Privacy Policy
ZÁSADY OCHRANY OSOBNÝCH ÚDAJOV, Slovak Lines Express, a. s. , Mlynské Nivy 5, Bratislava 821 09, Company ID: 44667345, Commercial Register of the Bratislava III District Court, section: Sa, file no. 4722/B, (hereinafter referred to as ‘Slovak Lines Express, a. s.’)
Slovak Lines, a.s. respects the privacy of all data subjects with whom we are in contact, whether we process personal data ourselves or through other parties. It is important to us that everyone understands which personal data about you we process, why we do so, and what your rights are. Therefore, we encourage you to read this Privacy Policy, which will provide you with more information about how Slovak Lines, a.s. processes your personal data.
This Privacy Policy sets out how we process your personal data when performing activities in the role of controller or processor.
We may update this statement from time to time without prior notice. Therefore, we ask you to regularly review its wording. This version of the statement was issued on 16.12.2024.
We may process personal data about you in various ways and in different situations, depending on whether you are a client, customer, supplier, job applicant, or an employee. We may also process personal data about visitors to our website(s), depending on how you choose to communicate with us. Regardless of the situation, we promise never to sell, commercialize, or use your personal data in violation of applicable data protection regulations.
Slovak Lines, a.s. respects your privacy, whether we process your personal data ourselves or on behalf of others. It is important to us that you understand what personal data about you we process, why we do so, and what your rights are. Therefore, we encourage you to read this Privacy Policy, which will provide you with more information about how Slovak Lines, a.s. processes your personal data.
PRIVACY STATEMENT – CUSTOMERS
At Slovak Lines Express, a. s., we respect the privacy of all data subjects with whom we are in contact, regardless of whether we process personal data ourselves or through other entities. It is important to us that you know which personal data about you we process, why we do so, and what your rights are. Therefore, we ask you to read this statement, which will provide you with more information about how your personal data are processed.
Categories of Personal Data – Controller
| Area | Activity | Types of Personal Data |
|---|---|---|
| Customer IS | Regular international transport – passenger verification | upon boarding the vehicle – verification of the purchased ticket via QR code – passenger’s first name, last name, email address, time and route of transportation; verification of eligibility for a discount; visual verification of a travel document, parental (legal guardian) consent for transporting a minor passenger – passenger’s first and last name, ID document number (passport or ID card), date of birth, permanent address, passenger’s telephone number, legal guardian’s first and last name, his/her telephone number, signature, route and time of transportation |
| Customer IS | Handling and recording complaints and identified defects (claims) | first and last name, permanent and temporary address of the customer/complainant, email address, possibly a relative’s email address, telephone number, other personal data found or submitted during the complaint handling, complainant’s signature, reason for defect identification or complaint, handling process, account number |
| Customer IS | Transport inspection | passenger’s first and last name, residence address, date of birth, ID card number, email, amount of fine, amount due |
| Customer IS | Lost and found | data necessary to identify the owner of the lost or found item – first and last name, telephone number, email address, item description, date of collection, signature on the handover protocol; in case of a valuable item (value clearly exceeding EUR 50), verification of identity by checking the ID |
| Customer IS | Customer line | audio recording of the call, the scope of personal data depends on the purpose of the call, at most first and last name of the customer, telephone number, email |
| Customer IS | Determining customer satisfaction and driver evaluation – requested feedback | employees – first name, last name, title, photograph, evaluation of provided services; customers – customer’s email address, telephone number; in connection with the evaluation, only the employee’s first name and photograph are published |
| Customer IS | Sale of goods and services through the web shopping cart – non-registered customer | customer’s first and last name, email address, telephone number, route, date and time of transportation, seat reservation, additional product, payment card number, account number, IP address, amount paid |
| Customer IS | Sale of goods and services through the web shopping cart – registered customer | customer’s first and last name, email address, telephone number, route, date and time of transportation, seat reservation, additional product, payment card number, account number, IP address, amount paid, history of ticket or service/product sales |
| Customer IS | Sale of goods and services through the mobile application – registered customer | customer’s first and last name, email address, telephone number, route, date and time of transportation, seat reservation, additional product, payment card number, account number, IP address, amount paid, product purchase history in the customer’s profile |
| Customer IS | Sale of goods and services through the mobile application – non-registered customer | customer’s first and last name, email address, telephone number, route, date and time of transportation, seat reservation, additional product, payment card number, account number, IP address, amount paid |
| IS marketing | Marketing communication – contacting with offers of the controller’s own similar goods and services (sending newsletters) | customer’s email address |
| IS marketing | Management of the operator’s social networks, customer service | profile name/nick name and other personal data that the profile user discloses about themselves |
| IS marketing | Organizing consumer competitions on social networks and on the operator’s website | profile name/name, email address, all information the data subject discloses about themselves or data defined in the contest rules necessary to participate in the contest; for the purpose of contacting the contest winner and handing over the prize – email address, first name, last name, residence address, telephone contact, or other data necessary to hand over the prize in accordance with the contest rules; personal data are published in accordance with the contest rules |
| IS marketing | Business analyses | customer’s email address, first name, last name |
| Finance and accounting | Accounting | Personal data from invoices for natural persons or sole traders – first name, last name, title, address, telephone number, bank account number, email, signature; payment data of customers, employees’ personal data – first name, last name, title, address, bank account number, email, signature, in case of insurance also personal ID number, information on wage deductions – e.g., for fuel overconsumption, damage events, membership fees in associations, executions, personal data of authorized employees (statutory representatives) necessary for communication with banks |
| Finance and accounting | Cash desk management | first name, last name, address, customer’s ID card number, customer’s account number; employee’s first name, last name, address, date of birth, employee’s account number, in the case of an authorized employee – personal data necessary for communication with the bank including signature specimen |
| Registry and archiving | Archival care | personal data in the scope indicated in the documentation that must be archived in accordance with applicable legislation |
| Customer IS | Providing WiFi service to passengers during transportation and in AS Nivy station premises and evaluating its usage (anonymized) | email address, only anonymized data on service usage without the possibility of identifying the data subject are used for statistical purposes |
Categories of Personal Data – Processor
| Area | Activity | Types of Personal Data |
|---|---|---|
| Customer IS | Sale of tickets | first name, last name, telephone contact, email address |
| Customer IS | Complaint proceedings | first name, last name, email address, date of ticket purchase, subject of the complaint, date and method of complaint handling |
Purposes of Data Processing – Controller
Slovak Lines Express, a. s. will process your data for the following purposes:
| Activity | Purpose | Legal Basis |
|---|---|---|
| Regular international transport – passenger verification | Processing of personal data by the driver or authorized staff to ensure the transport of passengers in accordance with the transport rules – passenger verification | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. |
| Handling and recording complaints and identified defects (claims) | Processing of personal data for the purpose of fulfilling obligations related to the company’s transport rules and the sale of additional products – handling complaints and claims (including travel accessories) | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary to fulfill a legal obligation of the controller. |
| Transport inspection | Processing of personal data for the purpose of fulfilling obligations in accordance with the transport rules – passenger transport inspection | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary to fulfill a legal obligation of the controller. |
| Lost and found | Processing of personal data for the purpose of comprehensive customer service – ensuring that the found item is handed over to its owner | – Processing is necessary to fulfill a legal obligation of the controller. – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring personal data protection, especially if the data subject is a child. |
| Customer line | Processing of personal data for the purpose of improving the quality of provided services | – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where overridden by the interests or fundamental rights and freedoms of the data subject requiring data protection, especially if the data subject is a child. |
| Determining customer satisfaction and driver evaluation – requested feedback | Processing of personal data for the purpose of improving provided services – determining customer satisfaction with transport and evaluating drivers | – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where overridden by the interests or fundamental rights and freedoms of the data subject requiring data protection, especially if the data subject is a child. |
| Sale of goods and services through the web shopping cart – non-registered customer | Processing of personal data in connection with the sale of goods and services to non-registered customers through the web shopping cart | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary to fulfill a legal obligation of the controller. |
| Sale of goods and services through the web shopping cart – registered customer | Processing of personal data in connection with the sale of goods and services to registered customers through the web shopping cart | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary to fulfill a legal obligation of the controller. |
| Sale of goods and services through the mobile application – registered customer | Processing of personal data in connection with the sale of goods and services to registered customers through the mobile application | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. |
| Sale of goods and services through the mobile application – non-registered customer | Processing of personal data in connection with the sale of goods and services to non-registered customers through the web shopping cart | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. |
| Marketing communication – contacting with offers of the controller’s own similar goods and services (sending newsletters) | Processing of personal data in connection with sending newsletters to the company’s customers | – The data subject has given consent to the processing of his/her personal data for one or more specific purposes. – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where overridden by the data subject’s interests or fundamental rights and freedoms requiring data protection, especially if the data subject is a child. |
| Management of the operator’s social networks, customer service | Processing of personal data in connection with promoting the company and developing public relations – communication with social network users and providing customer service | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where overridden by the interests or fundamental rights and freedoms of the data subject requiring data protection, especially if the data subject is a child. |
| Organizing consumer competitions on social networks and on the operator’s website | Processing of personal data in connection with organizing, evaluating and contacting participants of consumer competitions | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary to fulfill a legal obligation of the controller. |
| Business analyses | Processing of personal data in connection with evaluating customer activities | – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where overridden by the interests or fundamental rights and freedoms of the data subject requiring data protection, especially if the data subject is a child. |
| Accounting | Processing of personal data for the purpose of fulfilling obligations related to accounting | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary to fulfill a legal obligation of the controller. |
| Cash desk management | Processing of personal data for the purpose of fulfilling obligations related to cash desk management | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary to fulfill a legal obligation of the controller. |
| Archival care | Processing of personal data for the purpose of fulfilling obligations related to archival care | – Processing is necessary to fulfill a legal obligation of the controller. |
| Providing WiFi service to passengers during transportation and in the AS Nivy station premises and evaluating its usage (anonymized) | Processing of personal data for the purpose of providing additional services to passengers and processing statistics | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where overridden by the interests or fundamental rights and freedoms of the data subject requiring data protection, especially if the data subject is a child. |
Purposes of Data Processing – Processor
Slovak Lines Express, a. s. will process your data for the following purposes:
| Activity | Purpose | Legal Basis |
|---|---|---|
| Sale of tickets | Sale of tickets for carriers of other companies. | – Processing is necessary to fulfill a legal obligation of the controller. – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. |
| Complaint proceedings | Handling complaints when contractual conditions are not met (the subject of complaints are not the carrier’s transport conditions) | – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. – Processing is necessary to fulfill a legal obligation of the controller. |
In the event that we process your personal data on the legal basis of fulfilling our legal obligation, the following legal regulations may apply:
| Activity | Name of Regulation |
|---|---|
| Archival care | Act No. 395/2002 Coll. on Archives and Registries and on Amendments to Certain Laws |
| Transport inspection | Act No. 233/1995 Coll. on Bailiffs and Enforcement Activities (Execution Code) and on amendments to certain laws |
| Organizing consumer competitions on social networks and on the operator’s website | Act No. 595/2003 Coll. on Income Tax |
| Act No. 222/2004 Coll. on Value Added Tax | |
| Act No. 431/2001 Coll. on Accounting | |
| Act No. 40/1964 Coll. Civil Code | |
| Act No. 513/1991 Coll. Commercial Code | |
| EU Regulation No. 2016/679 Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) | |
| Sale of tickets and travel accessories at the ticket office | Act No. 513/1991 Coll. Commercial Code |
| Act No. 56/2021 Coll. on Road Transport | |
| Sale of goods and services through the web shopping cart – registered customer | Act No. 431/2001 Coll. on Accounting |
| Sale of goods and services through the web shopping cart – non-registered customer | Act No. 431/2001 Coll. on Accounting |
| Occasional transport | Act No. 513/1991 Coll. Commercial Code |
| Lost and found | Act No. 40/1964 Coll. Civil Code |
| Cash desk management | Act No. 431/2002 Coll. on Accounting |
| Accounting | Act No. 311/2001 Coll. Labour Code |
| Act No. 595/2003 Coll. on Income Tax | |
| Act No. 222/2004 Coll. on Value Added Tax | |
| Act No. 431/2001 Coll. on Accounting | |
| Handling and recording complaints and identified defects (claims) | Act No. 40/1964 Coll. Civil Code |
| Act No. 513/1991 Coll. Commercial Code | |
| Act No. 9/2010 Coll. on Complaints | |
| Act No. 108/2024 Coll. on Consumer Protection and on the Amendment of Certain Laws | |
| Accounting – financial audit | Act No. 152/1994 Coll. on the Social Fund and on the amendment of Act No. 286/1992 Coll. on Income Tax as amended |
| Act No. 222/2004 Coll. on Value Added Tax | |
| Act No. 431/2001 Coll. on Accounting | |
| Act No. 423/2015 Coll. on Statutory Audit and on the Amendment of Act No. 431/2002 Coll. on Accounting as amended | |
| Act No. 311/2001 Coll. Labour Code | |
| Act No. 595/2003 Coll. on Income Tax | |
| Act No. 650/2004 Coll. on Supplementary Pension Saving and on the Amendment of Certain Laws |
| Parties who may have access to your data | Recipients |
|---|---|
| As a controller, Slovak Lines Express, a. s. may share your data with the following third parties: | – Turnit Ltd, Estonia – Adyen N.V. Netherlands – Turnit Ltd, Estonia – freevision s. r. o. – Slovak Police Force (Policajný zbor SR) – Prosecutor’s Office of the Slovak Republic – Courts of the Slovak Republic – Slovak Trade Inspection (Slovenská obchodná inšpekcia) – Slovak Lines Služby, a. s. – Stanica Nivy s. r. o. – STAFFINO s. r. o. |
| As a processor, Slovak Lines Express, a. s. may share your data with the following third parties: | – Cestovná kancelária DAKA, s.r.o. – DOB BUS s.r.o. – ERABUS, Company ID: 39430443 – FOP Maksymyuk B.M., Company ID: 2790319035 – FOP Onchul Vasyl Ivanovych, Company ID: 2303202335 – FOP Popovych I.I., Company ID: 52627781 – FOP Symchera, Company ID: 2803522199 – INTERBUS – SK s.r.o. – Korona Travel, Company ID: 68678203000 – LeviTour s. r. o. – NIKOLO s.r.o., Company ID: 25770055 – SAOBRAĆAJNO PREDUZEĆE LASTA, Company ID: 7019734 – TRANZYT BUS, Company ID: 41520730 – TURANCAR Bus lines s. r. o. |
In such cases, these third parties may process your personal data only for the stated purposes and only in accordance with our instructions or applicable legal regulations. Our staff will also have access to your personal data. In this case, access is granted only if it is necessary for the stated purposes and only if the employee is bound by confidentiality obligations.
Location of Your Personal Data
Your personal data will be accessible to authorized personnel of Slovak Lines Express, a. s. in the Slovak Republic within the European Union and the European Economic Area. No personal data are processed outside the EU.
Retention of Personal Data – Controller
We retain your personal data only for a limited period, and they will be deleted when they are no longer needed for the processing purposes stated in this declaration.
| Activity | Retention Period |
|---|---|
| Regular international transport – passenger verification | Viewed personal data are not archived |
| Handling complaints and claims | Processing personal data for the purpose of fulfilling obligations related to the company’s transport rules and station management – handling complaints and identified defects (including travel accessories) |
| Transport inspection | For 5 years, or until the end of enforcement/court proceedings |
| Lost and found | Current and previous year from the reported/handled loss |
| Customer line | For 1 year |
| Determining customer satisfaction and driver evaluation – requested feedback | For 2 years |
| Sale of goods and services through the web shopping cart – non-registered customer | For 3 months for the purpose of asserting claims related to the ticket purchase, data necessary to fulfill legal obligations in connection with accounting are included in the “Accounting” processing activity |
| Sale of goods and services through the web shopping cart – registered customer | For 3 months for the purpose of asserting claims related to the ticket purchase, data necessary to fulfill legal obligations in connection with accounting are included in the “Accounting” processing activity |
| Sale of goods and services through the mobile application – registered customer | For 3 months for the purpose of asserting claims related to the ticket purchase, data necessary to fulfill legal obligations in connection with accounting are included in the “Accounting” processing activity |
| Sale of goods and services through the mobile application – non-registered customer | For 3 months for the purpose of asserting claims related to the ticket purchase, data necessary to fulfill legal obligations in connection with accounting are included in the “Accounting” processing activity |
| Marketing communication – contacting with offers of the controller’s own similar goods and services (sending newsletters) | A maximum of 4 years from the customer’s last activity or until objection or withdrawal of consent |
| Management of the operator’s social networks, customer service | Communication within FB and IG is not archived by the controller. Only communication regarding complaints and claims forwarded to the Customer Center is archived within the “Complaints and Claims” processing activity. |
| Organizing consumer competitions on social networks and on the operator’s website | Data published on social networks are not retained by the controller. Email communication with participants and winners of consumer competitions – max. 2 years after the end of the competition. In case of a prize worth more than EUR 350 for 10 years in accordance with applicable legislation – personal data are included in the “Accounting” processing activity. |
| Business analyses | During the duration of the legitimate interest, for a maximum of 4 years |
| Accounting | Current year and subsequently 10 years |
| Cash desk management | Current year and subsequently 10 years |
| Archival care | Storage periods in accordance with the Registry Plan and Archival Regulations or in accordance with applicable legislation |
| Providing WiFi service to passengers during transportation and in the AS Nivy station premises and evaluating its usage (anonymized) | For the duration of service usage |
Retention of Personal Data – Processor
We only keep your personal data for a limited time, and it will be deleted once it is no longer needed for the purposes set out in this statement.
| Activity | Retention Period |
|---|---|
| Sale of tickets | Data are stored in the controller’s system for the necessary period for the purpose of asserting claims related to the ticket purchase |
| Complaint proceedings | Data are stored in the controller’s system for the necessary period for the purpose of asserting claims in accordance with the Transport Rules and the operator’s contractual conditions |
We may process your personal data for a longer period in the event of a pending legal dispute, or if you have given us your consent.
Your Rights
Under the Data Protection Act, you have certain rights in relation to the processing of your personal data. Below is a list of these rights and what they mean for you.
| Right of access | You can request information on how we process your personal data, including:
All the above information is available in this Privacy Policy. You may also request a copy of the personal data we process about you. However, additional copies will be charged. |
|---|---|
| Right to rectification | It is important for us to have accurate information about you, and we ask you to notify us if any of your personal data are incorrect, e.g., if you changed your name or moved. |
| Right to erasure | If we process your personal data unlawfully, for example, if we process your personal data longer than necessary or without justification, you can ask us to delete these data. |
| Right to restriction | From the moment you have requested a correction of your personal data or have objected to processing, and until we investigate the matter or confirm the accuracy of your personal data (or change it according to your instructions), you have the right to restricted processing. This means that we (except for the storage of personal data) may process your personal data only with your consent, if necessary in relation to legal claims, to protect the rights of another person, or if there is a significant public interest in processing. You may also request that we restrict the processing of your personal data if the processing is unlawful, but you do not want us to delete your personal data. |
| Right to object | If you believe we have no right to process your personal data, you may object to our processing. In such cases, we can continue processing only if we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. However, we may always process your personal data if it is necessary to determine, exercise, or defend legal claims. |
| Right to data portability | You can request that the personal data you provided to us for processing based on consent or to fulfill a contract be provided to you in a structured, commonly used, and machine-readable format. You also have the right to request that these data be transferred to another data controller. |
| Withdrawal of consent | If you have given us consent for some processing activity, this consent is voluntary, and you have the right to withdraw it at any time in any manner. |
We will also inform other parties to whom we may have provided your personal data about your request(s).
In case of doubt, you have the right to file a motion to initiate proceedings under § 100 of the Personal Data Protection Act with the competent supervisory authority, for example through www.dataprotection.gov.sk.
How can I complain about how my data is being used, or how do I exercise my rights?
If you want to complain about how we process your personal data, including the above-mentioned rights, you can contact our Data Protection Officer (DPO) and your suggestions and requests will be reviewed.
If you are not satisfied with our response, or if you believe we are processing your data unfairly or unlawfully, you may lodge a complaint with the competent supervisory authority, which is the Office for Personal Data Protection (ÚOOÚ). More information about ÚOOÚ and their complaints procedure can be found at https://dataprotection.gov.sk/.
Contact
Data Protection Officer: dpo@slovaklines.sk.
Important documents
You can find more information about how we handle your personal data also in the documents below.
| Personal data protection policy of Slovak Lines Express, a.s. | View PDF |
| Personal data protection policy of Slovak Lines Služby, a.s. | View PDF |
| Personal data protection policy of Slovak Lines Opravy, a.s. | View PDF |
| Personal data protection policy of Slovak Lines, a.s. | View PDF |
| Privacy statement for websites and cookies | View PDF |