Privacy Policy

Operator Identification:

RentalPort.com, a.s.

Drieňová 27, Bratislava - mestská časť Ružinov 821 01

Business ID 52 339 530

and

Business Partner, selected by the Customer through the Rentalport.com platform, which provides the Customer with the Service (rental of Vehicle, rental of Accessories, provision of Extra Services) in accordance with the General Terms and Conditions of RentalPort.com

(hereinafter collectively referred to as "Operators")

Privacy Policy

The protection of the personal data of Customers and other physical entities is important for the Operators. These conditions explain how the Operators, on the basis of the concluded Agreement of joint operators on the processing of personal data concluded in accordance with § 33 of Act no. 18/2018 Coll. on the Protection of Personal Data (hereinafter referred to as the “Act”) process personal data when providing motor vehicle rental mediation via the website www.rentalport.com. In case the Customer has any questions regarding the protection of personal data, he may contact the Operators by e-mail at (gdpr@rentalport.com) or by post at the Operators' address.

All definitions stated in this statement are governed by the provisions of Law or Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46. / EC (General Data Protection Regulation) (hereinafter referred to as "GDPR").

In particular, these definitions are:

"Personal data" means data relating to an identified physical entity or an identifiable physical entity who can be identified directly or indirectly, in particular by a generally applicable identifier, another identifier such as a name, surname, identification number, location data, or an online identifier, or on the basis of one or more characteristics or traits that make up its physical identity, physiological identity, genetic identity, mental identity, mental identity, economic identity, cultural identity or social identity.

Personal data may include, in particular, data concerning the representatives, employees, members of the project team, and suppliers of the Operator (so-called "Affected Persons"), as well as personal data included in the information systems obtained in connection with the contract.

"Operator" is anyone who, alone or jointly with others, defines the purpose and means of the processing of personal data and processes personal data in his own name; the operator or specific requirements for its designation may be laid down in a special regulation or international agreement by which the Slovak Republic is bound if such regulation or this agreement stipulates the purpose and means of personal data processing,

"Intermediary" is anyone who processes personal data on behalf of the Operator,

"Recipient" means anyone to whom personal data are disclosed, whether or not they are a third party; the recipient is not considered to be a public authority that processes personal data on the basis of a special regulation or an international agreement by which the Slovak Republic is bound, in accordance with the rules of personal data protection applicable to the given purpose of personal data processing,

Purpose of processing

Personal data provided by Customers to Operators will be processed for and/or in connection with the following purposes:

1. Provision of services consisting in the rental of vehicles or the provision of Extra Services or the rental of Accessories, which will be mediated through the website www.rentalport.com

2. Compliance with legal and regulatory requirements (archiving and storage of documents for the purpose of complying with other legal requirements, eg the Accounting Act)

3. Addressing the requirements of any competent authorities and in communication with such authorities

4. Contract management, accounting, internal analysis, risk analysis, analysis of relationships with the Customer

5. Use of IT application systems for information technology services and information systems such as (but not exclusively) email / archiving, etc. This group may also include applications hosted in the cloud, provided that the obligations related to security and data transfer arising from personal data protection legislation are met.

6. Protection of the rights and obligations of the Person concerned and/or the Operators.

Legitimate interests of Operators

Operators may also process personal data if this is necessary for the purpose of the legitimate interests of the Operators or a third party, except where those interests outweigh the interests or rights of the data subject requiring personal data protection, in particular if the data subject is a child.

The legitimate interests of the Operators, including the Operator to whom such personal data may be provided, or third parties may never outweigh the interests or fundamental rights and freedoms of the data subject, taking into account the reasonable expectations of the data subjects based on their relationship with the Operators.

A legitimate interest exists, for example, when there is a relevant and proportionate relationship between the person concerned and the Operator, for example when the person concerned is in the client's position or in his services vis-à-vis the Operator. In any event, the existence of a legitimate interest would require a careful assessment, including an assessment of whether the data subject can reasonably expect that, at a given time and in the context of the collection of personal data, processing for that purpose can take place.

The interests and fundamental rights of the data subject shall prevail over the interests of the Operators, in particular where personal data are processed in circumstances where the data subjects do not reasonably expect further processing.

The processing of personal data for purposes other than those for which the personal data were originally obtained could only be carried out if such processing is compatible with the purposes for which the personal data were originally obtained. In such a case, no separate legal basis is required other than the legal basis that allowed the collection of personal data.

If the data subject consents or the processing is based on EU or Slovak law, which is a necessary and proportionate measure in a democratic society, in particular, to protect important public interests, the controller has the possibility to further process personal data regardless of the compatibility of purposes.

Examples of legitimate interests include:

1. Processing of personal data strictly necessary for the purpose of fraud prevention

2. Processing of personal data for the purposes of direct marketing of existing Customers. However, such persons may object to such processing and may request its termination, which must be complied with by the Operators.

3. Transfer of personal data within the group of companies of the Operators for internal administrative purposes, including the processing of personal data of Customers. This is without prejudice to the general principles for the transfer of personal data within an enterprise group of an undertaking located in a third country.

4. Processing of personal data to the extent strictly necessary and proportionate for the purposes of network security and information security, i. j. the ability of the network or information system to withstand, at a given level of confidentiality, failures or illegal or intentional acts that interfere with the availability, authenticity, integrity, and confidentiality of personal data stored or transmitted, and the security of related services offered or accessible through such networks, such as preventing unauthorized access; communication networks and the spread of malicious program code, as well as the cessation of attacks following targeted server congestion ("denial of service") and damage to the Operators' computer and electronic communication systems.

5. Notification of possible criminal offenses or threats to public security by Operators and provision of relevant personal data in individual cases or several cases concerning the same criminal offense or threat to public security to the competent authority if such processing is in accordance with legal, professional, or other binding duty of confidentiality of Operators.

6. Provision of personal data for a person's business partners, but always on condition that these persons meet similar personal data protection conditions as the Operators, and at the same time must be either exercising the Operators' rights and/or fulfilling its obligations arising from the relationship with the data subject and/or its business activities.

Transfer to third countries

The Operators do not intend a Cross-border transfer of your personal data to third countries outside the European Economic Area (EU, Iceland, Norway, and Liechtenstein).

Recipients of personal data and categories of recipients of personal data

In accordance with the above purposes, personal data may be processed by the following persons as recipients of personal data:

• RentalPort.com, a.s., with its registered office at Drieňová 27, Bratislava - mestská časť Ružinov 821 01, ID number 52 339 530;

• Business Partner, selected by the Customer through the Rentalport.com platform, which provides the Customer with the Service (rental of Vehicle, rental of Accessories, provision of Extra Services) in accordance with the General Terms and Conditions of RentalPort.com, which is a joint operator with spol. RentalPort.com, a.s., IČO 52 339 530, Drieňová 27, Bratislava - mestská časť Ružinov 821 01.

The categories of recipients of personal data are as follows:

Social Insurance Agency, tax offices, health insurance companies, companies dealing with information technology services, companies dealing with tax audit services, and financial institutions (Google Pay, Apple Pay, GoPay).

Recipients of personal data shall implement and adopt technical, physical, administrative, and procedural safeguards in accordance with industry-recognized standards in order to protect the personal data processed and to ensure their confidentiality, integrity, or availability. These protection measures will prevent unauthorized use of personal data, unauthorized access to them, or breaches of personal data protection, so-called security incident in accordance with applicable regulations.

Rights of the persons concerned

The provision of personal data is voluntary. The provision of personal data is not a condition for concluding a contractual relationship but may lead to a deterioration of the position and comfort of the person concerned.

The customer and other data subjects have the right (i) to access personal data, (ii) to correct inaccurate or false personal data (iii) to request an explanation in case of suspicion that the processing of personal data violates the protection of your personal and private data or if personal data the data is processed in breach of the law (iv) request the correction of the situation which is in breach of the law, in particular by stopping the handling, correction, addition or deletion of personal data (v) to contact the Office for Personal Data Protection. The data subject / Customer also has (iv) the right to delete personal data if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, or if it is found that they have been processed illegally, (vii) to restrict the processing of personal data. (viii) the portability of the data and (ix) the right to object, after which the processing of your personal data will be terminated, unless it is established that there is compelling possible enforcement of legal claims.

Each and all of these rights can be exercised by these persons by sending a request to the Operator to the email address (gdpr@rentalport.com).

As already mentioned, the Customer / affected person also has the right to contact the issues of personal data collection and processing within the Operators to the above-mentioned email address. These persons also have the right to lodge a complaint with the supervisory authority in their country of residence in situations where they consider that personal data are being processed in breach of the relevant legislation.

The time period of personal data processing

Personal data will be processed for a period of 10 years from the last contractual performance and, if there is no contractual performance, for a period of 10 years from the granting of this consent. Personal data processed for the purpose of fulfilling legal obligations are processed for the period required by the relevant legislation.

Processing of cookies

Cookies are small text files that improve the use of the website, e.g. by enabling the recognition of previous visitors when logging in to the user environment, by remembering the visitor's choice when opening a new window, when measuring website traffic or how it is used to improve its user experience. These cookies may be deleted or blocked by the Customer, but in such a case some functions of the Operators' website may not work as intended. Cookie information is not used to personally identify the Customer. These cookies are not used for purposes other than those described in the cookie policy located here at www.rentalport.com/legal/cookies. You can prevent these files from being saved to your device at any time by setting up your web browser. The settings of the Customer's browser are in accordance with § 55 par. 5 of the Electronic Communications Act considered as consent to the use of cookies on the Operators' website.

On what legal basis do Operators process personal data?

Arranging the rental of motor vehicles

• performance of the contract pursuant to Article 6 (1) 1 letter b) GDPR or legitimate interest according to Art. 6 par. 1 letter f) GDPR

Purposes related to the protection of legitimate interests

• the legitimate interest of the Operators or third parties pursuant to Article 6 para. 1 letter f) GDPR

Marketing purposes

• The consent of the person concerned pursuant to Article 6 (1) 1 letter (a) the GDPR or the legitimate interest of the Operators or third parties pursuant to Article 6 (1); 1 letter f) GDPR. More information regarding the processing of personal data for marketing purposes can be found here: www. rentalport.com/legal/marketing