Privacy policy
This policy explains what personal data we, as the operator of the dreamrental.eu website and car rental company, process about you, why and on what legal basis, to whom we disclose it, how long we retain it, and what rights you have.
Effective from 25 August 2026
1. Who is the controller of your data
The controller of personal data is ADDICTESTATE GROUP s.r.o., Kladenská 542/38, Vokovice, 160 00 Prague 6, Company ID No. 19254598, registered in the Commercial Register kept by the Municipal Court in Prague, file no. C 383761.
On matters of personal data protection you can contact us at info@dreamrental.eu or in writing at our registered office address. Please use this contact also to exercise any of your rights described in Article 10.
The law does not require us to appoint a data protection officer and we have not appointed one.
2. Purposes of processing and legal bases
We process your data only for specific purposes and always on the basis of a corresponding legal basis under Article 6 of the GDPR:
| Purpose | Legal basis |
|---|---|
| Handling a non-binding reservation enquiry from the website and contacting the interested party | steps taken prior to entering into a contract at the data subject’s request (Art. 6(1)(b)) |
| Conclusion and performance of the vehicle rental agreement, handover and return of the vehicle, settlement | performance of a contract (Art. 6(1)(b)) |
| Ordering and issuing a gift voucher | performance of a contract (Art. 6(1)(b)) |
| Replying to an enquiry sent via the contact form | consent (Art. 6(1)(a)) |
| Sending commercial communications (the “Klub DREAMRENTAL” newsletter) | consent (Art. 6(1)(a)) |
| Issuing invoices and keeping accounts | compliance with a legal obligation (Art. 6(1)(c)) |
| Handling and any re-invoicing of fines and traffic offences connected with the rental | legitimate interest — enforcement of claims under the contract (Art. 6(1)(f)) |
| Protection of property and locating the vehicle by GPS (see Article 7) | legitimate interest (Art. 6(1)(f)) |
| Verifying the client’s reliability (checking the Insolvency Register before concluding the contract) | legitimate interest — risk prevention (Art. 6(1)(f)) |
| Advertising measurement and marketing via cookies (see Article 4) | consent (Art. 6(1)(a)) |
| Publication of customer reviews (see Article 8) | legitimate interest — presentation of service ratings (Art. 6(1)(f)) |
For processing based on legitimate interest you have the right to object (Article 10). For processing based on consent you may withdraw your consent at any time, without this affecting the lawfulness of processing carried out before the withdrawal.
3. What data we process
Data from website forms
The dreamrental.eu website is a static page that does not itself store any data — completed forms are sent in encrypted form (HTTPS) to our internal system, where they are handled by our team. Depending on the particular form, we process:
- Reservation enquiry: e-mail, telephone, parameters of the requested rental (vehicle, dates, duration, mileage), and in the case of delivery outside Prague the delivery address and an optional note.
- Contact form: name, e-mail and the text of the message.
- Gift voucher order: first name and surname, e-mail, telephone, method of delivery, and optionally the text of the dedication.
- Newsletter: e-mail address and information about where the sign-up took place.
Data on third parties. If you include in a voucher order a dedication containing the name of the recipient, we process this data as well, solely for the purpose of issuing the voucher. The person placing the order is responsible for providing this data and for informing the recipient.
Car rental clients’ data
When concluding a rental agreement, we process the following to the extent necessary for renting the vehicle:
- identification and contact details (name, address, telephone, e-mail),
- for natural persons the birth number, ID card or passport number and driving licence number, including scans thereof,
- for self-employed persons and companies the Company ID No., VAT No. and details of representatives (name, e-mail, telephone),
- contractual and payment data, the amount of the security deposit, the odometer reading, settlement (damage, fines, late return) and photo documentation of the vehicle on handover and return,
- the result of the check in the Insolvency Register.
Providing this data is a contractual requirement necessary for concluding and performing the rental agreement; without it the vehicle cannot be rented.
Payment data
You pay the rent and the security deposit by bank transfer, by payment card via the terminal at our branch, or in cash. We do not use a payment gateway on the website. We therefore process only billing and payment data (data from the invoice, account number). The bank operating the payment terminal acts as a separate controller.
4. Cookies and traffic measurement
The website uses a consent banner with equally weighted Accept and Reject buttons. We store your choice in your browser and it applies until you change it. No marketing cookies are stored until consent is granted.
| Tool | Purpose | When it is activated |
|---|---|---|
| Essential items | remembering the consent choice and the closing of the newsletter window | always — the website will not work without them, consent is not required |
| Plausible Analytics | anonymous traffic statistics without cookies | always; does not process personal data |
| Google Ads, Google Tag Manager | conversion measurement and remarketing | advertising cookies only after your consent (Consent Mode v2) |
| Meta Pixel | measuring advertising effectiveness | the script is downloaded only after your consent |
You can change or withdraw your cookie consent at any time via the Cookie settings link in the website footer. The legal framework is Section 89 of Act No. 127/2005 Coll., on Electronic Communications, in conjunction with the GDPR.
5. Who we pass your data to
We do not pass your data to anyone not listed here. We work with carefully selected processors who process the data only according to our instructions and on the basis of a data processing agreement:
| Recipient | Role |
|---|---|
| Contabo GmbH (Germany) | operation of the server on which our internal system and database run |
| 200solutions s.r.o. | hosting of the dreamrental.eu website |
| Signi (Digital Solutions s.r.o.) | electronic signing of contracts, protocols and amendments |
| iDoklad (Solitea / Seyfor) | issuing invoices |
| Seznam.cz, a.s. | operation of company e-mail boxes and mail delivery |
| Anthropic (USA) | automated extraction of data from PDF notices to pay fines |
| Mapbox Inc. (USA) | address autocomplete and distance calculation for delivery outside Prague |
| Google Ireland Ltd., Meta Platforms Ireland Ltd. | advertising measurement — only after cookie consent is granted |
| Plausible Analytics (EU) | anonymous traffic statistics |
| Tango, spol. s r.o.; Commander Services s.r.o. | locator units in the vehicles (see Article 7) |
We may also pass your data to public authorities where required by law (e.g. when handling fines and traffic offences), and to our legal or tax advisors to the extent necessary. We never sell personal data.
6. Transfers to countries outside the EU
Most of the processors are based in the Czech Republic or in the EU. Some recipients (Anthropic, Mapbox and, where consent has been granted, also Google and Meta) process data in the United States. Transfers to the USA are secured by appropriate safeguards under the GDPR — in particular the European Commission’s standard contractual clauses, or certification under the EU–US Data Privacy Framework. We will provide you with a copy of the safeguards on request.
7. Vehicle location tracking
The rented vehicles are equipped with locator (GPS) units. We do not track the vehicle’s location on an ongoing basis — we access the system only exceptionally and on a one-off basis, namely where theft of the vehicle is suspected, where it is not returned by the agreed date, or in a dispute over the mileage driven or travel abroad. You are informed of the presence of GPS in the rental agreement.
Through this processing we pursue our legitimate interest in protecting high-value property, locating the vehicle and proving a breach of contract. You have the right to object to this processing (Article 10).
8. Published reviews
On the website we display selected public reviews from our Google profile, including the reviewer’s name, rating, review text and profile photograph. The source is the reviewer’s public Google profile; Google’s terms require the author to be identified. The legal basis is our legitimate interest in presenting ratings of our services. If you are the author of a review and do not wish it to be displayed on our website, let us know and we will remove it.
9. How long we retain the data
We retain personal data only for as long as is necessary for the given purpose, or for the period laid down by law:
| Data | Retention period |
|---|---|
| Contracts, handover protocols, invoices and tax documents | 10 years from the end of the tax period (Accounting Act and VAT Act) |
| Scans of ID card, passport and driving licence | no more than 3 months from the return of the vehicle and settlement of the security deposit |
| Birth number | for the duration of the contractual relationship |
| Data on fines and traffic offences | 3 years from payment or re-invoicing |
| Reservation enquiries without a concluded contract | 12 months |
| Messages from the contact form | 6 months |
| Newsletter | until consent is withdrawn; after unsubscribing we retain the e-mail address and time of unsubscribing for 3 years as evidence |
| Photo documentation of the vehicle from handover and return | 2 years |
| Vehicle location records (GPS) | according to the settings of the unit providers |
After erasure, your data may still persist for a limited time (no more than 14 days) in security backups, from which it is subsequently removed.
10. Your rights
In relation to your personal data you have the following rights under the GDPR:
- Right of access — to find out what data we process about you and to obtain a copy of it.
- Right to rectification of inaccurate or incomplete data.
- Right to erasure (the “right to be forgotten”) in the cases laid down by law.
- Right to restriction of processing.
- Right to data portability for data processed on the basis of consent or a contract.
- Right to object to processing based on legitimate interest, including profiling.
- Right to withdraw consent at any time, without affecting the lawfulness of earlier processing.
- Right to lodge a complaint with a supervisory authority.
You can exercise your rights at info@dreamrental.eu or in writing at our registered office address. We will handle them without undue delay, at the latest within one month.
The supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz, with which you may lodge a complaint if you believe that our processing of your data breaches legal regulations.
11. Data security
We adopt technical and organisational measures to protect your data against unauthorised access, loss or misuse:
- all data transmission takes place exclusively in encrypted form via HTTPS,
- the internal system can be accessed by invitation only, with roles and graded permissions and an audit log of actions,
- the data of individual agendas is separated within the database and the server access key is stored exclusively on the server,
- we sign contracts and protocols electronically with a traceable audit trail,
- the server is operated in a data centre in Germany (EU).
12. Final provisions
We may update these principles from time to time — for example when processing changes, when new tools are deployed, or when the legislation changes. The current wording is always available on this page; in the case of substantial changes we will inform you in an appropriate manner. These principles take effect on the date stated in the header.
Should you have any questions regarding personal data protection, please contact us at info@dreamrental.eu.
