1. Who We Are (Controller)
The controller of your personal data is Jonáš Bláha, a sole trader established under the laws of the Czech Republic, Company ID (IČO): 71772618, with registered office at Dolní hejčínská 298/19, 779 00 Olomouc, Czech Republic ("we" or "Flotello"). We operate the Flotello web application at flotello.app — software for managing businesses renting out trailers, cars, carts and machinery.
Contact for data protection matters: info@flotello.app. We have not appointed a data protection officer, as we are not required to do so under the GDPR.
This Privacy Policy describes how we process the personal data of: (a) visitors to the flotello.app website, (b) prospective customers of the service, and (c) users of the application — that is, our customers (rental businesses) and their authorised users.
2. Important: The Two Roles in Which We Process Data
As a controller, we process the data described in this Policy — that is, the data of website visitors and the data of our customers (rental businesses) and their users.
As a processor, we process the data that our customers — rental businesses — enter into the application about their own customers (renters): identification and contact data, contracts, protocols, photo documentation and similar records. The controller of that data is always the relevant rental business. If you are a renter and wish to exercise your rights (access, rectification, erasure and so on), please contact directly the rental business from which you rented the vehicle. If we receive your request, we will forward it to that rental business without undue delay. Processing on behalf of rental businesses is governed by the Data Processing Agreement, which forms an annex to our Terms of Service.
3. What Data We Process, Why and For How Long
3.1 Registration and Use of the Application (Customers and Their Users)
- Data: first name and surname, e-mail, telephone, company name and identification details (company ID, VAT ID, registered office), login credentials, account settings, account activity records.
- Purpose: creation and administration of the account, provision of the service, support, communication.
- Legal basis: performance of a contract (Article 6(1)(b) GDPR).
- Retention period: for the term of the contract and 30 days after its termination (the data export window); thereafter, only the data necessary for the establishment, exercise or defence of legal claims, for the duration of the applicable limitation periods (generally 3 to 4 years).
3.2 Invoicing and Accounting
- Data: billing details, subscription payment history, invoices and tax documents.
- Purpose and legal basis: compliance with legal obligations (Article 6(1)(c) GDPR) — in particular accounting and tax law of the Czech Republic, to which we are subject as a Czech-established business.
- Retention period: 10 years from the end of the tax period in which the supply took place.
3.3 Trial Period and Business Communications
- Data: e-mail, name, information about the use of the trial version.
- Purpose: communication during the trial period, offers to move to a paid plan, proportionate direct marketing to our own customers (newsletter, service news).
- Legal basis: performance of a contract, or our legitimate interest (Article 6(1)(f) GDPR) in direct marketing to our own customers. You can opt out of commercial communications at any time (an unsubscribe link is included in every e-mail).
- Retention period: for the term of the contract, or until you opt out; for inactive prospects, no longer than 1 year from the end of the trial period.
3.4 Visitors to the flotello.app Website
- Data: technical data about the visit (IP address, browser type, pages visited) and cookie data as described in Section 4.
- Purpose: operation and security of the website, traffic measurement.
- Legal basis: legitimate interest (operation and security), consent (analytics cookies).
3.5 Communication and Support
- Data: content of the communication (e-mail, contact form), contact details.
- Purpose and legal basis: handling of the enquiry — legitimate interest, or steps taken at your request prior to entering into a contract.
- Retention period: 2 years from the end of the communication.
4. Cookies and Analytics
On the flotello.app website we use:
- Essential (technical) cookies — these ensure the functioning of the website and the application (login, security). They do not require consent.
- Analytics cookies — Google Analytics (provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). They are used to measure traffic and behaviour on the website. They are set only with your consent given via the cookie banner; you can withdraw your consent at any time by changing the settings in the cookie banner. The data may be transferred to Google LLC in the USA — the transfer is safeguarded by certification under the EU-U.S. Data Privacy Framework or, where applicable, by standard contractual clauses. Retention period of analytics data: 14 months.
- Sign-up source — if you have consented to analytics cookies, your browser remembers (in local storage) the first page of our website you arrived at, the domain of the website that referred you to us and any campaign label (utm_source). When you register, we store this information with your account together with the page of our website from which you went to the registration (the latter is recorded even without consent, on the basis of our legitimate interest in knowing where our users come from). We do not store full addresses or their parameters. The information is kept for as long as the account exists.
An overview of the specific cookies used, including their expiry periods, is available in the cookie banner on the website.
5. To Whom We Disclose Data
We process data primarily ourselves; however, we use the following providers (processors and other recipients):
| Provider | Registered office | Purpose | Safeguards for transfers outside the EU |
|---|---|---|---|
| Vercel Inc. | USA | hosting of the website and application | EU-U.S. Data Privacy Framework, SCCs |
| Supabase, Inc. | USA | database and storage (data in the Frankfurt region, EU) | SCCs for any access from third countries |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Ireland / USA | subscription payment processing | EU-U.S. Data Privacy Framework, SCCs |
| Resend, Inc. | USA | sending e-mails | SCCs |
| Functional Software, Inc. (Sentry) | USA | application error monitoring (no IP addresses or user identifiers) | SCCs |
| Google Ireland Ltd. / Google LLC | Ireland / USA | analytics (Google Analytics) | EU-U.S. Data Privacy Framework |
| accountant / tax adviser | Czech Republic | bookkeeping | — |
We may also disclose data to public authorities where required by law.
6. Transfers to Third Countries
Application data is primarily stored in the EU (Frankfurt). Some of the providers listed above are established in the USA or may access the data from there. Such transfers take place exclusively on the basis of a European Commission adequacy decision (the EU-U.S. Data Privacy Framework) or standard contractual clauses under Article 46 GDPR, supplemented by additional measures where appropriate. You may request a copy of the relevant safeguards via our contact address.
7. Your Rights
You have the right: to access your data and obtain a copy of it; to rectification of inaccurate data; to erasure (the "right to be forgotten") where the conditions are met; to restriction of processing; to portability of data processed on the basis of a contract or consent; to object to processing based on legitimate interest, including direct marketing (upon an objection to marketing, we will always cease it); and to withdraw consent (where processing is based on consent), without affecting the lawfulness of processing carried out before the withdrawal.
You can exercise your rights via the contact set out in Section 1. We will respond without undue delay, and in any event within 1 month (this period may be extended by 2 months in complex cases, in which case we will inform you).
You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz. If you are located in another EU Member State, you may also lodge a complaint with the supervisory authority of your place of habitual residence, place of work or place of the alleged infringement.
8. Security
We protect data in particular by encryption in transit (HTTPS/TLS) and at rest, access control, logical isolation of each customer's data, regular backups, and the use of infrastructure from reputable providers holding recognised security certifications (SOC 2, ISO 27001).
9. Changes to This Policy
We may update this Policy from time to time, in particular when the features of the service or our providers change. The current version is always available at flotello.app; we will inform users of the application of material changes by e-mail or by a notice in the service.