Personal Data Protection

1. The protection of personal data and the processing of personal data are subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and based on the provisions of Act No. 18/2018 Coll. on the Protection of Personal Data and on amendment of certain acts (“Act”) and we hereby notify you as an affected party of the following information concerning the processing of your personal data in connection with your registration in the IDS BK App.

2. The User is obliged to provide the following personal data during registration and to use services to purchase tickets via the IDS BK App:

  1. first name, last name, phone number and email address
  2. if the User is under the age of 16, then also the personal data of their legal guardian in the following scope: title, first name, last name, date of birth, complete address, phone number and email.

3. For purchasing prepaid travel tickets, which are non-transferable between passengers and issued only for a name according to the Conditions of Carriage of the IDS BK, an additional registration in the IDS BK App is needed. The User is obliged to provide in addition the following information:

  1. date of birth,
  2. address of permanent residence,
  3. image of the face (photograph in an electronic form),
  4. copy of an ID document,
  5. copies of documents proving the entitlement for a discount.

4. If the User is under the age of 16, the processing of such personal data is only lawful if consent to the processing of this personal data is provided or approved by their legal guardian. The User is obliged to provide complete and true personal data.

5. By registering, User expresses their consentto the Terms and Conditions for use of the IDS BK App and consent to the processing, administration and storage of the above specified and provided personal data in connection with registration in the IDS BK App and its use.

6. The Operator shall not publish or otherwise provide the personal data obtained from the User to any other party, except when required under general legislation or in special instances with the consent of the party’s whose personal data is involved.

7. The Operator has taken sufficient technical and organisational measures corresponding to the method and purpose of processing of such personal data, with special consideration given to the type of equipment in use, the confidentiality and importance of the processed personal data and the scope of potential risks with the ability to interfere with the security or functionality of the information system.

8. The User has the right of confirmation from the Operator if it is processing their personal data. If the Operator is processing such personal data, the affected party has the right to access this personal data and information concerning:

  1. the purposes of processing personal data,
  2. the category of processing personal data,
  3. the identification of the recipient or category of recipient provided or to be provided with personal data, especially recipients in third countries or about international organisations, if possible,
  4. the archiving period for personal data; if not feasible, then information on criteria used to define such period,
  5. the right to request correction by the Operator of personal data related to the affected party, including their deletion or restriction of their processing or on the right to refuse the processing of personal data,
  6. the right to submit a petition to commence proceedings,
  7. the sources of personal data if not secured from the User personally,
  8. the existence of automated individual decision making, including profiling in such cases, the Operator shall provide the User with information, especially with respect to the applied procedure, the significance and expected consequences of such processing of personal data for the affected person.

9. If the User concludes that any of the personal data that the Operator processes is incorrect or incomplete, the User may request that the Operator make such information available to correct or delete it. A request to access personal data may be accomplished using any of the following methods:

  1. via email sent to: dpo@bid.sk
  2. by post to: Bratislavská integrovaná doprava, a.s., Jankolova 6, 851 04 Bratislava, Slovenská republika

10. To ensure the Operator is able to respond to a request to provide access to personal data, the User must::

  1. submit its request using the approved request form seeking access to personal data,
  2. provide the Operator with sufficient information to verify their identity (to ensure the person requesting the information is the User or their legal guardian).

11. The Operator commits that if it processes the User’s personal data on the basis of their consent (e.g. for marketing purposes), and if a request to terminate the processing of personal data is received in writing before the specified term, such personal data shall be deleted without any undue delay and within 30 days from receipt of the revocation of consent at the latest.

12. If the User wishes to file a complaint indicating that the Operator is processing their personal data, they shall contact the Operator’s Data Protection Officer (DPO), whose email address is dpo@bid.sk or by post at the following address: Bratislavská integrovaná doprava, a.s., Jankolova 6, 851 04 Bratislava, Slovenská republika. The DPO shall then review the complaint and will collaborate with the User to resolve the complaint. If the User continues to insist that their personal data was not properly processed within the scope of Act No. 18/2018 Coll. on the Protection of Personal Data, and on amendment of certain acts, they may contact the Data Protection Authority.