What personal data do we process?

We process the following personal data:

• identification data, which in the case of the customer means in particular the name;
• contact data, which means personal data that allows us to contact you, in particular e-mail address and telephone number;
• data on your orders, payments and data on complaints;
• data on your chosen payment methods;
• data relating to the location of a particular customer application user.

Why do we process personal data and what authorizes us to do so?

As part of our activity, we process personal data for various purposes and to various extents:

• based on the performance of the contract,
• based on our legitimate interest,
• or due to the fulfillment of a legal obligation

What kind of processing we can carry out without your consent depends on the purpose of the respective processing. In the case of the above processing purposes, your personal data is not processed on the legal basis of the consent of the person concerned.

Processing based on contract performance

Mediation of orders for contractual transport of people from customers

In the case of mediation of an order from a customer to a specific provider of contracted passenger transportation, the Company processes the customer's personal data based on the customer's order for services, either made using the customer application or by phone.

These personal data include name, telephone number, address of the beginning and end of the transport, and other data necessary for the execution of the order.

The data is processed for 2 years after the execution of the order.

Providing information to the customer about their placed orders using the application

Based on the contractual relationship, the customer who uses the application has the opportunity to see the history of his orders.

In this case, he has access to his personal data, such as date and time, address of the start and end of the transport, price, ratings.

The data is processed during the period of use of the application.

Records of persons authorized to order transportation for contracted billing_companies

If it is necessary to register persons authorized to order transport for contractual billing_companies, their personal data is processed on the basis of a contract between a specific contractual transport provider and contractual partner.

These personal data include first name, last name, telephone number, billing information and e-mail address.

The data is processed for 10 years.

Payment for services provided using the application

Existing customers can also pay for the provided services using the application, while the Company does not process payment card data, but uses the option of a payment gateway.

For the purpose of issuing an invoice, personal data in the scope of name, surname, telephone number, billing data and e-mail address are processed.

The data is processed for 10 years.

Processing based on legitimate interest

Customer communication

In the case of communication with an existing customer, the processing of the customer's personal data takes place without the customer's consent, as the legal basis for the processing of his personal data (to the extent necessary) is the Company's legitimate interest, for example, improving the quality of the services provided, informing the customer about new goods and services in order to promote their sales .

In accordance with Recital 47 of the Regulation, the operator has carefully assessed whether he can use a legitimate interest as the legal basis for processing, i.e. whether the data subject can, at the given time and in the context of obtaining personal data (when purchasing services), reasonably expect that the processing of his personal data for this purpose can to carry out.

Personal data of the customer are processed in the scope of name, telephone number and e-mail address.

The data is processed for a period of 2 years from the last use of the Company's services.

Evaluation of the customer by dispatch workers or persons providing passenger transportation

In the legitimate interest of protecting the property and safety of the operator and affected persons, the Company allows dispatch workers or persons providing passenger transportation to record an assessment of the customer's behavior and thereby protect the property and safety of other persons providing contractual transportation.

The customer's personal data is processed in the scope of name and telephone number.

The data is processed for 2 years.

Camera system

The purpose of the camera system is to monitor the movement of people for the purpose of protecting the Company's property, and for possible proceedings on misdemeanors and crimes.

The legal basis is the legitimate interest in protecting the safety and property of the Company.

The categories of personal data that are processed in this system are the likeness of a person, a record of a person's actions in a certain place at a certain time in the Company's premises.

Cameras can be placed in the Company's headquarters, while the premises are marked as such in the case of their monitoring, including informing the affected person through a notification. The processing time for recordings from the camera system is 30 days, if the recording is not used in the proceedings of a misdemeanor or criminal offense or for other proceedings.

Processing based on the fulfillment of legal obligations

The company must fulfill certain statutory obligations. If we process your personal data precisely for this reason, we do not need to obtain your consent for such processing. We process your identification and contact data and data on purchases on this legal basis, and the following laws are in particular:

• Law no. 250/2007 Coll. on consumer protection as amended
• Law no. 222/2004 Coll. on value added tax as amended
• Law no. 431/2002 Coll. on accounting as amended

For these purposes, we process personal data for a maximum of 10 years.

Categories of beneficiaries

As part of the mediation of contractual passenger transport services, we will provide your personal data to our contractual partner. As long as the given type of processing is not occasional, we have concluded intermediary contracts with contractual billing_companies that regulate the processing of personal data on their side.

Based on our legal obligations, your personal data may be provided to public authorities in accordance with the relevant legal regulations.

Automated decision-making and profiling

Automated decision-making and profiling does not occur in the Company.

Transfer of personal data to recipients outside the EU

Cross-border transfer to third countries (outside the EU) is not carried out.

What rights do you have in the processing of personal data?

Just as we have our rights and obligations when processing your personal data, you also have certain rights when processing your personal data. These rights include:

Right of access

Basically, you have the right to know what data we process about you, for what purpose, for how long, where we obtain your personal data, to whom we sell it, who processes it besides us, and what other rights you have related to the processing of your personal data. You can learn all that in this document. However, if you are not sure which personal data we are processing about you, you can ask us to confirm whether the personal data concerning you is or is not being processed by us, and if so, you have the right to access these personal data. As part of the right of access, you can ask us for a copy of the processed personal data, while we will provide you with the first copy free of charge and the next copy with a fee.

Right to rectification

If you find that the personal data we process about you is inaccurate or incomplete, you have the right to have it corrected or supplemented without undue delay.

Right to erasure

In some cases, you have the right to have your personal data deleted. We will delete your personal data without undue delay if any of the following reasons are met:

• we no longer need your personal data for the purposes for which we processed them;
• you revoke your consent to the processing of personal data, while it is data for which your consent is necessary for processing and at the same time we have no other reason why we need to continue processing this data;
• you exercise your right to object to the processing of personal data that we process on the basis of our legitimate interests and we find that we no longer have any such legitimate interests that would justify this processing
• you believe that the processing of personal data carried out by us is no longer in accordance with generally binding regulations.

But please keep in mind that if it is one of these reasons, it does not mean that we will immediately delete all your personal data. This right does not apply if the processing of your personal data is still necessary for the fulfillment of our legal obligation or the determination, exercise or defense of our legal claims.

Right to restriction of processing

In some cases, in addition to the right to deletion, you can use the right to restrict the processing of personal data. This right allows you in certain cases to request that your personal data be marked and that these data are not the subject of any further processing operations - in this case, not forever (as in the case of the right to erasure), but for a limited time.

Right to portability

You have the right to obtain from us all your personal data that you yourself have provided to us and which we process based on your consent and on the basis of the performance of the contract. We will provide you with your personal data in a structured, commonly used and machine-readable format. In order to be able to transfer the data easily at your request, it can only be data that we process automatically in our electronic databases.

The right to object to processing

You have the right to object to the processing of personal data based on our legitimate interest. Regarding marketing activities, we will stop processing your personal data without further conditions; in other cases, we will do so, unless we have serious legitimate reasons for continuing such processing.

The right to file a complaint

Exercising your rights in the above-mentioned ways does not in any way affect your right to file a complaint with the relevant authority. You can exercise this right in particular if you believe that we are processing your personal data unlawfully or in violation of generally binding legal regulations. You can submit a complaint against our processing of personal data to the Office for the Protection of Personal Data, located at Hraničná 12, 820 07 Bratislava.

How can individual rights be exercised?

In all matters related to the processing of your personal data, whether it is a request for information, exercising a right, filing a complaint or any other type of request, you can submit it in writing to the address of the registered office of DANUBIASOFT s.r.o., Račianska 88B, 831 02 Bratislava.

We will process your request without undue delay, but within one month at the most. In exceptional cases, especially due to the complexity of your request, we are entitled to extend this deadline by another two months. Of course, we will inform you about such a possible extension and its justification.

Person responsible for personal data protection

The company does not have a designated person responsible for the protection of personal data. The main activity of the company is not processing operations, which, due to their nature, scope or purposes, would require regular and systematic monitoring of the affected persons on a large scale. The company does not process special categories of data on a large scale.