Privacy Policy
1. Introduction
1.1 NOMAD enroute s.r.o., Company ID (IČO): 09095471, with its registered office at Třebízského 407/20, Pražské Předměstí, 397 01 Písek, Czech Republic, registered in the Commercial Register kept by the Regional Court in České Budějovice, Section C, Insert 29841 (the “controller”), as a personal data controller fully respects the right to privacy of its clients (the “data subjects”) and the related rights, and has therefore adopted this privacy policy.
1.2 This policy informs the controller’s clients about how and to what extent the controller processes personal data, including the rights of data subjects related to the processing of their personal data by the controller.
1.3 The controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as amended (the “Regulation”), and with the relevant national data protection legislation.
2. Personal data we process
2.1 The controller processes in particular, but not exclusively, the following personal data:
identification and address data (first name, surname, date of birth, birth number, permanent or other residential address; for sole traders also the business name, VAT number, company ID, registered office and place of business),
contact data (contact or billing address provided by the client, telephone or fax number, e-mail address, or other contact details provided by the client),
other personal data (e.g. socio-demographic data, data on personal preferences and behaviour, or location data including IP or URL addresses).
2.2 The controller does not process special categories of personal data (i.e. sensitive data).
2.3 The controller processes personal data only for the purposes set out below, to the extent and for the time necessary to fulfil those purposes.
3. Purposes and legal bases of processing
3.1 The controller processes clients’ personal data in particular, but not exclusively, for the following purposes:
- Delivery and provision of the ordered service
In this case, processing is necessary for negotiating the conclusion or amendment of a contract to which the data subject is a party, for the subsequent performance of that contract and for invoicing the services provided.
When an order is created, the controller collects and processes the data subject’s first name, surname, address, date of birth, telephone number and e-mail address. Providing these data is a prerequisite for concluding or amending the contract; they serve primarily to identify the data subject unambiguously and, where needed, to contact them.
In connection with its services, the controller may also process the data subject’s personal data to the extent arising from the specific contract or from the law (e.g. profile data where an order needs to be personalised), when administering and creating accounts on the website, using web applications, etc. - Protection of the controller’s rights in a dispute with a client
The controller may also process the personal data listed above to protect its rights in the event of a dispute with a client. - Recording business opportunities and business communication
The controller further processes the personal data listed above when creating and recording business opportunities and for business communication. - Client identification
In this case, the controller processes the first name, surname, permanent or other residence, birth number or date of birth, type and number of the identity document, the issuing state or authority and its validity. This is necessary to comply with the controller’s legal obligation for cash payments above the limit set by Act No. 253/2008 Coll., on certain measures against the legalisation of proceeds of crime and terrorist financing, as amended. - Sending commercial communications
These are offers of the controller’s products and services and information about marketing or other events, sent electronically within the meaning of Act No. 480/2004 Coll., on certain information society services, as amended.
In this case, the controller collects and processes the data subject’s first name, surname, date of birth, address, telephone number, e-mail address and nationality, only on the basis of freely given consent. The data subject may withdraw this consent at any time by written notice delivered to the controller using the contact details below. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal, nor processing that the controller carries out on another legal basis (e.g. performance of a contract or a legal obligation).
4. Security of and access to personal data
4.1 The controller uses all necessary technical and organisational measures to ensure the security and confidentiality of all personal data of data subjects, in particular to prevent unauthorised or accidental access to the data, their alteration, destruction or loss, unauthorised disclosure or transfer, or any other unauthorised processing or misuse.
4.2 To fulfil the purposes described above, personal data may be processed not only by the controller and its authorised employees but also by the controller’s business partners. The controller carefully selects external partners who may process personal data as processors, and entrusts personal data only to those who provide sufficient guarantees of appropriate technical and organisational measures to keep personal data secure.
4.3 Other parties that have or may in future have access to clients’ personal data include in particular, but not exclusively:
- persons who provide the technical operation of a service for the controller, or operators of technologies the controller uses for these services;
- persons to whom the controller provides data for the analysis and measurement of sales activities;
- persons who provide the controller with services related to its products and services or to sending commercial communications;
- business partners involved in organising the controller’s social and marketing events;
- law firms for the purpose of recovering the controller’s receivables.
4.4 The controller is also obliged to disclose certain personal data on the basis of applicable law, in particular to public authorities, courts and law enforcement authorities in connection with administrative, criminal or civil proceedings.
5. Retention period
5.1 The controller processes personal data for the duration of the contractual relationship and thereafter for the period strictly necessary to secure the mutual rights and obligations arising from the contract.
5.2 Where processing is necessary to comply with legal obligations, the controller processes personal data for the period required by the relevant legislation.
5.3 Where the controller processes personal data on the basis of the data subject’s consent, the data are processed for the period stated in the consent or until the consent is withdrawn.
6. Rights of data subjects
6.1 With regard to personal data, the data subject has the following rights:
- the right to withdraw consent to processing at any time (where processing is based on consent);
- the right of access (to obtain confirmation as to whether the controller processes personal data concerning the data subject and, if so, to access those data and further information under Article 15 of the Regulation);
- the right to data portability (to receive the personal data concerning the data subject in a structured, commonly used and machine-readable format and to transmit them to another controller, or to have them transmitted directly from one controller to another where technically feasible);
- the right to rectification (to have the controller correct inaccurate personal data concerning the data subject without undue delay);
- the right to restriction of processing (to have the controller restrict processing, e.g. while it verifies the accuracy of the data following a request for rectification, or where the data would be processed unlawfully but the data subject does not want them erased);
- the right to erasure (to have the controller erase the data subject’s personal data without undue delay, e.g. where the data are no longer necessary for the purposes for which they were collected, where the data subject has withdrawn the consent on which processing was based and there is no other legal ground, or where the data would be processed unlawfully);
- the right to object to processing;
- the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).
7. Cookies and Google Analytics
7.1 The website uses cookies. Necessary cookies remember the choice you made in the cookie bar, so the website doesn’t keep asking. They are kept for six months.
7.2 We use Google Analytics only with your consent, which you give in the cookie bar. It shows us how many people visit the website, where they came from and what interests them, so we can improve the website. It doesn’t tell us who you are. The data are processed by Google Ireland Limited and kept for 14 months. Without your consent, Google Analytics doesn’t load at all.
7.3 You can change or withdraw your consent at any time via the “Cookie settings” link in the website footer. Once you withdraw it, the Google Analytics cookies are deleted from your browser.
7.4 The map on the Contacts page loads from Google Maps only after you click “Load map”. Only then does Google receive your IP address.
8. How to contact the controller
8.1 If you have any questions about the processing of personal data or wish to exercise the rights above, you can contact the controller in writing at its registered office, by e-mail at toyotahandel@gmail.com or by phone at +420 774 718 101.
9. Final provisions
9.1 Rights and obligations not covered by this policy are governed by the Regulation and the relevant national data protection legislation.
9.2 This policy is publicly available on the website www.nomadenroute.eu. Data subjects are made aware of it when concluding a contract or receiving a service.
9.3 The controller reserves the right to amend this policy. The updated version is always published on www.nomadenroute.eu together with the date it takes effect.
9.4 This policy takes effect on 11 October 2026. It is a translation of the Czech version; in case of any discrepancy, the Czech version prevails.