1. Data controller and the parking operator

PARKNITO s.r.o., Company ID 08216797, Vavrečkova 5262, 760 01 Zlín, Czech Republic, is the controller for its own operation of the platform. Contact [email protected] or the registered office about personal data.

Parknito s.r.o. acts as a parking intermediary. Unless expressly stated otherwise for a specific location, the parking operator is the owner or manager identified on that location’s page. That operator is the relevant controller for its own parking services and camera operation. Where Parknito processes data only on its instructions, Parknito acts as a processor within that scope, subject to the applicable contractual arrangement.

2. Data and its sources

Depending on the service, data includes your name, email, phone number, account identifier and preferences, organization and member permissions, vehicle registration and type, booking location and period, booking status, price, payment references and billing details. Google sign-in may provide the basic profile information made available by that service.

Data comes from you, an authorized person booking for you, or the parking operator. Location management also involves uploaded photographs, descriptions and access instructions. Using the website generates technical information such as IP address, device/browser information, request times and security logs. Camera and access data is described in section 7.

3. Purposes and legal bases

Accounts, booking intermediation, payments, contractual communications and steps you request before a contract use Article 6(1)(b) GDPR. Required information is necessary for the relevant service; without it, an account, reservation or payment may not be completed.

Accounting and tax duties use Article 6(1)(c) GDPR. Platform security, fraud prevention, incident handling and protection of legal claims may rely on legitimate interests under Article 6(1)(f), subject to assessing the effect on your rights. Optional external maps and visit analytics require separate permission that you can withdraw; processing based on consent uses Article 6(1)(a).

4. Recipients and service providers

The selected operator and its authorized staff receive the information necessary for booking, parking and access, which may include contact details, vehicle registration, booking times and status. This does not authorize unrelated uses.

Technical services include Google/Firebase for hosting, authentication, databases, storage and security, including reCAPTCHA; SumUp or Stripe for the applicable payment flow; Resend or Amazon Web Services according to email configuration; Mapbox after maps are enabled; and Google Analytics after separate analytics permission. Access-device providers, accountants, legal advisers and public authorities may receive data where necessary and legally justified. Some providers, particularly payment providers, act as separate controllers for their own legal purposes.

5. Processing outside the European Economic Area

International providers may process or access information outside the European Economic Area. Transfers must meet Chapter V GDPR, for example through an adequacy decision or standard contractual clauses with necessary supplementary measures. Using an overseas provider does not itself meet those requirements.

You can request information about recipients, processing countries and safeguards for a particular service, and a copy of relevant safeguards where legally available, at [email protected].

6. Cookies, local storage, maps and analytics

The application sets the auth-token sign-in cookie for up to 1 hour. The parknito-locale language choice lasts 1 year; the theme preference stays in local storage until changed or deleted. The parknito-cookie-consent choice lasts 180 days. Firebase and security services may use additional technical identifiers needed for sign-in and protection.

Mapbox loads after you enable external maps. It receives IP addresses and map requests and may use browser storage. Location lists and grids work without maps. Change your choice through Cookie settings in the footer or the persistent page button. Withdrawal stops further map loads, removes active maps and clears Mapbox local-storage entries; it does not affect earlier lawful processing.

Google Analytics 4 loads only after your separate analytics consent. It helps us understand visits to public pages using _ga and _ga_* cookie identifiers, configured for up to 180 days, and technical device and visit information. Our events exclude URL query parameters, account, booking and payment details; advertising personalization and Google signals are disabled. Google may process data outside the EEA as described in section 5. Withdrawal stops further measurement and removes our analytics cookies; it does not automatically delete information already sent. Retention in Google Analytics depends on the service settings; contact [email protected] for details.

Non-essential storage or access to information on your device requires consent under section 89(3) of Czech Act No. 127/2005 Coll. Cookie choices do not accept the Terms of Service or marketing. Browser controls also let you remove storage; removing essential data may require signing in again.

7. Cameras and automatic access checks

At equipped locations, processing may include vehicle and registration-plate images, recognized registration, time and direction of passage, and the access-check result. The relevant camera controller must explain its purpose, legal basis and retention. This policy does not replace that obligation.

Automatic access may compare vehicle registration or a phone number with booking permissions and validity. An error can prevent entry or exit; ask the operator for individual review. Where a solely automated decision has legal or similarly significant effects, Article 22 GDPR safeguards apply, including human intervention and contesting the decision under that Article.

8. Retention and closing an account

Account information is needed while the account is maintained. Booking information and correspondence are kept for performance and related requests, then only as needed for a legal duty or specific legal claim during the applicable limitation period or proceedings. Operational and security logs should be retained no longer than needed for diagnosis and particular incidents.

Accounting documents are generally retained for 5 years after the relevant accounting period; other records or legal grounds may require a different period. This does not automatically apply to all account data or camera images. The relevant controller determines image retention by purpose and necessity and provides that information for its location or camera system.

Request account closure or erasure at [email protected] or through the account deletion-request feature. A request requires assessment and does not immediately erase all bookings, accounting records or another controller’s data. Legal retention duties and justified unresolved claims may limit erasure.

9. Your rights and requests

Subject to GDPR conditions, you have rights of access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests and withdraw consent. Portability applies particularly to automated processing based on consent or contract. These rights have statutory conditions and exceptions.

Send requests to [email protected]. Identity checks will be proportionate to the sensitivity of the request. We respond without undue delay and within 1 month. A lawful extension of up to 2 further months will be explained within the first month. You can complain to the Czech Office for Personal Data Protection or another competent supervisory authority.

10. Security and policy updates

Protection includes authentication, role-based access, communication security and access limited to authorized persons. Technical safeguards cannot guarantee absolute security. Protect your credentials and report suspected unauthorized access to [email protected].

The current text and its version date are available here. A new purpose or optional service requires corresponding information and fresh consent where legally required. Changing this policy does not itself create a new legal basis.