Privacy Policy
PRIVACY POLICY, Slovak Lines Express, a. s., Mlynské Nivy 5, Bratislava 821 09, Comp. ID: 44667345, Commercial Register of the Municipal Court Bratislava III, Section: Sa, Insert No. 4722/B (hereinafter referred to as “Slovak Lines Express, a. s.”)
Slovak Lines Express, a. s. respects the privacy of all data subjects with whom we are in contact; regardless of whether we process personal data ourselves or by other parties. It is important to us that everyone understands what personal data we process about you, why we do it and what your rights are. Therefore, we encourage you to read this Privacy Policy which will provide you with more information about the processing of your personal data by Slovak Lines Express, a. s.
This Privacy Policy sets out how we process your personal data when carrying out activities as a controller or a processor.
We may update this statement from time to time without notice. We therefore ask you to familiarise yourself with its wording on a regular basis. This version of the statement was issued on 25 June 2024.
We may process personal data about you in different ways and in different situations depending on whether you are a client, customer, supplier or job applicant or employee. We may also process personal data about visitors to our website(s), depending on how you choose to interact with us. Regardless of the situation, we promise that we will never sell, commercialize or use your personal data in violation of applicable data protection regulations.
Slovak Lines Express, a. s. respects your privacy, regardless of whether we process your personal data ourselves or on behalf of other parties. It is important to us that you understand what personal data we process about you, why we do it and what your rights are. Therefore, we encourage you to read this Privacy Policy which will provide you with more information about the processing of your personal data by Slovak Lines Express, a. s.
PRIVACY STATEMENT – Customers
At Slovak Lines Express, a. s. we respect the privacy of all data subjects with whom we are in contact, regardless of whether we process personal data ourselves or with the help of other entities. It is important to us that you know which personal data we process about you, why we do it and what your rights are. We therefore ask you to read this statement to give you more information about the processing of your personal data.
Categories of personal data – Controller
| Field | Activity | Types of personal data |
| Customer IS | International scheduled services – Passenger verification | upon boarding the vehicle – verification of the purchased ticket via QR code – passenger’s name, surname, email address, time and route of transport; verification of entitlement to the discount; visual verification of the travel document, parent’s (legal guardian’s) consent to transport a minor passenger – passenger’s name and surname, ID number (passport or ID card), date of birth, address of permanent residence, passenger’s telephone number, name and surname of the legal guardian, his/her telephone number, signature, route and time of transport |
| Customer IS | Handling complaints and claims | name and surname, address of permanent and temporary residence of the customer/complainant, email address or email address of a relative, telephone number, other personal data found or submitted in the course of complaint handling, signature of the complainant, reason for the complaint or claim, course of complaint resolution, customer’s account number (in case of refund of the amount for the purchased ticket) |
| Customer IS | Transport control | name and surname of the passenger, address of residence, date of birth, ID Card number, email, amount of the fine, amount owed |
| Customer IS | Lost and found | data necessary to identify the owner of the lost or found item – name and surname, telephone number, email address, description of the item, date of receipt, signature on the handover report, in the case of valuable items (value obviously exceeds EUR 50), inspection of the identity card and its verification |
| Customer IS | Call Centre | audio recording of the conversation, the scope of personal data depends on the purpose of the conversation, but the maximum is the customer’s name, surname, telephone number, email, |
| Customer IS | Customer satisfaction surveys and evaluation of drivers – solicited feedback | employees – name, surname, title, photo, evaluation of services provided; customers – customer’s email address, phone number; only the first name of the employee and his photo are disclosed in connection with the evaluation |
| Customer IS | Sale of goods and services via web shopping cart – unregistered customer | customer’s name, surname, email address, phone number, route, date and time of transport, seat, additional product, payment card number, account number, IP address, amount paid |
| Customer IS | Sale of goods and services via web shopping cart – registered customer | customer’s name, surname, email address, phone number, route, date and time of transport, seat, additional product, payment card number, account number, IP address, amount paid, ticket and/or service/product sales history |
| Customer IS | Sale of goods and services via mobile application – registered customer | customer’s first name, last name, email address, phone number, route, date and time of transport, ticket, additional product, payment card number, account number, IP address, amount paid, purchase history of products in the customer’s profile |
| Customer IS | Sale of goods and services via mobile application – unregistered customer | customer’s name, surname, email address, phone number, route, date and time of transport, seat, additional product, payment card number, account number, IP address, amount paid |
| IS marketing | Marketing communication – reaching out with offers of the own similar goods and services of the controller (sending newsletters) | customer’s email address |
| IS marketing | Management of the social networks of the controller, customer service | the profile name/nickname and other personal data that the profile user discloses about him/herself |
| IS marketing | Organising consumer competitions on social networks and on the controller’s website | name/profile name, email address, any information that the data subject discloses about him/herself and/or the data defined in the competition statute necessary to participate in the competition; for the purpose of contacting the winner of the competition and handing over the prize – email address, name, surname, address of residence, telephone contact, and/or other data necessary for handing over the prize in accordance with the statutes of the competition; personal data is disclosed in accordance with the statutes of the competition or the consent given |
| IS marketing | Business analysis | customer’s email address, name, surname |
| Finance and Accounting | Bookkeeping and accounting | Personal data from invoices of natural persons or natural persons entrepreneurs – name and surname, title, address, phone number, bank account number, email, signature; payment data of customers, personal data of employees – name and surname, title, address, bank account number, email, signature, in case of insurance also birth number, information on the amount of deductions from wages – e.g., in case of fuel over-consumption, events of damage, payment of OZ membership, executions, personal data of authorized employees (statutory officers) necessary for communication with banks, |
| Finance and Accounting | Treasury management | customer’s name, surname, address, ID Card number, customer’s bank account number; employee’s name, surname, address, date of birth, employee’s bank account number, in the case of an authorised employee – personal data necessary for communication with the bank, including a signature specimen |
| Registry and archiving | Archival care and maintenance | personal data to the extent specified in the documentation, which must be archived in accordance with applicable legislation |
| Customer IS | Provision of wifi service to passengers during transport and in the premises of Nivy Bus Station and evaluation of its use (anonymised) | email address, only anonymised data on the use of the service is used for statistical purposes without the possibility of identifying the data subject |
Categories of personal data – Processor
| Field | Activity | Types of personal data |
| Customer IS | Sale of tickets | name, surname, telephone contact, email address |
| Customer IS | Complaints procedure | name, surname, email address, date of purchase of the ticket, subject of the complaint, date and method of handling the complaint |
Purposes of data processing – Controller
Slovak Lines Express, a. s. will process your data for the following purposes:
| Activity | Purpose | Legal background |
| International scheduled services – Passenger verification | Processing of personal data by the driver or an authorised employee for the purpose of ensuring the transport of passengers in accordance with the transport regulations – verification of passengers | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. |
| Handling complaints and claims | Processing of personal data for the purpose of fulfilling obligations in connection with the company’s transport regulations and the sale of complementary products – handling of complaints and claims (including travel accessories) | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for compliance with a legal obligation to which the controller is subject. |
| Transport control | Processing of personal data for the purpose of fulfilling obligations in accordance with the transport regulations – Transport control of passengers | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for compliance with a legal obligation to which the controller is subject. |
| Lost and found | Processing of personal data for the purpose of comprehensive services to customers – ensuring the handover of the found item to the owner | – The processing is necessary for compliance with a legal obligation to which the controller is subject. – The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. |
| Call Centre | Processing of personal data for the purpose of improving the quality of services provided | – The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. |
| Customer satisfaction surveys and evaluation of drivers – solicited feedback | Processing of personal data for the purpose of improving the quality of services provided – surveying customer satisfaction with transport and evaluation of drivers | – The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. |
| Sale of goods and services via web shopping cart – unregistered customer | Processing of personal data in connection with the sale of goods and services to non-registered customers via the web shopping cart | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for compliance with a legal obligation to which the controller is subject. |
| Sale of goods and services via web shopping cart – registered customer | Processing of personal data in connection with the sale of goods and services to registered customers via the web shopping cart | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for compliance with a legal obligation to which the controller is subject. |
| Sale of goods and services via mobile application – registered customer | Processing of personal data in connection with the sale of goods and services to registered customers via the mobile application | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. |
| Sale of goods and services via mobile application – unregistered customer | Processing of personal data in connection with the sale of goods and services to non-registered customers via the web shopping cart | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. |
| Marketing communication – reaching out with offers of the own similar goods and services of the controller (sending newsletters) | Processing of personal data in connection with the sending of newsletters to the company’s customers | – The data subject has given consent to the processing of his or her personal data for one or more specific purposes – The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. |
| Management of the social networks of the controller, customer service | Processing of personal data in connection with the promotion of the company and the development of public relationships – communication with users of social networks and the provision of customer service | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. |
| Organising consumer competitions on social networks and on the controller’s website | The processing of personal data in connection with organising, evaluating and contacting participants in consumer competitions | – The data subject has given consent to the processing of his or her personal data for one or more specific purposes – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for compliance with a legal obligation to which the controller is subject. |
| Business analysis | Processing of personal data in connection with the evaluation of customer activities | – The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. |
| Bookkeeping and accounting | Processing of personal data for the purpose of fulfilling obligations in connection with bookkeeping and accounting | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for compliance with a legal obligation to which the controller is subject. |
| Treasury management | Processing of personal data for the purpose of fulfilling treasury management obligations | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for compliance with a legal obligation to which the controller is subject. |
| Archival care and maintenance | Processing of personal data for the purposes of fulfilling archival care obligations | – The processing is necessary for compliance with a legal obligation to which the controller is subject. |
| Provision of wifi service to passengers during transport and in the premises of Nivy Bus Station and evaluation of its use (anonymised) | Processing of personal data for the purpose of providing additional services to passengers and processing of statistics | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. |
Purposes of data processing – Processor
Slovak Lines Express, a. s. will process your data for the following purposes:
| Activity | Purpose | Legal background |
| Sale of tickets | Sale of tickets for carriers of other companies. | – The processing is necessary for compliance with a legal obligation to which the controller is subject. – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. |
| Complaints procedure | Dealing with complaints in case of non-compliance with the contractual conditions (the subject of the complaints do not cover the transport conditions of the carrier) | – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. – The processing is necessary for compliance with a legal obligation to which the controller is subject. |
| Parties who may have access to your data | Recipients |
| Slovak Lines Express, a. s. as the controller may share your data with the following third parties: | – Turnit Ltd, Estonia
– Adyen N.V. Netherlands – STAFFINO s. r. o. |
| Slovak Lines Express, a. s. as the processor may share your data with the following third parties:
|
– Cestovná kancelária DAKA, s.r.o. – DOB BUS s.r.o. – ERABUS, Comp. ID: 39430443 – FOP Maksymyuk B.M., Comp. ID: 2790319035 – FOP Onchul Vasyl Ivanovych, Comp. ID: 2303202335- FOP Popovych I.I., Comp. ID: 52627781 – FOP Symchera, Comp. ID: 2803522199 – INTERBUS – SK s.r.o. – Korona Travel, Comp. ID: 68678203000 – LeviTour s. r. o. – NIKOLO s.r.o., Comp. ID: 25770055 – SAOBRAĆAJNO PREDUZEĆE LASTA, Comp. ID: 7019734 – TRANZYT BUS, Comp. ID: 41520730 – TURANCAR Bus lines s.r.o. |
In such cases, these third parties may only process your personal data for the purposes stated and only in accordance with our instructions or applicable legal regulations. Our employees will also have access to your personal data. In this case, access will only be granted if it is necessary for the stated purposes and only if the employee is bound by the confidentiality obligation.
Location of your personal data
Your personal data will be accessible to authorised employees of Slovak Lines Express, a. s. in the Slovak Republic within the European Union and the European Economic Area. Processing of personal data outside the EU does not take place.
Storage of personal data – Controller
We will only retain your personal data for a limited period of time and will delete it when it is no longer necessary for the purposes of the processing set out in this statement.
| Activity | Archiving period |
| International scheduled services – Passenger verification | Browsed personal data is not archived |
| Handling complaints and claims | For the purpose of applying and settling a complaint for a period of 6 months, or until the complaint procedure is legally closed |
| Transport control | For a period of 5 years, or until the execution/court proceedings are completed |
| Lost and found | Current and previous year since the reported/settled loss |
| Call Centre | For a period of 1 year |
| Customer satisfaction surveys and evaluation of drivers – solicited feedback | For a period of 2 years |
| Sale of goods and services via web shopping cart – unregistered customer | For a period of 3 months, for the purpose of making claims in connection with the purchase of a ticket, the data necessary for the fulfilment of legal obligations in connection with bookkeeping and accounting shall enter into the processing activity “Bookkeeping and accounting” |
| Sale of goods and services via web shopping cart – registered customer | For a period of 3 months, for the purpose of making claims in connection with the purchase of a ticket, the data necessary for the fulfilment of legal obligations in connection with bookkeeping and accounting shall enter into the processing activity “Bookkeeping and accounting” |
| Sale of goods and services via mobile application – registered customer | For a period of 3 months, for the purpose of making claims in connection with the purchase of a ticket, the data necessary for the fulfilment of legal obligations in connection with bookkeeping and accounting shall enter into the processing activity “Bookkeeping and accounting” |
| Sale of goods and services via mobile application – unregistered customer | For a period of 3 months, for the purpose of making claims in connection with the purchase of a ticket, the data necessary for the fulfilment of legal obligations in connection with bookkeeping and accounting shall enter into the processing activity “Bookkeeping and accounting” |
| Marketing communication – reaching out with offers of the own similar goods and services of the controller (sending newsletters) | For a maximum period of 4 years from the last customer activity and/or until consent is not objected to or withdrawn |
| Management of the social networks of the controller, customer service | FB and IG communications are not archived by the controller. Only communications related to complaints and claims forwarded to the Customer Service Centre within the Complaints and Claims processing activity are archived. |
| Organising consumer competitions on social networks and on the controller’s website | Data disclosed on social networks is not stored by the controller. Consents granted and email communication with participants and winners of consumer competitions – maximum 2 years after the end of the competition. In the case of prizes worth more than EUR 350 for a period of 10 years in accordance with applicable legislation – personal data enters into the processing activity “bookkeeping and accounting”. |
| Business analysis | For the duration of the legitimate interest, up to a maximum of 4 years |
| Bookkeeping and accounting | The current year and 10 years thereafter |
| Treasury management | The current year and 10 years thereafter |
| Archival care and maintenance | Storage periods in accordance with the Registration Plan and the Archiving Rules or in accordance with applicable legislation |
| Provision of wifi service to passengers during transport and in the premises of Nivy Bus Station and evaluation of its use (anonymised) | For the duration of the service |
Retention of personal data – Processor
We will only retain your personal data for a limited period of time and will delete it when it is no longer necessary for the purposes of the processing set out in this statement.
| Activity | Archiving period |
| Sale of tickets | The data is stored in the controller’s system for the necessary period of time for the purpose of making claims in connection with the purchase of a ticket |
| Complaints procedure | The data is stored in the system of the controller for the necessary period of time for the purpose of making claims in accordance with the Transport Regulations and the contractual terms and conditions of the controller |
What are your rights
Under the Data Protection Act, you have certain rights in relation to the processing of personal data. Here is a list of these rights and what they mean to you.
| Right of access | You can request information about how we process your personal data, including information about:
All of the above information is available in this Privacy Policy. |
| Right to repair | It is important that we have the correct information about you and we ask you to let us know if any of your personal data is incorrect, for example, if you have changed your name or you have moved. |
| Right to erasure | If we process your personal data in an unlawful manner, for example if we process your personal data for longer than necessary or for no reason, you can ask us to delete this data. |
| Right to restriction | From the moment you have requested the rectification of your personal data or if you have objected to processing and until we can investigate the problem or confirm the accuracy of your personal data (or amend it as you instruct), you are entitled to restricted processing. This means that we (with the exception of data retention) can only process your personal data in accordance with your consent, where it is necessary in connection with legal claims, to protect someone else’s rights, or where there is a significant public interest in the processing. You can also request that we restrict the processing of your personal data if the processing is unlawful but you do not want us to delete the personal data. |
| Right to object | If you believe that we do not have the right to process your personal data, you can object to our processing. In such cases, we can only continue processing if we can demonstrate compelling legitimate grounds that outweigh your interests, rights and freedoms. However, we may always process your personal data if it is necessary for the establishment, exercise or defence of legal claims. |
| Right to data transfer | You may request that the personal data you have provided to us for processing on the basis of consent or for the performance of a contract be provided to you in a structured, commonly used and machine-readable format. You also have the right to request the transfer of this information to another data controller. |
| Withdrawal of consent | If you have given your consent to any processing activity, this consent is voluntary and you have the right to withdraw it at any time in any way. |
We will also inform the other parties to whom we may have disclosed your personal data of your request(s).
In case of doubt, you have the right to initiate proceedings pursuant to Section 100 of the Data Protection Act with the relevant supervisory authority, for example via www.dataprotection.gov.sk.
How can I complain about the use of my data or exercise my rights?
If you wish to make a complaint about how we process your personal data, including in relation to the above rights, you can contact our Data Protection Officer (“DPO”) and your complaints and requests will be examined.
Contact to the Data Protection Officer: dpo@slovaklines.sk .
If you are not satisfied with our response or believe that we are processing your data unfairly or unlawfully, you can complain to the relevant supervisory authority, which is the Data Protection Authority (DPA). Further information about the DPA and their complaints procedure can be found here: www.dataprotection.gov.sk.
Contact details
If you have any further questions about the processing of your personal data, you can contact us through our Data Protection Officer (DPO) by emailing to dpo@slovaklines.sk.
Important documents
You can find more information about how we handle your personal data also in the documents below.