Avokado Parking
Park & Fly Parking
Bratislava Airport

PRIVACY POLICY
Avokado Parking
Ivanská cesta 28, Bratislava

PAAS s.r.o., with its registered office at Primaciálne nám. 1, 811 01 Bratislava – Staré Mesto, Company ID: 35738880, as the operator of the website https://avokadoparking.sk/ (the “controller”), has adopted appropriate technical and organisational measures to protect your personal data. Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), as well as Act No. 18/2018 Coll. on the Protection of Personal Data, impose on the controller a duty of transparency when processing your personal data. In connection with its activities the controller processes personal data for various purposes, which are described in more detail below.

Contact details of the controller:

PAAS s.r.o.

Primaciálne nám. 1, 811 01 Bratislava – Staré Mesto

Company ID: 35738880

Contact e-mail: rezervacia@avokadoparking.sk

Contact details of the Data Protection Officer:

Data Protection Officer: Top privacy, s.r.o.

Contact person: Nikoleta Ducárová, LL.M.

E-mail: zodpovednaosoba@topprivacy.sk or nikoletaducarova@topprivacy.sk

Tel.: +421 905 503 074

For the Avokado Parking project (parking near Bratislava Airport), the controller processes the personal data of customers who book parking with us or contact us, within the following information systems:

Accounting documents

We process your personal data for the purpose of processing accounting documents of data subjects when entering into and performing pre-contractual and contractual relationships. We process the personal data you provide to the following extent: the name and surname of the taxable person or the name of the taxable person, the address of its registered office, place of business, establishment, residence or the address of the place where it usually resides, and its tax identification number under which it supplied the goods or service; or the name and surname of the recipient of the goods or service or the name of the recipient of the goods or service, the address of its registered office, place of business, establishment, residence or the address of the place where it usually resides, and its tax identification number under which the goods or service were supplied to it; and the bank account number of the natural person. The processing is carried out on the basis of a legal obligation pursuant to Article 6(1)(c) GDPR, arising from Act No. 431/2002 Coll. on Accounting as amended, Act No. 222/2004 Coll. on Value Added Tax, Act No. 40/1964 Coll. the Civil Code, and Act No. 513/1991 Coll. the Commercial Code. Data subjects are persons who have incurred an obligation to pay for the service or goods supplied. The retention period for personal data required for accounting purposes is 10 years.

For processing its accounting agenda, the controller uses the services of a processor, an external accounting firm, pursuant to Article 28 GDPR.

Parking reservation

The Avokado Parking project provides secure parking with a simple online reservation made through the website, where you select a date, complete a form and pay for the selected services. In providing this service we process your personal data for the purpose of creating and managing the parking reservation, which then allows you to enter and exit the car park, and for the necessary communication relating to the reservation (such as receiving e-mail instructions, including time reminders). The processing of your personal data is necessary for the performance of a contract pursuant to Article 6(1)(b) GDPR. Your data is processed to the following extent: name, surname, e-mail, telephone number, journey details (number of persons – children, adults; number of vehicles; vehicle licence plate number), reservation details (date and time of arrival, date and time of departure, selected tariff, reservation number and other necessary data relating to the reservation itself), and payment information.

Retention of personal data:

• Operational/reservation data (name, contact details, licence plate number, times, tariff and number of persons) is processed for 3 years from the end of the service provided (from exit), corresponding to the general limitation period under the Civil Code;
• Payment/invoicing data is processed for 10 years from the end of the accounting period in which the payment was made, in accordance with the Accounting Act.

To manage parking reservations we use the system of an external provider, which processes reservation data on our behalf as a processor (name, contact details, vehicle licence plate number, arrival/departure time, payment and invoicing data), on the basis of our documented instructions and a data processing agreement pursuant to Article 28 GDPR.

To process payments for the services provided we use the services of an external payment gateway, which acts as an independent controller in relation to your payment data. As part of authorising and processing the payment it processes payment data (e.g. the amount, currency, order number and the data needed to authorise the payment with your bank or card company). You enter your payment card number directly in the secure interface of the payment gateway – we neither store it nor have access to it. The legal basis for providing your data to the company whose services we use is the performance of a contract with you pursuant to Article 6(1)(b) GDPR – without this step the payment for the order cannot be completed.

Contracted travel agencies

You can also create a parking reservation through our contractual partners in the travel industry – either directly on our website after being redirected from theirs, or through our reservation widget implemented directly on their website. In both cases we process your data as the controller from the moment it is entered, in the same way as for a reservation made directly with us.

We subsequently provide our contractual partners in the travel industry with a summary overview of orders placed through them, including the name, surname, vehicle licence plate number and amount, for the purpose of verifying the orders placed within our partnership relationship and as supporting documentation for their own accounting.

The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR, based on the proper settlement and verification of performance of the partnership relationship with our contractual partners.

Operation of the parking system and the barrier

The controller processes personal data for the purpose of operating the parking system and the barrier, which consists of the technical connection between the reservation and the barrier system, the verification of authorised entry, and the record of vehicle entries and exits. The personal data we process about you is necessary for the performance of a contract pursuant to Article 6(1)(b) GDPR, since the physical entry and exit of vehicles is the direct fulfilment of what the customer paid for when making the reservation – a reservation without a functioning link to the barrier would be worthless. Verifying authorised entry (confirming that a vehicle with a given licence plate number holds a valid reservation) is necessary in order for us to be able to provide the service we contractually promised at all. In the case of verifying authorised entry to the car park, our purpose partially extends beyond “mere” performance of a contract towards a specific customer, since it also concerns protecting the car park from unauthorised entry by vehicles without a reservation (i.e. third parties with whom no contractual relationship has arisen at all). This points rather towards the controller's legitimate interest in protecting property and the safety of the operation than towards the performance of a contract with a specific data subject, since no contract exists in the case of a person without a reservation. In such a case we process personal data pursuant to Article 6(1)(f) GDPR.

To ensure entry, exit and the record of parking we use the technology of an external company, which processes on our behalf, as a processor, the data required to manage entry/exit and to record parking (e.g. the vehicle licence plate number, time of entry/exit).

CCTV system

CCTV surveillance of the car park

The Avokado Parking car park at Ivanská cesta 28, 821 04 Bratislava is monitored by a CCTV system, which involves the processing of your personal data. We process your personal data for the purpose of protecting property, ensuring safety and proper operation, preventing vandalism, and obtaining evidence for the purpose of defence in protecting the controller's property and other civil-law claims. We process your personal data to the extent of your likeness and the vehicle licence plate number on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR. Our legitimate interest is the making of video recordings for the purpose of protecting property, ensuring safety and proper operation, preventing vandalism, and obtaining evidence for the purpose of defence in protecting the controller's property and other civil-law claims.

The car park premises are under continuous CCTV surveillance (24/7) and the recording from the CCTV system is retained for 14 days (in order to allow verification and the possible reporting of a damage incident after the vehicle owner returns). In the event of an incident and the need to produce a recording to the competent public authorities, the controller may limit the purpose to the period necessary to fulfil that purpose (e.g. settling an insurance claim, concluding court proceedings, etc.).

Areas subject to monitoring by the controller are duly marked before entry into the monitored area.

CCTV system at entry and exit

A camera is installed at the entry to and exit from the car park which automatically recognises the vehicle licence plate number as the vehicle passes and compares it with a valid reservation. This process also includes storing a photograph of the vehicle together with the recognised licence plate number and the time data of the entry/exit. Since the camera captures the entire vehicle, the driver or passengers may also be visible in the photograph behind the windscreen, which constitutes processing of your personal data. The camera does not perform facial recognition or any other biometric identification of persons – it serves solely to verify authorised entry on the basis of the licence plate number. The legal basis for this processing is the performance of a contract pursuant to Article 6(1)(b) GDPR in relation to vehicles with a valid reservation, and the controller's legitimate interest in protecting property and preventing unauthorised entry pursuant to Article 6(1)(f) GDPR in relation to vehicles without a reservation.

We retain the records for 30 days (taking into account the time needed to resolve ordinary disputes relating to entry/exit). The controller may, however, limit the purpose to the period necessary to fulfil that purpose. This means that the retention of a recording may be extended where necessary, exclusively in relation to a specific incident or situation that arises on site (e.g. complaints, suspected misuse, etc.).

For the operation of the CCTV/entry system we use the services of processors.

Provision of airport transfers

As part of the Avokado Parking project we also provide a passenger transfer service to the airport. To provide the transfer we use the services of external companies, to which we submit, on the customer's behalf, the name, surname and telephone number needed to order the ride. These external companies act as independent controllers of personal data when providing the selected services.

The legal basis for providing/transferring your data to the external companies is the performance of a contract pursuant to Article 6(1)(b) GDPR – providing the ordered transfer is part of the agreed service.

Enquiries and communication with customers

We process your personal data for the purpose of responding to your questions, complaints or enquiries sent to our contact e-mail address, as well as for the purpose of effective communication with customers. We process the personal data you provide, to the extent of your name, surname and e-mail address, on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR, our legitimate interest being to contact you back in order to respond to your questions, complaints or enquiries, as well as effective communication with customers.

We process the personal data you provide for the period necessary to fulfil the purpose, but for no longer than 3 months. However, where the message contains data subject to a different retention period (e.g. of an accounting nature, where the retention period is 10 years, and others), the period required by law will apply to that data.

Marketing

We process your personal data for the purpose of sending information about changes to our operations, news, discounts and promotions of Avokado Parking (the “newsletter”).

You can subscribe to the newsletter separately by entering your e-mail address through our website. In that case we will process your personal data to the extent of your e-mail address on the basis of the consent you have given pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time via the link in the footer of the newsletter e-mail. If you do not withdraw your consent, we will process the personal data you have provided for a maximum of 5 years from the date consent was given. After consent is withdrawn, the consent record is archived for 4 years (pursuant to Act No. 452/2021 Coll. on Electronic Communications).

If you have previously been in a pre-contractual or contractual relationship with us, or are already our client, we will contact you with current news – newsletters – without your consent, since the processing of personal data for this purpose takes place on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR. Our legitimate interest is the promotion of our products and services, and for this purpose we use the personal data you provided to us as our client or interested party when previously using our services. You may object to this processing at any time. We process your data for a maximum of 1 year from the end of our contractual relationship.

This processing does not involve automated individual decision-making, including profiling.

Improving and targeting advertising using customer data

Within the operation of the Avokado Parking project and its website we use the following functions in order to improve the efficiency and accuracy of our advertising on the platforms we have selected:

a) Creating target audiences (Customer Match / Custom Audiences)

We upload part of your contact data (e-mail address, telephone number) in hashed (one-way encrypted) form to external companies (the platforms we have selected), which compare it with their own users in order to show you – as an existing customer – relevant advertising for our services. Hashing does not constitute anonymisation of the data – this means that the platforms we have selected are able, by comparing the hash, to match the data to a specific user profile.

The legal basis for such processing of your personal data is our legitimate interest pursuant to Article 6(1)(f) GDPR, based on approaching existing customers with a similar offer. You may object to this processing at any time.

b) More accurate attribution of conversions (Enhanced Conversions / Advanced Matching)

When your reservation/purchase is completed, we send hashed contact data directly relating to that transaction to external companies (the platforms we have selected), so that we can more accurately evaluate the effectiveness of our advertising (e.g. whether a particular advertising campaign led to a reservation).

The legal basis for such processing of your personal data is our legitimate interest pursuant to Article 6(1)(f) GDPR, based on measuring the effectiveness of advertising.

You may object at any time, without giving a reason, to the processing of your data for direct marketing purposes under points (a) and (b), at the e-mail address: rezervacia@avokadoparking.sk. In that case we will no longer use your data for these purposes.

Cookies

The controller uses the following categories of cookies on its website:

• necessary cookies, for the purpose of providing services in connection with operating the website in its essential mode;
• analytical cookies, for the purpose of determining the number of visits and traffic sources – measuring and improving the performance of the website;
• marketing cookies, for the purpose of displaying targeted advertising on websites as well as evaluating the effectiveness of advertising and tracking the number of users who were interested in the advertising.

*consent is always voluntary and unconditional, meaning that even if the data subject does not give it, they may still visit and use the websites, online services and products to the extent that cookies are not required for their functionality and accessibility. Disabling or restricting the use of cookies may affect the functionality and accessibility of the controller's pages and services, and it may happen that all or some of the services will not be fully functional or accessible.

Necessary cookies are temporary and are deleted automatically when the internet browser is closed. We classify other types of cookies as persistent; they remain on your device until they expire, but for no longer than 13 months, or until you delete them yourself. As a visitor to the website you may delete cookies at any time, regardless of whether they are persistent or temporary.

The controller uses third-party services on its websites, such as Google Analytics systems or marketing tools of the Meta company. In order to use these services the controller loads third-party code which, for full functionality, may require the storage of cookies. This results in cookies being accepted from third parties. If you accept the use of cookies relating to third parties, your data may be transferred to countries located outside the EEA (e.g. the USA, China).

Notice:

pursuant to Article 49(1)(a) GDPR, regarding the transfer of personal data to third parties which are likely not to provide the level of personal data protection that is standard in EEA countries:

Giving consent to the provision or disclosure of personal data through social networks and other means of communication whose operators are established outside the EEA (countries with no adequacy decision and without appropriate safeguards – “countries not considered safe in the field of the protection and processing of personal data”) carries risks such as:

• loss of control over the personal data transferred,
• loss of privacy,
• lack of knowledge about the onward transfer of the personal data provided to further entities,
• failure to provide further information about the purposes for which the personal data will be further processed,
• misuse and identity theft,
• provision of the personal data obtained to security agencies and secret services (e.g. the Russian Federation, the USA, China),
• the inability to exercise data subject rights in the form guaranteed by the European GDPR on the part of a controller established in a third country.

This processing does not involve automated individual decision-making, including profiling.

General and additional information on the processing of personal data by the controller

Technical and organisational measures:

Organisational and technical measures for the protection of personal data are set out in the controller's internal regulations. Security measures are implemented in the areas of physical and site security, information security, cryptographic protection of information, personnel and administrative security, and the protection of sensitive information, with precisely defined powers and duties set out in the security policy.

Categories of personal data:

For the purposes mentioned above, we process ordinary personal data.

Disclosure of personal data:

Personal data is not disclosed within any of the purposes mentioned above.

Automated processing including profiling:

Within the processing of personal data, the controller does not use automated decision-making or profiling.

Rights of data subjects:

A data subject has the right to request access from the controller to the personal data processed about them, the right to rectification of personal data, the right to erasure or restriction of processing of personal data, the right to object to the processing of personal data, the right not to be subject to automated individual decision-making including profiling, the right to data portability, as well as the right to lodge a complaint with the supervisory authority. Where the controller processes personal data on the basis of the data subject's consent, the data subject has the right to withdraw that consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. A data subject may exercise their rights by sending an e-mail to the controller's address, or in writing to the controller's address. The handling of data subject rights is carried out individually through a person designated by the controller.

As a data subject you may exercise the right to lodge a complaint with the supervisory authority if you believe that your rights relating to personal data have been infringed. The supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava.

Recipients of personal data and other authorised entities:

This Privacy Policy is effective from 9 September 2026. The current list of our suppliers is available here. In the event of any discrepancy between the Slovak and English versions, the Slovak version prevails.