Privacy Policy

Information and instruction on the collection and processing of personal data
pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "Regulation") and pursuant to Act No. 18/2018 Coll. on the protection of personal data and on amending and supplementing certain acts (hereinafter referred to as "the Act"):

Operator AUTOKLUB, a.s. with registered office Teplická cesta 1, 058 01 Poprad (hereinafter referred to as the Controller) hereby informs the data subjects about the collection and processing of their personal data.

This information is addressed to you if you are our customer, but also if you are an employee of our customer or supplier who is a legal entity or a sole trader and your employer has designated you as their authorised person for individual areas of communication relating to the supply of goods and services within the contractual relationship.

Data Protection Policy

We only process your personal data on the basis of the lawful conditions set out in the Regulation or the law. As a data controller, we are responsible for the protection of your personal data that we have obtained or obtain about you in accordance with the Regulation and the law to the extent and in the manner set out in this notice. If you have any questions about the processing of your personal data, you can contact us in person or by post at our registered office, by telephone on the following number +421 52 426 4700 or by email: rent@autoklub.sk.

Necessity to provide personal data

We need your personal data because in case you do not provide it, the contractual relationship between the supplier and the customer cannot be established, since in accordance with the Act of the National Assembly of the Slovak Republic No. 513/1991 Coll. (Commercial Code), as amended, your identification as a contracting party (or as a person designated by your employer to handle contractual matters) is one of the essential elements of the contract.

Recipients of personal data

Personal data will be processed and stored in our internal systems and will only be further disclosed by us to other recipients if this is necessary to achieve the purpose of the processing or on the basis of a legal obligation arising from specific legislation.

Recipients of personal data may be:

• control, supervisory and other state authorities in the performance of their activities within the meaning of a specific legal regulation (e.g. the Slovak Trade Inspection Authority, the Office for Personal Data Protection, the Tax Office, etc.),
• courts and law enforcement authorities at their request or in the legitimate interests of the controller in proving, asserting and defending legal claims,
• insurance companies with which the operator has concluded an insurance contract related to the rented vehicle,
• contracted service providers, such as providers of IT services, postal and freight forwarding services, financial and insurance services,
• to other recipients to whom the controller is obliged to provide personal data pursuant to a specific law or legitimate interest, such as auditors, legal advisors, tax and accounting advisors, insurance companies, banks, credit registers, third parties evaluating the use of our contractors' services, persons who are in an employment or other similar relationship with us, to the extent strictly necessary for the exercise of their work or rights, and who, at the same time, in relation to the personal data provided or made available, will be under an obligation of confidentiality with respect to such information to the extent and under the conditions agreed in the written contract we enter into with them or provided for by generally applicable law.

Purpose of personal data processing

We will collect and further process your personal data for the following purposes:

• Conclusion and performance of the contract; For the performance of contractual obligations or to carry out measures at your request before we enter into a contract with you, in particular for the purposes of processing and sending quotations, bookings, preparing and concluding contracts, registering contracts, including any changes thereto, in our internal system, checking the performance of contracts and the obligations of the parties, in particular in the context of rental contracts, rental contracts and framework contracts, as well as other obligations related to the administration of contracts, the picking up and returning of the vehicle, the handling of complaints and claims, invoicing, the recovery of damages and claims arising in connection with the supply of goods and services, the settlement of insurance claims, the storage of related documentation and records, the mutual communication of the parties, etc. The legal basis for the processing of your personal data for this purpose is Article 6(1)(b) and (c) of the Regulation, i.e. the performance of the contract and the fulfilment of the legal obligations of the controller arising in particular from the Act of the National Council of the Slovak Republic No. 513/1991 Coll., the Commercial Code, as amended. The provision of personal data by the data subject in this case is a contractual requirement. In the event of failure to provide personal data, it will not be possible to enter into a contractual relationship with the data subject.
• Marketing; In case of your consent, we will send you business information about products and various promotions by post, e-mail, SMS message or any other form. We will only send commercial information to the extent and frequency that is not annoying to you. The legal basis for the processing of your personal data for this purpose is the provision of Article 6(1)(a) of the Regulation, i.e. the consent of the data subject. You may withdraw your consent at any time, and we will notify you of the specific method of withdrawal (depending on the method of consent) in the request for your consent. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. Processing for marketing purposes may be regarded as processing based on the legitimate interests of the controller if you are our customer and we consider it to be in our legitimate interest to keep you informed of news and offers in our service area. You have the right to object to the processing of your personal data for marketing purposes or to stop receiving our marketing messages at any time via a link directly in these messages.
• Identification of persons – in order to unambiguously identify and verify the identity of persons - customers, or persons authorized by the customer (in the case of a customer who is a legal entity or a sole trader) and in order to verify the authenticity of official documents as well as the possible necessity to provide assistance to law enforcement authorities in the event of theft or damage to the property of the operator - rented property, we make photocopies of official documents (ID and driving licenses and passports). The legal basis for the processing of your personal data for this purpose is the provision of Article 6(1)(f) of the Regulation, i.e. the legitimate interest of the controller, which in this case is the protection of the property and financial interests of the operator in order to prevent crime and other anti-social activities in the field of property crime, committed primarily in the form of theft and damage to the property of the operator.
• Protection of the assets and financial interests of the operator; To protect the operator's property and financial interests, selected rental vehicles are secured by monitoring their location via satellite tracking (GPS), which enables tracking of rented movable assets during their use and after their theft. The processing of personal data resulting from the information obtained on the location of the vehicle occurs if the rented motor vehicle is used by a specific individual, i.e. if at the time of use of the rented movable property the operator is able to identify the specific individual and the vehicle is equipped with a monitoring device. In such a case, personal data will be processed to the extent of the GPS information obtained about the occurrence of the movable items and the identification data of the data subject. The hirer is informed upon taking possession of the movables that the hired movables are equipped with a GPS monitoring device. The legal basis for the processing of your personal data for this purpose is the provision of Article 6(1)(f) of the Regulation, i.e. the legitimate interest of the controller, which in this case is the protection of the property and financial interests of the controller in order to prevent crime and other anti-social activities in the field of property crime, primarily committed in the form of theft and damage to the property of the controller.
• Bookkeeping and preparation of accounting documents; In particular, administration and invoicing of prices for the supply of goods and services, processing of accounting, tax documents and invoices. The legal basis for the processing of your personal data for this purpose is the provision of Article 6(1)(c) of the Regulation, i.e. the fulfilment of our legal obligations arising in particular from Act No. 431/2002 Coll. Act No. 222/2004 Coll. on value added tax, as amended, etc..
• Recording of mail and registry management ; registration and management of postal items, mail delivered and sent to and from the electronic mailbox and registration and archiving of contracts, accounting, tax and related documents in our internal systems. The legal basis for the processing of your personal data for this purpose is the provision of Article 6(1)(c) of the Regulation, i.e. the fulfilment of the legal obligation of the controller under specific regulations, in particular under the Accountancy Act and Act No. 395/2002 Coll. on archives and registers and on amendment and supplementation of certain acts.

Categories of collected and processed personal data

We will only collect and process your routine personal data to the extent necessary in the course of our activities in connection with the provision of our services. We will not process special category personal data that would reveal your racial or ethnic origin, political opinions, political or philosophical beliefs, trade union membership, genetic data, biometric data, sexual orientation and other sensitive personal data about you.

We process your personal data to the following extent:

• Identification data: title, first name, surname, date of birth, signature, facial photograph and other data on the identity card or passport and driving licence.
• Contact details: address of residence or delivery address, e-mail address and telephone number.
• Banking, financial and transaction data: credit card number, bank account details, payment details.
• Insurance event-related data: claims history, including claims paid and expert opinions, information on victims.
• Location data: monitoring of the location of selected rental vehicles by satellite tracking (GPS), which allows tracking of rental vehicles when they are in use or after they have been stolen.

Retention period of personal data

We will process your personal data for as long as necessary to achieve the purposes of processing, but no longer than for the duration of the contractual relationship.

If we assert legal claims against you and conduct legal or administrative proceedings, or if you assert legal claims against us and conduct legal or administrative proceedings against us, personal data will be processed for the purpose of proving, asserting or defending legal claims until the final conclusion of such proceedings. After the termination of the contractual relationship or the final conclusion of the proceedings in accordance with the previous sentence, your personal data will only be stored (archived) for 10 years after the termination of the contract, because the obligation to store the contract and the accounting and tax documents related to the contract containing your personal data is imposed on us by generally binding regulations, in particular by the Accounting Act. After this period, the data will be deleted or destroyed/shredded.

If at any time you object to the processing of your personal data for direct marketing, we will stop processing your personal data for this purpose.

The personal data obtained from the monitoring of movable assets is kept for 1 year after the end of the contractual relationship.

Photocopies of official documents shall be kept for the duration of the contractual relationship and shall be destroyed within 1 year at the latest, unless the controller uses them on the basis of legitimate interests (e.g. in the context of dealing with damages, insurance claims and theft) or to prove, assert or defend legal claims.

Withdrawal of consent to the processing of personal data

If we also process your personal data on the basis of your consent, you have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal. You may withdraw your consent in the same way as consent was given.

Automated decision-making, including profiling.

There is no automated decision-making or profiling in the processing of your personal data by us.

Rights of the data subject in relation to the protection of personal data

In addition to the rights listed above, you have the following rights in relation to the processing of your personal data:

Right of access to personal data (Article 15 of the Regulation); you have the right to obtain confirmation from us as to whether we are processing your personal data and, if so, to obtain access to such personal data (copies thereof), as well as to additional information to the extent provided for in Article 15 of the Regulation. In most cases, we will provide you with these copies of your personal data and additional information in written paper form, unless you request otherwise. If you have requested this information by electronic means, it will be provided to you electronically where technically feasible.

Right to rectification of personal data (Article 16 of the Regulation); We take reasonable steps to ensure that the information we hold about you is accurate, complete and up-to-date. However, this right allows you to request us to correct your inaccurate personal data without undue delay or to complete your personal data if it is inaccurate, incomplete or out of date. Please note that you are only obliged to provide us with personal data that is complete and correct, and you are responsible for the inaccuracy of the personal data you provide to us.

Right to erasure of personal data (right to be forgotten) (Art. 17 of the Regulation) without undue delay after exercising this right, for example, if your personal data are no longer necessary for the purpose for which we obtained or processed them, if you have withdrawn your consent to the processing of personal data on the basis of which we process your personal data and there is no other legal basis for the processing of personal data (for example, a contract we have concluded with you), if you object to the processing of personal data pursuant to Art. 21(1) of the Regulation or if we process your personal data in breach of the Regulation and the law. However, this right of yours must be considered in light of all the relevant circumstances. For example, we may have certain legal and regulatory obligations which means that we may not be able to comply with your request.

Right to restrict processing of personal data (Article 18 of the Regulation), you have the right to ask us to stop processing your personal data in the cases provided for by law, e.g. if you object to the accuracy of the personal data we hold about you, but only for a period of time that allows us to verify the accuracy of your personal data, object to the processing of your personal data by automated decision-making or the processing of your personal data is contrary to the Regulation and the law, and object to the erasure of your personal data, instead, you request a restriction on its use or object to the erasure of your personal data which we, as the controller, no longer need and wish to erase but which you need, for example, to prove, exercise or defend your legal claims in an ongoing legal proceeding.

Right to portability of personal data (Article 20 of the Regulation), i.e. the right to obtain from us your personal data that you have previously provided to us in a structured, commonly used and machine-readable format, and the right to request that we transfer your personal data to another controller subject to the fulfilment of the legal conditions; the exercise of this right is without prejudice to your right to erasure of your personal data. However, the right of portability only applies to personal data that we have obtained from you on the basis of consent or on the basis of a contract to which you are a party.

Right to object to the processing of personal data (Article 21 of the Regulation) if the processing of your personal data is based on our legitimate legitimate interest or if we process your personal data for the purpose of direct marketing, including profiling in such processing. If you object and we do not demonstrate a compelling legitimate ground for processing your personal data or if you object to the processing of your personal data for the purpose of direct marketing, we will no longer process your personal data for these purposes.

The right not to be subject to a decision, which is based solely on automated processing of personal data, including profiling, where such automated decision-making and profiling would have legal effects in relation to you or significantly affect you (Article 22 of the Regulation); As we have already stated, there is no automated decision-making or profiling in the processing of your personal data by us.

Right to complain to the supervisory authority (Article 77 of the Regulation); if you believe that the processing of your personal data is in breach of the Regulation or Act of the National Assembly of the Slovak Republic No. 18/2018 Coll. No. 18/2018 Coll.), you may file a complaint (a petition to initiate a personal data protection procedure pursuant to Section 100 of Act No. 18/2018 Coll.) with the Office for Personal Data Protection of the Slovak Republic.

Contact details of the authority:

Úrad na ochranu osobných údajov SR
Hraničná 12
820 07 Bratislava 27
www.dataprotection.gov.sk

---