Privacy policy

Valid from 24 October 2026

Courtesy translation. This English text is provided for convenience only. The legally binding version is the Slovak original; if the two differ or anything is unclear, the Slovak version prevails.

1. Who processes your data

The controller of personal data is Bandurka s.r.o., Company ID 22450319, registered office Zenklova 24/54, Libeň, 180 00 Prague 8, registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 416658 (“we”). In matters of personal data write to us at info@mestomat.sk. We haven’t appointed a data protection officer, the law doesn’t require us to.

You can use most of the website without signing up and without us storing anything about you. We process personal data mainly when you create an account and write a review.

2. What data, why and for how long

User account

Username, e-mail and password (we store only a secure hash of it, we don’t know the password itself). We need them to run your account, log you in, confirm your e-mail and reset your password. The legal basis is the performance of a contract, i.e. the terms of use. We keep the data as long as the account exists. Registrations nobody confirmed through the e-mail link are deleted automatically after a while.

Reviews and reports

The text of a review, the stars, your relation to the school or district (e.g. “child attends the school”, “has lived here since 2015”), the moderation status and any moderator’s note. With a review we publish the text, the stars and the relation, never your username or e-mail. When you report someone else’s review, we store the reason, your message and that the report came from your account. The legal basis is the performance of a contract and our legitimate interest in moderating content and protecting the rights of others. We keep a review until you or we delete it, or until you cancel your account. A report is deleted together with the review.

Saved places and alerts

The neighbourhoods and schools you save, and when you saved them; only you see them. When you turn alerts on, we e-mail you at most once a week about new reviews of your saved places, and once a year a reminder of the enrolment (zápis) at a saved school or nursery; for that we store when we last sent the e-mail and a random code for the unsubscribe link. The legal basis is the performance of the contract (an account feature you turn on yourself). Turn alerts off with the link in every e-mail or in “Saved”; saved places are deleted together with the account.

Voting for the next city

On the home page you can vote for which city we should add next. We store the chosen city and the time, and your e-mail only if you fill it in yourself. We use it only to let you know that we’ve launched the city; we send no other messages to it. The legal basis is your consent, which you can withdraw at any time by e-mail to our address. We delete the e-mail once the city launches, or after three years at the latest.

Security records

IP address, username and the time of logins and logouts, failed login attempts and temporary blocks after too many requests. They protect accounts and the website from misuse (legitimate interest). We keep them for 12 months at most.

E-mails

We send only e-mails that belong to your account: registration confirmation, password reset, the outcome of moderating your review, and alerts about saved places if you turn them on. We send no marketing messages.

3. Cookies and similar technologies

Necessary: the session cookie (JSESSIONID), which keeps you logged in and protects forms from misuse. The website with an account doesn’t work without it, so it needs no consent. It lasts until you close the browser or log out.
Functional: the cookie cil with the code of an address you entered yourself as your commuting destination on the list of districts. We set it only at your request, to show you the travel time on other pages too. It lasts a year, we don’t store it anywhere on the server, and you delete it with the “forget” link.
Functional: the cookie anketa with a random number, set when you answer the quick poll “Do you live here?”. Thanks to it everyone answers only once and can change the answer. With the number we store only your answers (no IP address, name or e-mail), so you can’t be identified by it. It lasts two years; deleting the cookie in your browser separates the answers from you.
Visit statistics without cookies: to know which pages help people, we use the tool Umami on our own server. It records the page viewed, where you came from, the type of device and browser, and the country and city estimated from the IP address. It stores nothing in your browser and doesn’t keep the IP address: from it and the browser details it only computes an anonymous, regularly changing hash so that one visit isn’t counted several times. We share the data with no one; this is based on our legitimate interest.
We use no analytics or advertising cookies. If we ever introduce them, we’ll ask for your consent first and update this policy.

4. Who we share data with

We don’t sell data. It is processed on our behalf only by suppliers the website can’t work without: the server (hosting) provider in the European Union and the e-mail sending provider. We have a data processing agreement with both. We give data to public authorities only when the law requires us to.

Some parts of the pages are loaded by your browser directly from other servers, which therefore see your IP address: map tiles (OpenStreetMap), the noise map once switched on (IPR Praha), fonts (Google Fonts) and code libraries (jsDelivr, cdnjs). These services process data under their own policies.

5. Your rights

You have the right of access to your data, to rectification, erasure, restriction of processing and portability, and the right to object to processing based on legitimate interest. Write to us at info@mestomat.sk from the address of your account; we’ll reply within one month at the latest. You can also ask us to cancel your account at the same address.

If you believe we handle your data unlawfully, you can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz), or with the supervisory authority of the EU country where you live (in Slovakia the Úrad na ochranu osobných údajov SR, dataprotection.gov.sk).

6. Security

The website runs only over an encrypted connection (HTTPS), we store passwords only as a hash (bcrypt) and only the operator has access to the data. No automated decisions are made about you and we do no profiling.

7. Changes

We may change this policy, e.g. when we add a new feature. The current version is always on this page with its date of validity; we tell registered users about significant changes by e-mail.