Privacy Policy
AUTO GO s.r.o.
Personal Data Protection Notice under the GDPR
Effective from: 1 July 2026
This English version of the Privacy Policy is a translation provided for convenience only. In the event of any discrepancy or dispute regarding interpretation, the Czech version (Zásady ochrany osobních údajů) shall prevail.
AUTO GO s.r.o., Company ID No. (IČO): 01767542, with its registered office at Bořanovická 693, 250 64 Hovorčovice, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 266666 (hereinafter the "Controller"), hereby informs you about the manner and scope of the processing of personal data, including the scope of your rights as data subjects, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter the "GDPR") and Act No. 110/2019 Coll., on the processing of personal data.
Article 1 – Who is the controller of your personal data?
The controller of personal data is AUTO GO s.r.o., Company ID No. (IČO): 01767542, with its registered office at Bořanovická 693, 250 64 Hovorčovice, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 266666 (hereinafter the "Controller").
The Controller has appointed a Data Protection Officer (DPO), who can be contacted:
- by e-mail: [INSERT DPO E-MAIL]
- by post: Bořanovická 693, 250 64 Hovorčovice, Czech Republic, for the attention of the Data Protection Officer.
Article 2 – What personal data do we process and for what purpose?
We process only those personal data, and only to the extent, necessary for the provision of our services, the fulfilment of legal obligations and the protection of the Controller's legitimate interests. The individual purposes of processing, the categories of personal data processed and the applicable legal bases are set out below.
2.1 Performance of the contract for the temporary use of a vehicle (Art. 6(1)(b) GDPR)
For the conclusion and performance of the rental agreement (the Contract), we process in particular:
- identification data: name, surname, date of birth, personal identification number (birth number) or other personal identifier, permanent residence address;
- contact details: mobile phone number, e-mail address;
- data from the identity document and driving licence: document numbers, date of issue, period of validity, issuing authority, place of residence, scope of the driving entitlement, photograph, information on the absence of medical contraindications to driving;
- payment data: type of payment card, identifiers necessary for processing the payment, the first four and last four digits of the payment card, transaction history;
- operational and telematics data: vehicle geolocation data, distance travelled, driving time, driving style (acceleration, braking, speed), condition of the vehicle;
- dashboard camera data: footage from the road-facing camera (without any audio recording of the interior);
- administrative data: records of concluded contracts, fines, insurance events and other actions within the contractual relationship.
The provision of these data is a necessary condition for the conclusion and performance of the Contract. Refusal to provide them makes it impossible to provide the service.
2.2 Fulfilment of the Controller's legal obligations (Art. 6(1)(c) GDPR)
Certain processing of personal data is required of us by legal regulations, in particular:
- retention of accounting and tax documents for the period stipulated by law (Act No. 563/1991 Coll., on Accounting; Act No. 235/2004 Coll., on Value Added Tax);
- fulfilment of obligations towards administrative authorities, the Police of the Czech Republic and the courts;
- provision of data on the driver of the vehicle to the competent authorities in misdemeanour proceedings.
2.3 Legitimate interests of the Controller (Art. 6(1)(f) GDPR)
On the basis of legitimate interest, we process personal data for the following purposes:
- debt recovery and defence of legal claims – identification and contractual data, communication records;
- protection of the Controller's property and ensuring the security of the vehicle fleet – geolocation data, telematics data, data from IoT devices;
- fraud prevention and identity verification – identification and verification data;
- improving the quality of services and analysing vehicle usage – anonymised or pseudonymised operational data;
- direct marketing to existing customers – contact and identification data (you may opt out of receiving commercial communications at any time).
2.4 Consent of the data subject (Art. 6(1)(a) GDPR)
On the basis of your explicit consent, we process:
- personal data for direct marketing purposes after the termination of the contractual relationship;
- biometric data (facial measurement results) as part of the identity verification process using facial recognition technology – consent to this processing is voluntary and may be withdrawn at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. You may withdraw your consent using the Controller's contact details set out in Article 1.
Article 3 – Automated decision-making and profiling
Verification of the User's age and the length of their driving experience is subject to automated decision-making, which is necessary for the conclusion of the Contract (Art. 22(2)(a) GDPR). If the User does not meet the automatically verified conditions, their registration application will be rejected.
The User has the right to request human intervention, i.e. a review of the outcome of the automated decision by a natural person. An objection may be raised using the Controller's contact details. The Controller is obliged to carry out the review without undue delay.
The Controller further processes telematics data on driving style (speed, acceleration, braking) for the purposes of assessing traffic safety and protecting its property. These data may be used in assessing breaches of the User's contractual obligations.
Article 4 – To whom do we transfer your personal data?
4.1 Processors
Personal data may be transferred to processors who provide sufficient guarantees of personal data security and with whom the Controller has concluded a data processing agreement. These are in particular:
- providers of IT services and cloud infrastructure;
- payment service providers and banks processing transactions;
- providers of analytics and marketing tools;
- accounting and tax advisors;
- providers of customer support and call centres;
- debt collection agencies and legal representatives in the course of debt recovery.
The Controller’s analytics and marketing tools include in particular Google Analytics 4 and Google Ads (provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and Meta Pixel (provider Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). These tools are activated only if you give your consent in the cookie banner.
4.2 Public authorities and third parties by law
Under the conditions laid down by law, personal data may be disclosed to:
- the courts, the Police of the Czech Republic, the public prosecutor's office and other public authorities in the exercise of their statutory powers;
- insurance companies to the extent necessary for the settlement of insurance claims;
- tax offices and tax administration authorities.
4.3 Transfers of personal data outside the EEA
Personal data may be transferred to third countries outside the European Economic Area (EEA), exclusively under conditions ensuring their adequate protection, in particular:
- on the basis of a European Commission adequacy decision regarding the level of protection in the relevant country;
- on the basis of standard contractual clauses approved by the European Commission;
- on the basis of binding corporate rules;
- on the basis of a derogation for specific situations under Art. 49 GDPR.
Personal data are transferred to third countries in particular in connection with the tools listed in Article 4.1, whose parent companies are established in the United States of America. Such transfers take place under the EU–US Data Privacy Framework, in which both Google and Meta are certified, or on the basis of standard contractual clauses approved by the European Commission.
Upon request, the Controller will provide further information on the specific safeguards applied to cross-border transfers of personal data.
Article 5 – How do we ensure the security of your personal data?
The Controller applies technical and organisational measures appropriate to the nature, scope and risks of the processing, in particular:
- encryption of data in transit and at rest;
- access management – personal data are accessible only to authorised persons bound by a duty of confidentiality;
- storage of data in secured data centres with restricted physical access;
- regular security audits and vulnerability testing;
- compliance with industry standards (ISO 27001/27002, PCI DSS for payment data);
- procedures for handling security incidents and notifying the supervisory authority.
The Controller requires all processors and partners with access to personal data to meet the same security standards.
Article 6 – How long do we retain your personal data?
We retain personal data for the period necessary to fulfil the stated purpose of processing, but no longer than:
- for the duration of the contractual relationship and thereafter for the period strictly necessary to protect the Controller's rights and interests, as a rule 3–5 years from the termination of the contract;
- for the period stipulated by the applicable legal regulations for the fulfilment of legal obligations (e.g. accounting documents 5 years, tax documents 10 years from the end of the relevant tax period);
- for the duration of the Controller's legitimate interest, but no longer than 5 years from the termination of the contractual relationship, unless court or administrative proceedings are pending whose outcome depends on the processed data;
- in the case of processing based on consent, only until its withdrawal, but for a maximum of 5 years from the date it was given.
After the retention period expires, personal data are securely erased or anonymised.
Article 7 – What rights do you have in connection with the processing of your personal data?
As a data subject, you have the following rights vis-à-vis the Controller:
Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether your personal data are being processed and, if so, access to those data and information about the processing. The Controller is obliged to provide a copy of the personal data being processed.
Right to rectification (Art. 16 GDPR): You have the right to have inaccurate or incomplete personal data rectified without undue delay. We ask that you inform us of any change to your personal data without delay.
Right to erasure – "right to be forgotten" (Art. 17 GDPR): You have the right to erasure of personal data where (i) they are no longer necessary for the purposes for which they were processed; (ii) you withdraw consent and no other legal basis exists; (iii) you raise a justified objection; (iv) the data were processed unlawfully. This right does not apply where the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
Right to restriction of processing (Art. 18 GDPR): You have the right to restriction of processing where (i) you contest the accuracy of the data; (ii) the processing is unlawful and you oppose erasure; (iii) the Controller no longer needs the data but you require them for legal claims; (iv) you have raised an objection and the verification of legitimate grounds is pending.
Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of personal data carried out on the basis of the Controller's legitimate interest (including profiling) or for direct marketing purposes. In the case of an objection to direct marketing, processing for that purpose will be terminated immediately.
Right to data portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to the Controller in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller.
Right to withdraw consent: Where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal. Consent may be withdrawn by e-mail or by letter to the Controller's contact addresses.
Right to human intervention in automated decision-making (Art. 22 GDPR): You have the right not to be subject to a decision based solely on automated processing (including profiling) where such a decision has legal or similarly significant effects on you.
Right to lodge a complaint: If you believe that the processing of your personal data is in breach of the GDPR, you have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, e-mail: posta@uoou.cz, web: www.uoou.cz.
We will handle all requests to exercise your rights free of charge and without undue delay, no later than one month from their receipt. In exceptional cases, this period may be extended by a further two months, of which we will inform you.
Article 8 – Direct marketing and cookies
8.1 Direct marketing
We process the personal data of existing Users (name, e-mail, telephone) for direct marketing purposes on the basis of the Controller's legitimate interest. You may opt out of receiving commercial communications at any time:
- by unsubscribing directly in the body of the e-mail (unsubscribe link);
- by sending a request by e-mail or by letter to the Controller's contact addresses.
After the termination of the contractual relationship, we carry out direct marketing exclusively on the basis of the User's explicit consent.
8.2 Cookies and tracking technologies
The Controller's Website and Application use cookies and similar tracking technologies. Cookies strictly necessary for the operation of the website are always stored. Analytics and marketing cookies are stored only on the basis of your consent, which you give in the banner on your first visit and which you can change or withdraw at any time.
An overview of all cookies used on the website, including their purpose, retention period and provider, is available below.
Article 9 – Telematics and IoT devices
All of the Controller's vehicles are equipped with an electronic hardware device (IoT device) which:
- enables remote locking and unlocking of the vehicle;
- records and transmits to the Controller's system the vehicle's location (GPS), distance travelled, driving time, fuel/battery status and other operating parameters;
- records telematics data on driving style: speed, acceleration, sudden braking, impacts and involvement in traffic accidents;
- road-facing dashboard cameras record the surroundings of the vehicle; the camera does not record audio or images of the vehicle's interior.
These data are processed on the basis of the performance of the contract and the Controller's legitimate interest. By concluding the Contract, the User acknowledges and consents to this processing.
Article 10 – Changes to the Privacy Policy
The Controller is entitled to update this Policy at any time, in particular in response to changes in legal regulations or in the manner of processing personal data. Each change will be notified to the User by e-mail or via the Application at least 15 days before it takes effect. The current version of the Policy is always available on the Controller's website.
Article 11 – How can you contact us?
Please communicate your rights, questions or comments to us:
- by e-mail: info@autogo.cz
- by telephone: [INSERT PHONE]
- in writing to the address of the Controller's registered office: AUTO GO s.r.o., Bořanovická 693, 250 64 Hovorčovice, Czech Republic.
The Controller is obliged to respond without undue delay, no later than one month from receipt of the request. The Controller may record customer support communications for quality control purposes; callers will be informed of the recording in advance.
Appendix – Overview of the purposes of personal data processing
This overview summarises the main purposes of processing, the legal bases and the indicative retention periods. Details are set out in the relevant articles of this Policy.