Protection of personal data and information for the person concerned

Protection of personal data and information for the person concerned

For our company, it is a priority to protect customers' personal data in accordance with current legislation, in particular within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 about the protection of individuals with regard to the processing of personal data and on the free movement of such data, which repeals the Directive 95/46 / EC (General Data Protection Regulation - GDPR) and Act No. 18/2018 Z. z. on the Protection of Personal Data and on Amendments to Certain Acts ("ZoOOÚ").
We comply with all the necessary standards and rules and therefore, under the relevant ZoOOÚ, we provide the concerned person the information mentioned below.

· 1. Definition of basic concepts

Personal information - A physical person's name that can be identified directly or indirectly (eg name, surname, identification number, location data, online identifier, etc.);
The person concerned - any person whose personal data are being processed (eg customer, potential customer, employee);
Operator - anyone who, alone or together with others, defines the purpose and means of processing personal data and processes personal data on its own behalf;
Intermediary - Any person processing personal data on behalf of the operator;
Processing of personal data - processing operations with personal data (eg, collecting, recording, organizing, structuring, storing, changing, searching, viewing, exploiting, transmitting, spreading or otherwise, regrouping or combining,restricting availability or deleting);
Recipient of personal data - anyone to whom personal information is provided, irrespective of whether it is a third party;
Third party - A subject other than the person concerned, the operator, the intermediary and the persons who, under the direct authority of the operator or intermediary, are entrusted with the processing of personal data;
Profiling - Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal characters or characteristics relating to the person concerned;
Purpose of processing personal data - the reason the operator processes personal data;
Special categories of personal data - sensitive personal data of a specific nature (eg genetic data, biometric data, health data);
Restriction on the processing of personal data - Marking of retained personal data to restrict its processing in the future;
Responsible person - a person designated by an operator or an intermediary who performs tasks under the ZoOOÚ.

· 2. Identification and contact details of the Operator

The personal data operator is each of the listed companies that are members of the "Europcar" group.
PP Rent Cars, s.r.o., Company Registration Number: 35 869 992, establishment: Brusnicová 12316/20, 831 01 Bratislava;
Eurent Slovakia s.r.o., Company Registration Number: 35 842 598, establishment: M. Sch. Trnavského 14, 841 01 Bratislava;
(hereinafter referred to as "Europcar" or "Operator").
The individual members of the "Europcar" group listed above may, in special cases, hold the position of an intermediary vis-à-vis another operator, who shall determine the purpose and means of processing personal data.

· 3. Contact details of responsible person

The Operator's Responsible Person is: Adrián Haďunga, address of correspondence: M.Sch.Trnavského 14, 841 01 Bratislava, e-mail: gdpr@todos.sk,
tel. n. +421 918 631 935 .

· 4. Categories of processed personal data

An Operator shall process only the personal data necessary to enable him to provide his services, offer his products and provide customer support and to the extent necessary to fulfill the specific purpose of processing personal data.
Depending on the purpose, the Operator mainly processes these data:
a) basic identification data - title, name, surname, billing address, delivery address, date of birth, customer identification number, contract number;
b) contact details - email, phone number, billing and delivery address,
c) payment data and data related to payments accomplished;
d) vehicle data - technical and accounting data, vehicle purchase data, warranty and vehicle value data,
e) test drive data - Driving license data;
f) customer history data - customer satisfaction rate, data collected during seller visits, service history, complaints history,

· 5. Purpose of processing personal data

The purpose of the processing of personal data is in particular:
- processing of contractual and pre-contractual obligations in connection with the sale, rental and management of the Operator's products and in connection with the providing of its services;
- legitimate interest of the Operator;
- compliance with the legal obligations of the Operator;
- processing of the accounting agenda;
- customer records;
- marketing services and news about products and service providers' specialty campaigns and best sale- offers;
- Market Research and Customer Satisfaction Survey;
- providing a financial benefit to the customer;
- processing requests and incentives;
- processing of personnel and wage agenda;
- job attendance of employees.

· 6. Legal basis for the processing of personal data

The legal basis for the processing of personal data is primarily processing:
a) on the basis of the contract, without the need for the consent of the person concerned.
Pre-contractual relations and contractual relations relate in particular to the purchase or rental of the Operator's products or the provision of its services, f.e. orders, buy-sell contracts, lease agreements, repair contracts, and so on. In such case, personal data are processed only to the extent necessary to conclude and perform the relevant contract.
For this purpose, the provision of personal data by the person concerned is entirely voluntary. At the same time, however, this personal data is necessary for the conclusion of the contract and its subsequent administration. Without these data, it will not be possible to close the contract.
b) on the basis of legitimate interests, without the need for the consent of the person concerned
More information on legitimate interest is given in paragraph 7 of this document.
c) by law, without the need for the consent of the person concerned

(eg Act No. 431/2002 Coll., on Accounting)
d) subject to the consent of the concerned person
Consent is required when there is no other legal basis for the processing of personal data and for the processing of specific categories of personal data.

· 7. Eligible Operator's Interests

An operator may process personal data for the purposes of his or her legitimate interests or legitimate interests of the third party. This legitimate interest must outweigh the interests of the person concerned.


The legitimate interests of the Operator are, for example:
- Providing information about the contract management;
- direct marketing, unless consent by law is required;
- enforcement of legal claims;
- transfer of personal data between companies that are members of the Europcar business structure, in particular for internal administrative purposes;
- ensuring network security and information security;
- ensuring the safety of the operating area;
- further processing in accordance with the purpose for which the personal data were originally obtained, if all the conditions of lawful processing have been observed.

· 8. Recipients or categories of recipients of personal data

Recipients, respectively the categories of Operator Recipients are:
Europcar International, S.A.S.U, 2 r René Caudron, 78960 VOISINS LE BRETONNEUX

Jimpisoft, Lda , headquartered 2780 - 195 Oeiras Portugal. FO : 501919678 

- Todos Bratislava s.r.o., headquartered M. Sch. Trnavského 14, 84101 Bratislava, Company Registration Number: 31319823, registered in the Commercial Register of District Court Bratislava I, Section ltd., Insert no. 2447 / B;
- Todos Italia s.r.o., headquartered M. Sch. Trnavského 14,84101 Bratislava, serv. Lamačská cesta 109/A, Bratislava, Company Registration Number: 35754869, registered in the Commercial Register of District Court Bratislava I
- Todos Exclusive s.r.o., Brusnicová 12316/20, 83101 Bratislava, Company Registration Number: 46005731, registered in the Commercial Register of District Court Bratislava I, Section ltd., Insert no.70255/B,
- IPM Systems, s.r.o., Company Registration Number: 47 464 208, headquarters: Oravská Lesná 765, Oravská Lesná 029 57;
- SECURITON Servis, spol. s.r.o., Company Registration Number: 35 693 835, headquarters: Mlynské Nivy 73, 82105 Bratislava.

· 9. The source from which personal data come from

An operator obtains personal data directly from the person concerned or from a person other than the person concerned, f.e. from the close person of the person concerned, from the employer of the person concerned, from the insurance company, from the cooperating entity etc.

· 10. Transmission of personal data to a third country or international organization

The Operator assumes that it will transfer personal data to European Union countries, countries that are party to the European Economic Area Agreement and Switzerland or to third countries that are not Member States of the European Union. The Operator shall transmit personal data to third countries only on condition that these countries, as decided by the European Commission, guarantee an adequate level of protection of personal data. If there is no appropriate European Commission decision to transfer personal data to a third country or international organization, it can only take place if adequate data protection guarantees are provided.
The Operator is currently transferring personal data, e.g. in the use of cloud services and electronic communications via Google, as a company certified in Privacy Shield mode, i.e., guarantees an adequate level of protection of personal data.

· 11. Time of retention of personal data

Personal data is processed for the necessary time, especially for a period of time
- contract duration or
- three years from granting the marketing authorization or
- the duration of the purpose for which personal data are processed or
- laid down by the relevant legislation (e.g. after ten years under Act No. 431/2002 Coll. On Accounting)

· 12. Rights of the person concerned

The person concerned has the rights listed below for the processing of his or her personal data.
a) Right of access to personal data
The person concerned has the right to obtain a confirmation of the processing of personal data concerning him / her. If personal data are processed, they have the right to access these personal data together with information about the processing purpose, categories of processed personal data, recipients or categories of recipients, the period of retention of personal data, the right to repair personal data, delete, restrict or oppose their processing , the right to file a complaint to the Office for Personal Data Protection, information on the source of personal data, information on whether automated decision making and profiling, as well as information and guarantees in the case of the transfer of personal data to a third country or international organization. The person concerned has the right to provide copies of the processed personal data.
b) Right to the repair of personal data
The person concerned has the right to have the Operator corrected incorrect personal data (e.g. when changing the surname, permanent address, etc.) or supplemented incomplete personal data.
c) Right to delete personal information (the right to be forgotten)
The person concerned has the right to have the Operator erase his or her personal data if the legal preconditions for erasure (eg personal data are no longer needed for the purpose, after withdrawal of consent, etc.) are fulfilled.

Right to deletion of personal data

The person concerned does not have the right to erase a personal data, for example, where the processing of personal data is necessary for the exercise of the right to freedom of expression or the right to information, for the purpose of archiving, or to fulfill a statutory obligation etc.
d) Right to restrict the processing of personal data
The person concerned has the right to restrict the processing of personal data to the most pressing legal grounds (e.g. if the person concerned objects to the accuracy of the personal data during a period allowing the Operator to verify the accuracy of the personal data, the processing of the personal data is illegal and the person concerned objects to the deletion of personal data and asks for restrictions on their use instead).
e) Right to the portability of personal data
The person concerned has the right to obtain personal data relating to him / her which he has provided to the Operator in a structured, commonly used and machine readable form and He / She has the right to transfer such personal data to another operator if this is technically possible and if other legal requirements are met. By exercising this right, the right to delete personal data is not affected.
f) Right to object to the processing of personal data
The person concerned has the right to object to the processing of his personal data on account of his particular situation performed for the legitimate interests of the Operator or a third party unless the Operator establishes the necessary legitimate interests for the processing of personal data that outweigh the rights or interests of the person concerned or grounds for legal claim. The person concerned has the right to object to the processing of personal data for the purpose of direct marketing, including profiling.
g) Right to withdraw consent
The person concerned has the right at any time to withdraw consent to the processing of personal data concerning him / her. Revocation of consent does not affect the lawfulness of the processing of personal data based on consent prior to its revocation.
h) Right to lodge a motion to initiate legal proceedings
The person or person claiming to be directly concerned in his / her rights has the right to lodge a complaint or any other complaint concerning the processing of personal data at the Office for the Protection of Personal Data of the Slovak Republic, headquartered Hraničná 12, 820 07 Bratislava 27, Slovak Republic, Company Registration Number: 36 064 220, tel. No .: +421/2/3231 3220, web: https://dataprotection.gov.sk/uoou/
Individual rights may be claimed by the person concerned for each Operator referred to in point 2 of this information document through the contact data therein, i.e., by telephone, e-mail or in paper form via the delivery body.
Notices and measures taken in connection with the rights applied are provided free of charge.

However, if the request of the person concerned is obviously unfounded or inappropriate, in particular for its recurring nature, the Operator may request a reasonable fee for administrative costs or refuse to act on request.
The Operator is required to provide the person concerned with information on the measures taken at his request in connection with the exercise of his rights within one month from of delivery of the request. The stated time limit may be extended by the Operator for two additional months, if necessary, repeatedly. The operator is obliged to inform about any such extension the person concerned within one month of receipt of the request together with the reasons for the extension of the time limit.

· 13. Voluntary provision of personal data

The reason for the provision of personal data by the person concerned is primarily the performance of the contract, pre-contractual relations or compliance with statutory obligations, or the provision of information related to the Products and Services of the Operator. More detailed information is given in Paragraphs 5 and 6 of this document.
The provision of personal data by the person concerned is purely voluntary.

In the event that the Person (Customer / Prospective Customer) does not provide the personal data necessary for the conclusion of the reservation or the contract or for any other purpose, the said will be considered as a disinterest of the Customer to use the offered services.

· 14. Automated individual decision making

The Operator, when providing his services, uses the automatic processing of personal data - issued without human intervention, not by manual means (such as profiling, granting of discounts on fulfillment of specified conditions, camera systems, automated newsletters, etc.). Automatic processing serves for better, more accurate and faster provision of Operator services.
The person concerned has the right not to be covered by a decision which is based exclusively on the automatic processing of personal data, including profiling, and which has legal effects which concern him or have a similar effect on him. The person concerned is therefore entitled to request the Operator to review the issued decision by a method different from the automated form of processing. The method of review and the result of the finding The operator shall inform the person concerned within 30 days of the date of receipt of the request.
The above right of the person concerned does not apply to cases where processing is necessary for the conclusion of a contract or the performance of a contract executed on the basis of a special regulation or based on the express consent of the person concerned.

· 15. Final provisions

This information is primarily intended for the Operator's customers or prospective customers or other interested parties.
This information is published on the Operator's website and is also available in paper form at its headquarters as well as in individual stations.
The Operator shall provide these clearly worded information in a concise, transparent, comprehensible and easily accessible form. If the Respondent or a third person is confused about this document, they may contact the Operator by telephone, email, personally at the place of residence or correspondence via the contact details listed in Paragraph 2 of this information.
This information will be regularly updated. This text is valid and effective from 25.5.2018

Our booking team : +421 2 555 66666