Úvod / EN / Privacy Policy

Privacy Policy

1. Controller

1.1 The controller of personal data is JAPO – transport s.r.o., Company ID (IČO) 262 98 295, with its registered office at Vintrovna 395/25, 664 41 Popůvky, Czech Republic, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File 42419 (the “Controller”).

1.2 Contact details of the Controller in matters of personal data protection:

1.3 The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, the “GDPR”) and Czech Act No. 110/2019 Coll., on Personal Data Processing, as amended.

1.4 This Privacy Policy (the “Policy”) fulfils the Controller’s information obligation under Articles 13 and 14 GDPR.

2. Data Subjects

2.1 This Policy applies to the following natural persons (each a “data subject”):

  • visitors to the website www.japotransport.cz (the “Website”),
  • prospective customers who contact the Controller via a form on the Website, by email or by telephone,
  • customers and business partners of the Controller who are natural persons, and contact persons of customers and business partners (senders, consignees, carriers and suppliers),
  • job applicants.

3. Purposes, Legal Bases and Retention Periods

3.1 The Controller processes personal data for the purposes, on the legal bases and for the periods set out below.

3.2 Handling enquiries and pre-contractual communication

  • Categories of personal data: first name, surname, company name, email address, telephone number, content of the enquiry (e.g. loading and unloading locations, type of goods).
  • Legal basis: Art. 6(1)(b) GDPR – steps taken at the request of the data subject prior to entering into a contract; for contact persons of legal entities Art. 6(1)(f) GDPR – the Controller’s legitimate interest in communicating with a business partner.
  • Retention period: 1 year from the last contact if no contract is concluded.

3.3 Conclusion and performance of contracts

This covers in particular contracts of carriage, freight forwarding contracts, warehousing contracts and contracts for truck service, truck wash and filling station services.

  • Categories of personal data: identification and contact details, billing details, shipment details, name and address of the consignee.
  • Legal basis: Art. 6(1)(b) GDPR – performance of a contract; for contact persons of business partners and for consignees Art. 6(1)(f) GDPR – the Controller’s legitimate interest in the proper performance of the order.
  • Retention period: for the term of the contract and 4 years after its termination.

3.4 Compliance with legal obligations

This covers in particular obligations relating to accounting, taxation and the keeping of transport and customs documents.

  • Categories of personal data: data stated in accounting, tax, transport and customs documents.
  • Legal basis: Art. 6(1)(c) GDPR – compliance with a legal obligation of the Controller.
  • Retention period: for the period required by law; 10 years for tax documents.

3.5 Protection of the Controller’s legal claims

  • Categories of personal data: data from the contract and mutual communication.
  • Legal basis: Art. 6(1)(f) GDPR – the Controller’s legitimate interest in the establishment, exercise or defence of legal claims.
  • Retention period: for the duration of the limitation periods and of any court or other proceedings.

3.6 Recruitment

  • Categories of personal data: data contained in the CV and cover letter, contact details.
  • Legal basis: Art. 6(1)(b) GDPR – steps taken prior to entering into an employment contract; retention of data for future selection procedures Art. 6(1)(a) GDPR – consent of the data subject.
  • Retention period: until the end of the selection procedure; with the data subject’s consent for a maximum of 2 years.

3.7 Protection of forms against spam and abuse (Google reCAPTCHA)

  • Categories of personal data: IP address, browser and device information, data on interaction with the form.
  • Legal basis: Art. 6(1)(f) GDPR – the Controller’s legitimate interest in protecting the Website against automated abuse.
  • Retention period: the Controller does not store this data; Google processes it in accordance with its Privacy Policy.

3.8 Operation and security of the Website

This covers strictly necessary cookies and server logs.

  • Categories of personal data: IP address, browser and device information.
  • Legal basis: Art. 6(1)(f) GDPR – the Controller’s legitimate interest in the secure operation of the Website.
  • Retention period: for as long as necessary to ensure the security of the Website and to investigate any security incidents; the period is determined by the hosting provider’s settings.

3.9 Audience measurement and marketing on the Website

  • Categories of personal data: cookie identifiers, data on behaviour on the Website.
  • Legal basis: Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications, as amended – consent of the data subject.
  • Retention period: until consent is withdrawn, at most for the lifetime of the individual cookies.

3.10 Upon expiry of the retention period, the Controller erases or anonymises the personal data.

4. Sources of Personal Data

4.1 The Controller generally obtains personal data directly from the data subject.

4.2 The Controller may obtain personal data of contact persons from their employer or another entity on whose behalf they act and which is a customer or business partner of the Controller.

4.3 Personal data of consignees are provided to the Controller by the customer ordering the transport.

4.4 The Controller verifies identification data of businesses in public registers.

5. Recipients of Personal Data

5.1 The Controller does not sell personal data. Personal data may be disclosed, to the extent necessary, to the following categories of recipients:

  • providers of hosting, Website administration, email and IT services,
  • providers of accounting, tax and legal services,
  • carriers, customs brokers and other persons involved in carrying out a specific order,
  • insurance companies when handling insurance claims,
  • Google, for the purpose of form protection (reCAPTCHA),
  • providers of analytics and advertising tools, only with the data subject’s consent to the use of cookies,
  • public authorities (in particular customs and tax authorities, courts and the Police of the Czech Republic) where required by law.

5.2 Processors process personal data solely on the instructions of the Controller and on the basis of a data processing agreement pursuant to Art. 28 GDPR.

6. Transfers of Personal Data to Third Countries

6.1 The Controller generally processes personal data within the European Union and the European Economic Area.

6.2 For orders to countries outside the European Union, the Controller transfers to partners in the country of destination the personal data necessary to carry out the transport, on the basis of Art. 49(1)(b) and (c) GDPR.

6.3 Where the Controller uses services of providers based in the USA (in particular Google Analytics and Google reCAPTCHA), the transfer is based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or, where applicable, on standard contractual clauses.

7. Cookies

7.1 The Website uses cookies, i.e. small text files stored on the user’s terminal device.

7.2 The Controller uses the following categories of cookies:

  • strictly necessary cookies – ensure the functionality and security of the Website and store the user’s cookie preferences; their use does not require consent,
  • analytics cookies – used to measure traffic and improve the Website (e.g. Google Analytics); used only with the user’s consent,
  • marketing cookies – used to display relevant advertising; used only with the user’s consent.

7.3 The user gives consent via the cookie banner on the first visit to the Website. Consent may be changed or withdrawn at any time via the cookie settings link in the footer of the Website. An overview of the individual cookies and their lifetime is provided in the cookie banner settings.

8. Rights of the Data Subject

8.1 Under the conditions laid down in the GDPR, the data subject has the right to:

  • access personal data (Art. 15 GDPR),
  • rectification of inaccurate personal data (Art. 16 GDPR),
  • erasure of personal data (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • object to processing based on legitimate interest (Art. 21 GDPR),
  • withdraw consent at any time (Art. 7(3) GDPR); the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal,
  • lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz, or with the supervisory authority of the EU Member State of the data subject’s habitual residence or place of work.

8.2 Requests to exercise these rights may be submitted using the contact details set out in Article 1.2. The Controller will handle the request free of charge and no later than one month after its receipt. In complex cases, this period may be extended by a further two months, of which the Controller will inform the data subject. Where there are reasonable doubts as to the identity of the requester, the Controller may request additional information necessary to confirm it.

9. Obligation to Provide Personal Data

9.1 The provision of personal data necessary to handle an enquiry or to conclude and perform a contract is a contractual requirement. Without such data, the enquiry cannot be handled and the contract cannot be concluded or performed.

9.2 The provision of personal data processed on the basis of consent is voluntary and does not affect the handling of the enquiry.

10. Automated Decision-Making

10.1 The Controller does not carry out automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR.

11. Security of Personal Data

11.1 The Controller has adopted technical and organisational measures appropriate to the risk of processing, in particular access control, encrypted data transmission on the Website and confidentiality obligations of employees.

11.2 Access to personal data is granted only to persons who need it to perform their work duties.

12. Final Provisions

12.1 The Controller may update this Policy, in particular in the event of changes in legislation or in the services provided. The current version of the Policy is always published on the Website.

12.2 This Policy takes effect on 2 November 2026 and replaces the personal data protection terms effective from 14 May 2018.

12.3 This English version is a translation of the Czech original. In the event of any discrepancy, the Czech version prevails.