Principles and Rules for the Protection of Personal Data of pelicantravel.com s.r.o.
1. Introduction
These Privacy Policy and Data Protection Rules of pelicantravel.com s.r.o. (hereinafter referred to as "Pelikán") have been prepared in accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "EU Regulation"). Your privacy is very important to Pelikán, and we want you to feel safe when visiting our website WEB and using our services. That is why we have developed this Privacy Policy to inform you about how we collect and process your personal data when you communicate with our Customer Service experts, visit the www.pelikan.sk/en portal from a computer or your mobile device, place an order with us for various services, and also about your rights regarding the protection of personal data.
2. Data Controller
The controller for the processing of your personal data is:
pelicantravel.com s.r.o.
Registered office: Pribinova 17954/10, 811 09 Bratislava, Slovak Republic
Registered in the Commercial Register: Bratislava III District Court, Section: Sro, Insert No.:
32895/B
Company ID: 35 897 821
(hereinafter also referred to as “Pelikán”)
If you have any questions regarding the processing of your personal data or wish to exercise your rights, please contact us at the email address dpo@pelikan.sk or in writing at our company’s registered address.
3. Purposes for Which We Process Your Personal Data
“Personal data” refers to information relating to a natural person who is identified or identifiable.
If you wish to skip to a specific section of the Privacy Policy, click on the appropriate link below:
3.1 Personal data processed during communication with Pelikán
Purpose: Providing customer support and product support, and monitoring their quality and types.
Categories of personal data: Basic personal data
Description of category and recipients: When you communicate with our customer service representatives via email, phone, online chat, or in person, we collect personal data such as your name, surname, address, phone number, email address, Facebook ID, and date of birth. Some of these personal data may be received by third parties such as META and Apple if you communicate through the chat service on our website www.pelikan.sk/en or on our Facebook page https://www.facebook.com/Pelikan.sk/.
We may also generate event logs that are useful for diagnosing issues related to the use of our portal and record information regarding support or service-related issues.
To improve customer service, we may also record and review conversations with customer support representatives, and analyze feedback provided by users through voluntary customer opinion surveys, all within the scope of applicable legal regulations.
Pelikán may communicate with you through messaging applications such as those provided by Meta. We recommend that you familiarize yourself with the terms of use and data processing policies of the respective application providers.
When communicating with our customers, we may use advanced AI-based technologies, such as our Voicebot, to deliver fast and efficient customer support. Before engaging with the Voicebot, customers are transparently informed that communication will take place with AI, and they are given the option to choose a different method of communication. As a result, your personal data may be shared with providers of general-purpose AI modules.
Legal basis: The legal basis for processing such information for these purposes is Pelikán’s legitimate interest in providing you with high-quality customer support and fulfilling legal obligations related to data retention.
Retention period: 6 years from the date of request processing
3.2 Personal data processed during the pre-contractual relationship, contract conclusion, and performance with/through Pelikán
3.2.1 Purpose: Contract conclusion and performance
Categories of personal data: Basic personal data
Description of category and recipients: If you order a service/product via the www.pelikan.sk/en web portal, Pelikán collects your name, surname, gender, date of birth, email address, postal address, and phone number. For some services, we may also collect your nationality, travel document number, expiry date, issuing country, scan of travel documents, and signature. The payment card data we process includes: the card number (first six and last four digits), cardholder name and surname, card expiration date, and cardholder signature. Recipients of this data may include banks and financial transaction processing companies that comply with secure data processing standards for payment cards, as well as airlines.
If you pay for a service/product via a bank transfer, we process the account holder's name and account number. If you make a direct deposit to our account, we process the name and surname of the person who made the deposit. The recipients of these data are the banks through whose systems the payment is processed.
If you are a customer, depending on the services you have ordered, your personal data will primarily be shared with providers with whom you or we have entered into an agreement to deliver the ordered services. These recipients include airlines, accommodation facilities, travel agencies, tour operators, insurance companies, car rental companies, embassies, consulates, rail, ship, bus or personal transport providers, tax authorities, and more.
Additionally, data may be shared with cloud service providers such as Alphabet Inc. (Google), providers of general-purpose AI modules, helpdesk and communication tool providers (e.g., Daktela, LiveAgent, WhatsApp, Crisp, Slack), reservation systems and intermediaries (e.g., Travelfusion), as well as banks and financial institutions.
Other recipients may include external collaborators—such as tour guides/delegates—and Pelikán utilizes third-party cloud services, such as Mandrill, to assist with email dispatching.
Legal basis: The legal basis for processing this data is the performance of a contract or the execution of pre-contractual measures at your request. For special categories of personal data, the legal basis is also the performance of a contract. We process special categories of personal data with heightened care and caution. The processing may also be necessary to fulfill legal obligations concerning data destruction.
Retention period: 6 years from the termination of the contractual relationship
3.2.2 Purpose: Requesting special transportation services, special assistance at the airport or during transport
Categories of personal data: Basic personal data, Special category of personal data
Description of category and recipients: Information about your health condition. If you are a client, depending on the services you have ordered, we provide your personal data primarily to service providers with whom either you or we have entered into a contract to fulfill the ordered services. These recipients include, in particular, airlines providing passenger transport, accommodation facilities, travel agencies, tour operators, insurance companies, car rental brokers and car rental companies, embassies, consulates, and carriers providing rail, sea, bus, or personal transport.
In communication with our customers, we may use advanced AI-based technological solutions such as our Voicebot, which help us deliver fast and efficient customer support. Before communicating with the Voicebot, customers are transparently informed that the interaction will be conducted with AI, and they are given the option to choose a different form of communication. The main purpose of introducing AI into our customer service is to automate customer communication for the efficient handling of requests even outside Pelikán's business hours, with 24/7 availability. Therefore, recipients of your personal data may include providers of general-purpose artificial intelligence modules.
Legal basis: The legal basis for processing these data is the performance of a contract or the execution of pre-contractual measures at your request. We process special categories of personal data with heightened care and caution.
Retention period: 6 years from the termination of the contractual relationship
3.2.3 Purpose: Visa processing at relevant diplomatic missions
Categories of personal data: Basic personal data
Description of category and recipients: Information about your health condition. If you are a client, depending on the services you have ordered, we provide your personal data primarily to service providers with whom either you or we have entered into a contract to fulfill the ordered services. Recipients may include airlines providing passenger transport, accommodation facilities, travel agencies, tour operators, insurance companies, car rental brokers and car rental companies, embassies, consulates, and carriers providing rail, sea, bus, or personal transport. The recipients also include the relevant diplomatic missions.
For visa processing for certain countries, intermediary companies such as EVENT TOURISM s.r.o. may assist us. Documents or their copies are sent via courier services such as Slovak Parcel Service, s.r.o.
Legal basis: The legal basis for processing special categories of personal data is the performance of a contract. We process special categories of personal data with heightened care and caution. Another legal basis is the fulfillment of a legal obligation concerning data destruction.
Retention period: 6 years from the termination of the contractual relationship
3.2.4 Purpose: Contract withdrawal and other forms of contract termination
Categories of personal data: Basic personal data, Special category of personal data
Description of category and recipients: In exceptional cases, we may process personal data contained in your birth certificate, including, in addition to your name, surname, gender, date of birth, place of birth, personal identification number, nationality, also the name, surname, maiden name of your father and mother, their dates of birth, personal identification numbers, and nationalities. Likewise, we may exceptionally process personal data contained in the birth certificate of your child/grandchild, including their name, surname, gender, date and place of birth, personal identification number, nationality, and also the names, surnames, maiden names, dates of birth, personal identification numbers, and nationalities of both parents. Additionally, we may process personal data contained in your marriage certificate, including your name, surname, maiden name, date and place of birth, personal identification number, nationality, marital status at the time of marriage, and names, surnames, and maiden names of parents, as well as all such information concerning your spouse and the male and female versions of the agreed surname for your children.
If you are a client, depending on the services you have ordered, we provide your personal data primarily to service providers with whom either you or we have entered into a contract to fulfill the ordered services. These recipients mainly include airlines providing passenger transport, accommodation facilities, travel agencies, tour operators, insurance companies, car rental brokers and car rental companies, embassies, consulates, and carriers providing rail, sea, bus, or personal transport.
Legal basis: The legal basis for processing these data is generally the contract concluded between you and the carrier/travel agency, which in such cases allows for a full/partial refund of the flight/tour price. Another legal basis may be the contract with Pelikán, which, as an intermediary in concluding the transport contract or as a travel agent (in the case of a travel package contract), may attempt upon your request to secure an exceptional partial/full refund from the carrier or travel agency. Additionally, the legal basis includes the fulfillment of legal obligations concerning data destruction. The legal basis for processing special categories of personal data for this purpose is the performance of a contract. We process special categories of personal data with heightened care and caution. The legal basis also includes compliance with legal obligations related to data destruction.
Retention period: 6 years from the termination of the contractual relationship
3.2.5 Purpose: Handling complaints and refunds
Categories of personal data: Basic personal data, Special category of personal data
Description of category and recipients: When handling complaints and refunds, we process personal data such as name, surname, contact details, information about ordered services, and payments. If necessary, we may also process health-related data if it is relevant to the complaint or refund. Recipients of these data may include travel service providers, hosting providers, communication service providers, insurance companies, social media operators, and, if needed, legal representatives.
Legal basis: The legal basis (including for the processing of special categories of data) is the performance of a contract, legal obligations arising from the Consumer Protection Act, and legitimate interest in resolving complaints and refunds. The legal basis also includes compliance with legal obligations concerning data destruction.
Retention period: 6 years from the resolution of the complaint or refund
3.2.6 Purpose: Contacting the Client for the Purpose of Offering Compensation Processing in Case of Flight Cancellation or Delay
Categories of Personal Data: Ordinary personal data, Special categories of personal data
Description of Category and Recipients: Selected clients whose bookings qualify for compensation under Regulation (EC) No. 261/2004 are contacted by phone to confirm their consent for compensation processing in the event of a delayed flight and to provide telephone contact details for their fellow passengers. In contacting clients for the purpose of offering compensation processing due to flight delays or cancellations, we process personal data such as first name, surname, email address, telephone number of passengers listed in the booking, and all personal data obtained from the client relating to their order. Based on the client’s consent, information about the relevant booking is subsequently provided to a legal advisory partner who handles the compensation claim. Recipients may include companies specializing in the recovery of compensation from airlines such as Verdikto Group s.r.o. and Quanta Group s.r.o.
Legal Basis: The legal basis for contacting the client is Pelikán’s legitimate interest in reducing discomfort and mitigating the negative experience of clients whose flight was delayed or cancelled, by offering services of a business partner specializing in this area, who may assist clients in obtaining financial compensation. Subsequently, the legal basis is the consent of clients who express active interest in these services. Special attention and care is given to the processing of special categories of personal data. The legal basis also includes compliance with legal obligations in case of data disposal.
Retention Period: 6 years from the date of booking creation
3.2.7 Purpose: Provision of Subscription Service – Premium Club
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: For the purpose of providing the subscription service, we process your email, first name and surname, date of birth, phone number, login name on social media, membership numbers in airlines, and mileage cards. Recipients primarily include airlines transporting passengers, accommodation providers, travel agencies, tour operators, insurance companies, car rental intermediaries and car rental companies, embassies, consulates, rail, sea, bus or personal transport providers, financial authorities, or courier companies for delivery. Recipients may also include companies involved in airline compensation claims such as Quanta Group s.r.o. Furthermore, cloud service providers such as Alphabet Inc. (Google), providers of general-purpose artificial intelligence modules, providers of helpdesk and communication tools (e.g. Daktela, LiveAgent, WhatsApp, Crisp, Slack), reservation system providers and intermediaries (e.g. Travelfusion), banks, and financial institutions.
Legal Basis: The legal basis for processing this data is the performance of a contract and fulfillment of legal obligations in case of data disposal.
Retention Period: 6 years from subscription termination
3.2.8 Purpose: Sending SMS to the Client
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: When sending SMS messages to clients, we process personal data such as telephone number, message text, and RESA code. These data are necessary to inform the client about APIS data updates, flight changes or cancellations, or to send other information related to contract performance. The recipient of these data is the telecommunications service provider that ensures the technical delivery of the messages.
Legal Basis: The legal basis is the performance of a contract to which the data subject is a party or taking steps at the request of the data subject prior to entering into a contract, and in the case of data disposal, the fulfillment of the controller’s legal obligations. The legal basis also includes compliance with legal obligations in case of data disposal.
Retention Period: 30 days from the date of SMS dispatch
3.2.9 Purpose: Management of Order Data Logs
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: In managing order data logs, we process personal data such as name, surname, email address, date of birth, product type and destinations, telephone number, address, payment method, card prefix and suffix, account number (IBAN), and age. These data are necessary to ensure proper functioning of the order system, troubleshooting, and providing technical support. Recipients of this data may include cloud service providers such as Alphabet Inc. (Google), helpdesk and communication tool providers (Daktela, Crisp, Slack, Meta), and providers of general-purpose AI modules such as OpenAI. Additional recipients include cloud service providers such as Elastic.co, Amazon Web Services, Inc., Hetzner Online GmbH, and Alphabet Inc. (Google).
Legal Basis: The legal basis for processing such data is the legitimate interest of Pelikán in providing high-quality technical system operations and support, detecting and resolving errors, controlling processes, and fulfilling legal obligations in the event of data disposal.
Retention Period: 30 days from the creation of the log
3.2.10 Purpose: Creation and Management of Gift Vouchers
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: When creating gift vouchers, we process personal data such as photo, name, surname, email address, and other information entered by the client (free text). These data are necessary to create, personalize, and deliver the gift voucher, as well as to ensure its validity and usability.
Legal Basis: The legal basis is the performance of a contract to which the data subject is a party or taking steps at the request of the data subject prior to entering into a contract, and in the case of data disposal, the fulfillment of the controller’s legal obligations.
Retention Period: 4 years from the voucher creation (due to its validity period and the associated service selected by the client). The photo uploaded by the client is deleted 72 hours after upload.
3.2.11 Purpose: Cross-Sell – Telephonic Sales of Insurance and Additional Services
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: For the personalized sale of products and services related to flight tickets through telemarketing, we process personal data such as name, surname, address, passport number, email address, telephone number, date of birth, communication with the client (voice recording, emails), ticket number, reservation number, flight destination, and product preferences. These data are necessary for effective client identification, offering suitable additional services and products related to the client’s journey, and ensuring high-quality customer service. Recipients of this data may include cloud service providers such as Alphabet Inc. (Google), helpdesk and communication tool providers (Daktela, Crisp, Meta), and providers of general-purpose AI modules such as OpenAI.
Legal Basis: The legal basis is the controller’s legitimate interest in providing personalized products and services to clients, and in the case of data disposal, the fulfillment of the controller’s legal obligations.
Retention Period: 6 years from the last communication with the client
3.2.12 Purpose: Searching for Better Accommodation Offers for Subscribers of the Hotel Hop Service
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: In providing the Hotel Hop service, we process personal data such as email address, name and surname, date of birth, telephone number, address, screenshot/photo of accommodation, date and place of accommodation. These data are necessary to search for better accommodation offers for our subscribers, compare prices and accommodation conditions, and secure the best possible pricing options. Recipients of this data may include accommodation booking systems such as GoGlobal, Elevate, and others who assist us in delivering this service.
Legal Basis: The legal basis is the performance of a contract to which the data subject (subscriber of the service) is a party or taking steps at the request of the data subject prior to entering into a contract, and in the case of data disposal, the fulfillment of the controller’s legal obligations.
Retention Period: 4 years from account termination
3.2.13 Purpose: In-Person Meetings with Clients in the Lounge
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: When recording meetings with clients in the calendar, we process personal data such as name, surname, email address, and telephone number. These data are necessary for effective planning and organization of in-person meetings with clients in the Lounge area, ensuring staff availability, and delivering high-quality services. Recipients of this data may include technical support providers and cloud service providers such as Alphabet Inc. (Google).
Legal Basis: The legal basis is the performance of a contract to which the data subject is a party, or taking steps at the request of the data subject prior to entering into a contract, and, in case of data disposal, the fulfillment of the controller’s legal obligations.
Retention Period: 6 months from the date of the in-person meeting
3.2.14 Purpose: Processing Client Verification
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: In cases where we conduct verification on behalf of clients, we may process personal data such as name, surname, email address, address, passport/travel document scan – ID number, validity, and issuing country, photograph and signature, nationality, date of birth, and the traveler’s signature. These data are required to meet the requirements of the airline Ryanair for passenger verification for selected flight tickets. Recipients of this data include the airline Ryanair and the cloud service provider Alphabet (Google).
Legal Basis: The legal basis is the performance of a contract to which the data subject is a party, or taking steps at the request of the data subject prior to entering into a contract, and, in case of data disposal, the fulfillment of the controller’s legal obligations.
Retention Period: 1 year from the successful completion of verification
3.3 Personal Data Processed in Client Registration (Creation and Management of My Pelikán Account)
3.3.1 Purpose: Pelikán Processes Your Email Address to Deliver Important Information About Your Products and My Pelikán Account
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: Pelikán processes your first name, surname, and email address for the purpose of delivering important information regarding your products and your My Pelikán account. Pelikán uses third-party cloud services such as Mailgun, Alphabet Inc., and Bloomreach to assist with email delivery.
Legal Basis: The legal basis is the performance of a contract to which the data subject is a party or taking steps at the request of the data subject prior to entering into a contract, and, in case of data disposal, the fulfillment of the controller’s legal obligations.
Retention Period: For the duration of the active account
3.3.2 Purpose: Reporting and Statistics
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: For reporting and statistical purposes, we process personal data from your order, data about your behavior on the website (linked to the client only via IP address), and data from communication with our customer service. Recipients of this data include cloud service providers such as Alphabet Inc. (Google).
Legal Basis: The legal basis is the legitimate interest of the controller in evaluating the effectiveness of its services and processes, and, in case of data disposal, the fulfillment of the controller’s legal obligations.
Retention Period: 4 years from the date the data is obtained
3.4 Personal Data Processed When Participating in Competitions Organized by Pelikán
3.4.1 Purpose: Execution of the Competition and Identification of the Participant and Winner
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: Pelikán may process your personal data such as first name, surname, and email address provided when entering the competition. If you become a winner, additional data such as home address, date of birth, and phone number may be processed for the purpose of handling and delivering the prize. Recipients may include cloud service providers such as Bloomreach, Meta (Facebook), and Alphabet Inc. (Google).
Legal Basis: The legal basis is legitimate interest – organizing the competition and successfully evaluating its outcome. The legal basis also includes compliance with legal obligations in the case of data disposal.
Retention Period: 4 years from the end of the competition
3.4.2 Purpose: Announcement of the Competition Winner
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: Pelikán may process your first name and the initial letter of your surname, which will be published on Pelikán’s website and social media, such as Facebook. Recipients include companies operating social networks, such as Meta (Facebook).
Legal Basis: The legal basis is the winner’s consent. Refusal to give consent is not a reason to exclude a participant from the competition. The legal basis also includes compliance with legal obligations in the case of data disposal.
Retention Period: 1 year from the end of the competition
3.5 Personal Data Processed in Connection with Participation in Press Conferences and Distribution of Press Releases
3.5.1 Purpose: Participation in a Press Conference Organized by Pelikán
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: When you attend a press conference organized by Pelikán, we process your first name, surname, email address, and possibly your employer, for the purpose of recording attendance.
Legal Basis: The legal basis for processing this personal data is Pelikán’s legitimate interest in organizing the press conference and processing its outputs. The legal basis also includes compliance with legal obligations in the event of data disposal.
Retention Period: One year from the date of the press conference
3.5.2 Purpose: Interest in Receiving Regular Press Releases from Pelikán
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: When you attend a press conference organized by Pelikán, we process your first name, surname, email address, and possibly your employer, for the purpose of recording attendance.
Legal Basis: The legal basis is the data subject’s consent. The legal basis also includes compliance with legal obligations in the event of data disposal.
Retention Period: One year from the date of the press conference
3.6 Personal Data Processed on the Portal pelipecky.sk
3.6.1 Purpose: Processing of Readers’ Personal Data on the Portal Pelipecky.sk
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: The Pelipecky.sk portal provides travel-related information to readers and potential clients of Pelikán. Readers have the option to comment on articles, ask follow-up questions, and participate in discussions. During these interactions, we process your personal data such as name, surname, and email address provided when submitting a comment or question. Communication with readers is handled by Pelikán employees, and the data may be processed within content management and customer support systems.
Legal Basis: The legal basis for processing such information is Pelikán’s legitimate interest in providing you with high-quality customer support. The legal basis also includes compliance with legal obligations in the case of data disposal.
Retention Period: 4 years from the last communication
3.6.2 Purpose: Bug Reporting
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: For the purpose of registering and handling application bugs in Pelipecky, we process email addresses. These data are needed to identify the bug reporter and ensure effective communication for problem resolution. Recipients may include providers of cloud platforms and development tools (e.g., project/version/code management tools such as JIRA, GitHub). Users report bugs via various communication channels provided by the operator. Recipients include Alphabet Inc., Daktela s.r.o., Mango Technologies, Inc., and technical support providers.
Legal Basis: The legal basis for processing this information is Pelikán’s legitimate interest in ensuring proper technical operation of the application, system support, bug detection and resolution, process functionality control, and compliance with legal obligations in the case of data disposal.
Retention Period: 2 years from the date of the bug report
3.7 Personal Data Processed for Marketing Communication
3.7.1 Purpose: Sending Marketing Information and Pelikán Newsletters
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: Pelikán processes your email address and phone number for the purpose of sending marketing information and newsletters about various products/services offered via www.pelikan.sk/en. Pelikán uses third-party cloud services such as Mailgun to assist with email delivery. These services track activities related to emails, such as whether the recipient opened them, clicked on links, or made a purchase after clicking. Pelikán analyzes email engagement based on this data. Recipients of personal data are companies providing these cloud services.
Legal Basis: The legal basis for processing your email address for this purpose is your consent or our legitimate interest in informing you as a customer who has already purchased a product/service on the pelikan.sk/en portal about current prices, discounts, promotions, travel tips, news, and exclusive offers. You may unsubscribe from the newsletter at any time via the link provided in each message. The legal basis also includes compliance with legal obligations in the case of data disposal.
Retention Period:
- If you have given consent to receive newsletters: 6 years from consent or until you withdraw it and unsubscribe.
- If we send newsletters based on legitimate interest: 1 year from your last purchase or until you object or unsubscribe.
3.7.2 Purpose: Pelikán Price Watchdog
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: If you show interest in receiving price alerts from the Pelikán Price Watchdog, Pelikán processes your name, surname, and email address entered into the form at https://www.pelikan.sk/sk/watchdog. Pelikán uses transactional email services such as Mandrill and Mailgun to deliver these emails. These services track user interactions, including email opens, link clicks, and post-click purchases. Pelikán uses this data to analyze engagement with the emails it sends. Recipients of personal data are the companies providing these cloud services.
Legal Basis: The legal basis for this processing is the performance of a contract or the implementation of pre-contractual measures at your request. The legal basis also includes compliance with legal obligations in the case of data disposal.
Retention Period: 6 months. If no suitable product is found for you within 6 months, the Price Watchdog subscription is automatically deactivated.
3.7.3 Purpose: Email Collection for Pelikán Premium Service Leads and Updates
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: If you express interest in the Pelikán Premium service, Pelikán processes your name, surname, and email address entered into the form. Recipients may include cloud service providers such as Alphabet Inc. (Google). Pelikán uses third-party cloud services that track email-related activities, such as whether the recipient opened the message, clicked on links, or made a purchase. Pelikán uses this data to analyze email engagement.
Legal Basis: The legal basis for this processing is your consent. The legal basis also includes compliance with legal obligations in the case of data disposal.
Retention Period: For the duration of the subscription membership
3.7.4 Purpose: Promotion of Pelikán's Services Through Customer Reviews
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: If you express interest in reviewing the services you purchased through Pelikán, Pelikán will process your name, surname, email address, and the review submitted via the form. Recipients of personal data may include cloud service providers.
Legal Basis: The legal basis for such processing is your consent or our legitimate interest. The legal basis also includes compliance with legal obligations in the event of data disposal.
Retention Period:
- If you have provided your consent to process or publish your review: your email address and review will be processed until you withdraw your consent or until the review is relevant in relation to the current offering of our services.
- If we process your review for internal purposes based on our legitimate interest: your email address and review will be processed until you object to such processing or until the review is relevant in relation to the current offering of our services.
3.7.5 Purpose: Client Communication via Social Media
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: If you choose to communicate with Pelikán via social media, Pelikán may process your name, surname, photo, email address, telephone number, profile contacts, and ID. Recipients include social media companies such as META (Facebook).
Legal Basis: The legal basis for processing your personal data during communication on Facebook is a contract or our legitimate interest. The legal basis also includes compliance with legal obligations in the event of data disposal.
Retention Period: We process your personal data and communication on Facebook until you object to the processing or the post is deleted, or for as long as the data remains relevant, which may vary depending on its archival value.
3.7.6 Purpose: Implementation of Promotional Events
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: If you participate in Pelikán’s promotional events, the processed data may include your photographic likeness, voice recording, and video footage. Recipients for this purpose may include social media platforms where Pelikán has accounts, sponsors, other web portals, media partners, contracted photographers, and videographers.
Legal Basis: The legal basis is your consent or our legitimate interest. The legal basis also includes compliance with legal obligations in the event of data disposal.
Retention Period:
- If the legal basis is consent: your personal data will be processed until you withdraw your consent or as long as the promotional outputs remain relevant for marketing purposes.
- If the legal basis is legitimate interest (i.e., organizing the promotional event and processing its outputs for informational and marketing purposes): we will process your data until you object to such processing or as long as the promotional outputs remain relevant.
3.7.7 Purpose: Processing of Personal Data in Connection with Newsletter Subscriber and Social Media Visitor Surveys
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: When completing a survey as a visitor to Pelikán’s social media accounts or a newsletter subscriber, you may provide your email address.
Legal Basis: The legal basis for processing your email address for this purpose is your consent. The legal basis also includes compliance with legal obligations in the event of data disposal.
Retention Period: Personal data are deleted after survey evaluation.
3.7.8 Purpose: Company Promotion Through the Pelicast Channel
Categories of Personal Data: Ordinary personal data
Description of Category and Recipients: When sharing videos through Pelicast, we process personal data such as name, surname, occupation/profession, video, and audio recording. These data are needed to produce and distribute media content for company promotion. Videos are shared via the Pelipecky.sk portal and potentially on the YouTube platform. Recipients may include companies operating social networks such as YouTube (Google Media), as well as photographers and videographers.
Legal Basis: The legal basis is the data subject’s consent to the processing of their personal data. The legal basis also includes compliance with legal obligations in the event of data disposal.
Retention Period: 6 years from the date of recording
3.7.9 Purpose: Campaigns via Facebook and Google Audience
Categories of personal data: Ordinary personal data
Description of category and recipients: When conducting campaigns via Facebook and Google, we process personal data such as name, surname, and email address. This data is necessary to create targeted audience segments for marketing campaigns. The recipients of this data may include social media companies and cloud service providers such as Bloomreach, Meta (Facebook), and Alphabet Inc. (Google).
Legal basis: The legal basis is the controller's legitimate interest in marketing communication and promoting its services (search and evaluation), and in the case of data disposal, compliance with the controller's legal obligation.
Retention period: 50 months from the record creation date.
3.7.10 Purpose: Client Questionnaire
Categories of personal data: Ordinary personal data
Description of category and recipients: When determining client preferences using a questionnaire, we process personal data such as name, surname, email address, and phone number. This data is necessary to identify the client and process their preferences regarding products and services. The aim is to determine the client's preferences to provide them with relevant information and offers. Recipients of this data may include cloud service providers such as TypeForm (Spain) and Bloomreach.
Legal basis: The legal basis is the data subject’s consent to the processing of their personal data, and in the case of data disposal, compliance with the controller’s legal obligation. The legal basis also includes fulfillment of the legal obligation in case of data disposal.
Retention period: 12 months from the date the questionnaire is completed.
3.7.11 Purpose: Contact Collection
Categories of personal data: Ordinary personal data
Description of category and recipients: When collecting contacts, we process personal data such as name, surname, email address, phone number, address, gender, date of birth, client behavior on the website, and order history. Recipients of this data may include cloud service providers and marketing platforms such as Bloomreach, Inc., Unbounce Marketing Solutions Inc., Kickoff Labs LLC, and Retyp, LLC.
Legal basis: The legal basis is the data subject’s consent to the processing of their personal data for specific purposes (acquisition and retention), and in the case of data disposal, compliance with the controller’s legal obligation.
Retention period: 12 months.
3.8 Personal Data Processed Through Video Surveillance
Purpose: Ensuring proper management of company property and protection of the controller’s interests.
Categories of personal data: Ordinary personal data
Description of category and recipients: To ensure the safety and protection of Pelikan’s property, we process your image, activities performed in the monitored area, entry and exit, and the date and time of these activities by monitoring the entrance area in the Eurovea Lounge and the entrance areas of the office at the Pelikan headquarters. Recipients of this data may include the technical support provider of the camera system, public authorities (e.g., the police), or an insurance company in the case of a damage event.
Legal basis and retention: The legal basis is Pelikan’s legitimate interest in safety and property protection, or the legitimate interest of a third party (e.g., clients). The legal basis also includes compliance with a legal obligation in the case of data disposal.
Retention period: 72 hours from the moment the recording is made.
3.9 Personal Data Processed in the Case of Job Applicants at Pelikan
Purpose: Recruitment and selection of future employees
Categories of personal data: Ordinary personal data
Description of category and recipients: Your personal data included in your CV, such as academic title, first name, last name, gender, date of birth, phone number, email address, residential address, photo, education details, information regarding your career and work experience (identification of current and previous employers, professional focus, awards, major career achievements, language skills, and professional qualifications), and hobbies (optionally provided voluntarily).
Legal basis: The legal basis is your consent (data subject’s consent) to the processing of personal data for this purpose. The legal basis also includes compliance with a legal obligation in the case of data disposal.
Retention period: 6 months from the end of the recruitment process.
3.10 Personal Data Processed When Handling GDPR Requests
Purpose: Processing of data protection-related requests.
Categories of personal data: Ordinary personal data
Description of category and recipients: When handling GDPR-related requests, we process personal data such as name, surname, email address, and other information related to the request. This data is necessary to identify the applicant and properly process their data protection request. Recipients of this data may include legal service providers specializing in data protection.
Legal basis: The legal basis is compliance with legal obligations arising from the GDPR regulation and the Data Protection Act. The legal basis also includes compliance with legal obligations in the case of data disposal.
Retention period: 5 years from the date of request processing.
3.11 Personal Data Processed for Debt Collection and Legal Disputes
Purpose: Debt collection and handling of legal disputes.
Categories of personal data: Ordinary personal data
Description of category and recipients: In the course of debt collection and legal dispute resolution, we process personal data such as name, surname, address, email address, phone number, date of birth, and passport/ID number. This data is necessary to identify the debtor and to properly pursue claims or conduct legal proceedings. Recipients of this data may include courts, law firms, enforcement offices, and external translators.
Legal basis: The legal basis is the legitimate interest of the controller (debt recovery, protection of legal claims) and compliance with legal obligations in the case of data disposal.
Retention period: 20 years from the conclusion of the debt recovery or legal proceedings.
3.12 Personal Data Processed for Accounting and Tax Purposes
Purpose: Fulfillment of accounting and tax obligations.
Categories of personal data: Ordinary personal data
Description of category and recipients: For accounting and tax purposes, we process personal data such as name, surname, address, identification number, and information related to payments and orders. Recipients of this data may include accounting and auditing firms, as well as tax authorities.
Legal basis: The legal basis is compliance with legal obligations arising from accounting and tax regulations.
Retention period: 10 years from the end of the accounting period to which the data relates.
3.13 Personal Data Processed When Providing Data Upon Request by Public Authorities
Purpose: Provision of personal data upon request by public authorities; protection of public health.
Categories of personal data: Ordinary personal data
Description of category and recipients: When providing personal data upon request by public authorities, we process personal data such as name, surname, email address, phone number, and address. This data is necessary for the protection of vital interests of the data subject or other individuals, particularly in the interest of public health protection. The recipient of this data is the Public Health Authority.
Legal basis: The legal basis is the protection of vital interests of the data subject or another individual, and compliance with a legal obligation in the case of data disposal.
Retention period: 4 years from the provision of data.
3.14 Personal Data Processed When Providing Information to Public Authorities
Purpose: Provision of personal data upon request by public authorities in connection with criminal investigations and inspection activities.
Categories of personal data: Ordinary personal data
Description of category and recipients: When handling requests from public authorities, we process personal data such as name, surname, address, date of birth, email address, phone number, and possibly other data required during investigations or inspections. This data is necessary to fulfill the legal obligation to cooperate in criminal investigations, inspection activities, and to maintain public order and security. Recipients of this data include law enforcement authorities (police, prosecutor’s office, courts) and other authorized public authorities, including the Slovak Trade Inspection (SOI).
Legal basis: The legal basis is the controller’s legal obligation arising from the Criminal Procedure Code, the Police Force Act, the Slovak Trade Inspection Act, the Consumer Protection Act, and other applicable legal regulations requiring cooperation.
Retention period: 5 years from the provision of information or as specified by special regulations.
3.15 Personal Data Processed When Providing Data to Banks for Sanctions List Verification
Purpose: Provision of personal data to banks for the purpose of verifying individuals against sanctions lists.
Categories of personal data: Ordinary personal data
Description of category and recipients: When providing data to banks for sanctions list verification, we process personal data such as name, surname, date of birth, and nationality. This data is required to fulfill legal obligations under the Act No. 297/2008 Coll. on Protection Against Money Laundering and Terrorist Financing and Act No. 289/2016 Coll. on the Implementation of International Sanctions. Recipients of this data are banks.
Legal basis: The legal basis is the controller’s compliance with legal obligations under the Consumer Protection Act and other legal regulations requiring cooperation.
Retention period: 6 years from the provision of data.
4. Cookies, Pixels and Their Use
Cookies are small text files that are stored in your browser or mobile device while browsing websites. Pixels are small images or "pieces of code" located on a website or in an email that collect information about your browser or mobile device, and some of them may also store cookies. Some are set by us, others originate from third parties.
We use different types of cookies on our websites:
- Operational cookies: These are necessary for the proper functioning of our websites.
- Analytical cookies: These help us understand how visitors use our websites.
- Marketing cookies: These are used to display relevant ads and offers.
1. Operational Cookies
These cookies ensure the proper functioning of our website, such as enabling login to your user account, saving items in your shopping cart, or protecting against unauthorized access. Their use is essential; therefore, we do not require your consent to store them.
Google Analytics 4
- Purpose: Measuring website traffic and analyzing user behavior.
- Controller: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- More about privacy protection can be found here.
Bloomreach
- Purpose: [Purpose not specified in the original – please provide if needed.]
- Controller: Bloomreach Inc., 82 Pioneer Way, Mountain View, CA 94041, USA
- More about privacy protection can be found here.
Cloudflare
- Purpose: Website protection against attacks (e.g., DDoS), page load speed enhancement, and security solutions.
- Controller: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
- More about privacy protection can be found here.
Vimeo
- Purpose: Ensures proper playback of embedded videos on the website.
- Controller: Vimeo Inc., 330 West 34th Street, New York, NY 10001, USA
- More about privacy protection can be found here.
Crisp Chat
- Purpose: Enables online chat with customer support and stores communication history.
- Controller: Crisp IM SARL, 2 Boulevard de Launay, 44100 Nantes, France
- More about privacy protection can be found here.
2. Analytical Cookies
These cookies allow us to collect anonymized statistical data about how you use our website. They help us better understand your behavior on the website, track traffic, identify the most popular content, and analyze site performance. Thanks to this information, we can continuously improve the user experience and tailor our services to your needs. We require your consent to store these cookies, which you can withdraw at any time in the settings.
Microsoft Clarity
- Purpose: We use the Microsoft Clarity tool on our website to analyze user behavior.
This tool helps us understand how visitors interact with our website through:
○ Creation of heatmaps (visualizing user interactions with the site)
○ Recording anonymized user sessions for the purpose of improving the user experience
- Controller: Microsoft Corporation, Redmond, WA, 91-1144445 USA
- More information about Microsoft Clarity’s privacy policy is available at: Microsoft Clarity Privacy Policy.
3. Marketing and Advertising Cookies
These cookies allow us to display personalized advertisements and content based on your preferences. We use them only with your consent.
Google Ads
- Purpose: Google Ads uses cookies to display personalized advertisements based on your previous interactions with our website or other websites. These cookies enable us to track the effectiveness of advertisements.
- Controller: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- More about privacy protection can be found here.
Facebook Ads
- Purpose: Facebook Ads uses cookies to deliver personalized advertisements and measure their effectiveness. These cookies track your interactions with our website and allow us to target ads based on your interests.
- Controller: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
- More about privacy protection can be found here.
PushAlert
- Purpose: PushAlert uses cookies to send push notifications to your browser or device. These cookies enable personalized notifications and allow us to track their delivery and interaction.
- Controller: PushAlert, 202-B, Galaxy Bazaar, Opp. Sunrise Park, Vastrapur, Ahmedabad, India
- More about privacy protection can be found here.
Reddit Pixel
- Purpose: Reddit Pixel is a tool that enables us to track user interactions with our website after viewing or engaging with our advertisements on the Reddit platform. This data helps us optimize and improve the effectiveness of our advertising campaigns. Reddit Pixel uses cookies to store information on your device. These cookies may be first-party (set by our website) or third-party (set by Reddit).
- Controller: Reddit, Inc., 548 Market St. #16093, San Francisco, CA 94104, USA
- More about cookies: See Reddit’s Cookie Notice
- More about privacy: See Reddit’s Privacy Policy for details on how your personal data is processed.
TikTok Pixel
- Purpose: TikTok Pixel is a tool that enables us to track user interactions with our website after viewing or engaging with our advertisements on the TikTok platform. This data helps us optimize and improve the effectiveness of our advertising campaigns. TikTok Pixel uses cookies to store information on your device. These cookies may be first-party (set by our website) or third-party (set by TikTok).
- Controller: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland
- More about cookies: See TikTok’s Cookie Policy
- More about privacy: See TikTok’s Privacy Policy for details on how your personal data is processed.
Your Choices
You can manage your consent for the use of marketing cookies through:
- Browser settings: Allow you to delete or refuse cookies; however, some website features may not function properly.
- Third-party tools: You can use tools like optout.aboutads.info to limit cookies.
- Partners: Each partner offers cookie management settings (see links above).
More detailed information about the specific cookies we use can be found in our cookie settings on our website.
5. Data Transfers to Third Countries
Your personal data may also be processed outside the European Economic Area (EEA). In such cases, we ensure an adequate level of data protection through the use of standard contractual clauses approved by the European Commission or other appropriate safeguards in accordance with the GDPR.
6. Children Under the Age of 16
Since the services offered through our portal may be intended for individuals under the age of 16, we process the data of such persons solely for the purposes of processing the order, properly arranging and booking the ordered services, and providing customer service. The legal basis for processing the data of these individuals is the performance of a contract or the taking of pre-contractual measures at the request of the client. We do not process personal data of persons under the age of 16 for direct marketing or promotional purposes under any circumstances.
7. Updates to the Privacy Policy
In connection with the addition of new services and products, improvements to our current offering, and changes in technology and legislation, we may update this privacy policy from time to time. The date of the last revision of this privacy policy is indicated under the “Updated” heading at the top of this page. All changes become effective at the time the revised privacy policy is published.
8. Retention of Personal Data
We will retain your personal data for as long as your consent remains valid, for as long as we have a legitimate interest in retaining it, or for as long as applicable legislation requires us to do so. Once the applicable retention period for personal data has expired, your personal data will be deleted.
Your right to request the erasure of data is described below in the section “Your Rights”.
9. Contact Information
If you have any further questions regarding the processing of your personal data, the exercise of your rights, or if you wish to contact our Data Protection Officer, you may do so in person at:
pelicantravel.com s.r.o. (Data Controller)
Pribinova 17954/10
811 09 Bratislava
Slovak Republic
or via email at: dpo@pelikan.sk, or by completing the online form.
If you are not satisfied with our response and believe that your personal data is being processed unlawfully, you may contact the supervisory authority – the Office for Personal Data Protection – at https://dataprotection.gov.sk/uoou.
10. Your Rights
Under the General Data Protection Regulation (GDPR), you have the right to request access to your personal data from Pelikán, as well as to exercise the following rights:
- Right to know whether Pelikán processes your personal data, and if so, what data and for what purpose.
- Right to rectification – this allows you to correct any incomplete or inaccurate information we hold about you.
- Right to erasure – enables you to ask us to delete your personal data where there is no longer a valid reason for us to continue processing it.
- Right to data portability – allows you to transfer your personal data in an electronic and structured format from Pelikán to another controller.
- Right to restrict processing – you may ask us to temporarily suspend the processing of your personal data, for example, while verifying its accuracy or our grounds for processing it.
- Right to object to processing – you have the right to object where your personal data is being processed based on legitimate interests of the controller or a third party, especially where your interests or rights requiring the protection of personal data outweigh those interests, particularly if you are a child. You may also object to the processing of your data for direct marketing purposes, including objection to being subject to decisions based solely on automated processing, including profiling.
- Right to withdraw consent – where we process your personal data based on your consent, you have the right to withdraw that consent at any time.
- Right to lodge a complaint with a supervisory authority – the supervisory authority for personal data protection is the Office for Personal Data Protection, which you may contact if you believe your personal data is not being processed in compliance with applicable legislation.
If you wish to request access to your personal data and exercise the above rights (except the right to lodge a complaint), please complete and submit the designated form.