Personal data protection

1. Controller

Fafuliak, s.r.o.
J. Poničana 51, 960 01 Zvolen
Company ID: 36 790 737
registered in the Commercial Register of the District Court Banská Bystrica, section Sro, file no. 13207/S
managing director: Ing. Ondrej Fafuliak

Branch: Autopožičovňa Bystrica, Na Troskách 25, 974 01 Banská Bystrica (Europa SC).

Contact in matters of personal data protection: in person or by post at the registered office address, by phone at +421 905 537 157 or 045 536 42 88, or by e-mail at show e-mail.

A data protection officer (DPO) has not been appointed, as the law does not require the controller to do so.

2. What data we process

We obtain data mainly directly from you – when you make an enquiry or a booking and conclude an agreement (in person, by phone, in writing or electronically). We obtain data of employees of corporate customers from their employer. We process only ordinary personal data; we do not process special categories of data.

• Identification: title, first name, surname, date of birth, signature, details from your ID card, passport and driving licence including photo.
• Contact: permanent or postal address, e-mail, phone.
• Service data: rented vehicle, price, place, date and time, discounts and benefits.
• Payment: bank account, payment card and payment details.
• Leasing: client identification number, agreement number, vehicle identification number.
• Insurance claims: history of incidents including payments and expert reports.
• Vehicle location: GPS monitoring of selected vehicles – we inform you about monitoring when you take over the car.

Providing the data necessary to conclude the agreement is a contractual requirement. Without it we cannot conclude the rental agreement (Commercial Code No. 513/1991 Coll.).

3. Purposes and legal bases

Purpose	Legal basis
Handling enquiries and bookings, concluding and performing the agreement (vehicle handover, invoicing, complaints, insurance claims, recovery of damages)	Art. 6(1)(b) and (c) GDPR – agreement and pre-contractual relations, legal obligation
Identification of the lessee – copies of identity documents and driving licence	Art. 6(1)(f) – legitimate interest (protection of property, crime prevention)
Protection of property – GPS location of selected vehicles	Art. 6(1)(f) – legitimate interest
Accounting and tax documents	Art. 6(1)(c) – Act No. 431/2002 Coll. on accounting, Act No. 222/2004 Coll. on VAT
Records management and mail registry	Art. 6(1)(c) – Act No. 395/2002 Coll. on archives and registries
Sending commercial offers	Art. 6(1)(a) – consent (revocable at any time), for existing customers (f) – legitimate interest

We do not carry out automated decision-making or profiling.

4. Web form

Booking form: if you send us a rental enquiry, we process your name, phone, e-mail, selected vehicle, pick-up and return date and the text of the message (e.g. delivery place or a planned trip abroad). We process operating lease enquiries sent by e-mail or phone in the same way.

We use the data only to handle the enquiry and possibly conclude an agreement (Art. 6(1)(b) GDPR).

The enquiry reaches us by e-mail. If it does not result in an agreement, we delete the e-mail within 12 months at the latest. To protect the form against misuse, we briefly store the time of submission together with a one-way encrypted (hashed) record of the IP address, from which the original address cannot be recovered.

5. Recipients

We provide data only when necessary or required by law:

• state and supervisory authorities (e.g. Slovak Trade Inspection, Office for Personal Data Protection, tax office, Police Force of the Slovak Republic), courts and law enforcement authorities,
• insurance companies – to the extent of the vehicle insurance policy and in insurance claims,
• contracted providers of IT, hosting, e-mail, postal, financial and insurance services,
• auditors, legal, tax and accounting advisers, banks and other persons bound by confidentiality.

6. Retention period

• Contract data for the duration of the agreement and then 10 years after its end (archiving, accounting). In court or administrative proceedings until their final conclusion.
• Copies of identity documents for the validity of the agreement, at most 1 year, unless we need them to resolve damage, an insurance claim, theft or a legal claim.
• GPS data from vehicles 2 years after the end of the contractual relationship.
• Web enquiries that did not result in an agreement, at most 12 months.
• Marketing data until consent is withdrawn.

After the period expires, we delete, destroy or shred the data.

7. Your rights

You have the right of access to data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability (Art. 20), the right to object (Art. 21), the right not to be subject to automated decision-making (Art. 22) and the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing before it.

You can exercise your rights in person at the registered office or the branch, by post to the registered office address or by e-mail. We will reply without undue delay, within 1 month at the latest.

You also have the right to lodge a complaint (a petition under Section 100 of Act No. 18/2018 Coll.) with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, tel. +421 2 3231 3214, statny.dozor@pdp.gov.sk, dataprotection.gov.sk.

8. Cookies

Cookies are small files that a website stores in your browser. The browser's local storage (localStorage) works similarly.

Category	Purpose	Consent
Necessary	Remembering your cookie choice (ab_consent) and the price display incl. / excl. VAT (ab_vat) in the browser's local storage, valid until deleted or changed. Without it, the bar would be shown all the time.	Not required (Section 109(8) of Act No. 452/2021 Coll. on electronic communications)
Analytics	Anonymous traffic statistics. We currently do not use any analytics tool.	Yes
Marketing	Displaying relevant offers on other websites and social networks. We currently do not use any marketing tool.	Yes

The website does not load any third-party tracking scripts, fonts or maps. The Google Maps link opens only after a click, in a new window. If we add analytics or marketing tools in the future, they will only run with your consent and we will add them to this list.

Change cookie settings

You can also delete cookies at any time in your browser settings.

9. Security

The website communicates exclusively over an encrypted HTTPS connection. The form is protected against bots and misuse. Only authorised persons bound by confidentiality have access to personal data.

Effective from 8 November 2026.