Privacy Policy (GDPR)
Aktualizováno August 21, 2026
Effective from: 21 May 2026
This Privacy Policy describes how Getcars s.r.o. (the “controller”) processes personal data in connection with the GetCars platform in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Czech data protection law.
1. Controller and contact
Getcars s.r.o., Dlouhá 730/35, Staré Město, 110 00 Prague 1, Czech Republic, Company ID: 17852790, email: [email protected], tel.: +420 702 160 043.
We are not required to appoint a Data Protection Officer; for all data subject requests use the contact above with subject line “GDPR”.
2. Categories of data subjects
- registered Platform users (customers, dealers);
- prospective clients (inquiries without an account, contact form);
- representatives of legal entities and supplier contacts (where applicable);
- persons communicating with us by email or phone.
3. Categories of personal data
- identity and contact: name, email, phone, address, company ID/VAT, company name;
- account and authentication: account identifier, email verification status (passwords managed by identity provider – Amazon Cognito);
- contract and billing: billing profile, payment references, deposit variable symbols;
- Platform activity: bids, inquiries, business cases, watchlist, notifications, preferences;
- technical data: IP address, cookies, logs, device identifiers;
- communications: support content, records of consents.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Registration and account operation | Art. 6(1)(b) – contract |
| Intermediation Agreement, deposits, bids, business cases | Art. 6(1)(b) |
| Invoicing, accounting, tax obligations | Art. 6(1)(c) – legal obligation |
| Platform security, fraud prevention, logs | Art. 6(1)(f) – legitimate interests |
| Email and in-app notifications about your cases | Art. 6(1)(b) or (f) |
| Marketing messages | Art. 6(1)(a) – consent (withdrawable anytime) |
| Traffic analytics (if enabled) | Art. 6(1)(a) – consent via cookie settings |
5. Recipients and processors
Data may be shared with:
- IT and cloud providers (hosting, AWS – Cognito, S3, databases; Resend for application and authentication emails);
- Google Ireland Limited / Google LLC (Google Tag Manager, Google Analytics 4, Google Ads) – traffic and ad measurement, only with consent given in the cookie banner;
- banking and payment matching providers;
- carriers, customs agents, auction houses – as needed for your business case;
- accountants and legal advisers;
- public authorities where required by law.
Processors are bound by Art. 28 GDPR agreements. List available on request at [email protected].
6. International transfers
Some providers (e.g. AWS in the US) may process data outside the EEA based on adequacy decisions, Standard Contractual Clauses or other safeguards under Chapter V GDPR.
7. Retention
- account data – for account lifetime plus up to 3 years unless longer retention is needed for disputes;
- contract and invoice records – per tax and accounting law (typically 5–10 years);
- deposit and bid records – for the business relationship and statutory periods;
- marketing consent – until withdrawal, up to 3 years from last interaction;
- security logs – typically 6–24 months.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability (where applicable), objection to processing based on legitimate interests, and withdrawal of consent without affecting lawfulness prior to withdrawal.
Contact [email protected]; we respond within 30 days. You may lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz).
9. Automated decision-making
We do not perform automated decision-making with legal or similarly significant effects under Art. 22 GDPR. Bid and deposit limit validation is technical rule enforcement, not user profiling.
10. Security
We apply appropriate organisational and technical measures (encryption in transit, access control, backups). No system is 100% secure – please protect your password and report incidents.
11. Cookies
See our Cookie Policy.
12. Changes
The current version is always published on the Platform. Material changes will be announced on the Platform and possibly by email to registered users.