can be improved (Article 6(1)(f) GDPR). You can object at any time using the contact above, and we will delete what is there. If a Resident Profile is never finished, we delete it automatically — see How long we keep it, below.

If you do finish and submit, the section above is what applies from that moment on.

Checks against automated submissions

When you submit the profile we also record how long the form had been open before you sent it, and whether a field that people never see was filled in. Both are signs of a script rather than a person. A submission that fails either check is stored and marked as suspected automation, and no alert about it reaches us to read. Nothing about you is judged by it — the check looks at how the form was filled in, never at what you wrote — and if it happens to a real submission, write to us using the contact above and we will look at it ourselves. Legal basis: our legitimate interest in a questionnaire that is not filled in by scripts (Article 6(1)(f) GDPR).

Measurement of the page

For each visit we record: the page and questionnaire steps you reached, the time, whether you are on a phone, tablet or computer, the country and city your connection resolves to (from your network provider's own location data, not from storing your IP address), the network or hosting organisation your connection belongs to, the page that referred you, and any campaign tags in the link you followed. We do not store your IP address or your browser's user-agent string, and we do not derive or store any identifier made from them — not as a hash, not in any other form. Legal basis: our legitimate interest in understanding how the page is used (Article 6(1)(f) GDPR).

From the moment you give your first answer we also generate an identifier for that questionnaire and keep it on your device. It travels with the steps you take afterwards and is stored next to your answers, so we can follow one person's path through the questionnaire instead of a pile of unrelated steps, and so a questionnaire you left can be recognised as yours when you return. It is not derived from anything about you — but it does not change at midnight, so steps taken on different days belong to the same questionnaire, and once you submit, to the address you gave with it. Legal basis: our legitimate interest in seeing where the questionnaire loses people (Article 6(1)(f) GDPR). You can object using the contact above, and clearing your browser's site data removes it from your device.

Recognising your browser across separate visits is a different, optional thing, and needs its own separate consent — it is not part of measuring one questionnaire session above. Only if you say yes to it, we keep one random identifier (not derived from your IP address, your device, or anything else about you) in your browser for 90 days, so a visit to this page on one day and a return visit later can be recognised as the same (still anonymous) browser. If you say no, or say nothing, none of this happens, and nothing about your visits is joined together this way. You can withdraw this choice at any time through Cookie Settings (see the footer), which deletes the identifier from your browser and from our records immediately; otherwise it expires automatically after 90 days. Legal basis: your consent (Article 6(1)(a) GDPR). A separate consent choice covers whether Meta's own cookie is set on this page at all — see the Cookie Policy for what that involves.

Leads from our Meta advertising form

If you reached this page after filling in a form inside Facebook or Instagram, Meta collects your name, telephone number, email address, preferred contact channel and relocation horizon, and Meta passes those responses to us through Make, an automation service operated by Celonis, Inc., which transfers them to our systems for lead management and follow-up. We match the two by email address. We also tell Meta how an enquiry from that form progresses with us: that it reached us, that you completed our questionnaire, and the later stages of our review. For this we send Meta only its own reference number for your enquiry, the name of the stage and its date, never your answers or contact details. Meta uses this to show our adverts to people who are more likely to be interested. Legal basis: your consent, given in that form.

Future marketing emails

If you say yes to receiving occasional emails about future N.E.O.Residence seasons and opportunities, on the thank-you screen after your Resident Profile, we record your email address and that choice. This is entirely separate from processing your Resident Profile: saying no changes nothing about your application. Legal basis: your consent, which you may withdraw (unsubscribe) at any time.

If you write to us on WhatsApp or Instagram

If you message us on WhatsApp or Instagram — including by using one of the buttons on this page — your number or Instagram identifier, your message, and, if you came from one of our adverts, a reference to that advert reach us through Meta Platforms Ireland Ltd., who process them as our provider under its own WhatsApp and Instagram Business Data Processing Terms. We use what you send to answer you personally and to keep one record of the conversation. Legal basis: taking steps you asked for, at your request (Article 6(1)(b) GDPR) — the same basis as the RESIDENT PROFILE above; writing to us first is itself the request. A short, visible reference may appear at the end of the message a WhatsApp button opens for you, showing us which part of the page you wrote from — it is only added while you have accepted site measurement (see Measurement of the page, above), and it is never hidden.

Our team reads and answers these conversations through tawk.to, a messaging inbox; nothing you send this way is processed anywhere else. We also send ourselves a short Telegram note when a new contact arrives through WhatsApp or Instagram, with no name, number or message content in it — the same zero-detail note described below for a submitted Resident Profile.

If you book a call

If you tell us you would like a phone call, the thank-you screen after your Resident Profile shows a button, CHOOSE A TIME. Nothing is loaded from Cal.com until you press it. When you press it, a booking calendar hosted by Cal.com opens inside this page (see Who receives your data, below) and your browser starts talking to Cal.com. If you book a time, we keep the booking together with your enquiry: the time you booked, and the name, email address and phone number you gave in the booking. The same retention periods apply as for the enquiry itself (see How long we keep it, below). A booking that cannot be matched to an enquiry is deleted 90 days after the call. Cal.com keeps its own copy of the booking on its side. If you ask us to delete your data, we ask Cal.com to delete your booking as well.

Who receives your data

• Cloudflare, Inc. — serves this page and runs the software that receives your answers, in its European locations.
• Neon, Inc. — the database, hosted on Amazon Web Services in Frankfurt, Germany (eu-central-1). Your answers are stored there.
• Meta Platforms Ireland Ltd. — for marketing cookies, only if you accept them (see the Cookie Policy for exactly what is sent and when); and, separately, whenever you message us on WhatsApp or Instagram — that does not depend on the cookie choice, since writing to us is your own request (see "If you write to us on WhatsApp or Instagram", above).
• Make (Celonis, Inc.) — an automation service we use to receive information submitted through our Meta advertising forms and pass it to our systems. Make is used for this Meta Lead Ads workflow; data submitted through the website questionnaire is not routed through Make.
• tawk.to — the inbox our team uses to read and answer the WhatsApp and Instagram conversations described above. Nothing else on this page uses it.
• Resend (Plus Five Five, Inc., San Francisco, USA) — sends the confirmation email you receive after submitting your Resident Profile. Only your email address reaches it, as the message's recipient, together with the fixed message text; no answer content is included. The email is dispatched from Resend's Ireland region (eu-west-1); Resend keeps its sending records (email metadata and logs) in the United States.
• Cal.com (Cal.com, Inc., San Francisco, USA) — hosts the booking calendar that opens on this page only if you press CHOOSE A TIME, and stores the bookings made in it. The calendar may be filled in with the email address and phone number you already gave us, so that you do not have to type them again. Nothing is sent to Cal.com before you press the button. After you press it, your browser loads Cal.com's page, so Cal.com receives your IP address and browser details, sets the cookies and browser storage listed on our Cookies page, and may send technical error reports to its error-monitoring provider, Sentry (United States). Cal.com also receives what you enter and the time you choose, keeps the booking, and sends it to us, so that we can attach it to your enquiry and call you at the time you chose. Cal.com is a United States company, so what you enter on its page may be processed in the United States.
• Zoho Corporation B.V. — hosts our own mailbox 1234@1234neoresidence.org in its European data centres. Mail you send us, and any reply you write to the confirmation email above, arrives and is stored there.
• Telegram — we receive a notification when a profile is submitted, when a lead arrives from our Meta advertising form, when a new WhatsApp or Instagram contact arrives, and when a call is booked or is about to start. None of these notifications names or identifies you: each says only that a new one has arrived (for a call, the time of the call), with a link to our own review queue. Nothing from your answers or your message — no name, email, phone, market, budget, timing or free-text — is ever sent there.

We do not sell your data, and we do not share it with anyone else.

Transfers outside the European Economic Area

Our hosting and database providers store your data inside the EEA. Resend, which sends your confirmation email (see above), is based in the United States; it certifies under the EU-U.S. Data Privacy Framework and processes personal data under the European Commission's Standard Contractual Clauses (Resend DPA §6.2, §11.1). Responses from our Meta advertising forms pass through Make, which processes them in its European data centres; its operator, Celonis, Inc., is a United States company certified under the EU-U.S. Data Privacy Framework. Cal.com, which hosts the booking calendar you may open to schedule a call (see above), is based in the United States, so what you enter in it may be processed there. Cal.com states that, for transfers out of the European Economic Area, it relies on Standard Contractual Clauses or an adequacy mechanism such as the EU-U.S. Data Privacy Framework. If you accept marketing cookies, data sent to Meta for measurement may be processed in the United States under the European Commission's Standard Contractual Clauses and Meta's own transfer framework; if you refuse, none of that measurement data is sent. Separately, if you message us on WhatsApp or Instagram, Meta processes that conversation under its own transfer safeguards regardless of the cookie choice, since writing to us is your own request and not a cookie-based measurement (see "If you write to us on WhatsApp or Instagram", above).

How long we keep it

A Resident Profile you never finish is deleted automatically after 365 days of inactivity on it. A completed application follows the same 365-day inactivity clock if nothing further happens with it — it is moved out of active use, and permanently deleted 3 years after that point (so, in total, up to about 4 years of inactivity from your last contact with us). If we tell you we cannot offer you a place, the same 3-year deletion clock starts immediately rather than waiting for 365 days of silence. None of this clock is restarted by anything we do on our own — a reminder we send, or an unanswered outreach attempt — only something you do restarts it. If you become an actual resident, none of this applies for as long as that relationship continues. Raw measurement records (Measurement of the page, above) are kept for a much shorter 12 months, separately from the above.

Your rights

Under the GDPR you can ask us to:

• give you a copy of the data we hold about you;
• correct anything that is wrong;
• delete it;
• restrict what we do with it, or object to it;
• hand it to you, or to someone else, in a portable form.

Where we rely on your consent, you can withdraw it at any time. Withdrawing does not undo what we did while it was valid.

You can also complain to the Czech supervisory authority — Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz — or to the authority in the country where you live.

No profiling, no automated decisions

Nothing here is scored, and nothing about you, your answers or your suitability is decided automatically. A person reads the answers.

The one automated check we run is the anti-script check described above. It looks only at how the form was filled in — never at what you wrote — and its only effect is that a submission it flags does not reach us as an alert. It stays in our records either way, and you can ask us to look at it.

Sensitive information

We do not ask for health, religious or other special-category data, and you should not include it in the free-text answer that asks what would make the residence feel right for you. If it does appear there, it follows the same retention schedule as the rest of your Resident Profile (see How long we keep it, above) — and you can ask us to remove it from your profile at any time, sooner than that schedule, using the contact above.

Children

This page is addressed to adults, and the residence is designed for people aged 45 and over. We do not knowingly collect data from minors.

Changes

If we change how any of this works, we update this page and the date at the top of it. If the change affects what you consented to, we ask you again.