Privacy Policy

The data controller within the meaning of Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Coll. on Personal Data Processing is:

• Autoškola MeGo — operator: Bc. Anna Hodgson
• Registered office / premises: Palackého třída 924/105, 612 00 Brno, Czech Republic
• Company ID: 21376034
• VAT payer
• E-mail: info@onlymego.cz
• Phone: +420 602 615 916

The Controller has not appointed a Data Protection Officer (DPO), as there is no legal obligation to do so. For all matters concerning personal data protection, please use the contacts above.

The Controller processes the following categories of personal data:

• Identification data: first name, surname, date of birth, personal ID number (required by Act No. 247/2000 Coll.), ID card number
• Contact data: address, phone, e-mail
• Training data: completed lessons, evaluations, examination results, lesson records
• Health data: medical certificate of fitness to drive (§ 84 of Act No. 361/2000 Coll.)
• Payment data: bank account number, payment records (the Controller does not process full card numbers — these are processed only by the payment gateway)
• Technical data (website): IP address, browser and device information, behavioural data on the website (only with consent via cookie banner)
• Communication content: content of e-mails, messages and phone calls with the Controller

We obtain data directly from you when you register for a course, communicate with us, or visit our website.

We process personal data only on the basis of one of the legal grounds under Article 6 GDPR:

a) Performance of a contract (Art. 6(1)(b) GDPR)

For the conclusion and performance of the training agreement, tracking your progress, scheduling lessons, and registering for examinations. Provision of this data is a contractual requirement; without it, we cannot enter into an agreement with you.

b) Legal obligation (Art. 6(1)(c) GDPR)

Act No. 247/2000 Coll. requires us to maintain student records, issue training certificates, and retain documents. Accounting and tax laws require archiving of invoices and accounting records.

c) Legitimate interest (Art. 6(1)(f) GDPR)

Ensuring the safety of training (e.g. checking fitness to drive), defence of legal claims, sending information to existing students about their ongoing course, and basic website security.

d) Consent (Art. 6(1)(a) GDPR)

Sending commercial communications and newsletters, marketing, analytical and marketing cookies. Consent is entirely voluntary and may be withdrawn at any time — withdrawal does not affect the lawfulness of processing prior to withdrawal.

Health data (special category under Art. 9 GDPR) is processed on the basis of Art. 9(2)(b) GDPR — compliance with obligations in the area of employment and social security law, and Act No. 247/2000 Coll.

We retain personal data only for the time necessary to achieve the purpose of processing:

• Student records (training documents): 5 years from completion of training (§ 31 of Act No. 247/2000 Coll.)
• Contract documentation: 10 years from the end of the agreement (limitation period + accounting obligations)
• Accounting documents, invoices: 10 years (§ 31 of the Accounting Act and § 35 of the VAT Act)
• Marketing contacts (newsletter, commercial communications): until withdrawal of consent, maximum 5 years from the last contact
• Communication records (e-mails, forms): 3 years from the last communication
• Website analytics data: according to the settings of the tool used (Google Analytics default 14 months), only with consent

After the above periods expire, the data is deleted or anonymised.

Your personal data may be shared, to the necessary extent, with the following recipients:

• Magistrate of the City of Brno and other municipal offices — for examination registration and the driver register
• IT and cloud service providers — website and e-mail hosting, reservation system
• Accountant and tax advisor — payroll, accounting, taxes
• Payment gateways (Stripe, GoPay, etc.) — online payment processing
• Legal counsel — only in case of disputes
• Controller's bank — receiving and sending payments
• Public authorities — on the basis of a legal obligation (court, police, tax authority)

We have a personal data processing agreement with all processors in accordance with Art. 28 GDPR.

Your personal data is not transferred to third countries outside the European Economic Area (EEA) or to international organisations, except where we use services of providers with servers in the USA (e.g. analytics tools, payment gateways). In such cases, transfers are governed by:

• Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), or
• an adequacy decision (EU–US Data Privacy Framework)

If you refuse these services in the cookie banner, no transfer outside the EU occurs in connection with these services.

The website www.onlymego.cz uses cookies — small text files stored in your browser. Cookies are divided into three categories:

Necessary cookies (always active)

Ensure the basic functionality of the website (remembering language, session, security). Without them, the website does not function correctly. These cookies do not require consent.

Analytical cookies (consent only)

We use Google Analytics to anonymously measure traffic and improve content. Data collected: IP address (masked), browser type, pages visited, time spent on page, referrer.

Marketing cookies (consent only)

Used to display relevant advertising on social networks and third-party websites. We may use Meta (Facebook) Pixel or Google Ads.

Embedded content (consent only)

Embedded Google Maps, 3D tours, and other external content is loaded only after consent is given, to prevent data transfer to third-party servers without your knowledge.

You can change or withdraw your consent at any time by clicking the "Cookie settings" button in the website footer, or by clearing cookies in your browser.

As a data subject, you have the following rights under Articles 15–22 GDPR, which you can exercise at any time:

• Right of access (Art. 15) — obtain confirmation of whether we process your data and a copy of that data
• Right to rectification (Art. 16) — request correction of inaccurate or completion of incomplete data
• Right to erasure ("right to be forgotten", Art. 17) — request erasure of data if no longer necessary or processed unlawfully
• Right to restriction of processing (Art. 18) — restrict processing in case of dispute over accuracy or lawfulness
• Right to data portability (Art. 20) — receive your data in a structured, commonly used format and transfer it to another controller
• Right to object (Art. 21) — against processing based on legitimate interest or for direct marketing purposes
• Right to withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing
• Right not to be subject to automated decision-making (Art. 22) — we do not make automated decisions about you or profile you

Exercise your rights in writing by e-mail to info@onlymego.cz or by post to the registered office. We will respond without undue delay, within 30 days at the latest (this period may be extended by a further 2 months in complex cases).

We adopt appropriate technical and organisational measures to protect personal data against misuse, loss, or unauthorised access:

• Encrypted data transfer via HTTPS (TLS 1.2+)
• Password-protected access to information systems with tiered permissions
• Regular backups and encryption of sensitive data
• Physical documents locked in the driving school office
• Regular staff training on personal data protection
• Data processing agreements with all processors (Art. 28 GDPR)

In the event of a personal data breach likely to result in a high risk to your rights, we will inform you without undue delay (Art. 34 GDPR).

For any matters concerning the processing of personal data, please contact us at:

• E-mail: info@onlymego.cz
• Phone: +420 602 615 916
• Address: Palackého třída 924/105, 612 00 Brno, Czech Republic

If you believe that our processing of your personal data breaches the GDPR or Czech law, you have the right to lodge a complaint with the supervisory authority:

• Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
• Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
• Phone: +420 234 665 111
• Website: www.uoou.cz

This Privacy Policy is effective as of the date indicated in the header. The Controller reserves the right to update it; the current version will always be available on this page.