1. Who We Are (Controller)
The controller of personal data is Jonáš Bláha, Company ID No. (IČO): 71772618, with registered office at Dolní hejčínská 298/19, 779 00 Olomouc, Czech Republic ("we" or "Flotello"). We operate the Flotello web application at flotello.app — software for managing rental companies renting out trailers, cars, carts and machines.
Contact for personal data matters: info@flotello.app. We have not appointed a data protection officer, as we are not subject to this obligation.
This Policy describes how we process the personal data of: (a) visitors to the flotello.app website, (b) prospective customers of the service, and (c) users of the application — i.e. our customers (rental companies) and their authorised users.
2. Important: The Two Roles in Which We Process Data
As a controller, we process the data described in this Policy — i.e. the data of website visitors and the data of customers (rental companies) and their users.
As a processor, we process the data that our customers — rental companies — enter into the application about their own customers (renters): identification and contact data, contracts, protocols, photo documentation and the like. The controller of such data is always the relevant rental company. If you are a renter and wish to exercise your rights (access, rectification, erasure, etc.), please contact directly the rental company from which you rented the vehicle. If we receive your request, we will forward it to the rental company without undue delay. Processing on behalf of rental companies is governed by the data processing agreement, which forms an annex to our terms and conditions.
3. What Data We Process, Why and For How Long
3.1 Registration and Use of the Application (Customers and Their Users)
- Data: first name and surname, e-mail, telephone, company name and identification details (company ID number (IČO), VAT ID (DIČ), registered office), login credentials, account settings, account activity records.
- Purpose: creation and administration of the account, provision of the service, support, communication.
- Legal basis: performance of a contract (Article 6(1)(b) GDPR).
- Retention period: for the term of the contract and 30 days after its termination (the data export period); thereafter, only the data necessary for the defence of legal claims, for the duration of the limitation periods (generally 3–4 years).
3.2 Invoicing and Accounting
- Data: billing details, subscription payment history, tax documents.
- Purpose and legal basis: compliance with legal obligations (Article 6(1)(c) GDPR) — in particular the Czech VAT Act and the Czech Accounting Act.
- Retention period: 10 years from the end of the tax period in which the supply took place.
3.3 Trial Period and Business Communications
- Data: e-mail, name, information about the use of the trial version.
- Purpose: communication during the trial period, offers to switch to a paid plan, proportionate direct marketing towards customers (newsletter, service news).
- Legal basis: performance of a contract, or legitimate interest (Article 6(1)(f) GDPR) in direct marketing towards our own customers. You can unsubscribe from commercial communications at any time (a link is included in every e-mail).
- Retention period: for the term of the contract, or until you unsubscribe; for inactive prospects, no longer than 1 year from the end of the trial period.
3.4 Visitors to the flotello.app Website
- Data: technical data about the visit (IP address, browser type, pages visited) and cookie data pursuant to Article 4.
- Purpose: operation and security of the website, traffic measurement.
- Legal basis: legitimate interest (operation and security), consent (analytics cookies).
3.5 Communication and Support
- Data: content of the communication (e-mail, contact form), contact details.
- Purpose and legal basis: handling of the enquiry — legitimate interest, or steps taken prior to entering into a contract.
- Retention period: 2 years from the end of the communication.
4. Cookies and Analytics
On the flotello.app website we use:
- Essential (technical) cookies — these ensure the functioning of the website and the application (login, security). They do not require consent.
- Analytics cookies — Google Analytics (provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). They are used to measure traffic and behaviour on the website. They are stored only with your consent given via the cookie banner; you can withdraw your consent at any time by changing the settings in the cookie banner. The data may be transferred to Google LLC in the USA — the transfer is safeguarded by certification under the EU-U.S. Data Privacy Framework or, where applicable, by standard contractual clauses. Retention period of analytics data: 14 months.
An overview of the specific cookies used, including their expiry periods, is available in the cookie banner on the website.
5. To Whom We Disclose Data
We process data primarily ourselves; however, we use the following providers (processors and other recipients):
| Provider | Registered office | Purpose | Safeguards for transfers outside the EU |
|---|---|---|---|
| Vercel Inc. | USA | hosting of the website and application | EU-U.S. Data Privacy Framework, SCCs |
| Supabase, Inc. | USA | database and storage (data in the Frankfurt region, EU) | SCCs for any access from third countries |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Ireland / USA | subscription payment processing | EU-U.S. Data Privacy Framework, SCCs |
| Resend, Inc. | USA | sending e-mails | SCCs |
| Google Ireland Ltd. / Google LLC | Ireland / USA | analytics (Google Analytics) | EU-U.S. Data Privacy Framework |
| accountant / tax adviser | Czech Republic | bookkeeping | — |
We may also disclose data to public authorities where required by a legal regulation.
6. Transfers to Third Countries
Application data is primarily stored in the EU (Frankfurt). Some of the providers listed above are established in the USA or may access the data from there. Such transfers take place exclusively on the basis of a European Commission adequacy decision (the EU-U.S. Data Privacy Framework) or standard contractual clauses under Article 46 GDPR, supplemented by additional measures where applicable. You may request a copy of the safeguards via our contact address.
7. Your Rights
You have the right: to access your data and obtain a copy of it; to rectification of inaccurate data; to erasure (the "right to be forgotten") where the conditions are met; to restriction of processing; to portability of data processed on the basis of a contract or consent; to object to processing based on legitimate interest, including direct marketing (upon an objection to marketing, we will always cease it); and to withdraw consent (where processing is based on consent), without affecting the lawfulness of prior processing.
You can exercise your rights via the contact set out in Article 1. We will respond without undue delay, and no later than within 1 month (this period may be extended by 2 months in complex cases, of which we will inform you).
You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
8. Security
We protect data in particular by encryption in transit (HTTPS/TLS) and at rest, access control, logical isolation of the data of individual customers, regular backups and the use of infrastructure from reputable providers holding security certifications (SOC 2, ISO 27001).
9. Changes to This Policy
We may update this Policy, in particular when the features of the service or our providers change. The current version is always available at flotello.app; we will inform users of the application of material changes by e-mail or by a notice in the service.