spol. Panda Ride s.r.o.

 I.

Dear Customers,

In this document, we would like to inform you about how we, as the controller, handle your personal data that you have provided to us (as the data controller) in connection with your registration in the e-shop. system on the website www.pandaride.cz, where the registration of persons for transport by the controller is carried out.

This document fulfils our information obligation towards you in accordance with Articles 12, 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR“) and the obligations under Act No. 101/2000 Coll., on the protection of personal data, as amended.

You can read the content of the GDPR at the following address: http://eur-lex.europa.eu/legal-content/CS/TXT/PDF/?uri=CELEX:32016R0679&qid=1503598706724&from=CS.

A. Who is the controller of the personal data you have provided and how can you contact them?

By The personal data provided by you is the company Panda Ride s.r.o., ID NO.: 06450547, registered office: Rooseveltova 597/27, Bubeneč, 160 00 Prague 6 (hereinafter also referred to as the “Administrator“).

Regarding the processing of your personal data, you can contact us personally at our headquarters at Rooseveltova 597/27, Bubeneč, 160 00 Prague 6.

You can also contact us by phone at +420 770 670 270 or by e-mail at info@pandaride.cz.

Instead of you, we may be contacted about the processing of the personal data provided by you by a representative of your choice who proves to us by written power of attorney.

B. Who is our Data Protection Officer and how can you contact them?

The data processing officer is Tomáš Janout. It is ready to provide you with details of why and how we process your personal data, how we handle it and how it is secured against misuse or loss.

You can contact our Officer by email at info@pandaride.cz.

1. What categories of my personal data do you process?

As a rule, we process the following personal data:

• name and surname
• date of birth
• permanent home address or other address
• phone number
• e-mail
• Gender
• health information to prevent problems during transport (C)
• biometric data – a photograph recording your body (C)
• the above information on the persons over whom parental responsibility is exercised

For your information, we have marked personal data that is sensitive with “(C)”.

We only process sensitive personal data if it is necessary to provide you with the relevant service. For further details, please refer to section J. of this information.

D. For what purposes do we process your personal data and what is the legal basis for processing your personal data?

We process your personal data for the purposes of your use of the Company’s passenger transport services via the vehicles used by the Company and the use of other services related thereto, as well as the use of the said services by your relatives for whom you exercise parental responsibility and whom you have registered in the e-Privacy system. system on the website www.pandaride.cz, where the registration of persons for transport by the Administrator is carried out. The processing of your personal data is therefore carried out in order  tofulfil the purpose of the transport contract on the basis of which the controller provides you with services(processing pursuant to Article 6(1)(b) GDPR).

Due to the nature of the services provided by the Controller in the context of passenger transport, the transport operator (i.e. the Controller) cannot provide you with the services without having the following personal data from you in the form of:

(a) your name and surname,

(b) Your permanent address,

(c) your date of birth,

(d) information about your gender (if it can be inferred from your name and surname)

(e) Your phone

(f) Your e-mail

If you want the services of the personal transport operator – i.e. the controller – to be used by your relatives for whom you exercise parental responsibility, we will require the following information:

(a) the information listed in (a) to (d) above about the persons close to you for whom you exercise parental responsibility,

(b) Your telephone number so that we can contact you in the event of an accident to a loved one for whom you have parental responsibility.

In view of the nature of the services provided in the context of passenger transport in the controller’s vehicles, we also process your personal data for the purpose of protecting your life, health and property, as well as the life, health and property of other users of passenger transport and for advertising and marketing purposes (processing pursuant to Article 6(1)(d) GDPR). For this purpose, photographs of your person (or persons for whom you exercise parental responsibility) are also taken during transportation by the Administrator and are retained in case of an accident or other incident resulting in harm to the life, health or property of the participants or the Administrator or are used in the Administrator’s advertising and marketing for its presentation. For this purpose, we process the following personal data:

(a) Your biometric data (photographs of your body in the context of personal transport),

(b) information about your health to the extent of any injury or for the purpose of avoiding problems during personal transport.

The controller processes the aforementioned personal data for the purposes of the legitimate interests of the controller operating passenger transport. We define these legitimate interests as (a) the protection of the controller’s rights under the contract if you breach it or (b) if you assert any claim against the controller in connection with the contract between you and the controller. We thus process your personal data for the purpose of using them for the judicial and enforcement of our claims and rights in the event of your breach of contract and for the purpose of legal defence in the event that you bring any claim against us in connection with the contract(processing pursuant to Article 6(1)(f) GDPR). In this context, we would like to inform you that you have the right to object under Article 21 GDPR to the processing of your personal data on the grounds of our legitimate interests as defined above. You can address your objection to our Data Protection Officer (see section B. above).

By registering in el. system on the website www.pandaride.cz, where the registration of persons for transport by the administrator is carried out , you give your express consent:

1. to process your e-mail address for the marketing purposes of the controller in the form of sending you offers from the controller (including newsletters) and its business partners. We also forward your e-mail address to them for these purposes. You can request a list of the administrator’s partners who may contact you with a marketing offer from the administrator. Further information can also be requested from our Data Protection Officer;
2. to take photographs of your person (and of persons for whom you exercise parental responsibility and have registered them in your e-mail. system on the website pandaride.cz, where the registration of persons for transport by the controller is carried out) in the context of transport by the controller or persons authorised by the controller and to use these photographs by the controller for marketing or advertising purposes for the presentation of the controller and the personal transport services provided by the controller;
3. for the purpose of profiling you in order to offer you discounts or other benefits from the administrator that most closely match your customer profile. For more information on profiling, please contact the Data Protection Officer again.

The above consent is granted for an indefinite period of time (i.e. without time limit).

E. Who is the recipient of your personal data?

The recipient of your personal data is the controller.

With regard to the nature of the services that will be provided to you under the contract by the controller, your personal data will also be provided by the controller to the extent necessary:

 

(a) persons carrying out and participating in your passenger transport (drivers, dispatchers, …),

(b) to the state and administrative authorities conducting the investigation, should such a case arise,

(c) to state and administrative authorities for the purpose of protecting your vital interests (see section D. above),

(d) medical facilities, doctors, paramedics or similar persons providing treatment to you and/or saving your life (or the lives of your loved ones),

(e)  to the administrator’s legal representatives for the purpose of recovering claims owed to us in the event of a breach of contract by you and/or our defence against claims brought by you,

(f) entities dealing with and/or in charge of the recovery of outstanding debts,

(g) to state and administrative authorities, if we are asked to provide them, in connection with the exercise of the powers of such authorities,

(h) to business partners for the purposes of advertising and marketing offers if you have given your consent to the processing of your personal data,

(i)  to insurance companies for the purpose of investigating and settling claims made by you (or persons over whom you exercise parental responsibility) in the course of personal transport (accidents or damage to property or health).

F. Will your personal data be transferred abroad?

Your personal data will not be transferred abroad.

1. How long will your personal data be processed by the controller? 

As regards personal data in respect of which you have consented to processing (if applicable), as described in the consent, such personal data will be processed for the period for which your consent was given. You can contact our Data Protection Officer at info@pandaride.cz for information on how long you have consented to the processing of your personal data.

As regards the personal data we process on the basis of the relevant provisions arising from the GDPR (see section C. above), they will be processed for the time necessary for the provision of the service by the controller, for the time necessary to prove the provision of the service under accounting and tax regulations to the competent authorities of the Czech Republic and for the time necessary to protect our rights in the event of disputes arising from the contract, but in all cases always for at least the period during which the statute of limitations expires in respect of any claims, whether yours or those of the controller, arising out of or in connection with the concluded contract. The length of the limitation period is set out in the Civil Code (Act No. 89/2012 Coll.).

1. How will your personal data be processed? How will your personal data be protected? 

Your personal data will be processed in electronic form in the electronic system of the controller or in the electronic system of the persons to whom the personal data will be transferred.

Your personal data may also be processed in the form of a tangible document (a document on paper or similar tangible medium), which will be stored in the file cabinet of the controller.

Please be assured that we have put in place measures to ensure that your personal data is always protected to the maximum extent possible against misuse or loss.

All persons on the controller’s side who come into contact with personal data have been trained and vetted for this purpose. The archive of documentary documents is secured against unauthorised entry. The archive is secured by locks and other physical security measures. The electronically processed personal data is stored in a secure database.

1. What are your rights in relation to the processing of personal data? 

We hereby inform you of your rights related to the processing of your personal data:

(a) If you have given your consent to the processing of your e-mail address for advertising and marketing purposes, you have the right to withdraw your consent. You can withdraw your consent by unmarking the appropriate consent in your profile that was set up during your registration or by sending a withdrawal by email.

In connection with the withdrawal of your consent to the processing of your personal data, we would like to inform you that the controller is still entitled to process your personal data if the purpose of the processing is based on a reason provided for by the GDPR other than your consent.

At the same time, we would like to inform you that if you withdraw your consent, the lawfulness of the processing of your personal data resulting from your consent is not affected in any way. Thus, even after you withdraw your consent, the processing of your personal data by us will continue to be considered lawful during the period of validity of your consent.

(b) You have the right to request access to your personal data in accordance with Article 15 GDPR.

(c) You have the right to rectification of the personal data provided pursuant to Article 16 GDPR.

(d) You have the right to request the deletion of your personal data pursuant to Article 17 of the GDPR.

(e) You have the right to request restriction of the processing of your personal data pursuant to Article 18 GDPR.

(f) You have the right to portability of your personal data to another controller according to Article 20 GDPR, i.e. you can ask us to transfer your personal data to another controller.

(g) You have the right to lodge a complaint against us as the controller of your personal data with the supervisory authority, which is the Office for Personal Data Protection(https://www.uoou.cz/)(Article 77 GDPR).

If you decide to exercise any of the above rights, we are obliged to identify you, i.e. to verify whether the person to whom the personal data processed by us relates is requesting the exercise of the rights.

1. Are you processing my sensitive personal data? 

In the case of sensitive personal data, we process these data if they have been provided to us by you and/or if they have been disclosed by you and if their processing is necessary for the protection of your vital interests or those of another natural person or if their processing is necessary for the establishment, exercise or defence of legal claims of the controller. We have listed the sensitive personal data we generally process in section C. above.

In other cases, we only process such sensitive personal data if you have given your consent to the processing.

1. Is the provision of your personal data a prerequisite for the use of the personal transport services of the controller or for the conclusion of a contract for the use of these services? 

As we stated in Section D. above, without providing (a) your name, (b)               your permanent address, (c) your date of birth, (d) information about your gender (if it can be inferred from your first and last name), and (e) your telephone number and (f) your email address, you may not be provided with the services of the Controller due to the nature and type of services provided by the Controller. These data are necessary for the conclusion of the contract between you and the controller (identification of the contractual parties, identification of the persons to whom the service is to be provided, provision of the service) and without their provision the contract cannot be concluded.

Sensitive personal data is also required for the provision of services by the controller, without which it will not be possible to provide the transport services. Specifically, this includes (a) your biometric data (photographs of your body in the context of a passenger transport) and (b) health information to the extent of any injury or for the purpose of preventing problems during a passenger transport.

1. What is meant by the processing of personal data?

Processing of personal data shall mean any operation or set of operations on personal data or on sets of personal data, whether carried out mechanically or by automated processes. Processing includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other disclosure, alignment or combination, restriction, erasure or destruction of personal data. 

1. Further information 

If we change the purpose of processing your personal data, we will inform you in advance.

If your personal data is transferred to us from a third party, we will inform you of this.

If you are unclear about anything in this information, we are ready to answer your questions. You can contact our Data Protection Officer. For information on how to contact us, please see A. and B. above.

If we change this information, we will inform you of the change.

This information is available in physical or electronic form at the Administrator’s registered office and in electronic form on the website www.pandaride.cz.

* * *

Thank you for your attention to this information.

In Prague 1.8.2021

PANDA ride s.r.o.

Tomáš Janout – jednatel