Privacy policy

1. Who we are and who to contact

The controller — the party that decides why and how your personal data is processed — is the company below.

• Company name: Rival Slovakia s. r. o.
• Registered office and postal address: Doležalova 15C, 821 04 Bratislava – Ružinov, Slovakia
• Company ID: 54 281 067 · Tax ID: 2121618972 · VAT ID: SK2121618972
• Registration: Commercial Register of the Bratislava III City Court, section Sro, file no. 157285/B
• Contact point for data protection and exercising your rights: gdpr@pozicauto.sk
• General contact: info@pozicauto.sk · Phone: +421 907 633 517 · Web: www.pozicauto.sk
• We have not appointed a Data Protection Officer — the law does not require one at our scale of processing. All requests are handled by the contact point above.

2. What this policy covers

It applies to everything you can do with us: browse the website, send us a message, book a vehicle, create an account, rent a car and write a review. It does not apply to third-party websites we link to — those have their own policies.

• Files stored on your device (cookies and similar technologies) are described in a separate document: /cookies
• Rights and obligations of the rental itself are in the terms and conditions: /podmienky
• The policy applies to individuals. Company data on its own (company name, company ID, tax ID) is not personal data — but the name and contact details of the person acting for the company are.

3. What data we process about you

We collect only what a booking or a rental could not work without. Nothing “just in case” and nothing extra.

• Identification data: first and last name, date of birth, ID card and driving licence number, address of residence.
• Contact data: e-mail, phone number, correspondence address.
• Booking and rental data: the vehicle chosen, date and place of pick-up and return, extra services, your notes, order status and amount.
• Billing data: for a company order, the company name, company ID, tax ID, VAT ID and billing address.
• Payment data: the amount, method and status of payment. We never see your card number or CVV — you enter the card directly on the payment gateway's page.
• Documents you upload to your booking yourself, and photo documentation of the vehicle's condition from the handover report.
• Vehicle location data from the GPS unit — described in detail in article 7.
• Technical data: IP address, browser and device type, time and address of the page visited, in server logs; plus cookies according to your settings.
• If you create an account: login e-mail, password in an unreadable (hashed) form, booking history, favourite vehicles, loyalty points and your reviews.

4. Purposes, legal bases and retention periods

This is the core of the whole document — what we need the data for, what allows us to do it, and until when we keep it.

5. Scanning an identity document

When booking, you can photograph your document and have the data read into the form instead of typing it. It is the only place where a photo of a document comes into play, so it deserves a precise description.

• Scanning is optional. Every field can be filled in by hand and withholding consent has no effect whatsoever on the booking.
• The photo is sent for processing solely so that the first name, last name, document number, date of birth and address can be read from it. It is not stored anywhere — it ceases to exist once the data has been read.
• We do not process the national identification number. The system does not actively read it, and even if processing returned it, it is discarded before anything is saved.
• We use a Google service as a processor for reading the data; the processing is covered by EU standard contractual clauses.
• We record your consent with a timestamp at the time of booking — so that we can prove it was given (Art. 7 GDPR).
• You always see the result in the form and can correct it. Nothing about you is decided automatically.
• We never take or retain your ID card — under § 15(4) of Act No. 395/2019 Coll., an identity document may neither be handed over nor accepted as a security deposit.

6. Documents uploaded to the booking

Besides the scan, which is not stored, you can upload or photograph documents for your booking — a driving licence, for example — so that we have the contract ready before you arrive.

• Uploading is optional and you give separate consent for it. Without it the booking works with no restrictions.
• Unlike the scan, these files are kept — for at most 30 days after the vehicle is returned. After that they are deleted automatically, both the file and the database record.
• They sit in non-public storage. The link to a file is time-limited and does not work without an authorised person being logged in.
• Only our staff preparing the contract have access to them.
• If you want a document deleted sooner, write to gdpr@pozicauto.sk — we will do it without delay.

7. The GPS unit in the vehicle

Our vehicles are fitted with a GPS unit. It is a condition of insuring property of this value and, at the same time, the only way to find a car that does not come back. It does not mean we are tracking you.

• We do not monitor location on an ongoing basis and we do not report it to anyone. We look into the history only in a specific incident: theft or non-return of the vehicle, a road accident, an insurance claim, an offence being dealt with by the police, or a serious breach of the rental contract.
• Location history is kept for 90 days and is then overwritten automatically.
• Access is limited to a small group of authorised people and is always tied to a specific case.
• The unit does not record sound or video inside the cabin and does not register who is driving.
• The legal basis is our legitimate interest in protecting high-value property (Art. 6(1)(f) GDPR). You may object to this processing under Art. 21 GDPR — we will assess the objection and reply to it.

8. Customer account, loyalty programme and reviews

An account is optional — you can book without one. If you create one, history and a few extras are added to your data.

• In your account you can see your bookings, favourite vehicles, loyalty points and the reviews you have written.
• You can also sign in with a Google account. In that case the sign-in provider gives us your name, e-mail and profile picture — your Google password never reaches us.
• Your password, if you use one, is stored only as an irreversible hash. Not even we can read it; if you forget it, all we can do is set a new one.
• Loyalty points are calculated from completed rentals. This is not profiling with legal effect — the points affect nothing but the size of your discount.
• You can only write a review for a completed rental. We check it before publication. What is published is the name given in the booking, the rating and the text — never the e-mail, phone number or address.
• We will take a published review down on request. Just write to gdpr@pozicauto.sk.
• We will close your account on request. Closing it forfeits your loyalty points; data we are required to keep by law — contracts and invoices — remains until the statutory period expires.

9. Newsletter and marketing

• We send the newsletter only to those who signed up. Signing up is a separate act — it is not part of a booking and cannot be “hidden” inside consent to the terms.
• You can unsubscribe using the link in the footer of every e-mail or by writing to info@pozicauto.sk. We handle it without undue delay and without asking why.
• Withdrawing consent does not affect the lawfulness of processing before the withdrawal, and it does not affect e-mails about your booking — those are sent on the basis of the contract, not marketing consent.
• We do not sell, rent or trade newsletter data with anyone.
• The request for a review after your rental ends is sent on the basis of legitimate interest. If you decline it, you will not receive it again.

10. The e-mails and text messages we send you

• Operational messages about a booking — confirmation, reminders before pick-up and before return, documents, invoice — are sent on the basis of the contract. While the booking is live they cannot be turned off; they are part of the service.
• Text messages go to the number you entered in the booking. The SMS gateway provider receives nothing but the phone number and the text of the message.
• The record of a message being sent (time, recipient, delivery status) is kept together with the booking — so that we can prove we informed you.
• We do not use addresses from bookings for advertising. Marketing goes out only through the newsletter under article 9.

11. Who we share your data with

Data goes only to those who need it for their work for you. Below are not categories but names — because that is exactly the point of Art. 13 GDPR.

12. Transfers outside the European Union

• Most processing takes place in the EU. The database holding your bookings and documents is in Frankfurt.
• Some providers may also process data in the USA. The transfer is covered by the European Commission's adequacy decision (EU – U.S. Data Privacy Framework) or by EU standard contractual clauses under Art. 46 GDPR.
• We do not transfer data to countries covered by neither of these safeguards.
• We will give you a copy of the safeguards the transfer relies on if you ask.

13. How long we keep data and how we delete it

The specific periods are in the table in article 4. This article is about what happens once a period runs out — because “we delete it” sounds good only until someone actually does it.

• Deletion is not manual work. Documents uploaded to a booking are deleted automatically every night, 30 days after the vehicle is returned — the file and the database record alike.
• Old bookings, form messages and damage reports are anonymised by a separate job on the first day of every month. One year after the vehicle pick-up date, the name, e-mail, phone number, age and notes disappear from a booking. What remains is the order number, the dates, the vehicle and the amount — what accounting and statistics need.
• An anonymised record can no longer be linked to a specific person. This is not hiding the data, it is overwriting it.
• Every deletion run is written to an internal audit log — so we can show that it really happened, and when.
• What we must keep by law — contracts, invoices, accounting records — is not deleted even on request. The GDPR itself recognises this exception in Art. 17(3)(b).

14. How we protect your data

• The connection to the site is always encrypted (HTTPS/TLS). The unencrypted version redirects.
• The database has row-level security enabled — not even a logged-in user can reach someone else's booking.
• Uploaded documents and handover photos sit in non-public storage, reachable only through a time-limited link.
• Passwords are stored solely as an irreversible hash, never in readable form.
• Only a small group of people can access the administration, each under their own account. Sensitive operations are written to an audit log.
• Forms are protected by a limit on the number of submissions so they cannot be abused at scale.
• Should a personal data breach nevertheless occur and pose a risk to you, we will report it to the Office within 72 hours and, where the risk is high, tell you directly as well.

15. What we do not do

Just as important as what we do:

• We have no CCTV system. We hand over and take back vehicles in publicly accessible car parks that we neither own nor operate — if there are cameras at such a place, they belong to the owner of the premises, not to us, and we receive no recordings from them.
• We do not process the national identification number.
• We do not take or retain your ID card as a deposit — Act No. 395/2019 Coll. forbids that to both parties.
• We do not carry out automated decision-making with legal effect or profiling under Art. 22 GDPR. Reading data from a document is automated, but you always see and correct the result in the form — nothing about you is decided without a human.
• We do not sell or rent personal data to third parties and we do not trade databases with anyone.
• We do not process special categories of data — health, biometrics, religion, political opinions. If you send them to us in a note, we delete them.
• We do not ask for more data than we need. The mandatory fields in the form are precisely those without which we cannot conclude the contract.

16. Your rights

Exercising any of these rights is free of charge and carries no adverse consequences for you.

• Right of access (Art. 15) — to find out whether we process anything about you and to receive a copy.
• Right to rectification (Art. 16) — to put an incorrect or incomplete record right.
• Right to erasure (Art. 17), the “right to be forgotten”. It does not extend to what we must keep by law.
• Right to restriction of processing (Art. 18) — we keep the data but stop working with it for the time being.
• Right to data portability (Art. 20) — to receive your data in a machine-readable format or have it transferred to another controller.
• Right to object (Art. 21) to processing based on legitimate interest, including GPS. You may object to direct marketing at any time and without giving a reason.
• Right to withdraw consent (Art. 7(3)) — at any time and as easily as you gave it. Withdrawal does not affect the lawfulness of processing before it.
• Right not to be subject to automated decision-making (Art. 22) — this does not happen here, see article 15.

17. How to exercise your rights, complaints and changes

• Write to gdpr@pozicauto.sk or by post to our registered office. Just say what you want — no form is needed.
• We reply within one month. For a complex or bulk request the deadline may be extended by a further two months; if that happens, we will let you know within one month, with the reason.
• If we cannot establish with certainty who is asking, we may request additional verification of identity. This is not obstruction — it is protection against your data going to someone else.
• If you disagree with how we handled your request, or we do not respond, you have the right to file a motion to open proceedings on personal data protection under § 100 of Act No. 18/2018 Coll. with: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, Slovakia, statny.dozor@pdp.gov.sk, www.dataprotection.gov.sk
• You may equally turn directly to a court.
• We update this document whenever the way we work changes. The date of the last update is shown at the top of this page; for a substantial change we will notify you by e-mail or by a notice on the website.