Privacy Policy

Controller

The controller is the Operator identified above. Use the contact details above for privacy requests. Where the Operator publishes a dedicated privacy contact, that contact applies for data protection matters.

What data we process

Depending on how you use the service, the Operator may process: - booking data: ride, duration, date, time, number of Participants, selected extras, vouchers and the booking code; - contact data: name, email and phone, and company or invoice details where you provide them; - payment related data: payment status and identifiers from the payment provider; the Operator does not store full card numbers; - communication data: messages you send and the emails the service sends you; - account data for admins and staff who log in: login identity, role and session information; - technical data needed to operate and secure the service, such as server logs.

Provide only the data needed for the Booking. Please do not enter unnecessary sensitive information about other Participants.

Purposes and legal bases

The Operator processes personal data to: - create and manage your Booking and provide the ride (performance of a contract); - process payments and prevent payment fraud (contract and legitimate interests); - meet accounting and tax obligations, including invoices (legal obligation); - respond to your messages and complaints (contract or legitimate interests); - operate, secure and improve the service, including admin and staff accounts (legitimate interests); - send operational notifications to admins and staff who opt in on their device (legitimate interests or consent).

Where processing relies on consent, you can withdraw it at any time without affecting prior lawful processing.

Recipients and processors

The Operator uses service providers who process data on its behalf under contract, only as needed to run the service: - Stripe for card payment processing; - Resend for transactional email delivery; - an S3 compatible object storage provider for uploaded media; - a cloud hosting and database provider that hosts the application and its PostgreSQL database; - browser push delivery services used only for admin and staff notifications.

The Operator does not sell personal data. Data may be disclosed to authorities where legally required. The current list of providers reflects the service as operated and can change; material changes are published with an updated date.

International transfers

Some providers may process data outside the European Economic Area. Where that happens, the Operator relies on a valid transfer mechanism under applicable data protection law, such as an adequacy decision or standard contractual clauses. You can request information about the safeguards used for a specific provider.

Retention

The Operator keeps personal data only as long as needed for the purpose it was collected for, and then deletes or anonymizes it. Booking and communication data are kept for the duration of the relationship and while a claim or complaint may arise. Accounting and tax documents are kept for the statutory retention period. Housekeeping deletion of operational data is performed as an administrative action rather than by an automatic public facing timer.

Your rights

Subject to applicable law, you have the right to access your data, to rectify inaccurate data, to erasure, to restriction, to object to certain processing, and to data portability. Where processing relies on consent, you can withdraw it at any time.

To exercise a right, contact the Operator using the details above. The Operator may need to verify your identity. You also have the right to lodge a complaint with the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov Slovenskej republiky) or your local supervisory authority.

Payment data

Card payments are handled by Stripe. You enter card details in the payment provider's secure flow, and the Operator receives payment status and identifiers needed to reconcile the Booking, not your full card number. The payment provider processes card data as an independent controller for its own compliance and fraud prevention purposes; see the provider's own privacy information.

Cookies and local storage

The public website does not run analytics or marketing tracking and does not set tracking cookies. Signed in admin and staff areas use a session mechanism that is strictly necessary to keep you logged in. Some pages use browser local storage for a limited functional purpose. The Cookie Policy describes this in more detail.

Security

The Operator applies appropriate technical and organizational measures to protect personal data, including access control for admin and staff accounts and encryption in transit. No method of transmission or storage is perfectly secure, but the Operator works to protect data proportionately to the risk.

Children

The booking service is intended for adults. Minors may attend a ride under the supervision required by the ride and applicable law, but a binding Booking should be made by an adult. Please do not provide unnecessary personal data about children.

Changes to this policy

The Operator may update this policy to reflect changes in the service or the law. Material changes are published here with an updated date. Please review this page from time to time.