Information and Instruction on Obtaining and Processing Personal Data

According to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “Regulation”) and Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (hereinafter referred to as the “Act”):

The operator, RAI – INTERNACIONAL, s.r.o., with its registered office at Námestie Slobody 2, 974 00 Banská Bystrica, ID No.: 36629855, registered in the Commercial Register of the District Court Banská Bystrica, Section: Sro., Entry No. 9675/S (hereinafter referred to as “RAI – Internacional”), hereby informs data subjects about the obtaining and processing of their personal data.

This information is intended for you if you are our customer, and also if you are an employee of our customer or supplier who is a legal entity or a sole trader, and your employer has designated you as their authorized person for specific areas of communication related to the supply of goods and services within contractual relationships.

Principles of Personal Data Protection

We process your personal data only on the basis of legal conditions stipulated in the Regulation or in the Act. As the operator, we are responsible for the protection of your personal data that we have obtained or are obtaining from you in accordance with the Regulation and the Act, to the extent and in the manner described in this information. If you have any questions regarding the processing of your personal data, you can contact us in person or by mail at our registered office address, by phone at +421 907 999 399 and +421 907 999 499, or by e-mail: rai@rai.sk.

Obtaining Personal Data

We obtain your personal data primarily directly from you when you voluntarily provide it to us in connection with an inquiry or request for our services, which you address to us in person, by phone, in writing by mail, or electronically, based on your request.

If you are an employee of our customer or supplier, who is a legal entity or a sole trader, and who has designated you as their authorized person for specific areas of communication related to the supply of goods and services within contractual relationships, we obtain personal data from your employer. The provision of data contained in this information does not affect your employer’s information obligation to the extent according to Article 13 of the Regulation, or § 19 of the Act, when obtaining and processing your personal data in connection with the employment relationship between the employee and the employer.

Categories of Personal Data Obtained and Processed

We will obtain and process only your ordinary personal data to the extent necessary for our activities in connection with providing our services. We will not process special categories of personal data that would reveal your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, sexual orientation, or other sensitive personal data about you.

We process your personal data to the following extent:

Identification data: title, first name, last name, date of birth, signature, facial photograph, and other data specified in your identity card, passport, and driver’s license.
Contact data: permanent residence address, delivery address if applicable, e-mail address, and telephone number.
Purchase and discount data: purchased goods or services, price of purchased goods or services, place, date, and time of purchase, data on provided discounts and benefits.
Banking, financial, and transactional data: credit card number, bank account details, payment details.
Data related to vehicle lease agreements: client identification number, contract number, vehicle identification number.
Data related to insured events: history of insured events including paid benefits and expert opinions, information about victims.
Location data: monitoring the location of selected leased vehicles via satellite tracking (GPS), which allows tracking of leased vehicles during their use or after their theft.

Necessity of Providing Personal Data

We absolutely require your personal data because, if it is not provided, a contractual relationship between the supplier and the customer cannot be established. This is due to Act of the National Council of the Slovak Republic No. 513/1991 Coll. (Commercial Code) as amended, which stipulates that your identification as a contracting party (or as a person designated by your employer to handle contractual matters) is one of the essential elements of a Contract.

Recipients of Personal Data

All your personal data will be processed and stored in our internal systems and will only be further provided to other recipients if it is necessary to achieve the purpose of processing or based on a legal obligation arising from specific legal regulations.

Recipients of personal data may include:

Control, supervisory, and other state authorities within the scope of their activities in accordance with specific legal regulations (e.g., the Slovak Trade Inspection, the Office for Personal Data Protection, the Tax Office, etc.).
Courts and law enforcement agencies based on their request, or within the legitimate interests of the operator in proving, asserting, and defending legal claims.
Insurance companies with which the operator has concluded an insurance contract related to the leased vehicle.
Contractually authorized service providers, such as IT service providers, postal and courier services, financial and insurance services.
Other recipients to whom the operator is obliged to provide personal data in accordance with a specific law or legitimate interest, such as auditors, legal advisors, tax and accounting advisors, insurance companies, banks, credit registries, third parties evaluating the use of services of our contractual partners, persons who are in an employment or similar relationship with us, to the extent absolutely necessary for the performance of their work or rights, and who will also be obliged to maintain confidentiality about such information to the extent and under the conditions agreed in a written contract concluded with them or stipulated by generally binding legal regulations.

Purpose of Personal Data Processing

We will obtain and further process your personal data for the following purposes:

Conclusion and performance of the contract: For the fulfillment of contractual obligations or the implementation of measures at your request before we conclude a contract with you, especially for the purpose of processing and sending price offers, reservations, preparing and concluding contracts, registering contracts including all their changes in our internal system, monitoring the fulfillment of contracts and obligations of the contracting parties, especially within lease agreements, rental agreements, and framework agreements, as well as other obligations related to contract management, vehicle handover and delivery, handling complaints and grievances, invoicing, enforcing damages and receivables arising in connection with the supply of goods and services, resolving insured events, storing related documentation and records, mutual communication between contracting parties, etc. The legal basis for processing your personal data for this purpose is Article 6(1)(b) and (c) of the Regulation, i.e., the performance of a contract and the fulfillment of the operator’s legal obligations arising mainly from Act of the National Council of the Slovak Republic No. 513/1991 Coll. Commercial Code as amended. The provision of personal data by the data subject is in this case a contractual requirement. If personal data is not provided, it will not be possible to enter into a contractual relationship with the data subject.
Marketing: With your consent, we will send you commercial information about products and various promotions by mail, e-mail, SMS message, or other forms. Commercial information will be sent only to such an extent and frequency that it is not burdensome for you. The legal basis for processing your personal data for this purpose is Article 6(1)(a) of the Regulation, i.e., the consent of the data subject. You can withdraw your consent at any time, and we will inform you of the specific method of withdrawing consent (depending on how it was granted) when we request your consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Processing for marketing purposes can be considered processing based on the legitimate interests of the operator if you are our customer and we consider it our legitimate interest to inform you about news and offers in the area of our services. You have the right to object at any time to the processing of your personal data for marketing purposes or to stop receiving our marketing messages at any time via a link directly in these messages.
Identification of persons: For the purpose of unambiguous identification and verification of the identity of persons – customers, or persons authorized by customers (in the case of a customer who is a legal entity or a sole trader) and for the purpose of verifying the authenticity of official documents, as well as the possible necessity of providing assistance to law enforcement authorities in case of theft or damage to the operator’s property – leased property, we make photocopies of official documents (identity cards, driver’s licenses, and passports). The legal basis for processing your personal data for this purpose is Article 6(1)(f) of the Regulation, i.e., the legitimate interest of the operator, which in this case is the protection of the operator’s property and financial interests with the aim of preventing crime and other antisocial activities in the area of property crime, committed primarily in the form of theft and damage to the operator’s property.
Protection of the operator’s property and financial interests: To protect the operator’s property and financial interests, selected leased vehicles are secured by monitoring their location via satellite tracking (GPS), which allows tracking of leased vehicles during their use and after their theft. The processing of personal data resulting from the obtained information about the vehicle’s location occurs if a leased motor vehicle is used by a specific natural person, i.e., if at the time of using the leased motor vehicle, the operator is able to identify a specific natural person and the vehicle is equipped with a monitoring device. In such a case, personal data will be processed to the extent of the obtained GPS information about the vehicle’s location and the identification data of the data subject. The lessee is informed when taking over the vehicle that the leased vehicle is equipped with a GPS monitoring device. The legal basis for processing your personal data for this purpose is Article 6(1)(f) of the Regulation, i.e., the legitimate interest of the operator, which in this case is the protection of the operator’s property and financial interests with the aim of preventing crime and other antisocial activities in the area of property crime, committed primarily in the form of theft and damage to the operator’s property.
Accounting and preparation of accounting documents: primarily the management and invoicing of the price for the supply of goods and services, processing of accounting, tax documents, and invoices. The legal basis for processing your personal data for this purpose is Article 6(1)(c) of the Regulation, i.e., the fulfillment of our legal obligations arising mainly from Act No. 431/2002 Coll. on Accounting as amended (hereinafter referred to as the “Accounting Act”), Act No. 222/2004 Coll. on Value Added Tax as amended, etc.
Mail registration and records management: registration and management of postal shipments, mail delivered to and sent from electronic mailboxes, and registration and archiving of contracts, accounting, tax, and related documents in our internal systems. The legal basis for processing your personal data for this purpose is Article 6(1)(c) of the Regulation, i.e., the fulfillment of the operator’s legal obligation according to special regulations, namely the Accounting Act and Act No. 395/2002 Coll. on Archives and Records Management and on Amendments to Certain Acts.

Personal Data Retention Period

We will process your personal data for the period necessary to achieve the purposes of their processing, but no longer than the duration of the contractual relationship.

If we assert legal claims against you and conduct court or administrative proceedings, or if you assert legal claims against us and conduct court or administrative proceedings against us, personal data will be processed for the purpose of proving, asserting, or defending legal claims until the final conclusion of such proceedings. After the termination of the contractual relationship, or after the final conclusion of the proceedings according to the previous sentence, your personal data will only be stored (archived) for a period of 10 years from the end of the contract, because the obligation to store the contract and accounting and tax documents related to the contract, which contain your personal data, arises from generally binding regulations, especially the Accounting Act. After this period, the data will be deleted or destroyed/shredded.

If you object at any time to the processing of your personal data for direct marketing, we will cease processing your personal data for this purpose.

Personal data obtained from vehicle monitoring is stored for 2 years after the termination of the contractual relationship.

Photocopies of official documents are stored for the duration of the contractual relationship and are destroyed within 1 year at the latest, unless the operator uses them based on legitimate interests (e.g., within the scope of resolving damages, insured events, and thefts) or for proving, asserting, or defending legal claims.

Transfer of Personal Data to Third Countries or International Organizations

Your personal data is not provided to third countries or international organizations, and we do not intend such a transfer of personal data.

Withdrawal of Consent to Personal Data Processing

If we process your personal data based on your consent, you have the right to withdraw this consent to personal data processing at any time. The withdrawal of consent does not affect the lawfulness of personal data processing based on consent before its withdrawal. You can withdraw the granted consent in the same way it was granted.

Automated Decision-Making, Including Profiling

When we process your personal data, no automated decision-making or profiling occurs on our part.

Rights of the Data Subject in Connection with Personal Data Protection

In connection with the processing of your personal data, in addition to the above-mentioned rights, you have the following rights:

Right of access to personal data (Article 15 of the Regulation): You have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed, and, where that is the case, you have the right to obtain access to the personal data (copies thereof), as well as to supplementary information to the extent specified in Article 15 of the Regulation. In most cases, we will provide you with these copies of your personal data and supplementary information in written paper form, unless you request a different method of provision. If you have requested the provision of this information by electronic means, it will be provided to you electronically, if technically possible.
Right to rectification of personal data (Article 16 of the Regulation): We take reasonable steps to ensure the accuracy, completeness, and up-to-dateness of the information we hold about you. However, this right allows you to request that we rectify your inaccurate personal data without undue delay or complete your personal data if it is inaccurate, incomplete, or outdated. Please note that you are obliged to provide us only with personal data that is complete and correct, and you are responsible for the untruthfulness of the personal data you have provided to us.
Right to erasure of personal data (right “to be forgotten”) (Article 17 of the Regulation): This right applies without undue delay after exercising this right, for example, if your personal data is no longer necessary for the purpose for which we obtained or processed it, if you have withdrawn your consent to the processing of personal data on the basis of which we process your personal data, and there is no other legal basis for the processing of personal data (e.g., a contract we have concluded with you), if you object to the processing of personal data according to Article 21(1) of the Regulation, or if we process your personal data in violation of the Regulation and the Act. However, this right must be assessed from the perspective of all relevant circumstances. For example, we may have certain legal and regulatory obligations, which means that we will not be able to comply with your request.
Right to restriction of processing of personal data (Article 18 of the Regulation): In legally stipulated cases, you have the right to request that we stop processing your personal data, e.g., if you object to the accuracy of the personal data we hold about you, but only for a period enabling us to verify the accuracy of your personal data; you object to the processing of personal data by automated decision-making; or the processing of your personal data is in violation of the Regulation and the Act and you object to the erasure of your personal data, requesting instead the restriction of its use; or you object to the erasure of your personal data which we, as the controller, no longer need and wish to erase, but you need them, for example, for proving, asserting, or defending your legal claims in ongoing court proceedings.
Right to data portability (Article 20 of the Regulation): This means the right to receive from us your personal data, which you have previously provided to us, in a structured, commonly used, and machine-readable format, and you have the right to request that we transmit your personal data to another controller subject to legal conditions; the exercise of this right does not affect your right to erasure of personal data. However, the right to portability only applies to personal data that we have obtained from you based on consent or based on a contract to which you are a party.
Right to object to the processing of personal data (Article 21 of the Regulation): This applies if the processing of your personal data is based on our legitimate interest or if we process your personal data for direct marketing purposes, including profiling in such processing. If you object and we do not demonstrate compelling legitimate grounds for processing your personal data, or if you object to the processing of your personal data for direct marketing purposes, we will no longer process your personal data for these purposes.
Right not to be subject to a decision based solely on automated processing of personal data, including profiling, if such automated decision-making and profiling would produce legal effects concerning you or similarly significantly affect you (Article 22 of the Regulation): However, as we have stated, our processing of your personal data does not involve automated decision-making or profiling.
Right to lodge a complaint with a supervisory authority (Article 77 of the Regulation): If you believe that the processing of your personal data is in violation of the Regulation or Act of the National Council of the Slovak Republic No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (hereinafter referred to as “Act No. 18/2018 Coll.”), you can lodge a complaint (a proposal for initiating proceedings on personal data protection according to § 100 of Act No. 18/2018 Coll.) with the Office for Personal Data Protection of the Slovak Republic. Contact details of the office: Office for Personal Data Protection of the Slovak Republic Hraničná 12 820 07 Bratislava 27 www.dataprotection.gov.sk Tel. number: +421 /2/ 3231 3214 E-mail: statny.dozor@pdp.gov.sk.

Your rights can be exercised:

In person by submitting a request at the registered office of RAI-INTERNACIONAL, s.r.o.
By sending a written request by mail to the address of RAI-INTERNACIONAL, s.r.o.
Electronically via e-mail: rai@rai.sk

Operator Contact Information:

RAI – INTERNACIONAL, s.r.o. Nám. Slobody 2 974 00 Banská Bystrica Tel.: +421 907 999 399 +421 907 999 499 E-mail: rai@rai.sk ID No.: 36629855 Registration in Commercial Register: District Court Banská Bystrica, Section: Sro., Entry No.: 9675/S

Last updated date: 09.06.2019