Privacy Policy

1. Data Controller

The controller responsible for the processing of your personal data is Nelio Tours, operated by Jelio Krassimirov Pentchev (živnostník), registered in the Czech Republic. The controller determines the purposes and means of processing personal data in connection with the operation of this website, booking administration, customer communication, service delivery, invoicing and compliance with legal obligations.

2. Personal Data We Collect

Depending on the nature of your inquiry, booking or communication with us, we may collect and process the following categories of personal data:

• Identification data, such as your name and surname;
• Contact data, such as your email address and phone number;
• Booking data, such as travel date, time, pick-up and drop-off details, destination, number of passengers and selected service;
• Communication data, including email correspondence, WhatsApp messages, booking requests and customer service inquiries;
• Payment-related information, to the extent necessary to confirm payment status or reconcile a transaction, although payment card data is typically processed directly by external payment providers;
• Invoice and legal compliance data, where applicable under Czech tax, accounting or consumer law.
• Technical data, such as IP address, browser user-agent, date and time of form submission, where this is necessary for website security, spam prevention and reliable handling of inquiries.

We do not intentionally collect special categories of personal data unless such information is voluntarily provided by you and is necessary for the provision of the requested service.

3. How We Collect Personal Data

Personal data may be collected directly from you when you contact us by email, phone or WhatsApp, submit a request through our website, complete a booking through a booking form or third-party platform, request a quotation, or otherwise communicate with us regarding our services.

In certain cases, data may also be received from third-party booking or payment platforms where you use such services to make or manage your booking.

4. Purposes of Processing

Your personal data is processed only to the extent necessary for legitimate and specified purposes, including:

• managing booking requests, reservations and service schedules;
• communicating with customers before, during and after a booking;
• providing private transport, transfers, tours and related customer support;
• issuing confirmations, invoices or payment-related records;
• fulfilling legal, accounting and tax obligations;
• responding to legal claims, complaints, refund requests or operational disputes;
• maintaining the security, integrity and proper operation of our website and business communications.

5. Legal Basis for Processing

We process personal data only where a valid legal basis exists under applicable data protection law. This may include:

• Performance of a contract – where processing is necessary to take steps at your request or to perform a booking or related service;
• Compliance with legal obligations – where processing is required under accounting, tax, consumer or other applicable laws;
• Legitimate interests – where processing is reasonably necessary for customer communication, service administration, fraud prevention, dispute management or business protection, provided that such interests are not overridden by your rights and freedoms;
• Consent – where legally required for a specific form of processing, in which case consent may be withdrawn at any time without affecting prior lawful processing.

6. Data Sharing and Recipients

We do not sell or rent your personal data. Personal data may, however, be disclosed where reasonably necessary to the following categories of recipients:

• Payment providers, such as SumUp or other approved payment processors, for payment handling and transaction administration;
• Booking platforms or intermediaries, if your booking is made through a third-party system;
• Professional advisors, such as accountants, tax consultants or legal advisors, where necessary for compliance or legal protection;
• Public authorities, courts or regulators, where disclosure is required by law or lawful request.

Any such sharing is limited to what is reasonably necessary and, where applicable, is carried out subject to confidentiality and data protection obligations.

7. Online Payments

Online payments may be processed through external payment providers. When you make a payment, certain payment and transaction data may be processed directly by the relevant provider under its own privacy policy and legal obligations. We do not typically store full payment card details on our own systems.

We may retain limited transaction-related information where necessary for booking confirmation, invoicing, accounting, refund handling or dispute resolution.

8. Data Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected, including the duration needed to provide the service, manage follow-up communication, handle complaints or disputes, and fulfill legal obligations.

Booking and communication data may be retained for a reasonable period in order to manage service history, customer support and legitimate business interests. Accounting, tax and invoicing data may be retained for longer periods where required by Czech law or other applicable regulations.

When personal data is no longer required, it will be securely deleted, anonymized or otherwise disposed of in accordance with applicable standards and practical business necessity.

9. International Data Transfers

As a rule, we aim to process personal data within the European Economic Area. If personal data is transferred outside the EEA by a third-party service provider used in connection with booking, communication, hosting or payment services, such transfer should be subject to appropriate safeguards in accordance with the GDPR, such as an adequacy decision, standard contractual clauses, or another lawful transfer mechanism where applicable.

10. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful access, accidental loss, destruction, alteration or disclosure. These measures may include secure communication tools, restricted access to relevant business data, service-provider safeguards, password protection, and reasonable operational controls proportionate to the nature of the data processed.

While we take reasonable steps to protect personal data, no method of electronic transmission or storage can be guaranteed as absolutely secure. Accordingly, protection measures are applied on a best-efforts and proportionate basis consistent with the scale and nature of our business.

11. Your Rights Under GDPR

Subject to the conditions and limitations laid down by applicable law, you may have the following rights in relation to your personal data:

• Right of access – to request confirmation as to whether your data is being processed and to obtain access to relevant information;
• Right to rectification – to request correction of inaccurate or incomplete personal data;
• Right to erasure – to request deletion of personal data where there is no overriding lawful basis for continued processing;
• Right to restriction of processing – in specific situations provided by law;
• Right to object – to object to processing based on legitimate interests, where applicable;
• Right to data portability – where processing is based on consent or contract and carried out by automated means;
• Right to withdraw consent – where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal;
• Right to lodge a complaint – with a competent supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of alleged infringement.

To exercise any of these rights, please contact us using the contact details provided in this Privacy Policy. We may request reasonable proof of identity before responding to certain requests.

12. Cookies and Website Functionality

Our website may use cookies or similar technologies necessary for basic website functionality, performance, security, user experience and, where implemented, communication or booking-related features.

Cookies may help us understand how visitors interact with the website, maintain essential functionality, remember preferences, and improve usability. You can control or disable cookies through your browser settings, although doing so may affect certain parts of the website.

Where legally required, cookie use should be subject to an appropriate notice or consent mechanism.

13. Third-Party Links and Services

Our website or communications may contain links to third-party websites, booking systems, payment processors, maps, messaging platforms or social media services. We are not responsible for the privacy practices, content or security policies of such third parties. We encourage users to review the relevant privacy information of those services before providing personal data through them.

14. Children’s Data

Our services are not specifically directed to children, and we do not knowingly collect personal data directly from children without appropriate legal basis or parental involvement where required. If you believe that personal data relating to a child has been provided to us improperly, please contact us so that appropriate steps can be considered.

15. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy from time to time in order to reflect changes in our services, legal requirements, operational needs or data processing practices. The most current version should always be made available on this website. Continued use of our services after an updated version is published may indicate acknowledgement of the revised policy to the extent permitted by law.

16. Contact

If you have any questions regarding this Privacy Policy, your personal data, a data access request, a request for correction or deletion, or any other privacy-related matter, please contact us using the details below: