Genera Data Protection Regulation

GENERAL DATA PROTECTION REGULATION

GOPALL

according to article 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on protection of natural persons with regard to the processing of personal data and on the free movement of such data

Company GOPALL s.r.o., with its registered office at Tallerova 4, 811 02 Bratislava Slovak republic, company reg. no.: 52606252, registered in the Commercial Register of the District Court Bratislava I, section Sro, file no. 140734/B, hereinafter referred to as “Company” pays great attention to the protection of personal data and protecting your privacy and personal information is very important in our Company.

The personal data You provide the Company processes and protects in accordance with applicable law, in particular REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing of Directive 95/46/EC (hereinafter referred to as “GDPR“) and Act no.18/2018 on personal data protection and amending and supplementing certain Acts (hereinafter referred to as the “Act”). Below You will find information about what personal data we process, for what purpose and what your rights are.

In order to maintain consistent in the terminology, the terms used in these principles have the same meaning as the terms used in the GENERAL TERMS AND CONDITIONS FOR USING THE GOPALL PLATFORM (hereinafter referred to as “GTC”) unless otherwise expressly stated.

1. Controller

1.1. Controller is a business company GOPALL Ltd., with its registered office at Tallerova 4, 811 02 Bratislava, Slovak republic, company reg. no.: 52606252, registered in the Commercial Register of the District Court Bratislava I, section Sro, file no. 140734/B.

2. Responsible Person

2.1. In all matters relating to the processing of your personal data, our data protection processor as a responsible representative of our Company is available to you. This processor can be contacted via gdpr@gopall.com.

3. What Personal Data are processed?

The scope and form of collecting and using data of the User (hereinafter referred to as “You“) will vary depending on whether You are looking at our www.gopall.com (hereinafter referred to as “Website“) for the sole purpose of obtaining some information about the Platform (Incl. Mobile App), i.e. for informational purposes or You are actually using the offered services.

3.1. Data processed for Informative Purpose:

By the informative use of the Website, the Company only obtains data that is automatically sent to it by your Internet browser. Thus, the company processes only the necessary types of data (the stated data that are technically inevitable for the Website to be displayed and to ensure its stability and security), i.e. for example:

• IP address
• Date and time of the question
• Difference between time zone and Greenwich Mean Time (GMT)
• Request content
• Amount of transferred data and access status
• The Website, from which the request comes
• Type of browser
• Operating system and its interface

3.2. Data processed for Purpose of Contacting the Company:

3.2.1. Contact forms:

You can contact the Company via the contact form on the Website’s subpages. The data obtained from the contact form (name, surname, business name, telephone, e-mail address, the text of your message itself) and your message will be used by the Company solely to answer your question or request. Upon completion of its processing, the Company deletes all the data. Within the framework of the statutory archiving period, electronic communication data shall be saved for a maximum of 10 years.

However, the Company saves your data if You conclude a contract on the grounds of the communication and sing up to the Platform in accordance with the GTC. In this case, the processing of your data is inevitable for the execution of the contract or the adoption of pre-contractual measures. Your data will be deleted by the Company if the storage of your data is no longer necessary after the contract has been fulfilled, unless it is required by law to keep your data for a longer period of time.

Your data shall only be passed on to third parties if it is required by law.

3.2.2. Contacting via e-mail:

Likewise, You can contact the Company via e-mail, e.g. gdpr@gopall.com or personalized e-mail address of the Company’s employee. The data obtained from your e-mail (e.g. name, surname, business name, telephone, e-mail address, the text of your message itself) will be used by the Company solely to answer your question or request. Upon completion of its processing, the Company deletes all the data. Within the framework of the statutory archiving period, e-mail communication data shall be saved for a maximum of 10 years.

However, the Company saves your data if You conclude a contract on the grounds of the communication and sign up to the Platform in accordance with the GTC. In this case, the processing of your data is inevitable for the execution of the contract or the adoption of pre-contractual measures. Your data will be deleted by the Company if the storage of your data is no longer necessary after the contract has been fulfilled, unless it is required by law to keep your data for a longer period of time.

Your data shall only be passed on to third parties if it is required by law.

3.2.3. Contacting via call center:

If You communicate with the Company via call center, the Company will process your identification and contact data and records of past communications including call recordings, based on the Company’s legitimate interest (i.e. without your consent) for the following purposes:

• handling your requirements;
• if You are registered in the Platform and your request regards the provided Platform services (Inc. Mobile App.), the Company is allowed to implement the processing based on the execution of the contract between You and the Company;
• keeping an evidence of your requirements so that the Company can check that it is taking care of them properly and in due time;
• proving that your requirements has been received and taken care of.

Thus, the Company keeps personal data for 3 months. If You are registered in the Platform, the Company may retain data for the protection of legal claims for the duration of the general time-barring period of 4 years and one year after its expiration with respect to claims filed at the end of the time-barring period. In the event of legal, administrative or other proceedings being initiated, the Company will process your personal data to the extent necessary for the entire duration of such proceedings and the remaining of the time-barring period after its termination.

3.3. Registration and the Use of Services

In order to use the services offered by the Company (the use of the Platform, as well as the Mobile App.) You have to register/sign up.

The Company shall only save the data obtained in the registration form for the period of time during which You use the Company’s services as a User, i.e. for the duration of the contract concluded between You and the Company. In relation to this, the Company processes, or rather may process the following types of data:

• identification data, meaning name and surname, business name, company reg. number, TAX id. number, VAT number, username and password;
• contact data, meaning personal data that allows the Company to communicate with You, particularly e-mail address, phone number, postal address, billing address;

• your setup, which means the data in your Account, in particular (but not exclusively) User Accesses (Administrator, Dispatcher, Driver) including their scope of authority and information about their activities, bank connection, bank account number – IBAN, tax residence;

• data about your Orders, in particular, data of ongoing or completed services provided to You by the Company through the Platform;
• data about Your behavior and those with User Access when using the Platform functionalities (Incl. the Mobile App), which You use in particular (but not exclusively) as Supplies, Demands, Reactions, Orders You search, place or send to other User, links You click on and also data about the devices You use to visit our Website and from which You log in to the Platform, such as your IP address and the location derived from it, device identification, its technical parameters such as operating system and its version, screen resolution, browser and its used version, and data obtained from cookies and similar device identification technologies.

4. Purposes and Legal Basis of the Processing of Personal Data

4.1. In the course of its activities, the Company processes personal data for various purposes and to different extents either:

4.1.1. without your consent according to:

• Article 6, section 1 (b) of GDPR, processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• Article 6, section 1 (c) of GDPR, processing is necessary for compliance with a legal obligation to which the controller is subject;
• Article 6, section 1 (f) of GDPR, processing is necessary for the purposes of the legitimate interests pursued by the controller.

4.1.2. based on your consent according to Article 6, section 1 (a) and Article 7 of GDPR, such as checking the box or confirming the icon.

4.2. What processing the Company may perform without your consent depends on the purpose for which the processing is directed and your position towards the Company – whether You are just a visitor to our Website or sign up to the Platform.

4.3. If You Visit the Website:

When You visit a Website, small files such as cookies are saved on your device and then read from it. A cookie is a small set of letters and numbers that is saved in your Internet browser or your computer’s hard drive (or another device such as tablet, mobile phone, etc.). Some cookies allow the Company to link your activities while browsing the Company’s Website from the moment You open the web browser window until You close it. When You close your browser window, these cookies shall be deleted. Others remain on your device for a set period of time and are activated each time You visit the Website that created the specific cookie. Furthermore, pixel tags (also known as web beacons) are used, which are small images that have a similar function as cookies. Unlike cookies that are saved to your computer’s hard drive, pixel tags are a fixed part of the Website.

All of these technologies will be referred to as cookies for the sake of simplicity in this document. Hereinafter, for convenience, we will only talk about saving.

This Company Websites use cookies to the following extent:

• Transient Cookies (temporary use)
• Persistent Cookies (time limited use)
• Third-Party Cookies (from third parties)
• Flash-Cookies (permanent use)

Transient Cookies are automatically deleted when You close your browser. These include Session Cookies in particular which save so-called Session-IDs that can be used to associate your browser’s questions with one common session. This allows your device to recognize when You return to a Website. Session Cookies are deleted when You log out or close your browser.

Persistent Cookies are deleted automatically after a specific time settled in advance that may vary from cookie to cookie. You can delete cookies at any time in your browser’s security settings.

You can configure your browser settings according to your requirements and, for instance, refuse to accept Third-Party Cookies or all cookies. However, please note that You may not be able to use all the functionalities of the Website or the Platform (Inc. Mobile App).

The Flash-Cookies You use shall not be recorded by your browser, but by your Flash plugin. These cookies save the necessary data independently of the browser You use and do not have an automatic expiration date. If do not wish to have your Flash-Cookies processed, You must install the appropriate software.

Regarding the above, the Company does not collect or save any personal data in cookies and does not use any techniques that combine data obtained through cookies with User data.

4.4. If You Sign Up and the Use of the Platform

You must visit the Website in order to sign up, so the information described in ‘If You visit the Website’ applies to You. If You sign up, the Company performs the following data processing:

4.4.1. Processing under contract performance

By creating your Account, the Contract for Data Processing between You and the Company comes into existence. If You create an Account in the Platform on the Website, we process your identification and contact information, your settings, your Orders data, your behavior data, and those with the User Access, based on the performance of the Contract with You (without your consent) to maintain your User Account and to mediate the TRANSPORT PACKAGING exchange service with other Users through the Platform, which includes in particular:

• mutual identification of Users that is required to provide the TRANSPORT PACKAGING exchange service through the Platform;
• enabling the creation of Demands, Supplies and Reactions in order to conclude, execute and complete an Order between Users,
• facilitating mutual exchange of information and documents between Users for the purpose of executing Orders through the Platform,
• determination of the current position (location), which serves the Driver to unload / load the TRANSPORT PACKAGING from a specific location,
• regarding the execution of “transactions” within the Credit on your Account established in the Platform, depending on the executed Orders,
• regarding your creation of User Access for Administrators, Dispatchers and Drivers,
• regarding your other requests for the Company.

For this purpose, the Company uses the personal data for as long as your Account exists, which You can delete at any time to cancel your registration.

4.4.2. Processing based on legitimate interest

If You create an Account in the Platform on the Website, we process your identification and contact information, your settings, your Order data, your behavior data, and those with User Access also based on the Company’s legitimate interest (i.e. without your consent), The Company has a legitimate interest in improving the Platform (Incl. the Mobile App.), in particular improving the design of the Platform (Incl. the Mobile App.) and optimizing its content and functionalities, as well as protecting Users while using the services provided through the Platform (Incl. the Mobile App.). Therefore, the Company also uses the data for the following purposes:

• informing about changes in the Platform (Incl. the Mobile App.) and updating the terms of the use of the Platform (Incl. the Mobile App.) by sending notifications to the Platform mailbox or to the User’s e-mail address;
• promoting the Platform’s updates (Incl. the Mobile App), e.g. adding new filters, functionalities, etc., by displaying information about the update directly in the Platform (Incl. the Mobile App), or by sending a notification;
• checking compliance with the terms of the use of the Platform (Incl. the Mobile App) and detecting violations;
• continuous monitoring of the quality of services provided through the Platform (Incl. the Mobile App.), dealing with service quality problems and taking corrective action;
• preventing and detecting illegal activities during the use of services mediated through the Platform (Incl. the Mobile App.), including use for investigation and prosecution by competent authorities;
• controlling of the proper performance of the contract concluded between You and the Company (e.g. control of the proper performance of contractual obligations);
• protection of legal claims (in particular the establishment, exercise, defense of legal claims in administrative, judicial, extrajudicial, arbitration and other proceedings) where the legitimate interest is the prevention of damages ;
• to protect legal claims, internal reports and control.

4.5. Compliance with Legal Regulations

Personal data (to a limited extent) are also processed by the Company for the purpose of fulfilling the billing and other obligations pursuant to the relevant legal regulations, in particular (but not exclusively): Act no. 513/1991 Coll. of the Commercial Code, as amended, Act no. 40/1964 Coll. Of the Civil Code, as amended, Act no. 431/2002 Coll., On Accounting, as amended, Act no. 222/2004 Coll., On Value Added Tax, etc.

In such case, the provision of personal data is a legal requirement and a failure to provide such personal data would result in the impossibility, or more precisely termination of provision of services through the Platform (Incl. the Mobile App). If the Company processes your personal data for this reason, it needs not to obtain your consent for such processing. On this legal basis, the Company processes your identification and contact information, your Order data, and your User behavior and user access data.

4.6. Processing based on your Consent

The Company sends promotional offers and commercial announcements (newsletter) only to Users that have subscribed to it. If You are interested in subscribing to a newsletter, You need to give your consent – to subscribe to it. When subscribing to the newsletter it is necessary to enter your e-mail address. By subscribing to the newsletter, You agree with processing of the e-mail address for marketing purposes, i.e. for having products and services offered, having commercial information sent, etc. The provision of personal data is voluntary. You can withdraw your newsletter subscription at any time by clicking on the link at the end of each e-mail You receive when You subscribe to the newsletter.

5. Recipient or Categories of Recipients

5.1. All mentioned personal data are processed by the Company – the Controller. This means that the Company determines the purposes defined above for which your personal data are collected, determines the means of the processing and is responsible for their proper execution.

5.2. Authorized employees of the Company have access to the processed data.

5.3. The Company provides the data to the registered Platform Users to each other solely to the extent necessary to mediate the conclusion of an Order for the exchange of TRANSPORT PACKAGING. The Company provides other Users minimal data as for the following extent: name and surname, business name, address/registered office, company reg. number, e-mail address, phone number, address for delivery/handover of TRANSPORT PACKAGING and User’s Driver’s name, surname, vehicle reg. plate number, e-mail and phone number. Provision of other data is possible and depends on the settings that the User has set directly in the Platform.

5.4. Your personal data is also being processed by the Company through Processors who ensure the fulfillment of contractual obligations and provision of services related to the Platform for the Company, Incl. the Mobile App. These persons process personal data for the purposes described in the section “Purpose and legal basis of the processing of personal data”. These Processors are:

• Marketing agency: Mentra Ltd., Pod Rovnicami 51, 841 04 Bratislava, Slovak republic, company reg. no.: 51453959
• Cloud service providers – Amazon Web Services EMEA SARL, 38 AVENUE JOHN F. KENNEDY, L-1855 LUXEMBOURG, VAT LU 26888617, the privacy policy of this company is available here https://aws.amazon.com/privacy/;
• Marketing tools providers – Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043 USA; the privacy policy of this company is available here https://www.linkedin.com/legal/privacy-policy;
• Facebook Inc. Facebook 1 Hacker Way Menlo Park, CA 94025 USA, the privacy policy of this company is available here:https://cs-cz.facebook.com/about/privacy;
• LinkedIn Headquarters 2029 Stierlin Ct. Ste. 200 Mountain View, CA 94043 USA, the privacy policy of this company is available here: https://www.linkedin.com/legal/privacy-policy;

These companies will have access to the necessary personal data but cannot use it for any other purposes and are obliged to process this personal data in accordance with the applicable legislation.

6. Personal Data Source

6.1. Usually, the Company collects personal data directly from You through the Website when You use the Platform functionalities (Incl. the Mobile App), from persons to whom You have granted User Access to your Account or when communicating with You. The Company may also receive some additional data from other Users of the Platform or from Company partners, e.g. banks and suchlike.

6.2. In most cases, the Company processes the data You provide as a part of your signing up to the Platform, creating and using the Account, submitting your Demands, Supplies, Reactions, and creating Orders for the purpose of mediating the TRANSPORT PACKAGING exchange services between the Users. The Company also collects personal data directly from You by monitoring your behavior on the Website and reading messages sent via the contact form, e-mail communication or phone communication.

7. Data Transmission beyond EU Borders

7.1. Your personal data are processed primarily by the Company within the EU member states. Since the level of protection of personal data within EU member states has been synchronized by the adoption of GDPR, your personal data will be adequately protected in the event of such transmission.

7.2. We may also transfer your information to third countries beyond the European Economic Area that do not ensure an adequate level of privacy. If it is necessary to carry out the transfer of personal data to a third country, which is not a country guaranteeing an adequate level of protection, the Company shall ensure that such transfer of personal data is subject to appropriate security measures, such as: in the forms of standard contractual clauses issued by the European Commission which ensure the level of protection of personal data equivalent to EU legislation. The Company does not disclose your personal information.

8. What Rights You have with regard to Personal Data Processing

Regarding your personal data You have the following rights:

8.1. Right to Withdraw Consent to Personal Data Processing

If You grant the Company permission to process certain data, You may withdraw this consent at any time by sending a notice of withdrawal of consent to gdpr@gopall.com or by mail to the current registered office address of the Company, without affecting the lawfulness of the processing based on the consent granted prior to its withdrawal. Withdrawal of the consent shall not affect the Company’s authority to process personal data if this is based on another legal basis than consent to processing.

8.2. Right to Data Access

You have the right to request a confirmation at any time whether your personal data is being processed by the Company and, if so, You have the right to access such data (a copy of your personal data) and information about the conditions of their processing. Basically, You have the right to know what data the Company is processing about you, for what purpose, for what period, where it collects your personal data, to whom it transfers it to, who is processing it besides the Company and what other rights You have according to processing of your personal data. All of this can be found in this “GOPALL Privacy Policy”. However, if You are not sure which personal data is being processed about You, You may request confirmation that the personal data concerning You are or are not being processed by the Company and, if so, You have the right to access these data.

Under the right of access, You may request a copy of the personal data the Company processes, each copy shall be provided to You at a reasonable cost. This information will normally be provided to You by the Company within one month of the date of receipt of such request. The company has the right to use all reasonable measures to verify the identity of the data subject requesting the access.

8.3. Right for Correction

In case of incorrect or incomplete data, You have the right to request a correction or a completion. You can also update your information, which You entered during the registration process, directly in the Platform under the heading “Company Management”. If You have trouble updating your data, please contact the Company using the contact details on the Website.

8.4. Right to Delete

In some cases, You have the right to have your personal data deleted. Your personal data shall be deleted without undue delay by the Company if any of the following reasons are met:

• Your personal data are no longer necessary for the purposes processed by the Company;
• withdrawal of your consent to the personal data processing, which is the data for which your consent is necessary, and at the same time the Company has no other legal reason for the need to continue processing the data;
• the processing of personal data carried out by the Company has ceased to comply with generally binding regulations;
• You object to the processing of personal data, which is carried out on a legal basis of a legitimate interest and no legitimate reasons do outweigh the processing;
• personal data must be deleted in order for the Company to fulfill its legal obligation, unless processing is necessary to fulfill a legal obligation or to establish, exercise or defend legal claims;
• using your right to object (see “Right to Object” below) to processing of your personal data by the Company on the basis of its legitimate interests and the Company will find that there are no such legitimate interests that allow the processing.

Personal data must be deleted in order for the Company to fulfill its legal obligation, unless processing is necessary to fulfill a legal obligation or to establish, exercise or defend legal claims. Please note that even if one of these reasons are met, it does not mean that the Company will immediately delete all your personal data. This right is not permitted if the processing of your personal data remains necessary to fulfill another legal obligation of the Company or to determine, exercise or defend the Company’s legal claims (see the section “Purposes and legal basis of the processing of personal data”).

8.5. Right to Restrict the Processing

In some cases, You may exercise the right to restrict the processing of personal data. This right allows You, in certain cases, to request that your personal data be marked and this data has not been subject to any further processing operations – in this case, yet not forever (as it is in the case of the right to delete), but for a limited period. The Company is obliged to restrict the processing of personal data in the following cases:

• You deny the accuracy of personal data – until the Company and You agree on what data is correct;
• Your personal data are processed by the Company without a sufficient legal basis (e.g. beyond what the Company has to process), but You will only prefer to restrict such data (e.g. if You expect to provide such data to the Company in the future);
• Your personal data is no longer necessary for the purposes of processing, but You require it to determine, exercise or defend your legal claims; or
• You object to the processing of your personal data that is performed on a legal basis of a legitimate interest during verification whether there is a legitimate reason for its further processing. The right to object is described in more detail below under “Right to object“. As long as the Company ascertains whether your objection is justified, the Company is obliged to restrict the processing of your personal data.

8.6. Right to Transfer

The data You have provided to the Company for the purposes of performing the contract or with your consent and are processed by the Company by automated means may be transferred to other organizations on your impulse if it is technically possible. In order for your data to be easily transferred, it may only be data processed automatically by the Company in electronic databases.

8.7. Right to Object

You have the right to object to the processing of your personal data that is performed on a legal basis of a legitimate interest of the Company for reasons relating to your particular situation. In the event of such an objection, the Company will cease the processing of your personal data unless there is a necessary legitimate reason for further processing or reasons to prove, assert or defend legal claims.

8.8. Right for Explanation of an Automated Decision

You have the right to be given an explanation of a decision taken solely on the automated processing of personal data and having legal effects which affect You or have a significant effect on you. You have the right to express your opinion on the decision and consequently (if necessary) the right to object the automated individual decision and, if necessary, to request human intervention from the Company.

8.9. Right to Lodge a Complaint

The exercise of the rights mentioned above shall in no way prejudice your right to lodge a complaint with the competent supervisory authority. You may exercise this right, especially if You believe that your personal data is being processed by the Company improperly or in violation of generally binding legal regulations. You can lodge a complaint against the personal data processing by the Company at the Office for Personal Data Protection of Slovak republic, which is located at Hraničná 12, 820 07 Bratislava 27, Slovakia, e-mail: statny.dozor@pdp.gov.sk.

9. How Particular Rights are Put into Effect

9.1. Regarding the personal data processing, You have the rights mentioned above. These rights can be exercised by sending a request to the e-mail address gdpr@gopall.com.

9.2. Your application will be processed by the Company without undue delay and within a maximum of one month. In exceptional cases, especially due to the complexity of your request, the Company is entitled to extend this period by another two months. The Company will, of course, inform You of any such extension and its justification.

10. Retention Period

10.1. The Company keeps the data You provided to it for the duration of the contract, i.e. contractual relationship between You and the Company.

10.2. You may terminate the data processing at any time by requesting the Company to terminate/cancel your registration and revoke your consent to the processing of your personal data at any time and without giving any reason which will result in the cancellation of your registration in the Platform, i.e. Account and User Access to the Platform (Incl. access to the Mobile App.) and deletion of your personal data.

10.3. The processing of your personal data is terminated even if the contract is terminated unilaterally by withdrawal from the contract or by termination of the contract by the Company in accordance with the GTC, which will result in the cancellation of your registration in the Platform, i.e. Account and User Access to the Platform (Incl. access to the Mobile App) and deletion of your personal data.

10.4. You acknowledge that for any kind of investigation by the competent authorities, the Company shall retain a backup copy of your data in its system for a period of 30 days after the termination of your registration in the Platform. Within the framework of legally prescribed archiving, data shall be stored for a maximum of 10 years, unless a longer archiving period is determined by law.

10.5. The Company shall keep the personal data, the processing of which is necessary for the fulfillment of the legal obligations of the Company, for a period determined by the relevant legal regulations.

11. Data Safety

11.1. To protect your data from unauthorized access or tampering, the Company has taken the necessary technical and organizational measures. These measures include the necessary software and hardware security, including firewall protection and data encryption. These safety measures are regularly adapted and continually optimized to keep up with the latest technological developments.

12. Updates

12.1. The Company periodically reviews and monitors the processing stages and personal data protection processes, and this Privacy Policy may be updated from time to time. If such an update involves significant changes, the Company shall inform You. The current version of the Privacy Policy will always be visible on www.gopall.com.

12.2. This Privacy Policy is valid and in force since 11/25/2019.

12.3. Please note that the Slovak language is the governing language under which the performance of contract and Privacy Policy are executed. This document may be translated to various languages solely for convenience and informative purposes. It cannot be relied upon as an official translation and the decisive version is always the Slovak version. The Company does not provide any guarantee as to the accuracy or completeness of the translation.