PERSONAL DATA PROCESSING POLICY
JP-AUTO RENT s.r.o., with registered office at Dolné Hony 425/23, 949 01 Nitra, Slovak Republic, Company ID No. 52964841, registered in the Business Register of the Trnava District Court, Section: Sro, Insert No.: 19858/T (the “Controller”) processes personal data in accordance with Act No. 18/2018 Coll. on the protection of personal data and on the amendments to certain acts (the “Act”) and Regulation (EU) 2016/679 of the EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “Regulation”).
When the Controller processes personal data, you are the data subject, i.e. the person to whom the personal data being processed relate.
Our company has a data protection contact person who is your point of contact for answering any questions you may have regarding data protection or for receiving and handling requests from data subjects. Contact details:
JP–AUTO RENT, s.r.o
E-mail: info@jpautorent.sk
Phone: +421 37/321 46 22
CATEGORIES OF DATA SUBJECTS
This section lists whose personal data we process. These are mostly:
- persons acting on behalf of our business partners,
- clients (or future clients – persons interested in our services and goods),
- job applicants.
CATEGORIES OF PERSONAL DATA
In the course of our business, we only process ordinary personal data, depending on the purpose:
Contact form available at https://jpauto.sk and marketing purposes
- first name,
- surname,
- e-mail,
- phone No.
Selection procedure
- first name and surname,
- contact details,
- other data to the extent provided in the job applicant’s CV/motivation letter (or other data necessary to achieve the purpose of the processing).
Customer satisfaction surveys and general market research to improve our products and services
- first name and surname,
- address,
- contact details,
The processing of personal data is necessary for the purposes of conducting satisfaction surveys among the customers of the Controller, for improving the Controller’s services and goods, and, where applicable, for improving the Controller’s economic results and the development of their goods and services. Personal data are processed in line with the principle of data minimisation. As a result of the facts described above, the processing of personal data serves the legitimate interests of the Controller and also the interests of their customers, since the customers participate in this way in the improvement of the goods and services of the Controller, and the customers use the said services and/or goods. As a result of the above, it can be reasonably argued that the results of satisfaction surveys and their conclusions at the same time contribute to increasing of customer satisfaction.
Site monitoring
- camera recordings capturing video of the data subjects.
Our premises are monitored by CCTV cameras, based on our legitimate interests, which are the protection of property, therefore the personal data processed may include video recordings of data subjects who are on the premises. Another reason for monitoring our premises by CCTV cameras is the protection of the health of persons on the premises in the event of unforeseen events (e.g. in the event of a fire, directing the persons and preventing further damage to health and property).
Establishment of contractual relationships
- first name and surname,
- contact details,
- address of residence/place of business,
- birth number/personal ID number/company ID number,
- identity card/driving licence number,
- signature.
You provide your personal data voluntarily for the performance of a contract or the delivery of a service that you have ordered from us as our client or business partner. If you do not provide these data, which are required for contractual relationships or for the delivery of services (identification data and other necessary data) in accordance with your requirements, the conclusion of the contract or the delivery of the service cannot take place.
Accounting and tax purposes
PURPOSE OF PERSONAL DATA PROCESSING
We process your personal data within the scope of the purpose for which you provide it to us. The processing purposes include:
- selection procedure,
- establishment of commitment relationship,
- marketing purposes (sending newsletters or other notifications),
- accounting and tax purposes,
- statistical purposes, archival purposes in the public interest and historical and scientific research purposes,
- protection of Controller’s property and the health of persons on the monitored premises,
- customer satisfaction surveys and general market research to improve our goods and services.
LEGAL BASIS FOR PERSONAL DATA PROCESSING
We process your personal data for the following lawful reasons:
Accounting and tax purposes
- the data subject has consented to the processing of their personal data for one or more specific purposes;
- the processing is necessary for the performance of a contract to which the data subject is a party or in order to carry out pre-contractual measures at the request of the data subject; if you do not provide personal data, the company cannot enter into a contractual relationship with you;
- the processing of personal data is necessary pursuant to a special regulation or an international treaty to which the Slovak Republic is bound;
- the processing is necessary for the purposes of the legitimate interests pursued by the Controller.
As part of their business activities, the Controller may send various advertising communications (direct marketing) or other communications to persons who have given their consent to the Controller (Section 13 (1) (a) of the Act), or to persons who have purchased/ordered a product/service from the Controller.
For contractual relationships and job applicants, we process personal data on the basis of Section 13 (1) (b) of the Act, according to which the processing of personal data is necessary for the performance of a contract to which the data subject is a party or for the performance of a pre-contractual measure at the request of the data subject.
The Controller processes the personal data of the data subjects in the scope of video recordings based on the legitimate interests of the Controller pursuant to Section 13 (1) (f) of the Act, which are the protection of property and the safety of persons on the monitored premises of the Controller.
LEGAL BASIS FOR PERSONAL DATA PROCESSING
Personal data must be stored in a form that permits identification of the data subjects for no longer than is necessary for the purposes for which the personal data are processed. Personal data can be stored for longer periods if they are processed exclusively for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) of the Regulation, provided that appropriate technical and organisational measures are taken as required by the Regulation to protect the rights and freedoms of data subjects.
Your personal data will be processed for the period, for which consent is granted. Upon the expiry of that period, the Controller shall immediately destruct (erase) the personal data provided, unless there is other legal basis for the processing.
In the cases where, in accordance with the Regulation or the Act, the Controller processes your personal data without your consent and for the purposes as set out above, the Controller shall destruct (erase) your personal data as soon as it is no longer possible to use them for the purpose for which they were collected, unless there is further legal basis for processing them (assertion of legal claims, litigation, administrative proceedings, etc.).
Expected time limits for erasure of different categories of personal data:
- CVs – after the end of the selection procedure (unless a consent is given to include them into Controller’s database);
- other personal data related to accounting, taxes and other documents will be processed for the period specified by law; upon the expiry of this period
they will be erased;
- accounting documents such as invoices issued by the Controller are archived for 10 years from their issue, in accordance with law;
- camera recordings are archived for 14 days and upon the expiry of this period they will be erased.
When determining the retention periods of personal data, we follow the Act, the Regulation and other generally binding legal regulations (e.g. Act No. 395/2002 Coll. on archives and registries and on the amendments to certain acts, etc.).
CATEGORIES OF RECIPIENTS OF PERSONAL DATA
Your personal data may be further provided to persons authorised within the meaning of the relevant legislation, such as courts, district authorities, law enforcement authorities, lawyers, notaries, auditors.
Furthermore, the Controller may provide the personal data of the data subjects to processors if they have been entrusted with the processing of personal data on behalf of the Controller. Accordingly, we have concluded contracts on personal data processing with processors under which an adequate level of protection of personal data is ensured, in accordance with applicable data protection legislation. The processors to whom we provide your personal data include companies to which we outsource our accounting, or other companies with whom we cooperate.
If you own a Jaguar Land Rover vehicle, information relating to you and your vehicle (including the Vehicle Identification Number or VIN) may be shared (to an appropriate extent) within our network of dealers, repairers, importers, credit providers and providers of credit hire replacement vehicle, in connection with the requested purpose (e.g. servicing, insurance claim, etc.). The information we exchange depends on a variety of factors, e.g. from whom you purchased the vehicle and the services you require from us during the period you own the vehicle.
In the context of evaluating customer satisfaction with the their services, the Controller also sends to the importer of Jaguar and Land Rover vehicles, T.O.P.AUTO Slovakia, a.s., with registered office at Plynárenská 7/A, Bratislava 821 09, Company ID. No.: 35 874 546 (the “vehicle importer”), personal data about real clients/prospects, which are required by the internal regulations of the vehicle importer, and the clients will be informed about this fact when providing their personal data and receiving instructions about their rights.
TRANSFER OF PERSONAL DATA
The Collector does not transfer personal data into third countries or international organisations.
AUTOMATED INDIVIDUAL DECISION-MAKING, INCLUDING PROFILING
The Regulation characterises data processing as “profiling” if it involves:
- automated processing of personal data,
- use of such personal data to evaluate certain personal aspects relating to a natural person.
In the course of its data controlling activities, the Controller does not carry out automated individual decision-making, including profiling.
RIGHTS OF THE DATA SUBJECT
Below you will find the rights you have under the Act and the Regulation as a data subject.
Right to access personal data
The data subject shall have the right to obtain confirmation from the Controller as to whether personal data relating to the data subject are being processed. The Controller is obliged to provide the data subject with their personal data, which are being processed. For the repeated provision of personal data requested by the data subject, the Controller may charge a reasonable fee corresponding to the administrative costs. The Controller is obliged to provide the data subject with their personal data in the manner requested by the data subject.
Right to rectification of personal data
The data subject shall have the right to have inaccurate personal data relating to him or her rectified by the Controller without undue delay. With regard to the purpose of the processing of personal data, the data subject shall have the right to have incomplete personal data completed.
Right to erasure of personal data
The data subject shall have the right to have personal data relating to him or her erased by the Controller without undue delay under the conditions set out in the Act and the Regulation. This concerns, for example, the personal data we have obtained about you, which are no longer necessary for the fulfilment of the original purpose of the processing. However, your right has to be assessed in the light of all the relevant circumstances. For example, we may have certain legal and regulatory obligations, which means we may not be able to comply with your request.
The Controller is not obliged to erase personal data of a natural person if the processing of personal data is necessary
- to exercise the right to freedom of expression or the right to information;
- to fulfil an obligation under the Act, a special regulation or an international treaty by which the Slovak Republic is bound, or to perform a task carried out in the public interest or in the exercise of official authority vested in the Controller;
- for reasons of public interest in the field of public health;
- for the purpose of archiving, for scientific, historical research or statistical purposes, where the right to erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing, or
- to exercise a legal claim.
Right to restriction of personal data processing
The data subject shall have the right to request from the Controller restriction of personal data processing, under the conditions set out in the Act.
If the processing of personal data has been restricted, in addition to storage, the Controller may only process the personal data with the data subject’s consent or for the purpose of exercising a legal claim, for the protection of persons or for reasons of public interest.
The Controller is obliged to notify the data subject for whom the processing of personal data is restricted before the restriction on the processing of personal data is lifted.
Right to portability of personal data
The data subject shall have the right to obtain the personal data relating to him or her, which he or she has provided to the Controller, in a structured, commonly used and machine-readable format, and the right to transfer such personal data to another controller, if it is technically feasible and if
- the personal data are processed on the basis of the data subject’s consent or on the legal basis of processing for the necessary performance of the purpose of a contract to which the data subject is party or for the performance of a pre-contractual measure at the request of the data subject;
- automated means are used for the processing of personal data.
Right to object to personal data processing
The data subject has the right to object to the processing of his or her personal data on grounds relating to his or her particular situation, including profiling, if:
- the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller; or,
- the processing of personal data is necessary for the purpose of the legitimate interests of the Controller or of a third party, except where those interests are overridden by the interests or rights of the data subject requiring the protection of personal data, in particular where the data subject is a child; this legal basis shall not apply to the processing of personal data by public authorities in the performance of their duties.
The Controller shall no longer process the personal data unless it demonstrates compelling legitimate interests for the processing of the personal data which override the rights or interests of the data subject or grounds for exercising a legal claim.
The data subject shall have the right to object to the processing of personal data relating to him or her on grounds relating to his or her particular situation, except where the processing of personal data is necessary for the performance of a task carried out for reasons of public interest, where the personal data are processed for scientific purpose, for historical research purpose or for statistical purpose.
Right to withdraw the consent with the processing of personal data at any time
You have the right to withdraw your consent at any time with effect for the future. You can send the withdrawal of your consent to the Controller using the contact details above. Withdrawal of consent does not affect the lawfulness of the processing of personal data based on consent prior to its withdrawal.
Right to bring a data protection action
If you suspect that your personal data is being processed unfairly or unlawfully, you may lodge a complaint with the supervisory authority, i.e. the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27; Phone No.: +421 /2/ 3231 3214; e-mail: statny.dozor@pdp.gov.sk, https://dataprotection.gov.sk.
SECURITY OF PERSONAL DATA PROCESSING
Your personal data is safe with us. In order to prevent unauthorised access to and misuse of your personal data, we have introduced appropriate measures of both technical and organisational character.
As a Data Controller we regularly control the security of the data. Your communication between your device and our web servers is encrypted. We strive to use security measures that provide sufficient security given the current state of technology. The security measures taken are then regularly updated.
