POLICY ON THE PROCESSING AND PROTECTION OF PERSONAL DATA
This English translation is provided for convenience; the Czech version is binding.
Version 2.0 · effective from 21 April 2026
Dear clients,
protecting your privacy and personal data is of fundamental importance to us. This document gives you all the information about which personal data we process, for what purpose, on what legal basis, to whom we disclose it and what rights you have in connection with the processing.
This policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and Act No. 110/2019 Coll., on the processing of personal data.
Identification of the controller
The controller of personal data is Teslička s.r.o., Company ID (IČO): 09062521, registered office at Novákových 257/32, 180 00 Praha 8, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 330159 (the “Provider” or the “Controller”), in connection with the provision of services in the field of vehicle rental, driving experiences, passenger transport and related services (the “Services”) on the basis of a contract concluded with the client (the “Contract”).
The operator of the booking system and payment intermediary is Tvůj tým s.r.o. (the “Intermediary”), which acts for the Provider as a processor of personal data within the meaning of Article 4(8) GDPR; the Provider remains the controller.
Contact for exercising your rights and for questions: privacy@teslicka.cz
The Provider has not appointed a data protection officer (DPO), as it is not required to do so under Article 37 GDPR. Please direct all questions and requests to the e-mail address above.
1. For what purposes and on what legal basis we process personal data
1.1 Conclusion and performance of the Contract
Legal basis: Article 6(1)(b) GDPR – performance of a contract and steps taken prior to entering into a contract.
The Services are provided on the basis of a Contract concluded under the General Terms and Conditions (GTC) via the Intermediary's booking system. For the purpose of concluding and performing the Contract we process:
identification data of the client or, where the client is a legal entity, of the natural person acting on its behalf: first name, surname, address of residence / registered office, date of birth, company ID (IČO), tax identification number (DIČ);
contact details: e-mail address, telephone number;
data on the Service provided (scope, dates, price);
for Services in which the client drives the vehicle: the driving licence number and validity, and confirmation that the client holds a category B driving entitlement (to verify eligibility to drive);
bank details and other payment data;
data from communication with the client and records of the performance of the Contract.
Providing this data is a contractual requirement; without it the Contract cannot be concluded or performed.
1.2 Compliance with legal obligations
Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation of the controller (in particular Act No. 563/1991 Coll., on accounting; Act No. 235/2004 Coll., on value added tax; Act No. 499/2004 Coll., on archiving and records management; the Tax Code).
In this context we process the data necessary for keeping accounts, meeting tax obligations, archiving documents and fulfilling obligations towards public authorities.
1.3 Protection of the Provider's legitimate interests
Legal basis: Article 6(1)(f) GDPR – legitimate interests of the Controller.
The Provider's legitimate interests for which we process personal data include in particular:
protection and enforcement of legal claims (records in case of complaints, disputes, court or administrative proceedings);
protection of property – for Services that include vehicle rental, we process data from the GPS locator on the position of the vehicle solely for the purposes of theft prevention, vehicle security, dealing with traffic accidents and recovering damages (see point 1.5);
direct marketing to existing clients – sending information and news about the Provider's services to the e-mail address / telephone number obtained when the Contract was concluded. You have the right to object to such processing at any time (Article 21(2) GDPR); unsubscribing is free of charge and the option is included in every message.
1.4 Sending commercial communications to persons outside a contractual relationship
Legal basis: Article 6(1)(a) GDPR – consent of the data subject, in conjunction with Act No. 480/2004 Coll., on certain information society services.
We send commercial communications to persons who have actively subscribed to our news, to the e-mail address they provided to us for this purpose. You can withdraw your consent at any time free of charge via the unsubscribe link in every message or by e-mail to privacy@teslicka.cz. Withdrawing consent does not affect the lawfulness of processing before its withdrawal.
1.5 GPS location of the rented vehicle
Legal basis: Article 6(1)(f) GDPR – the Provider's legitimate interest in protecting high-value property against theft, misappropriation and unauthorised use, and Article 6(1)(b) GDPR to the extent of checking compliance with contractual limits (territorial limit, permitted areas of use).
GPS data is processed for the duration of the vehicle rental Contract and then kept for no longer than 12 months after the end of the rental for the purpose of dealing with later complaints and incidents. The client is informed before the Contract is concluded that the vehicle is fitted with a GPS locator. GPS data is not used for profiling the client's behaviour within the meaning of Article 22 GDPR.
2. Sources and recipients of personal data
2.1 Sources of data
We obtain personal data primarily directly from you, through the Intermediary's booking system or through in-person or electronic communication. We do not seek out any other data about you. The client is obliged to provide only accurate data and to update it if it changes.
2.2 Processors and recipients
We use the following processors to process personal data (Article 28 GDPR):
Tvůj tým s.r.o. – operator of the booking system and payment intermediary;
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland – provider of the Microsoft 365 and Microsoft Azure cloud services;
Ecomail.cz s.r.o., Company ID (IČO): 02762943, Na Zderaze 1275/15, 120 00 Praha 2 – provider of the e-mailing platform used to send commercial communications;
the provider of the telematics / GPS solution for tracking the vehicle's position (we will provide the current list of processors on request);
accountants and tax advisers, lawyers and other professional advisers bound by a statutory duty of confidentiality.
Personal data may also be disclosed to public authorities within the scope of their statutory powers (tax authorities, the Police of the Czech Republic, courts, the Office for Personal Data Protection, etc.).
2.3 Transfers of data outside the EU/EEA
We process personal data primarily within the EU/EEA. With Microsoft Ireland Operations Limited, selected data may, in justified cases, be transferred to the USA (e.g. support and administrative operations of the parent company Microsoft Corporation). Such a transfer takes place on the basis of:
the European Commission adequacy decision C(2023) 4745 of 10 July 2023 under the EU-U.S. Data Privacy Framework (DPF), where the recipient is certified under it (Microsoft Corporation is certified under the DPF); and/or
standard contractual clauses approved by the European Commission under Article 46(2)(c) GDPR.
No other transfers to third countries take place. Note: the EU-U.S. Privacy Shield framework was declared invalid by the judgment of the Court of Justice of the EU of 16 July 2020 in Case C-311/18 (Schrems II) and has been replaced by the DPF mentioned above.
3. Method of processing and security
Personal data is processed in electronic form by automated means in the systems of the Provider, the Intermediary and the individual processors and, in justified cases, also manually. Processing is carried out by employees and contractors of the Provider who are bound by a duty of confidentiality.
To protect personal data we use appropriate technical and organisational measures within the meaning of Article 32 GDPR, in particular:
encryption of communication (TLS/HTTPS) and secure data transfer;
access management based on the principle of least privilege and multi-factor authentication for sensitive systems;
antivirus protection, firewalls, regular system updates and backups;
physical protection measures (secured premises, access control);
regular staff training and assessment of security risks.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the Controller will notify the Office for Personal Data Protection in accordance with Article 33 GDPR and, where applicable, also the data subjects under Article 34 GDPR.
The Provider does not carry out automated individual decision-making or profiling within the meaning of Article 22 GDPR.
4. Retention period of personal data
We keep personal data only for as long as is strictly necessary to fulfil the given purpose:
data processed for concluding and performing the Contract – for the duration of the contractual relationship;
data for protecting legitimate interests (enforcement of claims) – for the limitation periods under the Civil Code; the general objective limitation period is 10 years (Section 629(2) of the Civil Code) and, for rights arising from intentionally caused damage, up to 15 years (Section 636(2) of the Civil Code); during this period we process identification and contact data, data on the performance of the Contract and on communication;
accounting and tax documents – 5 years from the end of the accounting period (Section 31 of the Accounting Act), tax documents for VAT 10 years from the end of the tax period (Section 35 of the VAT Act);
data processed on the basis of consent – until consent is withdrawn, but no longer than 5 years from when it was given, with the possibility of extension;
GPS data – for the duration of the rental and 12 months thereafter (see point 1.5).
After the specified periods have expired, personal data is securely destroyed or anonymised.
5. Your rights
In connection with the processing of personal data you have the following rights (Articles 15 to 22 GDPR):
the right of access to personal data, including a copy of the data processed and information on the purpose, categories of data, recipients and retention period;
the right to rectification of inaccurate or incomplete data;
the right to erasure (“right to be forgotten”) where there are no legal grounds for further processing;
the right to restriction of processing;
the right to data portability – to receive the data in a structured, commonly used and machine-readable format or to have it transmitted to another controller;
the right to object to processing based on legitimate interest (including direct marketing);
the right to withdraw consent where processing is based on consent, with effect for the future;
the right not to be subject to a decision based solely on automated processing, including profiling;
the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.
You can exercise your rights by e-mail to privacy@teslicka.cz or in writing to the Provider's registered office. We usually deal with requests within one month of receipt; in complex cases the period may be extended by up to two further months, and we will inform you of this.
6. Cookies and similar technologies
The Provider's website, or the Intermediary's booking system, may use cookies and similar technologies. We process technically necessary cookies on the basis of legitimate interest (Article 6(1)(f) GDPR). We process analytics and marketing cookies only with your consent given in accordance with Section 89 of Act No. 127/2005 Coll., on electronic communications. Detailed information is provided in a separate document, the “Cookie Policy”, available on the website.
7. Final provisions
This policy is effective from the date stated in the heading. The Provider is entitled to update the policy in justified cases (in particular following changes in legislation or in the scope of the Services provided). The current version is always available on the Provider's website. Clients will be informed of material changes by e-mail.
If you have any questions or suggestions, please do not hesitate to contact us at privacy@teslicka.cz.
Prague, 21 April 2026
Teslička s.r.o.