Personal Data Processing & Protection Policy
GDPR – AlkaRoute s.r.o. (Car Rental 001)
Information on personal data processing
Information on personal data processing
AlkaRoute s.r.o., with its registered office at Blatnická 4219/4, 628 00 Brno, Company ID 05622913, as the data controller, protects the personal data you provide when you wish to use our services. It is important for you to know that we process the personal data you provide responsibly, transparently, and in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council. You have the right to request information about the personal data recorded, its correction, or deletion if it was processed on the basis of your consent or if the purpose of processing has ceased. We do not carry out automated decision-making within our activities. If you have any questions or requests regarding the processing of your personal data, you may contact us in writing at the company’s registered office address.
Security of your personal data
AlkaRoute s.r.o. ensures the security of the personal data you provide. We have adopted appropriate technical and organisational measures to adequately protect your data with regard to the seriousness of the processing. No unauthorised person has access to your personal data obtained from you, and we do not pass it on to other entities for further processing without your knowledge, unless required by law or for the protection of our legitimate legal interests.
Right to information
You have the right to request from AlkaRoute s.r.o. information about what personal data, to what extent and for what purpose we process about you. We will provide this information free of charge no later than within 30 days, and in exceptional situations no later than within 90 days. We will inform you in due time if the deadline is extended in exceptional cases. If you request information that we keep about you, we will first need to verify that you are the person entitled to that information. Please include sufficient identification in your request. If necessary, we may request additional information to verify your identity before providing the personal data we process about you.
We may reasonably refuse requests for information that are unfounded or excessively repetitive, or where obtaining the information would require disproportionate effort, or where the information would be difficult to obtain (typically from backup systems, archives, etc.).
Right to data portability
You have the right to obtain the personal data we keep about you in a structured, commonly used, and machine-readable format. Upon your request, such data may be transferred to another controller.
Updating data, right to rectification
As personal data may change over time (for example, a change of surname), we would appreciate it if you inform us of any change so that your data remains up to date and potential errors are avoided. Notifying us of changes is necessary for us to properly perform our duties as the controller.
Related to this is your right to rectification of personal data we keep about you. If you find that our data is no longer up to date, you have the right to request correction.
Objections
If you believe that we do not process your personal data in accordance with applicable Czech and EU legislation, you have the right to raise an objection, and we will then assess the legitimacy of your request. From the moment you raise an objection, processing of your personal data will be restricted until it is verified whether the objection is justified. You also have the right to lodge a complaint with the supervisory authority for personal data protection at:
Office for Personal Data Protection
Pplk. Sochora 27
170 00 Prague 7
Right to restriction of processing
You have the right to restriction of processing of your personal data if you believe the data is inaccurate, or if we process it unlawfully, and also if you believe we no longer need the data for the purposes of processing.
Right to erasure
If you have ever granted consent to the processing of your personal data (for example, an email address for a newsletter), you have the right to withdraw it at any time, and we are obliged to delete data processed solely on the basis of your consent. The right to erasure does not apply to data processed for performance of a contract, legal obligations, or legitimate interests. If some of your data is stored in backup systems that automatically ensure the resilience of our systems and protect against data loss in case of incidents, it may not be within our power to delete such data from backups and it may not always be technically feasible. However, such data is not actively processed further and will not be used for other processing purposes.
Where you can contact us
You can contact us regarding personal data protection at gdpr@autopujcovna.as or at our registered office:
AlkaRoute s.r.o.
Blatnická 4219/4
628 00 Brno
Website – log files
If you access and browse our website, we process the following log files and store them on our servers. The information we store includes:
- Your IP address
- The page you open on our website
- HTTP response code
- Identification of your browser
We process this information for a maximum of one year and only for the purposes of our legal protection.
Cookies
When you visit our website, you are informed that we use technologies to collect and store information using cookies on your device. Cookies are small text files; you can delete them from your browser or disable their use completely. Cookies do not collect any of your personal data; however, without them we cannot ensure full functionality of the website.
Our website uses “session” cookies to remember user choices and settings. We also use some persistent cookies (e.g., to remember cookie consent). These cookies remain on your device until you delete them or until they expire; usually for a short period (in some cases up to two years).
Analytics and statistics
We monitor and analyse the website using analytics services. None of the data we analyse through this service are your personal data. We use it to determine traffic and geographical data, information about the browser and operating system you use to access our website. We use this information for marketing purposes, to improve the website and content, and for legal protection.
Processing of personal data
See how AlkaRoute s.r.o. processes the following personal data / categories of personal data, including legal bases, purposes and retention periods for individual processing activities.
Category: Subscribers
All personal data of subscribers, or their representatives, are processed solely for the purpose of performance of a contract, compliance with legal obligations applicable to the controller, and protection of the controller’s legitimate interests, only for as long as necessary for these purposes.
Vehicle rental order
| Data obtained from another entity | No |
| Record contains information about a minor | No |
| Legal basis | Performance of a contract |
| Personal data | House number (Personal data), ID card number (Personal data), Driving licence number (Personal data), Date of birth (Personal data), Email (Personal data), First name (Personal data), Last name (Personal data), Postcode (Personal data), Country (Personal data), Phone (Personal data), Street (Personal data) |
| Purpose of processing | processing the vehicle order and preparing the rental agreement |
| Retention period | unlimited |
Vehicle geolocation data
| Data obtained from another entity | No |
| Record contains information about a minor | No |
| Legal basis | Legitimate interest |
| Personal data | Vehicle geolocation data (Personal data) |
| Purpose of processing | vehicle geolocation data in emergency situations |
| Retention period | until the vehicle is returned to the lessor |
Vehicle rental agreement
| Data obtained from another entity | No |
| Record contains information about a minor | No |
| Legal basis | Performance of a contract |
| Personal data | House number (Personal data), ID card number (Personal data), Driving licence number (Personal data), Date of birth (Personal data), Email (Personal data), First name (Personal data), Last name (Personal data), Postcode (Personal data), Country (Personal data), Phone (Personal data), Street (Personal data) |
| Purpose of processing | processing the vehicle order and preparing the rental agreement |
| Retention period | unlimited |
| Legal basis | Legitimate interest |
| Personal data | Vehicle geolocation data (Personal data) |
| Purpose of processing | obtaining vehicle geolocation data in emergency situations |
| Retention period | until the vehicle is returned to the lessor |
Insurance claims reporting
| Data obtained from another entity | No |
| Record contains information about a minor | No |
| Legal basis | Legitimate interest |
| Personal data | Address (Personal data), ID card number (Personal data), Driving licence number (Personal data), Date of birth (Personal data), Email (Personal data), First name (Personal data), Last name (Personal data), Phone (Personal data) |
| Purpose of processing | processing an insurance claim |
| Retention period | unlimited |
| Recipients | Contracted insurance companies |
Category: Internal records
All personal data used for the controller’s internal purposes are processed solely to comply with legal obligations applicable to the controller and to protect the controller’s legitimate interests, only for as long as necessary for these purposes. In particular, this includes tax records.
Tax records
| Data obtained from another entity | No |
| Record contains information about a minor | No |
| Legal basis | Legal obligation |
| Personal data | Address (Personal data), Tax ID (Personal data), First name (Personal data), Last name (Personal data) |
| Purpose of processing | keeping tax records |
| Retention period | 10 years |
| Processors | Contracted insurance companies |
Category: Suppliers
We keep necessary contact details of suppliers and persons we communicate with based on legitimate interest and especially for the performance of contracts.
Supplier record
| Data obtained from another entity | No |
| Record contains information about a minor | No |
| Legal basis | Performance of a contract |
| Personal data | Address (Personal data), Bank account number (Personal data), Individual Tax ID (Personal data), Email (Personal data), First name (Personal data), Last name (Personal data), Phone (Personal data) |
| Purpose of processing | keeping supplier contact records |
| Retention period | 10 years from the last record |
Transfer of personal data to third countries
- There is no transfer of personal data to processors or other recipients in third countries or international organisations.
This policy is regularly reviewed and may be updated if necessary. The last change of this personal data protection policy took place on Monday, 28 May 2023.