{"id":3,"date":"2026-03-30T10:50:09","date_gmt":"2026-03-30T10:50:09","guid":{"rendered":"https:\/\/www.wooz.sk\/?page_id=3"},"modified":"2026-09-14T15:38:30","modified_gmt":"2026-09-14T14:38:30","slug":"gdpr","status":"publish","type":"page","link":"https:\/\/www.wooz.sk\/en\/gdpr\/","title":{"rendered":"PRIVACY POLICY AND NOTICE ON DATA PROCESSING (GDPR) FOR THE WOOZ PLATFORM"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>Issued in accordance with Regulation (EU) 2016\/679 (GDPR), Act No. 18\/2018 Z. z., and Act No. 452\/2021 Z. z.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Article I. \u2013 Data Controller and Scope<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Operator:<\/strong> WOOZ s.r.o., Sek\u010dovsk\u00e1 2792\/4, 080 06 \u013dubotice, Company ID: 53 808 720. Email: <strong>gdpr@wooz.sk<\/strong> (general support: <strong>podpora@wooz.sk<\/strong>).<\/li>\n\n\n\n<li><strong>Data Protection Officer (DPO):<\/strong> It is not mandatory; the Operator handles this matter directly at gdpr@wooz.sk.<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Scope:<\/strong> This applies to B2C customers and B2B drivers. Fleet partners and investors have a separate B2B Partner Information Memorandum.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Article II. \u2013 Data Categories and Data Minimization<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Operator <\/strong>processes the following data:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Identification and Contact Information:<\/strong> First name, last name, permanent address, date of birth, country where the driver's license was issued, phone number, email address.<\/li>\n\n\n\n<li><strong>Technical and Authentication:<\/strong> Hashed passwords, session security tokens, IP address, device ID, push tokens, app version, logs.<\/li>\n\n\n\n<li><strong>Documents and driver's license:<\/strong> ID card\/passport number, expiration date, driver's license number, license categories, and double-sided photos of the original documents.<\/li>\n\n\n\n<li><strong>Biometrics (voluntary consent):<\/strong> A selfie and a liveness check that compares the geometry of the face with that on the ID document.<\/li>\n\n\n\n<li><strong>Payments and Billing:<\/strong> Payment token from the PCI-DSS gateway (we do not store full card numbers or CVC codes), masked 4-digit numbers, billing information, and trip history.<\/li>\n\n\n\n<li><strong>IoT Telematics and Location:<\/strong> Real-time GPS location, route, speedometer (kilometer count), fuel\/battery level, acceleration, impact sensors, immobilizer status.<\/li>\n\n\n\n<li><strong>Photo documentation:<\/strong> 5 photos from check-out (1 interior + 4 exterior) and photos of damage from check-in.<\/li>\n\n\n\n<li><strong>Offenses:<\/strong> Police citations under the strict liability system assigned to lease periods.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Article III. \u2013 Purposes and Legal Basis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Operator <\/strong>processes data for the following purposes:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>Purpose of Processing<\/td><td>Legal Basis<\/td><\/tr><tr><td>Registration, Account Management, and Lease Agreement<\/td><td>Performance of a Contract \u2013 Article 6(1)(b) of the GDPR<\/td><\/tr><tr><td>Real-Time Biometric Identity Verification (Sumsub)<\/td><td>Explicit Consent \u2013 Article 9(2)(a) of the GDPR<\/td><\/tr><tr><td>Manual verification of documents within 24 hours (alternative)<\/td><td>Performance of a Contract \u2013 Article 6(1)(b) of the GDPR<\/td><\/tr><tr><td>Check-in\/Check-out, keyless access, mileage billing<\/td><td>Performance of a Contract \u2013 Article 6(1)(b) of the GDPR<\/td><\/tr><tr><td>Settlement of Deposits, Fines, and Damages<\/td><td>Performance of a Contract \u2013 Article 6(1)(b) of the GDPR<\/td><\/tr><tr><td>Invoicing and Bookkeeping<\/td><td>Legal obligation \u2013 Article 6(1)(c) of the GDPR<\/td><\/tr><tr><td>24\/7 Fleet Protection, Theft Prevention, and Vehicle Immobilization<\/td><td>Legitimate Interest \u2013 Article 6(1)(f) of the GDPR<\/td><\/tr><tr><td>Detection of Traffic Accidents and Safety Incidents<\/td><td>Legitimate Interest \u2013 Article 6(1)(f) of the GDPR<\/td><\/tr><tr><td>Police Handling of Traffic Violations<\/td><td>Legal Obligation \u2013 Article 6(1)(c) and Legitimate Interest<\/td><\/tr><tr><td>Direct Marketing of Our Own Services <br>(soft opt-in for clients)<\/td><td>Legitimate interest (Article 6(1)(f)) and Section 116(3) of Act No. 452\/2021 Coll.<\/td><\/tr><tr><td>Marketing and Newsletters for Non-Clients<\/td><td>Consent \u2013 Article 6(1)(a) of the GDPR and Section 116(2) of Act No. 452\/2021 Coll.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Article IV. \u2013 Biometrics, Article 22 of the GDPR, and Data Protection Impact Assessment (DPIA)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Biometrics<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Voluntary Participation and Alternatives:<\/strong> The user may opt out of biometric authentication; the operator provides manual verification by staff until <strong>24 hours<\/strong> free of charge.<\/li>\n\n\n\n<li><strong>Automated Decision-Making in the Registration Process (Article 22):<\/strong> The algorithm verifies the document's security features, the MRZ zone, the validity of the visa, and the mathematical match of the face. In the event of a rejection, the user has the right to human intervention (human-in-the-loop), to express their opinion, and to have the case manually reviewed by a staff member within 24 hours.<\/li>\n\n\n\n<li><strong>DPIA:<\/strong> The controller has conducted an internal Data Protection Impact Assessment (DPIA) in accordance with Article 35 of the GDPR.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Article V. \u2013 IoT Telematics and Driving Dynamics<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">All vehicles <strong>operator <\/strong>are tracked via GPS. The purpose is:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In addition to the lease, 24\/7 location monitoring is in place to protect the property (not linked to a specific person). <\/li>\n\n\n\n<li>During the lease term, the telematics system is used to track mileage, monitor fuel levels, detect unauthorized entry into restricted countries, and immobilize the vehicle in the event of unauthorized retention.<\/li>\n\n\n\n<li>Overloads and impacts are used solely for assistance in the event of an accident and to verify gross violations of the General Terms and Conditions. <strong>The data is not used for covert driver profiling, dynamic pricing, or insurance scoring.<\/strong><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Article VI. \u2013 Beneficiaries and Cross-Border Transfers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Processors (Article 28 of the GDPR):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SIA ATOM Tech<\/strong> (Aldaru iela 10-4, LV-1050 Riga, Latvia) \u2013 the platform's cloud core (AWS EU data centers).<\/li>\n\n\n\n<li><strong>Sumsub Tech Limited<\/strong> (Cyprus \/ Lithuania \/ UK based on the UK Adequacy Decision) \u2013 identity verification.<\/li>\n\n\n\n<li><strong>Adyen N.V.<\/strong> (Amsterdam, Netherlands) \u2013 payment gateway and card tokenization.<\/li>\n\n\n\n<li><strong>Fakturuj.si<\/strong> \u2013 billing system.<\/li>\n\n\n\n<li><strong>Dexatel O\u00dc<\/strong> (P\u00e4rnu mnt 139e\/2, Tallinn, Estonia) \u2013 SMS authorization codes.<\/li>\n\n\n\n<li><strong>OneSignal, Inc.<\/strong> (San Mateo, USA) \u2013 push notifications (transmission secured via <strong>EU-U.S. Data Privacy Framework<\/strong> and SCC).<\/li>\n\n\n\n<li><strong>Independent operators:<\/strong> Insurance companies contracted to cover a specific vehicle (PZP\/KASKO) in the settlement of claims, legal representatives, the Slovak Police Force, and administrative authorities.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Article VII. \u2013 Retention Periods<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We store your data:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Profile in the App:<\/strong> For the duration of the active account.<\/li>\n\n\n\n<li><strong>Scans of documents (ID card, driver's license):<\/strong> For the duration of the account plus 3 years (B2C) \/ 4 years (B2B) after its termination, to defend against legal claims (Section 101 of the Civil Code \/ Section 397 of the Commercial Code).<\/li>\n\n\n\n<li><strong>Accounting and tax documents:<\/strong> <strong>10 years<\/strong> in the years following the year of issuance.<\/li>\n\n\n\n<li><strong>Telematics Routes (GPS):<\/strong> <strong>90 calendar days<\/strong> from the termination of the lease; in the event of an accident or dispute, until the matter is legally resolved.<\/li>\n\n\n\n<li><strong>Photo Documentation: Check-out:<\/strong> <strong>12 months<\/strong>.<\/li>\n\n\n\n<li><strong>Direct marketing (soft opt-in):<\/strong> During the term of the contract + max. <strong>1 year<\/strong> upon its completion (Section 116(3) of Act No. 452\/2021 Coll.), or until an objection is filed.<\/li>\n\n\n\n<li><strong>Raw facial biometric data:<\/strong> Disposed of immediately after the completion of the comparative test.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Article VIII. \u2013 Rights of Data Subjects and the Supervisory Authority<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As a data subject, you have the right to <strong>to the operator <\/strong>the following rights:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The user has the right of access, rectification, erasure, restriction, portability (automated data derived from a contract or consent), withdrawal of consent, and the right to object. If an objection is raised against direct marketing, the processing <strong>will terminate immediately<\/strong>.<\/li>\n\n\n\n<li><strong>Deleting an Account in the App:<\/strong> Profile \u2192 Account Settings \u2192 Delete Account.<\/li>\n\n\n\n<li><strong>Supervisory Authority:<\/strong> <strong>Office for Personal Data Protection of the Slovak Republic<\/strong>                          Galvani Business Center II, <strong>7\/B Galvaniho Street, 821 04 Bratislava<\/strong>                                                        Website: <a href=\"https:\/\/dataprotection.gov.sk\/\" target=\"_blank\" rel=\"noopener\">https:\/\/dataprotection.gov.sk<\/a> | Email: statny.dozor@pdp.gov.sk.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div style=\"height:40px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><\/h2>","protected":false},"excerpt":{"rendered":"<p>vydan\u00e9 v s\u00falade s Nariaden\u00edm (E\u00da) 2016\/679 (GDPR), z\u00e1konom \u010d. 18\/2018 Z. z. a z\u00e1konom \u010d. 452\/2021 Z. z. \u010cl\u00e1nok I. \u2013 Prev\u00e1dzkovate\u013e osobn\u00fdch \u00fadajov a rozsah \u010cl\u00e1nok II. \u2013 Kateg\u00f3rie \u00fadajov a minimaliz\u00e1cia Prev\u00e1dzkovate\u013e sprac\u00fava nasleduj\u00face \u00fadaje: \u010cl\u00e1nok III. \u2013 \u00da\u010dely a pr\u00e1vne z\u00e1klady Prev\u00e1dzkovate\u013e sprac\u00fava \u00fadaje na tieto \u00fa\u010dely: \u00da\u010del sprac\u00favania Pr\u00e1vny z\u00e1klad [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_yoast_wpseo_title":"","_yoast_wpseo_metadesc":"","_yoast_wpseo_focuskw":"","rank_math_title":"","rank_math_description":"","rank_math_focus_keyword":"","_aioseop_title":"","_aioseop_description":"","footnotes":""},"class_list":["post-3","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.wooz.sk\/en\/wp-json\/wp\/v2\/pages\/3","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wooz.sk\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.wooz.sk\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.wooz.sk\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wooz.sk\/en\/wp-json\/wp\/v2\/comments?post=3"}],"version-history":[{"count":9,"href":"https:\/\/www.wooz.sk\/en\/wp-json\/wp\/v2\/pages\/3\/revisions"}],"predecessor-version":[{"id":221,"href":"https:\/\/www.wooz.sk\/en\/wp-json\/wp\/v2\/pages\/3\/revisions\/221"}],"wp:attachment":[{"href":"https:\/\/www.wooz.sk\/en\/wp-json\/wp\/v2\/media?parent=3"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}