GDPR

For users of the WOOZ app and car rental services

1. IDENTIFICATION OF THE OPERATOR

The controller of your personal data is the company PHX ProFi s. r. o. (Kojatická Dolina 228, 082 32 Kojatice, Company ID: 53808720, Tax ID: 2121516705, VAT ID: SK2121516705) (hereinafter referred to as „Operator“). If you have any questions regarding privacy, you can contact us in writing at our registered office address or by email at: info@wooz.sk.

2. SCOPE AND CATEGORIES OF DATA PROCESSED

Operator processes the following data:

Identification Information: First name, last name, date of birth, permanent address, and photos of your ID card and driver's license.
Contact Information: Email address, phone number.
Biometric data: A facial map derived from a „selfie“ (only if you consent to automatic verification).
Location data: GPS location of the vehicle during the rental period (vehicle tracking).
Payment Information: Credit card number (processed through a secure payment gateway).
Usage data: Ride history, routes, rental duration, and payment history.

3. PURPOSE AND LEGAL BASIS FOR PROCESSING

Operator processes data for the following purposes:

Performance of the Contract (Main Purpose): User registration, profile management, vehicle rental, and payment processing.
Identity Verification (Legal Requirement): Verifying that the user has a valid driver's license and meets the age requirement for operating a motor vehicle.
Protection of Property and Safety (Legitimate Interest): Vehicle location tracking (GPS) to prevent theft, monitor compliance with rental zones, and provide assistance in the event of an accident.
Risk Management (Legitimate Interest): Evaluating user behavior within the service (e.g., compliance with payment terms and rental conditions) in order to protect the vehicle fleet operator.
Marketing (Consent): Sending Offers and Service Updates WOOZ, provided that you have given us your express consent to do so.

4. BIOMETRIC VERIFICATION AND MANUAL CHECK

Operator uses automated identity verification (biometrics).

Biometric verification: The system automatically compares your selfie with the photo on your ID. If the biometric features do not match, your registration may be automatically rejected.
The Right to Human Intervention: If you disagree with the result of the automated verification, you have the right to request operator a manual review of your documents by a support representative, which takes up to 24 hours.
If the user disagrees with biometric processing, has the right to request operator manual verification of documents by staff, which takes a maximum of 24 hours.

5. GPS VEHICLE TRACKING

All vehicles operator are tracked via GPS. The purpose is:

Vehicle location for users in the app.
Securing the vehicle against theft.
Monitoring compliance with parking zones. Location data is linked to the user only when necessary (e.g., in the event of an accident, theft, or breach of contract).

6. DATA RECIPIENTS

Operator may disclose your data to:

IT service providers and payment gateways: To ensure the smooth operation of the app and secure payments.
To Insurance Companies: When handling insurance claims and vehicle damage:
KOOPERATIVA Insurance Company, a.s. Vienna Insurance Group
Allianz – Slovak Insurance Company, a.s.
Generali Insurance Company, a.s.
To government agencies: Law enforcement agencies, courts, or the municipal police (in cases of misdemeanors and felonies) when investigating traffic violations or crimes committed using a vehicle operator.
Payment gateway provider: Adyen
User verification provider: sumsub.com
Invoice Issuance Provider: spaceinvoices.com
SMS phone number verification provider: dexatel.com
Push notification provider: onesignal.com

7. DATA RETENTION PERIOD

We store your data:

For the duration of your membership in the app WOOZ.
10 years since the termination of the last lease agreement (mandatory retention of accounting and tax documents).
5 years after the account has been closed, for the purpose of protecting our legal claims (e.g., in the event of damages discovered at a later date).
Biometric Data are immediately destroyed following a successful verification process (unless otherwise agreed).

8. YOUR RIGHTS

As a data subject, you have the right to to the operator the following rights:

Right of access: You may request information about what data we process about you.
Right to rectification: If your information is out of date (e.g., a new driver's license).
Right to erasure: If there is no longer a legal basis for processing them (e.g., when an account is closed with no outstanding balances).
The right to object to GPS tracking: You may object to the monitoring if it goes beyond what is necessary to protect the Controller’s property.
Right to file a complaint: To the Office for Personal Data Protection of the Slovak Republic.

Rights of Data Subjects

Regardless of the legal basis for the processing of personal data, the data subject has the right to access personal data, the right to have it corrected, erased, or its processing restricted, and the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, or the right to file a motion to initiate proceedings regarding the protection of personal data.

Right of Access to Personal Data

This right means that you are entitled to request confirmation from us as to whether we are processing personal data about you. Therefore, if we are processing such personal data about you, you have the right to access your personal data and to receive information regarding:

Why we process your personal data (purpose of personal data processing)
What information about you do we process (category of personal data)
To whom your personal data may be or will be disclosed (identification of recipients or categories of recipients)
How long we will retain your personal data (retention period for personal data)
that you have the right to request that we correct or delete your personal data, as well as to restrict its processing, or that you have the right to object to the processing of your personal data
that you have the right to file a motion to initiate proceedings regarding the protection of personal data under the Act, or
the right to file a complaint with the supervisory authority under the Regulation, which is the Office for Personal Data Protection of the Slovak Republic
where your personal data comes from (source information), unless you provided the personal data to us directly
whether we use automated individual decision-making, including profiling, pursuant to Section 28(1) and (4) of the Act; in particular, regarding the procedure used, as well as the significance and anticipated consequences of such processing of personal data for you
about appropriate safeguards regarding the transfer, in the event that we transfer your personal data to a third country or an international organization

This right of access also means that you can obtain the personal data we process about you. We will provide you with a copy of the personal data we process about you. However, if you repeatedly request a copy of your personal data, we may charge you a reasonable administrative fee in connection with your request for a copy of your personal data.

Right to Rectification of Personal Data

As part of the terms and conditions for providing our services, we ask that you provide us with accurate information. However, if we happen to process incorrect data about you, your right to rectification means that you are entitled to request that we correct any incorrect personal data concerning you. Furthermore, taking into account the purpose of the processing of personal data, you also have the right to have your incomplete personal data completed.

The Right to Erasure of Personal Data (Right to Be Forgotten)

You have the right to have us erase personal data concerning you if at least one of the following grounds applies:

Your personal data is no longer necessary for the purpose for which we collected or otherwise processed it
You have withdrawn your consent to the processing of personal data, on the basis of which we process your personal data, and there is no other legal basis for its further processing
you object to the processing of personal data carried out on the legal basis of public interest or legitimate interest, and there are no legitimate grounds for such processing that override your objection
Your personal data was processed unlawfully
Your personal data must be erased, as this is necessary to comply with a legal obligation under the law of the Slovak Republic or the law of the European Union
Your personal data was collected in connection with the provision of information society services pursuant to Section 15(1) of the Act

However, your right to erasure of personal data may not be granted in a specific case, taking into account the specific circumstances, if the processing of personal data is necessary for:

to exercise our right to freedom of expression or our right to information
to comply with a legal obligation
to assert our legal claim
for archiving purposes, for historical research purposes, or for statistical purposes, provided that the right to erasure would likely prevent us from achieving the objectives of such processing or significantly impede our ability to do so

The Right to Restrict the Processing of Personal Data

You have the right to have us restrict the processing of personal data concerning you, provided that at least one of the following grounds applies:

During the period that allows us to verify the accuracy of your personal data, you contest the accuracy of your personal data
If the processing of personal data is unlawful, you may object to the erasure of your personal data and request that the processing of your personal data be restricted instead of erased
we will no longer need your personal data for any of the purposes of processing, or you will need it to establish, exercise, or defend your legal claims
You may object to the processing of your personal data until it has been determined whether our legitimate interests outweigh your legitimate interests

Right to Data Portability

If our right to process your personal data is based on your consent or on the performance of obligations arising from a contract we have entered into with you, you have the right to request the transfer of the data concerning you that you have provided to us to another personal data controller.

Right to Withdraw Consent

If we process your personal data on the legal basis of the data subject’s consent, you have the right to withdraw that consent at any time, even before the expiration of the period for which the consent was granted. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Right to Object

If you have grounds related to your specific situation, you have the right to object to the processing of your personal data if the legal basis for such processing is our legitimate interest. However, if our legitimate interest in processing your data outweighs your personal interest, we may continue to process your data despite your objection to such processing. We are also entitled to continue processing your data if it is necessary to establish, exercise, or defend our legal claims.

Retention Period for Personal Data

How to Exercise Your Rights

You can exercise the rights listed above by emailing support@wooz.sk.

Please include your first name, last name, email address, and, if applicable, your permanent address in your request. If you do not provide us with this information, we will not be able to process your request. We require this information from you so that we can verify your identity and ensure that your personal data is not disclosed to an unauthorized person.

If, as a data subject, you do not have full legal capacity, your legal representative may exercise your rights under the Regulation and the Act. The rights of a data subject who is deceased may be exercised by a close relative under the Regulation and the Act. If your requests as a data subject are manifestly unfounded or excessive, particularly due to their repetitive nature, we may charge a reasonable fee taking into account the administrative costs of providing the information or refuse to act on the request.

Deletion of Personal Data

The operator shall ensure that the personal data provided is deleted from the information system after the user revokes their consent to the processing of personal data or after the retention period has expired.

Person in Charge

The operator has not designated a responsible person.

Disclosure and Transfer to Third Countries

Your personal data is not disclosed or transferred to third countries.

Profiling and Automated Decision-Making

Your personal data is not subject to automated decision-making or profiling.

Safety

Ensuring the highest possible level of protection for our clients’ personal data is a top priority for us, and in addition to our existing business objectives, we will devote increased attention to this area. The technical and organizational measures to be implemented will be carefully selected with regard to the scope of personal data processing and our technical and personnel capabilities, but always in such a way that these measures are as effective as possible and that they comply with the applicable and effective legal regulations in the Slovak Republic and the EU.

How do I file a complaint?

As a data subject, you have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, located at Hraničná 12, 820 07 Bratislava, tel. no. 02/323 132 14, email: statny.dozor@pdp.gov.sk, if you suspect that your personal data is being processed in violation of applicable law.

9. ACCOUNT CLOSURE

The user may request at any time operator to delete the account directly within the app. If the user does not have to the operator no debts, so operator It will deactivate the account and destroy the data in accordance with its retention policies.

10. DATA SECURITY

Company PHX ProFi s. r. o. (Kojatická Dolina 228, 082 32 Kojatice, Company ID: 53808720, Tax ID: 2121516705) implements strict technical data protection measures, including encryption of data transmitted between mobile devices and the server, and regular security audits of the application WOOZ.

11. COOKIES

Cookies

Our website uses cookies to improve its functionality and to enhance search results. Some sections of our website also use cookies to help us get to know you better so we can offer you more personalized search options.

Use of Cookies

We use cookies to ensure the basic functionality of the website and to improve your online experience. For each category, you can choose whether to enable or disable it. For more details regarding cookies and other sensitive data, please see the full text of our Privacy Policy.

These cookies are essential for the website to function properly. Without these cookies, the website will not function properly.

What cookies do we use?

Essential – These cookies enable basic functions, such as logging in as a registered user or pre-filling forms. If you disable these cookies, we cannot guarantee that our website will function properly.

Operational and functional—essential—cookies are used to provide services or remember your settings in order to ensure maximum convenience during your visit and, subsequently, to improve the website’s functionality and appearance. These cookies do not collect information about you that could be used for marketing purposes, nor do they track your browsing activity on the internet. If you disable these cookies, we cannot guarantee the full functionality of our website.
Advertising cookies – these are used to optimize the ads displayed based on visitor behavior and to ensure the effectiveness of advertisers’ marketing communications. Thanks to these cookies, for example, you won’t see ads from areas you’re not interested in more often than necessary. For these cookies, we use solutions from the following third parties:
...
...
....
Third-party cookies – created and used by service providers. These services are integrated into our website because we consider them useful and completely secure. Since we have taken measures to prevent the misuse of these cookies (anonymization on the part of our suppliers), we do not ask for your consent to their use. For these cookies, we use solutions from the following third parties:
Google Analytics,
Google AdSense
Facebook.

How can I disable cookies?

If you do not wish to receive cookies from our website, you can set your browser to notify you when you receive a cookie, so you can decide whether to accept it or not. Please note, however, that if you disable cookies in your browser, you will not be able to fully use some of our pages.

In Kojatice, on June 15, 2026.

PHX ProFi s. r. o. (Kojatická Dolina 228, 082 32 Kojatice, Company ID: 53808720, Tax ID: 2121516705)