Personal data protection

1. Controller

1.1 The controller of personal data is WeDriver, with its registered office at DOPLNIŤ – sídlo spoločnosti, company ID (IČO): DOPLNIŤ (the “Controller”). We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on the protection of personal data.

1.2 Contact for personal data protection matters: gdpr@wedriver.cz, or by post at the registered office address.

2. What data, why and on what legal basis

• Account and login (email, name, telephone, date of birth): creating and managing the account, login by one-time link. Basis: performance of a contract, Article 6(1)(b) GDPR.
• Booking, rental and payments (vehicle, dates, price, payment status, handover and return protocols including photographs of the vehicle, damage, kilometres): concluding and performing the rental agreement, settlement of accounts, resolution of damage. Basis: contract (point (b)), legitimate interest in protecting property and asserting claims (point (f)).
• Driving licence and driver verification (number, validity, category, verification result): verifying fitness to drive, protection of property and insurance. Basis: contract (point (b)) and legitimate interest (point (f)). We do not copy it beyond what is necessary.
• Invoices and accounting (billing details, company ID, tax ID, VAT ID): legal obligation under the accounting and VAT legislation, Article 6(1)(c).
• Telematics and digital key (vehicle location, odometer, lock status, command log; this is generally vehicle data that is linked to the renter during the rental): protecting property against theft, charging for mileage, assistance, securing digital access. Basis: legitimate interest (point (f)) and contract (point (b)). We do not track location in real time except on statutory and contractual grounds (suspected theft, non-return of the vehicle, accident, assistance).
• Business customers (company ID, tax ID, contact persons, members of the business account): contractual relationships and invoicing. Basis: contract and legal obligation.
• Vehicle owners (name, date of birth, address, telephone, tax ID, IBAN, data from an identity document that we only verify (we do not store a copy of the document), vehicle data and documents – registration certificate, insurance, photographs): concluding and performing the contract with the Owner, verifying identity and ownership, payouts, fraud prevention. Basis: contract (point (b)) and legitimate interest (point (f)).
• Reporting of owners’ income to the tax administration (DAC7): the Owner’s identification data, IBAN and total rental income. Basis: legal obligation, Article 6(1)(c).
• Brokering between renter and Owner: after a confirmed booking, the Owner sees the renter’s name and telephone number, and the renter sees the Owner’s telephone number and exact pick-up address (only the first name and the initial of the surname are shown publicly). Basis: contract (point (b)). Each party is an independent controller in using this data and may use it only for the handover, the return and asserting claims arising from the rental.
• Communication and enquiries (forms, emails, B2B enquiries): replying to a request, preparing an offer. Basis: pre-contractual relations (point (b)), legitimate interest (point (f)).
• Transactional emails (confirmation, reminder, invoice, cancellation): performance of the contract; this is not marketing.
• Newsletter (email): sending offers on the basis of consent, Article 6(1)(a) GDPR. You can withdraw consent at any time using the link in the email or at gdpr@wedriver.cz.
• Security and logs (technical logs, audit log of staff activity): securing the system and preventing misuse, legitimate interest (point (f)).

2.2 Providing the data needed to conclude and perform the contract is a contractual requirement; without it we cannot rent you a vehicle. The newsletter is voluntary.

3. Who we share data with

3.1 We share data only with processors and recipients who need it for the purposes stated, on the basis of a data processing agreement:

• Stripe Payments Europe, Ltd. and affiliated companies – processing of payment cards and deposit holds (the lessor does not see or store card data),
• Resend (Resend, Inc.) – sending emails,
• hosting, database and backup provider [TO BE COMPLETED depending on deployment],
• telematics and digital key provider (vehicle manufacturer or device supplier) [TO BE COMPLETED once selected],
• insurers and assistance companies, repair shops and towing services in the event of a claim,
• accountant, legal and tax adviser, auditor,
• the vehicle Owner (when renting their vehicle) and the renter (when renting from an Owner) to the extent stated above,
• the tax administrator (Financial Administration of the Slovak Republic) for the statutory reporting of owners’ income (DAC7),
• public authorities (police, courts, administrative bodies) where required by law, and, in the recovery of debts, debt collection companies.

3.3 We do not sell personal data. If a processor is based outside the EU/EEA (e.g. the USA), the transfer takes place on the basis of a Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

4. How long we keep data

• Account: until you cancel it; an inactive account with no bookings is deleted/anonymised 3 years after the last activity.
• Contracts, bookings, protocols and photographs: 4 years from the end of the rental (limitation period and assertion of claims); in the case of an ongoing dispute, until it is concluded.
• Accounting documents (invoices, payout statements): 10 years under the accounting legislation; data needed for DAC7 reporting for the period set by law.
• Owner data and vehicle documents: for the duration of the cooperation and then 4 years; payout data in accordance with accounting rules.
• Driving licence data: for the duration of the rental and then 4 years as part of the contract documentation.
• Telematics and location: during the rental; then for no more than 6 months, and in the case of a claims event or suspected criminal offence for the time necessary to resolve the matter.
• Audit and technical logs: no more than 12 months.
• Newsletter: until consent is withdrawn.
• Login links: valid for 15 minutes, stored in the database only as a hash.

5. Your rights

5.1 You have the right of access to your data, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. You may withdraw consent at any time without affecting the lawfulness of processing before its withdrawal.

5.2 Send your request to gdpr@wedriver.cz. We will respond within 30 days (in complex cases the period may be extended by a further 2 months). You can also correct the data in your account directly in the Profile section.

5.3 You have the right to lodge a complaint with the supervisory authority: the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.

5.4 We do not carry out automated decision-making or profiling with legal effects.

6. Security

6.1 We protect data with technical and organisational measures: an encrypted connection (HTTPS), passwordless login by one-time link, role-based access separation (customer, staff, administrator), logging of staff activity, storing tokens only as hashes, payments through a certified gateway, and regular backups.

6.2 We will notify the supervisory authority and affected data subjects of a personal data breach in the cases and within the time limits laid down by the GDPR.

7. Cookies

7.1 We use strictly necessary cookies (login session, consent choice) and, with your consent, a functional cookie to remember your chosen appearance. Details are in the cookie notice.

8. Changes

8.1 We may update this policy. The current version is always published on this page with its effective date.