Personal Data Processing Policy

1. Introduction and scope

This Personal Data Processing Policy (the "Policy") describes how KurzFactory, s.r.o., operating the service under the VertexRent brand (the "controller"), processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and related Czech law. The Policy applies to rental prospects, renters, drivers and additional drivers, partner contact persons, visitors of vertexrent.cz and other persons whose data the controller processes. It follows up on the General Terms and Conditions ("GTC") and the Schedule of Fees, Penalties and Compensations.

2. Data controller

The controller is KurzFactory, s.r.o., company ID 11817810, with registered office at Pricna 1892/4, Nove Mesto, 110 00 Prague 1, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 354397. Contact for personal data matters: e-mail info@vertexrent.cz, phone +420 777 729 793, branch Trebohosticka 3069/14, Strasnice, 100 00 Prague 10. The controller has not appointed a Data Protection Officer (DPO). For data protection matters, use the contacts above.

3. Definitions

• Personal data - any information relating to an identified or identifiable natural person.
• Data subject - the natural person to whom the personal data relate.
• Processing - any operation with personal data (collection, storage, use, transfer, erasure).
• Controller - the entity that determines the purposes and means of processing, i.e. KurzFactory, s.r.o.
• Processor - an entity processing personal data for the controller under a data processing agreement.

4. Sources of personal data

• directly from the data subject - from enquiries, reservations, contracts, communication, presented documents and at vehicle handover and return,
• from third parties - from partners (hotels, concierge, event agencies) mediating an enquiry or reservation, and from the additional driver,
• from own operations and technology - vehicle GPS and telematics, photo and video documentation, damage and service records,
• from public sources and registers - to the extent necessary for client verification, fraud prevention and legal claims.

5. Categories of processed data

• identification data - name, surname, date of birth, document number, signature,
• contact data - address, e-mail, phone, delivery or accommodation address,
• document and client verification data (KYC) - ID card or passport, driving licence, residence permit and their copies or photos,
• reservation and contract data - vehicle, dates, place, price, deposit, kilometres, protection package,
• payment and billing data - payment and bank details, invoicing data, payments and holds,
• operational and technical data - GPS and telematics data (location, route, driving style, events), vehicle photos and video, odometer and fuel level,
• damage, fine and claim data - protocols, accident documentation, communication with insurers, service and authorities,
• communication data - e-mails, messages (including WhatsApp and Telegram), phone calls and internal notes,
• online identifiers - IP address, cookies and marketing identifiers (see the Cookie Policy below).

6. Purposes and legal bases

• handling enquiries and offers - pre-contractual negotiations (Art. 6(1)(b) GDPR),
• concluding and performing the rental contract - contract performance (point b),
• identity and eligibility verification (KYC), vehicle protection and fraud prevention - legitimate interest (point f) and contract performance (point b),
• GPS monitoring and telematics - legitimate interest in protecting high-value assets and contract performance,
• handling damage, insurance events, fines and legal claims - legitimate interest and establishment, exercise or defence of legal claims (point f), or legal obligation (point c),
• accounting and taxes - legal obligation (point c),
• complaints and client communication - contract performance and legitimate interest,
• direct marketing to existing customers - legitimate interest (point f) with the right to object; marketing to new prospects - consent (point a),
• cookies and analytics - consent (point a); necessary cookies rely on legitimate interest or necessity.

For processing based on legitimate interest the controller performed a balancing test, and the data subject may object (see Section 15).

7. GPS monitoring and telematics

Vehicles may be equipped with GPS, telematics and security systems. Processed data may include location, route, movement, speed anomalies, harsh acceleration or braking and indications of risky use. The purpose is asset protection, safety, theft prevention, verification of contractual use and handling of damage, fines and insurance events. The data are not intended for disproportionate surveillance of the client's privacy. Tampering with GPS or telematics is contractually prohibited. Data are usually retained for 3–12 months, longer only in case of damage, dispute, fine or legal claim.

8. Camera and recording systems

Vehicles may be fitted with camera or recording devices. Recordings serve to protect assets, ensure safety and resolve damage and insurance events. The branch may be monitored by CCTV; in that case information notices are placed at the entrance.

9. Obligation to provide data

Providing data for concluding and performing the contract and for client verification is a contractual requirement and a condition of vehicle handover. Without the necessary data the contract cannot be concluded and the vehicle cannot be handed over. Providing data for accounting and tax purposes is a statutory requirement. Providing data for marketing is voluntary and has no effect on the contract.

10. Recipients

• IT and cloud providers (Google Workspace, hosting, CRM) - processor,
• payment and banking services (payment gateway, bank) - processor / independent controller,
• insurance company (claims settlement) - independent controller,
• garages and towing services (repairs, diagnostics, towing) - processor / independent controller,
• GPS / telematics provider (tracking and security system) - processor,
• marketing tools (e-mailing, Google, Meta) - processor / independent controller,
• lawyers, accountants, tax advisors - processor / independent controller,
• public authorities (Police, offices, courts) - independent controller,
• partners (hotels, concierge, agencies) mediating reservations - independent controller.

Data processing agreements under Art. 28 GDPR are concluded with processors. The controller keeps the current list of processors internally.

11. Transfers to third countries

Some technology providers (in particular analytics and marketing tools, e.g. Google and Meta) may process data outside the EU/EEA. In such cases appropriate safeguards are used, in particular Standard Contractual Clauses (SCC) or an adequacy decision (EU–US Data Privacy Framework).

12. Retention periods

• enquiries without a contract: usually 12 months,
• contract documentation: for the duration of the contract and then typically 10 years for accounting and legal reasons,
• document copies and client verification (KYC) data: only as long as necessary, deleted regularly per internal policy,
• GPS data: usually 3–12 months, longer only in case of damage, dispute, fine or legal claim,
• marketing consent: until withdrawn,
• cookies: per cookie banner settings,
• camera recordings (if used): short-term, longer in case of an incident.

13. Automated decision-making and profiling

The controller generally does not make decisions based solely on automated processing with legal or similarly significant effects. Risk factors may be evaluated during client verification and vehicle protection; the final decision on concluding the contract or handing over the vehicle is always made by a human.

14. Direct marketing

Commercial communications are sent based on consent, or legitimate interest towards existing customers in connection with a similar service. Consent can be withdrawn at any time and you may object to direct marketing at any time; every message contains an easy opt-out.

15. Data subject rights

You have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest including direct marketing, and the right to withdraw consent. Rights are exercised in writing at info@vertexrent.cz or at the controller's registered office. The controller may require identity verification. Requests are handled without undue delay, within one month at the latest; in complex cases this may be extended by two further months. Handling is generally free of charge. You may lodge a complaint with the supervisory authority: Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

16. Data security

The controller has adopted appropriate technical and organisational measures: access limited to authorised persons, two-factor authentication, transport encryption, backups, rules for deleting document copies, access audits and confidentiality obligations. Communication via Telegram and WhatsApp runs through external providers; documents and sensitive data are transferred only to the necessary extent and subsequently deleted per internal policy.

17. Children

The service is intended for persons over 21 years of age (driver) and is not aimed at children. The controller does not knowingly process children's data beyond the necessary extent (e.g. passengers listed in the contract).

18. Changes to this Policy

This Policy may be updated. The current version is always published at vertexrent.cz with the effective date and version.

Cookie Policy

Cookies are small files stored on your device used for website operation, traffic measurement and marketing. The vertexrent.cz website uses cookies and similar technologies.

Consent and its withdrawal

Necessary cookies are required for the website to work and can be used without consent. Analytics and marketing cookies are activated only after the visitor's active consent in the cookie banner. Consent can be changed or withdrawn at any time via the cookie settings on the website or in your browser.

Cookie categories

• Necessary (security, forms, language, session) - legitimate interest / necessity, always active,
• Analytics (Google Analytics 4) - activated only after consent,
• Marketing (Meta Pixel and other tools deployed via Google Tag Manager) - activated only after consent,
• Preferences (stored user choices) - consent or necessity depending on function.

Specific cookies

• Google Analytics 4 - traffic measurement - analytics - stored up to 2 years,
• Meta Pixel - marketing and remarketing - marketing - stored typically 3 months,
• session / CSRF - website and form operation - necessary - session only,
• stored preferences (including cookie choice) - preferences - per cookie banner settings.

Marketing and analytics tools (Google, Meta) may act as independent controllers or processors and transfer data outside the EU/EEA.

Contact

KurzFactory, s.r.o., Pricna 1892/4, Nove Mesto, 110 00 Prague 1 • e-mail info@vertexrent.cz • phone +420 777 729 793 • web vertexrent.cz

Effective from 16 July 2026 • Version 1.0