Important notice: This English version is a machine-generated translation of legal and contractual text and is provided for information purposes only. In the event of any discrepancy, inconsistency, ambiguity or difference in interpretation between this English version and the original Slovak-language version, the original Slovak-language version shall prevail.

Information on the Processing and Protection of Personal Data

Effective from 13 July 2026

This information is provided in accordance with Articles 12 to 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) and Act No. 18/2018 Coll. on Personal Data Protection.

I. Controller

The controller of personal data is Biofilms rental Slovakia s. r. o., with its registered office at Zámocká 30, 811 01 Bratislava, Slovak Republic, Company ID No.: 54 357 021, Tax ID No.: 2121645614, VAT ID No.: SK2121645614, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No. 158291/B (the “Controller” or “Biofilms”).

Place of business: Račianska 1524/75, 831 02 Bratislava, Slovak Republic

Telephone: +420 777 174 155

Email for enquiries and exercising personal data protection rights: martin@biofilms.cz

Electronic mailbox: E0007317121, URI: ico://sk/54357021

II. Who This Information Applies To and Where We Obtain the Data

This information applies in particular to customers, persons interested in rental or another service, persons authorised to act on behalf of a customer, contact persons and persons taking delivery, guarantors, drivers of rented vehicles, website visitors and persons entering the Controller’s monitored premises (the “data subject”).

We obtain personal data in particular:

• directly from the data subject during registration, placing an order, entering into or performing a contract, personal collection and return of equipment, communication, complaints or handling of an insurance claim or damage event,
• from a customer or ordering party who designates a contact person, person taking delivery, billing contact or another authorised person,
• from publicly available registers and records where verification is necessary for entering into or performing a contract, protecting property or asserting legal claims,
• automatically when using the website, customer account and information systems,
• from the CCTV system in designated monitored premises.

If a customer provides us with the personal data of another person, the customer should do so only to the extent necessary and ensure that they are authorised to provide such data. The Controller will provide the data subject with information under Article 14 GDPR unless one of the statutory exceptions applies.

III. Categories of Personal Data Processed

Depending on the specific service and the status of the data subject, we may process in particular the following categories of personal data:

1. identification data: first name, surname, title, date of birth, permanent or other residential address and signature,
2. contact details: telephone number, email address and correspondence address,
3. business and billing data of a natural person: business name, place of business, Company ID No., Tax ID No., VAT ID No. and details of registration in the relevant register,
4. identity verification data: type, number and validity of an identity document and other data from the document only to the extent necessary for reliable identity verification and protection of the rented property,
5. order and contractual relationship data: customer number, order content and history, rented items, serial numbers, collection and return dates, prices, security deposits, payments, discounts, invoicing, communication, complaints, service records and damage records,
6. payment data: payment status and method, bank details, variable symbol/payment reference and data necessary to match the payment; payment card data is generally processed by the payment service provider,
7. insurance and damage-event data: data necessary for arranging or intermediating insurance, identifying the event, its course, the extent of damage and the insurance benefit,
8. vehicle rental data: driving licence details, entitlement to drive a vehicle, data concerning traffic or insurance incidents, fines and related costs,
9. technical and operational data: IP address, date and time of access, device, browser and operating system data, system and security logs and data stored through cookies or similar technologies,
10. CCTV recordings: visual recordings of a person, the time and place of movement within monitored premises and recordings of events related to the protection of persons or property.

The Controller does not normally process a Slovak birth number. A generally applicable identifier may be processed only where its use is necessary to achieve a specific purpose and the conditions under Section 78(4) of Act No. 18/2018 Coll. are met. The Controller does not normally make copies of identity documents; if a copy were required in a specific case, a separate legal basis would have to exist and the data subject would be informed accordingly.

IV. Purposes and Legal Bases of Processing

We process personal data only for specifically defined purposes and on the basis of at least one legal basis under Article 6 GDPR and Section 13 of Act No. 18/2018 Coll.

1. Pre-contractual Communication, Entering Into and Performance of a Contract

The purpose is customer registration, creation and confirmation of an order, equipment reservation, verification of authorisation to take delivery, handover and return of the rented item, receipt of payment and a security deposit, customer communication, service, complaints and other actions necessary to perform the contract.

Legal basis: Article 6(1)(b) GDPR – performance of a contract or taking steps prior to entering into a contract.

2. Compliance with Legal Obligations

The purpose is, in particular, bookkeeping, issuing and retaining accounting and tax documents, handling statutory consumer rights, providing cooperation to authorised authorities and complying with other obligations under applicable laws.

Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation to which the Controller is subject.

3. Protection of Property, Security and Legal Claims

The purpose is to verify the identity of persons taking delivery of valuable equipment, protect rented property, prevent fraud and misuse of services, secure premises and information systems, record the handover and return of equipment, document damage or missing items, recover receivables, handle damage and insurance events and establish, exercise or defend legal claims.

Legal basis: Article 6(1)(f) GDPR – the legitimate interests of the Controller or a third party, in particular property protection, security, fraud prevention and the protection of legal claims. In connection with such processing, the Controller assesses whether the interests or fundamental rights and freedoms of the data subject override those interests.

4. Insurance of Rented Equipment or a Vehicle

If the customer requests insurance or an insured event occurs, data is processed to provide the requested service, communicate with the insurer or intermediary, settle the insurance claim and protect legal claims.

Legal basis: depending on the specific situation, Article 6(1)(b), (c) or (f) GDPR.

5. Consent of the Data Subject

Where processing cannot be based on a contract, legal obligation or legitimate interest, we process personal data only on the basis of freely given, specific, informed and unambiguous consent, for example in relation to optional analytics or marketing cookies. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

V. Identity Verification

Given the value of the rented equipment, the Controller may, before handing it over, require the presentation of a valid identity document and verify the identity of the renter, contact person or person taking delivery. Only data proportionate to the value and risk of the specific rental is processed.

Presentation of an identity document does not automatically constitute consent to its copying. No copy of the document is made without a separate legal basis. Data that is not necessary for identity verification or the protection of the Controller’s rights is not recorded.

VI. Website, Technical Logs and Cookies

When the website is used, the Controller may process the IP address, access time, device and browser data, system logs and cookies or similar technologies.

Cookies that are strictly necessary for the transmission of communications, security, login, the shopping or ordering process and the provision of a service expressly requested by the user may be used without consent to the extent permitted by Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications.

Optional analytics, functional or marketing cookies are stored or accessed only after the user has given demonstrable consent. Consent may be withdrawn or changed at any time through the cookie settings on the website. Refusing optional cookies does not affect the ability to use the basic functions of the website.

The specific list of cookies used, their providers, purposes and validity periods is displayed in the cookie consent management tool if such cookies are used on the website.

VII. CCTV System

The Controller may monitor designated areas of the place of business, entrances, equipment handover and return areas and other high-risk locations using a CCTV system.

The purpose is to protect the life and health of persons, protect the property of the Controller, customers and third parties, prevent and clarify unlawful conduct, document the handover and return of rented equipment and establish or defend legal claims.

The legal basis is Article 6(1)(f) GDPR – the legitimate interest of the Controller and affected third parties in the protection of persons and property.

CCTV recordings are retained only for the shortest period necessary for the stated purposes, taking into account the configuration of the specific CCTV system and the risk assessment. If a recording captures a security incident, damage event, complaint, dispute or other legally significant event, the relevant part of the recording may be retained until the investigation and settlement of related legal claims are completed. Access to recordings is limited to authorised persons.

VIII. Recipients and Processors

Personal data is not provided to third parties for their own unrestricted purposes. However, to the extent necessary, it may be received or processed in particular by:

• authorised employees and contractors of the Controller,
• providers of web hosting, cloud, email, ordering, warehouse, accounting, security and other information systems,
• accounting, tax, audit, legal and insurance advisers,
• banks, payment service providers and payment gateways,
• insurance companies, insurance intermediaries, service centres and experts in connection with insurance or a damage event,
• carriers, couriers and other suppliers necessary to perform the ordered service,
• entities providing debt recovery and protection of legal claims,
• courts, law enforcement authorities, administrative, tax, supervisory and other public authorities where required or permitted by law.

If a recipient processes personal data on behalf of the Controller as a processor, the Controller uses only processors providing sufficient guarantees of data protection and regulates the processing by a contract or another legal act under Article 28 GDPR. Use of the Controller’s service is not considered consent to the disclosure of data to processors; such processing is based on the relevant legal basis specified in this information.

IX. Transfers of Personal Data Outside the European Economic Area

Some providers of information, cloud, communication or analytics services may also process data outside the European Economic Area. Where such a transfer takes place, the Controller carries it out only in accordance with Chapter V GDPR, in particular on the basis of an adequacy decision of the European Commission or appropriate safeguards such as standard contractual clauses. Information on the specific transfer mechanism and the possibility of obtaining a copy of the safeguards used will be provided by the Controller upon request, where the relevant transfer concerns the data subject.

X. Retention Period for Personal Data

Personal data is retained only for the period necessary for the purpose for which it was obtained or for the period required by law. In particular, the following rules apply:

• contractual, order and customer data for the duration of the contractual relationship and subsequently for the period during which related legal claims may be asserted, demonstrated or defended; if a dispute arises, until its final resolution,
• accounting documents and accounting records for ten years following the year to which they relate, unless the law requires a longer period,
• data required for identity verification and protection of rented property for the duration of the specific rental and subsequently only to the extent necessary to settle obligations, damage or legal claims,
• communications, complaints, insurance claims and damage events for the period required to handle them and subsequently for the applicable period for asserting or defending legal claims,
• security and system logs for a period proportionate to the purpose of protection and investigation of security events,
• CCTV recordings according to the criteria set out in Article VII of this information,
• data processed on the basis of consent until consent is withdrawn or the purpose ceases to exist, whichever occurs first,
• cookies for the period specified in the cookie management tool or until consent is withdrawn where consent is the legal basis.

After expiry of the relevant period, personal data is securely deleted, anonymised or its further processing is restricted if continued retention is required by law.

XI. Obligation to Provide Personal Data

Providing data necessary to enter into and perform a contract or comply with a legal obligation is a contractual or statutory requirement. Without such data, it may not be possible to create a customer account, confirm an order, reliably verify the person taking delivery of equipment, hand over the rented item, issue an accounting document, arrange insurance or handle a complaint or damage event.

Providing data processed solely on the basis of consent is voluntary. Refusal to give or withdrawal of such consent must not adversely affect performance of the contract unless the relevant processing is objectively necessary for the requested service.

XII. Rights of the Data Subject

Subject to the conditions laid down in the GDPR, the data subject has in particular:

• the right to obtain confirmation as to whether their personal data is being processed and the right to access such data and obtain a copy,
• the right to rectification of inaccurate personal data and completion of incomplete personal data,
• the right to erasure of personal data where the statutory conditions are met,
• the right to restriction of processing,
• the right to data portability where processing is based on consent or a contract and is carried out by automated means,
• the right to withdraw consent at any time where processing is based on consent,
• the right to lodge a complaint with the supervisory authority or submit a petition to initiate personal data protection proceedings,
• the right to an effective judicial remedy.

Right to object: The data subject has the right, on grounds relating to their particular situation, to object to the processing of personal data based on Article 6(1)(f) GDPR. In such a case, the Controller will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims.

Individual rights are not absolute and may be exercised only where the conditions laid down by the GDPR are met. For example, the right to erasure does not apply to data that the Controller must retain in order to comply with a legal obligation or protect legal claims.

XIII. How to Exercise Rights and Response Period

The data subject may exercise their rights:

• by email at martin@biofilms.cz,
• in writing at the Controller’s registered office: Biofilms rental Slovakia s. r. o., Zámocká 30, 811 01 Bratislava,
• in person at the place of business at Račianska 1524/75, 831 02 Bratislava,
• through the Controller’s electronic mailbox.

The request must make it possible to reliably determine who is exercising the right and what is being requested. If the Controller has reasonable doubts concerning the identity of the applicant, it may request additional information necessary to confirm their identity. Additional data must not be requested to a greater extent than is necessary for verification.

The Controller will provide information on action taken without undue delay and no later than one month after receipt of the request. Taking into account the complexity and number of requests, this period may be extended by a further two months. The data subject will be informed of the extension and the reasons for it within one month after receipt of the request.

Information and action are generally provided free of charge. If a request is manifestly unfounded or excessive, in particular because of its repetitive character, the Controller may, subject to the conditions of the GDPR, charge a reasonable fee or refuse to act on the request.

XIV. Supervisory Authority

If the data subject believes that the processing of their personal data has infringed the GDPR or Act No. 18/2018 Coll., they have the right to contact:

Office for Personal Data Protection of the Slovak Republic
website: https://dataprotection.gov.sk/uoou/sk

The right to contact the Controller, the supervisory authority or a court may be exercised independently within the scope laid down by law.

XV. Automated Decision-Making and Profiling

The Controller does not carry out decision-making based solely on automated processing, including profiling, which would produce legal effects concerning the data subject or similarly significantly affect them.

XVI. Security of Personal Data

Personal data is processed electronically and in paper form. The Controller implements appropriate technical and organisational measures to protect the data against unauthorised access, misuse, loss, damage, destruction or unauthorised disclosure. Access is limited to persons who need the data to perform their employment or contractual duties and who are bound by confidentiality.

XVII. Final Provisions

If the Controller begins processing personal data for a new purpose that is not compatible with the original purpose, it will provide the data subject with the relevant information before commencing such processing and ensure that the necessary legal basis exists.

The Controller may update this information in particular following changes in legislation, systems used or processing methods. The version effective at the time the processing is carried out will apply to the relevant processing. The current version will be available on the Controller’s website.

This information takes effect on 13 July 2026.

In Bratislava on 13 July 2026