PRIVACY POLICY

We have prepared this Privacy Policy to inform you about the personal data we process, why we process it, how we handle it, how you can contact us about your personal data, submit requests and exercise other rights, and everything else we are required to disclose under applicable legislation. Our aim is to explain all matters relating to our company's processing and protection of personal data as clearly and understandably as possible.

AUTO - RENTAL, s.r.o., with its registered office at Tomanova 121, 83107 Bratislava, Company ID: 43794904, registered in the Commercial Register of Bratislava I District Court, Section Sro, File No. 48751/B ("Controller 1" or "we"), provides data subjects with the following information on personal data processing under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, "GDPR"):

What is personal data?

Personal data is information that can identify a particular natural person. Data protection does not apply to legal entities themselves, although it may apply to individuals acting on their behalf. Personal data includes information that identifies a person on its own (for example, a first and last name, national identification number or biometric data) and information that identifies someone only when combined with other data (for example, a date of birth together with a permanent address). Personal data may include first and last names, dates of birth, national identification numbers, identity document numbers (including driving licence numbers), passport numbers, business and tax identification numbers, VAT numbers, telephone numbers, email addresses, permanent or temporary addresses, contact addresses, IP addresses, assigned client/customer numbers, video and audio recordings, photographs, biometric data such as fingerprints, and location data. There is no exhaustive list: information that does not identify a person in one context may do so in another. Individuals to whom personal data relates are referred to as "data subjects".

Whose personal data do we process?

Our data subjects include individual customers and statutory representatives of corporate customers who enter into contracts with us on a company's behalf, as well as other individuals authorised by a customer to perform particular acts or exercise rights (for example, to sign an agreement, drive a rented vehicle or act as a contact person). As a controller, we process personal data only to the extent necessary and in accordance with applicable legislation. The specific data processed is determined mainly by the customer agreement and the service agreed in it, our legitimate interests and, where applicable, the data subject's consent, for example when we publish photographs of them on our social media profiles. We also process data about our employees, self-employed business partners and supplier representatives who help us provide our services. Data subjects include visitors to our premises at Bajkalská 31, Bratislava, which are monitored by CCTV, and users of our website and Facebook and Instagram profiles. They may also include individuals whose data is necessary to establish, exercise or defend our rights and legal claims, such as officials, judges, police officers, civil servants, enforcement officers, opposing legal representatives, experts, notaries, official translators, insurance claims handlers, road accident participants, persons injured through the operation of our vehicles and drivers who commit traffic offences during a rental. All drivers of rented vehicles are also data subjects; depending on the vehicle chosen, some may be monitored by GPS.

Other data subjects may include consumers making complaints, people exercising their GDPR rights, individuals whose data appears in accounting documents or is required to meet our tax and contribution obligations (such as statutory representatives, contacts and invoicing staff), and existing customers or their contacts whom we may approach with offers for similar services, discounts and related offers.

With whom do we jointly process your personal data?

Due to our business, staffing, organisational and ownership links, we process your personal data jointly with EUROCOVER Slovakia, s.r.o., registered at Miletičova 57, Bratislava 821 09, in the Commercial Register of Bratislava I District Court, Section Sro, File No. 32651/B ("Controller 2"). We have entered into a joint-controller agreement under Article 26 GDPR. Its essential arrangements affecting data subjects are:

- Data subjects may exercise their rights against Controller 1 and Controller 2 through a single contact point: AUTO – RENTAL, s.r.o., Bajkalská 31, 821 05 Bratislava, or by email to auto@autorental.sk;

- Regardless of the above arrangement, a data subject may exercise GDPR rights with and against either controller separately;

- Controller 1 and Controller 2 jointly provide the information required by Articles 13 and 14 GDPR through this Privacy Policy;

- Controller 1 and Controller 2 have adopted a shared security policy to ensure GDPR compliance and demonstrate accountable observance of the basic processing principles in Article 5(1) and (2) GDPR.

Which personal data must or may we process when entering into a contract?

Every customer contract must contain, among other things, the following customer personal data:

- First name, last name, date of birth and permanent address for an individual customer;

- Business name, place of business and business identification number (or an equivalent number assigned in another EU country) for a sole trader;

- The person or persons authorised to act for an individual customer or legal entity, including representatives and statutory officers, and the information needed to contact them effectively, usually their phone number and email address;

- The driving licence of the person who will drive the rented vehicle.

To verify the information provided, we may require customers or their authorised representatives to present identification and proof of entitlement to drive when entering into a customer contract. Our staff may therefore ask you to present your identity card and driving licence, or passport or other identity document, and may make copies. You will also be asked to provide all information required in the agreement, as listed above. Without this information, we cannot enter into a vehicle rental agreement or hand over the ordered vehicle. A copy of the identity document and driving licence of the driver is required to conclude the agreement. If these are not provided, we cannot conclude the rental agreement and will not rent the vehicle to you, in order to protect our legitimate interests.

We also need customers' email addresses and telephone numbers to perform the contract and communicate effectively. Failure to provide this data may complicate or prevent conclusion of the agreement, so we consider it necessary for entering into the contract.

For what purposes do we process your personal data?

We collect and process personal data for the following purposes:

· Performing contracts and providing services, including in particular:

- Vehicle rental and operating lease services;

- Operational assistance services, such as airport transfers or collection of a rented vehicle from an airport;

- Other additional services, such as passenger or parcel transport;

- Verifying the identity of the person entitled to collect a vehicle, including copying their identity document;

- Using internal administrative systems;

- Fulfilling rights and obligations in B2B/B2C customer relationships under general rental terms and other agreements;

- Processing the data of contacts and statutory representatives of legal entities when concluding or performing contracts with customers, business partners and suppliers;

- Providing information society services, such as remembering completed online order forms at your request;

- Processing data about our internal self-employed business partners;

- Collecting data through our websites to establish pre-contractual relationships or provide customer support.

· Meeting legal obligations, including in particular:

- Keeping accounts;

- Meeting employer obligations under the Labour Code and other applicable laws;

- Meeting tax and contribution obligations;

- Handling data subjects' GDPR requests;

- Using an electronic mailbox under the e-Government Act;

- Carrying out transaction due diligence to prevent money laundering and terrorist financing, which may include copying an identity document;

- Handling consumer complaints.

· Protecting property and security, including in particular:

- GPS monitoring of vehicles;

- Using CCTV;

- Ensuring IT security.

· Raising awareness and building customer relationships (marketing and PR), including in particular:

- Targeting and personalising online advertising;

- Operating Facebook and Instagram profiles;

- Conducting customer satisfaction surveys;

- Direct-marketing electronic communications with existing customers or potential customers who have consented;

- Communicating quickly and effectively with customers to improve their experience;

- Publishing promotional photographs featuring data subjects who have consented to the processing, for example on social media;

· Establishing, exercising or defending legal claims (legal administration), including in particular:

- Keeping terminated contracts until related legal claims become time-barred;

- Keeping records of powers of attorney;

- Scanning and copying official documents needed to pursue legal claims;

- Managing litigation, administrative and criminal proceedings;

- Retaining legal documentation demonstrating compliance with administrative and legal obligations where it contains personal data;

- Cooperating with public authorities;

- Providing data to insurers and the Slovak Insurers' Bureau in connection with insurance claims;

- Providing data to lawyers, auditors and other advisers defending legal claims;

- Collecting our overdue debts out of court.

· Statistical purposes, including in particular:

- Using Google Analytics on the website.

What legal bases allow us to process your personal data?

Like other organisations, Controller 1 and Controller 2 may process individuals' personal data on several legal bases, meaning formal grounds and authorisations for processing. Processing is lawful if at least one of the following bases applies. Data processed for one purpose may also rely on more than one legal basis, as sometimes happens in our case.

The legal bases on which we may process your personal data are:

a) The data subject's consent to at least one specific purpose.

If you give or have given consent to processing your personal data, we are entitled to process it. Consent need not be in writing only: it may be given in a contract, in a separate document, by ticking a box on a website, or otherwise.

Withdrawal of consent stops processing based exclusively on that consent. Where we also process the data on another legal basis, withdrawal does not remove our right or obligation to continue processing on that basis. For example, if we process data to perform our customer agreement or protect our legitimate interests, withdrawal of consent does not affect that processing.

We use this legal basis for raising awareness and building customer relationships (marketing and PR).

b) Processing is necessary to perform a contract with the data subject or take steps at their request before entering into a contract.

Much of your personal data is processed because it is needed to perform our contract and the rights and obligations arising from it, including the applicable general terms. To simplify and speed up communication about the service, we exchange information by email or phone, such as electronic invoices, planned servicing, complaints and breakdown reports. We therefore need your email address and telephone number. The parties must also be sufficiently identified for a valid contract to be concluded.

Where processing is necessary to perform our contract, separate consent is not required or relevant. Concluding the rental agreement gives our company the right, and usually the obligation, to process and retain the relevant personal data.

We use this legal basis for performing contracts and providing services.

c) Processing is necessary to comply with a legal obligation of the controller.

Our company has numerous obligations under generally applicable Slovak legislation. For example, Act No. 431/2002 Coll. on Accounting requires personal data processing in connection with keeping accounts. Other obligations arise under tax and employment legislation. We must also ensure an appropriate level of processing security and handle requests to exercise GDPR rights, which also requires some data processing. When the relevant legal obligation applies, we are required to carry out those processing operations.

Separate consent is not required for processing needed to meet our legal obligations, as the obligation arises from legislation.

We use this legal basis to meet legal obligations and, partly, to protect property and security through operations that ensure the IT security of our assets and personal data.

d) Processing is necessary to protect your life, health or property, or that of another individual.

Where necessary to protect your property or another individual's property, we may process personal data on that ground without separate consent.

We do not normally use this legal basis in practice, but it may apply in exceptional circumstances where data must be provided to emergency services, such as the police, fire brigade or paramedics.

e) Processing is necessary for the legitimate interests of our company or a third party.

We also process some personal data for reasons important to providing high-quality rental services, maintaining and developing good customer relationships and convenience, and adequately protecting our claims. Protecting customers' interests and convenience also supports our legitimate interest in good customer relationships.

We use this legal basis for the following purposes:

- Performing contracts and providing services;

- Protecting property and security;

- Raising awareness and building customer relationships (marketing and PR); and

- Establishing, exercising or defending legal claims (legal administration).

What legitimate interests do we rely on when processing your personal data?

For performing contracts and providing services, our legitimate interests include in particular:

- Verifying the identity of customers and drivers, including copying identity documents and driving licences, to prevent vehicles being obtained fraudulently under false identities; handling insurance claims efficiently to optimise operating costs, maintain cash flow and minimise lost earnings; taking preventive basic anti-money-laundering measures beyond statutory requirements to avoid breaches; and retaining evidence that may be needed to establish, exercise or defend claims against drivers, including recourse claims for damage caused through vehicle operation;

- Processing data about individuals who are not direct parties to our corporate customer contracts where needed to provide our services.

For protecting property and security, our legitimate interests include in particular:

- Protecting our company's and customers' property;

- Preventing unlawful conduct, maintaining security and detecting crime;

- Protecting our company's monetary and non-monetary claims;

- Protecting health and road safety for customers and their employees;

For raising awareness and building customer relationships (marketing and PR), our legitimate interests include in particular:

- Raising awareness of our company and services through social media profiles;

- Raising awareness through personalised online advertisements, including profiling for direct marketing;

- Processing data needed for fast, effective customer communication, regular contact and customer convenience, including emails offering goods and services to existing customers;

- Processing data needed to offer customers better-value services, discounts and promotions, including by email.

For establishing, exercising or defending legal claims (legal administration), our legitimate interests include in particular:

- Exercising, establishing or defending our rights and legal claims before the relevant courts and other public authorities;

- Exercising, establishing or defending our rights and claims against any individuals or legal entities in relation to whom rights, claims or obligations arise;

- Cooperating with authorised public authorities;

- Negotiating and resolving disputes out of court concerning the conclusion and performance of contracts;

- Creating and retaining evidence needed to exercise, establish or defend our rights and claims against employees, contractual partners, third parties or public authorities.

To whom may we disclose your personal data (recipients)?

Your personal data may be disclosed to the following categories of recipients:

a) Lawyers, law firms and enforcement officers.

Like any business, we expect to be paid properly and on time. When collecting debts, identifying data in customer contracts, handover records and invoices may be disclosed to lawyers and subsequently to enforcement officers. Both are bound by statutory confidentiality requirements governing their work. When we use legal services and disclose personal data to lawyers, they process it as independent controllers. The same applies to enforcement officers.

b) Our company's accountants, tax advisers and auditors.

For accounting and statutory audit purposes, we provide invoices to external organisations, which may therefore receive the personal data shown on them. In exceptional cases, customer contracts may also be provided to check invoicing amounts and accuracy, in which case the data in those contracts is disclosed as well.

c) Assignees of our receivables and debt collection agencies.

If customers have unpaid debts, we may assign those receivables to a third party under Section 524 et seq. of Act No. 40/1964 Coll., the Civil Code, as amended. The assignee may then collect the debts. Assignment mainly reduces the administrative burden of judicial or out-of-court debt recovery and improves cash flow. To enforce the claims, the assignee needs accounting, contractual and other documents that may be used as evidence in court. Data in contracts, handover records, invoices and payment records may therefore be transferred as part of an assignment. We may also provide necessary data to collection agencies that recover overdue debts out of court without any change of creditor.

d) Maintenance and other service suppliers (processors).

We provide some customer services through subcontractors acting as data processors. This helps reduce costs and customer prices while improving service speed and quality. Data is provided only to the extent necessary to serve the relevant customer and properly perform our contract. Our processors mainly include web-hosting and cloud-storage providers, technical support providers with access to our systems, GPS monitoring providers, collection agencies, and accounting and administrative service providers. An up-to-date list of processors is available on request.

e) Our employees and business partners involved in providing services.

We also disclose data to employees and internal associates who have received instructions under Article 29 GDPR on safe and lawful processing. They are bound by confidentiality under Section 79 of Act No. 18/2018 Coll. on Personal Data Protection and amending certain acts. They process data when providing services and related administrative or technical support.

For example, regular customer care, service-quality assessments, a 24-hour service/hotline, IT support and administration may be provided by internal business partners. We may also use such partners to provide some services in locations we cannot cover directly.

f) Social media operators and remarketing system providers.

Facebook and Instagram

Our website integrates social-media plugins of Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA ("Facebook"), identifiable by the Facebook/Instagram logos. When you visit our website, Facebook receives information that your IP address visited it. If you click the Facebook icon while signed in and/or registered with Facebook, website content is redirected to your Facebook profile and Facebook may associate the visit with your account. Data is transmitted whether or not you have a Facebook account. We have no influence over the data collected or its processing and do not know the full scope, purposes or retention periods. Facebook stores the data as user profiles and uses it for advertising, market research and/or tailoring its services and tools to registered users. Such evaluation is used in particular to inform other Facebook users about your activity on our website. You may object to the creation of such profiles directly to Facebook. We recommend logging out after using Facebook, particularly to prevent your internet activity being associated with your profile. Further information is available in Facebook's privacy policy: https://www.facebook.com/policy.php .

We may also use Facebook Ireland Limited's "data file custom audiences" service to manage advertising audiences, which may match data we process against personal data in Facebook databases, and "measurement and analytics", in which Facebook processes personal data on our behalf to measure advertising reach and performance and provide reports about users who viewed or responded to our advertisements. This may occur when you interact with our advertising or websites while using Facebook. In these cases Facebook acts as our processor, under the safeguards at https://www.facebook.com/legal/terms/businesstools and https://www.facebook.com/legal/terms/dataprocessing .

Use of our social-media profiles may also involve processing for statistical purposes. Under the case law of the Court of Justice of the European Union, we act as a joint controller with Facebook for this processing. The essential joint-controller arrangements are available at https://www.facebook.com/legal/terms/page_controller_addendum .

If you object to the processing described above, you may exercise your right to object or use the online-marketing industry's self-regulatory tools at http://www.aboutads.info/choices and http://www.youronlinechoices.eu/ . These tools can identify and delete third-party digital identifiers in your browser, including Facebook identifiers, to prevent related personal data processing.

Google AdSense

We may use Google's behavioural advertising and direct-marketing services to raise awareness of our company, for example when you click our sponsored search links. Although we do not have your personal data, Google processes it in its own name as an independent controller to display our advertising based on profiling. Processing between our company and Google Inc. is governed by https://privacy.google.com/businesses/controllerterms/ .

Google Analytics

This Google Inc. analytics service stores information in cookies to generate website traffic statistics. It is not necessary for browsing and helps us monitor and improve the website.

When using Google Analytics, we (Controller 1 and Controller 2) do not ourselves process personal data or identifiers such as IP addresses that could indirectly identify data subjects. Google Inc. may nevertheless process your personal data as our processor under https://privacy.google.com/businesses/processorterms/ .

The main Google Analytics cookie is __ga. More information about Google's cookie types is available at https://policies.google.com/technologies/types?hl=en .

In addition to reporting website usage statistics, Google Analytics can be combined with advertising cookies to display more relevant Google advertisements based on search history and activity on our website, and to measure interactions with those advertisements.

Google Analytics uses cookies stored on the visitor's device, such as a computer, tablet or smartphone, to analyse website behaviour. Google anonymises part of the device's IP address when collecting it to strengthen privacy protection. Google Inc. uses website usage information to evaluate your use, provide activity reports and supply further services relating to website and internet use. You can prevent this processing by configuring your browser and installing the browser add-on available at https://tools.google.com/dlpage/gaoptout?hl=en .

Clicking the link places an opt-out cookie in your browser to prevent future collection of data when visiting the website.

Further information about Google's processing when using Google Analytics is available at https://policies.google.com/technologies/partner-sites?hl=en .

g) Insurers and the Slovak Insurers' Bureau.

If a vehicle is damaged or destroyed in a road accident during a rental, personal data about accident participants is processed to handle the insurance claim. We may disclose it to the insurers involved and, where the responsible party is uninsured or unidentified, or for other legal reasons, to the Slovak Insurers' Bureau.

h) Financial intermediaries, banks and financial institutions.

When working with financial intermediaries on claims and benefits under a financial services agreement, such as an insurance policy, we may disclose data included in the agreement and supporting documentation, including insurance claim documents. Data may also be processed when we enter into financial services agreements for our own needs; this does not involve processing our customers' personal data. Financial intermediaries act as controllers; further information is available at https://globins.sk/gdpr.html . Data may also be processed when you use banking and payment services in dealings with us, with banks acting as independent controllers.

i) Internet service provider.

If you use our customer Wi-Fi, for example, our internet provider may receive information that indirectly identifies you. The provider acts as a controller; further information is available at http://www.rainside.sk/ochrana-osobnych-udajov.html .

Not all personal data is disclosed to all categories listed above. We disclose data only to the extent necessary, when relevant grounds arise and for the required processing purpose. Please also note that these categories of recipients do not include third parties.

How long do we process your personal data?

We process personal data only for as long as necessary and, where legislation specifies an exact period, for that legally required period.

Our retention policy is based on keeping customer data for the minimum period. In our electronic database, we retain it until the vehicle is properly returned. Written customer records, including agreements and document copies, are retained for a further three months. In specific cases, electronic and written data relating to service provision may be retained for up to one year. This does not prevent processing for other purposes where a sufficient legal basis exists and the retention periods below apply.

The following table summarises maximum retention periods by purpose:

From which sources do we obtain your personal data?

We most often obtain data directly from you. Providing it is voluntary. You may provide it in various ways, for example:

- Registering on our websites or ordering our services;

- Entering into a contract with us;

- Communicating with us;

- Taking part in events we organise;

- Using our Facebook/Instagram profiles;

- Using our website;

- Submitting a contact form with comments or questions about our services or contractual relationships.

We may also obtain data from your employer or the company in connection with which we process your data. This commonly applies when you drive a vehicle rented under an agreement with your employer or another person with whom you have a legal relationship. It also applies when we negotiate or enter into a contract with a company and your personal or contact details are needed to conclude or perform it.

Where data is collected in connection with a contract, it is usually a contractual requirement or necessary to conclude the contract. Failure to provide your or your colleagues' data may adversely affect the organisation you represent because the contract cannot be concluded or performed; for example, we may be unable to rent you the vehicle requested.

If you are a statutory representative of an organisation that contracts or negotiates with us, we may obtain your data from public sources and registers, such as the Commercial Register or Trade Register.

We may also obtain data from customers or the police if you are involved in an accident during a rental in which our vehicle is damaged or destroyed.

We do not systematically process accidentally obtained personal data for any of our stated purposes and arrange its prompt destruction.

Do you make automated individual decisions based on my personal data?

No. We do not carry out fully automated processing that produces legal effects or otherwise significantly affects you. In practice, we do not use software that generates decisions based on your data with significant consequences, such as automatically refusing to provide our services.

To which countries do we transfer your personal data?

By default, we restrict transfers outside the EU and/or European Economic Area unless necessary. Some subcontractors or recipients listed above may be based, or have servers, in the United States. The USA is generally considered a third country without an adequate level of protection, but transfers outside the EU/EEA take place only in strict compliance with GDPR safeguards. Following the Court of Justice of the European Union's Schrems II judgment of 16 July 2020 invalidating the EU–US Privacy Shield, our subcontractors mostly use European Commission-approved standard contractual clauses as a specific transfer safeguard. We have assessed each case individually and consider that these transfers do not create increased risks to data subjects' rights and freedoms.

The table below links to adequate or appropriate safeguards and the means of exercising your GDPR rights:

Cookie processing

Cookies are small text files that improve website use, for example by recognising returning visitors when signing in, remembering choices when a new window opens, and measuring traffic and usage to improve the user experience. Our website mainly uses cookies to measure visits and support direct marketing. You may prevent their storage at any time through browser settings. Under Section 55(5) of the Electronic Communications Act, your browser settings are considered consent to the use of cookies on our website.

Our websites directly store a cookie recording the permanent dismissal of the cookie notice after the visitor agrees by clicking "OK". On www.auto-rental.sk we also use session cookies, which contain only non-personal visitor information and are automatically deleted when the browser closes. They provide useful information such as visitor numbers and browser types, helping us optimise and improve the website. Functional cookies remember language preferences and improve security, for example by protecting against bots. Third-party tools integrated into our websites also use cookies, mainly to support marketing, statistical and analytical activities that help us operate a modern website.

In general, cookies do not constitute personal data for us because we cannot identify you from them alone. Third parties or our processors, such as Google and Facebook, may be able to identify you when combining them with their own data. Since cookie processing affects your privacy, we aim to provide as much information as possible, including understandable explanations of how to prevent processing effectively; see the Google Analytics and Facebook sections above.

We currently do not use cookies on www.eurocover.sk. On www.auto-rental.sk we mainly use the following cookies:

Changes to this Privacy Policy

Data protection is an ongoing matter for us. The information we must provide about our processing may change or become outdated. We therefore reserve the right to amend this Privacy Policy at any time and to any extent.