Privacy Policy

I. Controller of personal data

The controller of personal data is Gaelta s. r. o., registered office Novomestská ulica 9514/9, 917 01 Trnava, Slovakia, Company ID: 55 966 357, Tax ID: 2122141912, VAT ID: SK2122141912, registered in the Commercial Register of the District Court Trnava, section Sro, file no. 55755/T, operating the brand LuxMotion – Zážitková požičovňa áut (the “Controller”).

Contact for questions about personal data protection: [email protected], phone: +421 911 463 138.

II. Purposes and legal bases of processing

A. Conclusion and performance of a contract (Art. 6(1)(b) GDPR)

We process personal data necessary to:

• conclude a motor vehicle rental contract (Mercedes-Benz GLC, Ford Mustang Mach 1, Chevrolet Camaro SS);
• carry out an order for a driving experience;
• provide chauffeur service and transfers;
• provide video production services (GoPro, drone, post-production);
• handle online orders and payments;
• issue invoices and accounting documents, including company invoicing;
• create and manage a customer account, including login details;
• communicate about the order and the provision of the service.

Categories of data (natural person): first name, surname, date of birth, Slovak birth number, home address, e-mail, phone number, identity card/passport number, driving licence number, photocopies/scans of the identity card (front and back) and driving licence (front and back) uploaded when booking a short-term rental, signature (digital or handwritten), login details for the customer account. Payment data (card number) is processed exclusively by Stripe, Inc. as payment processor – the Controller has no access to the card number.

Categories of data (company order): company name, company ID, tax ID, VAT ID, billing address, name and contact details of the person acting.

Processing of the birth number: We process the Slovak birth number to uniquely identify the lessee in the Motor Vehicle Rental Contract under Slovak Act No. 301/1995 Coll. on birth numbers and § 78(5) of Act No. 18/2018 Coll. The birth number is not disclosed to third parties except where required by law (public authorities).

Processing of document copies: Scans/photos of documents are uploaded over an encrypted HTTPS connection and stored in a secured non-public directory with restricted access. Only staff authorised to manage orders can access these files. We keep document scans for the duration of the contractual relationship and at most 5 years after it ends (for possible complaints, insured events and legal claims), after which they are deleted automatically.

Retention period (other contract data): for the duration of the contractual relationship and 5 years after it ends, or for the period set by specific legislation (accounting and tax rules – 10 years). The customer account is kept until the customer deletes it.

B. Compliance with legal obligations (Art. 6(1)(c) GDPR)

We process data on the basis of obligations under:

• Slovak Act No. 431/2002 Coll. on accounting;
• Act No. 222/2004 Coll. on VAT;
• Act No. 563/2009 Coll. (Tax Code);
• Act No. 395/2002 Coll. on archives and registries;
• Act No. 8/2009 Coll. on road traffic (obligations in traffic accidents).

Retention period: according to the relevant legislation (usually 10 years).

C. Legitimate interest of the Controller (Art. 6(1)(f) GDPR)

On the basis of legitimate interest we process data for:

• protection of the Controller's property – GPS telemetry tracking of rented vehicles during the rental period;
• 360° photo and video documentation of the vehicle condition at pick-up and return (handover/return protocol);
• GoPro recording from the vehicle cabin while driving (when the video production service is activated) – the Lessee agrees by signing the contract; the Lessee is responsible for obtaining fellow passengers' consent;
• prevention of fraud, misuse of services and unauthorised use of vehicles;
• recovery of claims arising from the contract;
• improving the quality of services and analysing website traffic;
• direct marketing to existing clients (soft opt-in under § 116 of Slovak Act No. 452/2021 Coll. on electronic communications).

GPS tracking: The vehicles are equipped with a GPS device. Position is tracked only during the rental period. Location data is kept for at most 30 days after the end of the rental and then deleted automatically, unless needed to resolve a dispute or insured event.

Photo documentation of the vehicle: Photos and videos of the vehicle condition at pick-up and return serve only as evidence in case of a damage dispute and are kept for at most 12 months after the vehicle is returned, unless an insured event or another dispute is being resolved.

Right to object: You have the right to object at any time to processing based on legitimate interest (including direct marketing) under Art. 21 GDPR. For direct marketing, we stop processing immediately after an objection.

D. Consent of the data subject (Art. 6(1)(a) GDPR)

On the basis of freely given, informed and unambiguous consent we process data for:

• sending marketing e-mails and the newsletter (via Ecomail);
• showing personalised advertising via remarketing tools (Meta Pixel + Conversions API / PixelYourSite, Google Ads, Seznam Sklik);
• storing analytics and marketing cookies.

Age limit: Marketing services are intended only for persons over 16 years of age in accordance with Art. 8 GDPR.

Consent can be withdrawn at any time without affecting the lawfulness of processing before withdrawal: by unsubscribing from the newsletter (link in every e-mail), by changing the cookie settings on the website or by sending a request to [email protected].

III. Recipients and processors of personal data

Your personal data may be disclosed to the following third parties (processors), with whom the Controller has concluded data processing agreements (Art. 28 GDPR):

Transfers to third countries: For transfers to the USA, the Controller relies on standard contractual clauses (SCC) approved by the European Commission and/or certification under the EU-U.S. Data Privacy Framework (DPF).

Joint controllers (Art. 26 GDPR): When using Meta Pixel, the Controller and Meta Platforms, Inc. may act as joint controllers (judgment C-40/17 Fashion ID). Division of responsibilities: Meta Controller Addendum.

Data may also be provided to public authorities (police, courts, tax office, SOI) to comply with legal obligations.

IV. Rights of the data subject

• Right of access (Art. 15 GDPR) – confirmation of processing, a copy of the data and information about the processing.
• Right to rectification (Art. 16 GDPR) – correction of incorrect or completion of incomplete data.
• Right to erasure (Art. 17 GDPR) – erasure if the purpose has ceased, you have withdrawn consent or the data was processed unlawfully (not absolute where there are legal obligations).
• Right to restriction of processing (Art. 18 GDPR) – e.g. when the accuracy of the data is contested.
• Right to data portability (Art. 20 GDPR) – receiving the data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR) – in particular to direct marketing, at any time and unconditionally.
• Right not to be subject to automated decision-making (Art. 22 GDPR) – the Controller does not carry out profiling with legal effects.
• Right to withdraw consent – at any time without affecting previous processing.
• Right to lodge a complaint – with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk.

Send requests to: [email protected]. We will reply without undue delay, at the latest within 30 days; in justified cases the period may be extended by a further 60 days.

V. Security of personal data

The Controller has taken appropriate technical and organisational measures, in particular:

• encryption of data in transit (TLS/SSL);
• access to personal data restricted to authorised persons only;
• regular data backups;
• physical security of the premises;
• strong passwords and two-factor authentication;
• staff training on personal data protection;
• regular review of security measures.

VI. Cookies and automatically collected data

Detailed information on the use of cookies can be found in the Cookie Policy.

VII. Final provisions

This policy takes effect on 1 May 2026. The Controller reserves the right to update it at any time. The current version is always available at www.luxmotion.sk/gdpr.