Privacy policy

This notice explains how we handle personal data when you request a quotation, book or use passenger transport, make a payment, contact us or visit our website. It covers customers, passengers, group organisers and business contact persons.

1 Controller and contact details

The controller is Indigo Coaches s.r.o., Company ID 21945063, VAT ID CZ21945063, with its registered office at Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic; Commercial Register of the Municipal Court in Prague, Section C, File 408892.

Privacy enquiries: [email protected] | Telephone: +31 610 20 1224
Website: https://indigocoaches.com/

We process personal data under Regulation (EU) 2016/679 (GDPR) and applicable Czech legislation, including Act No 110/2019 Coll. Accepting a booking or submitting a contact form does not give blanket consent to marketing.

2 Personal data and its sources

2.1Booking and contact data may include your name, email, telephone number, organisation, billing address, itinerary, travel dates, pickup and destination, passenger numbers and correspondence. Passenger details are collected only to the extent needed for the journey or a legal requirement. Do not send identity document copies unless they are specifically required and a suitable secure channel has been agreed.

2.2Payment and claim records include invoices, amounts, currencies, transaction references, payment status, refunds and relevant supporting evidence. Card payments are accepted only after the booked transport has been completed, normally within 7 days; no advance card deposits are collected. Enter card details only through the approved payment channel, not by email.

2.3We receive data directly from you and, for group or corporate bookings, from the organiser, employer, travel agent or other authorised customer. Technical data from a website visit may include the IP address, browser, requested pages, timestamps and security identifiers. An organiser should give passengers this notice and share only information they are entitled to provide.

2.4The contact, itinerary and billing details necessary to arrange a booking or meet legal duties must be provided for those purposes; without them we may be unable to quote or perform the service. Optional marketing or non-essential cookie consent is not a condition of transport.

3 Purposes and legal bases

3.1Quotations, bookings, transport and customer support: steps at your request before a contract and performance of a contract with you (Article 6(1)(b) GDPR). For a corporate contact or passenger who is not the contracting party, our basis is the legitimate interest in organising and delivering the booked transport (Article 6(1)(f)).

3.2Invoicing, tax records and legally required disclosures: compliance with applicable legal obligations (Article 6(1)(c)). Handling claims, payment disputes, fraud prevention and proportionate IT security: our legitimate interests in protecting customers, our business and legal rights (Article 6(1)(f)); specific legal duties apply where relevant.

3.3Google Analytics and newsletter subscriptions through Mailchimp: consent where required (Article 6(1)(a)), with any permitted customer exception explained in section 8. Assistance information revealing health data is requested only where necessary and processed with explicit consent (Article 9(2)(a)) unless another specific legal exception applies. Please describe the assistance needed rather than a medical diagnosis.

4 Recipients of personal data

4.1Relevant data is shared only as necessary with drivers and contracted transport operators, booking and communication providers, website and IT providers, banks and payment service providers, accountants, professional advisers and insurers handling a relevant claim. Authorities receive information where required by law or a lawful request. We do not sell personal data.

4.2Providers acting on our instructions are bound by appropriate processing arrangements and confidentiality. Banks and other regulated payment providers, including Revolut where used, may act as independent controllers for their own legal, security and payment duties; their own privacy notices also apply. We disclose only data relevant to the recipient's role.

We use Google Analytics for website statistics and Mailchimp for newsletters, as described in sections 8 and 9. They receive the data relevant to those purposes under the applicable processing terms.

5 Transfers outside the European Economic Area

Google Analytics and Mailchimp can involve processing in the United States and other countries outside the EEA. Google uses Google group companies and authorised service providers; Mailchimp uses The Rocket Science Group LLC and relevant Intuit group entities and subprocessors. Transfers rely on the applicable provider processing terms and a valid GDPR mechanism, including a relevant adequacy decision such as the EU-U.S. Data Privacy Framework where the recipient and processing are covered, or European Commission standard contractual clauses with necessary safeguards. Contact us for the relevant destinations and a copy or explanation of the safeguards.

6 How long we retain data

Retention depends on the purpose and the applicable legal requirement, not simply on whether you remain a customer. We delete or irreversibly anonymise data when there is no continuing lawful need to retain it.

Record category	Retention period or determining criteria
Enquiries and quotations	For the time needed to answer and follow up the enquiry or negotiations; longer only where a documented legal or claim-related need remains.
Bookings, journeys and claims	For performance of the booking and the relevant statutory limitation or complaint periods; where a dispute is ongoing, until its final resolution and any necessary enforcement period.
Invoices and statutory records	For the applicable accounting and tax retention period. Czech VAT tax documents are generally retained for 10 years from the end of the tax period to which the transaction relates.
Technical and security records	For the period necessary to operate, diagnose and secure the service; records relevant to a detected incident may be retained for its investigation and any related claims.
Newsletter contacts and consent	For the subscription or other lawful marketing purpose, until withdrawal or objection. Minimal consent evidence and suppression records may be kept for accountability and to respect an opt-out.
Google Analytics records	For the user/event retention period configured for website measurement. Cookie lifetimes are separate and depend on the cookie settings and browser. See section 9 for the relevant criteria and the defaults published by Google.

7 Security

We apply technical and organisational measures appropriate to the risks, including access limited to authorised persons, suitable access controls, secure handling and sharing, and confidentiality requirements for staff and providers. Please avoid sending unnecessary sensitive information or full card credentials in ordinary correspondence. Security incidents are handled and reported where required by law.

8 Newsletters through Mailchimp

8.1We use Mailchimp to manage subscriptions and send newsletters about Indigo Coaches transport services. The provider is The Rocket Science Group LLC d/b/a Mailchimp, part of Intuit, based in the United States. Mailchimp processes our subscriber lists on our instructions under its Data Processing Addendum; its own privacy notice also explains processing for its independent purposes. Provider notice: https://www.intuit.com/privacy/statement/.

8.2Newsletter data includes the email address, name where supplied, subscription preferences, subscription or consent records, delivery status and unsubscribe information. Our basis is separate consent (Article 6(1)(a) GDPR), or the limited lawful customer exception for our own similar services, based on our legitimate interest (Article 6(1)(f)). A booking or quotation request does not automatically subscribe you.

8.3You can unsubscribe using the link in each newsletter or email [email protected]. Withdrawing consent does not affect earlier lawful processing. Direct marketing stops when you object or unsubscribe; a minimal suppression record may be retained to prevent further mailings. Service messages relating to an existing booking remain separate.

8.4Where email open or link-click tracking is enabled, Mailchimp can record interactions, timestamps and related technical information through tracking images or links. Such optional measurement requires prior information and consent where applicable. You may withdraw optional tracking consent by contacting us; unsubscribing stops the newsletter.

9 Google Analytics and website cookies

9.1We use Google Analytics to understand visits and improve the website. The service is provided by Google LLC (United States) and relevant Google affiliates under the applicable Google terms. Data may include pseudonymous browser or device identifiers, page views, sessions, interactions, referral information and approximate location. Google acts as a processor for Analytics data. Provider notice: https://policies.google.com/privacy.

9.2Our basis for optional analytics is consent (Article 6(1)(a) GDPR). Non-essential Analytics cookies and related measurement require prior consent where prescribed by law. Refusing analytics does not prevent you from requesting a quotation or booking transport. Browsing, closing a banner or accepting these terms does not constitute analytics consent.

9.3Google publishes _ga (to distinguish visitors) and _ga_<container-id> (to retain session state) as its standard GA4 cookies, each with a default expiry of 2 years. Actual expiry can be shorter or change because of site configuration, repeat visits or browser limits. The figures stated here are the published Google defaults.

9.4Cookie expiry differs from server-side Analytics retention. Google's standard GA4 settings allow 2 or 14 months for user/event data; aggregated reports may follow different retention rules. The applicable period is the period configured for the website's measurement purpose, which is made available with the analytics consent information or on request.

9.5Technical cookies may support security, forms and functions you request. You can change optional cookie choices through the website controls where available and remove cookies in your browser. Google also provides an Analytics opt-out tool at https://tools.google.com/dlpage/gaoptout. This is an additional choice; our obligation to obtain any required prior consent remains. External social media links are governed by the destination provider's privacy notice.

10 Your rights

Subject to the conditions of the GDPR, you may request access to your data and a copy, correction of inaccurate or incomplete information, erasure, restriction of processing, and portability of data processed automatically on the basis of consent or a contract. Erasure may be limited where retention is legally required or necessary to establish, exercise or defend a claim.

You may object, on grounds relating to your particular situation, to processing based on legitimate interests. We will then stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims. You may object to direct marketing at any time without having to give a reason. You may withdraw consent at any time.

Send a request to [email protected], to our registered office or through another legally permitted channel. We may request proportionate information to verify identity where there is a reasonable doubt; we do not routinely require a copy of an identity document. The first copy and handling of a request are normally free, subject to the GDPR rules on manifestly unfounded or excessive requests and additional copies.

We respond without undue delay and normally within one month of receipt. Where justified by complexity or the number of requests, this may be extended by up to two further months; we notify you within the first month and give reasons. If we cannot act on a request, we explain why and tell you about your complaint and judicial remedies.

11 Supervisory authority and other information

You may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic; email [email protected]; website https://uoou.gov.cz/. You may also contact another competent supervisory authority, in particular in the EU Member State of your habitual residence or workplace, or where the alleged infringement occurred. Contacting us first is not a condition of making a complaint.

The processing described in this notice does not involve solely automated decisions producing legal or similarly significant effects on you. Any materially different processing requires appropriate prior information and a lawful basis. Updated notices identify the relevant version; a change to this notice does not create consent to a new purpose or retrospectively legitimise processing.

Download PDF version | Terms and Conditions | Privacy Policy