Privacy Policy

Depending on how you use the website, we process the following categories of data:

• Identification and contact data – first name and surname, phone number, e-mail address, and for business customers also company name and company ID.
• Vehicle data – make and model, description and extent of the damage or the requested treatment.
• Service enquiry data – service type, affected body parts, vehicle size, paint condition, preferred (non-binding) date and other parameters you fill in the enquiry form.
• Photos – images of the vehicle or damage that you upload for an orientational estimate or to prepare a quote.
• Voice recordings – if you use the microphone button to describe your request, a short audio recording is made and automatically converted to text; the transcript (and possibly the recording) becomes part of your enquiry.
• Communication content – messages you send us via the virtual assistant, by e-mail, by phone or via WhatsApp.
• Technical and analytics data – IP address, device and browser type, operating system, approximate location derived from the IP address, information about your visit and behaviour on the website, cookie identifiers and advertising identifiers (e.g. gclid from a Google Ads click).
• Data stored on your device – the assistant conversation is kept in your browser storage (localStorage) so it persists between pages.

Providing personal data in the enquiry form is voluntary; however, without contact details we cannot get back to you with an estimate or a quote. We deliberately do not process special categories of data (“sensitive data”) and ask that you do not include them in free text or recordings.

We process your personal data for the following purposes and on the following legal bases:

• Handling your enquiry and preparing the service (price estimate, call-back, arranging an appointment, preparing and performing a contract) – legal basis: performance of a contract and steps taken at your request prior to entering into it (Art. 6(1)(b) GDPR).
• Orientational price estimate from a photo and virtual-assistant replies – legal basis: steps taken at your request and our legitimate interest in providing the requested website function (Art. 6(1)(b) and (f) GDPR).
• Compliance with legal obligations (in particular accounting and tax) – legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Protecting and securing the website, preventing misuse and fraud, and establishing or defending legal claims – legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Direct marketing of our own similar services to existing customers (e.g. by e-mail) – legal basis: our legitimate interest, with the right to object and unsubscribe at any time (Art. 6(1)(f) GDPR; Section 7 of Act No. 480/2004 Coll.).
• Analytics, remarketing, ad measurement and marketing cookies – legal basis: your consent (Art. 6(1)(a) GDPR), given in the consent management tool and revocable at any time.
• Publishing “before / after” photos of the vehicle in our reference gallery and on our social media – legal basis: your consent granted by accepting the terms of use; we do not publish identifying data (e.g. licence plates). You can request removal of the photos at any time at info@garservice.cz.

The website offers three AI-based features: a virtual assistant (chat), an orientational price estimate from a photo, and speech-to-text. For these features we use a language model from Google via the Google Gemini API.

If you use these features, we transmit the content you provide – message text, an uploaded photo or a voice recording – to the provider of this interface in order to generate a reply, estimate or transcript. Please do not enter data you do not wish to have processed, or personal data of third parties.

The assistant’s estimates and replies are orientational and informational only. This is not automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR – the final assessment and price are always confirmed by a human (technician) after inspecting the vehicle in person. The assistant is a tool and may make mistakes.

Cookies are small files stored in your browser. The localStorage and sessionStorage technologies work similarly. We use them to the following extent:

• Necessary (technical) – required for the basic operation of the website and to remember your consent choice. Stored without consent on the basis of our legitimate interest. This also includes storing the assistant conversation on your device (localStorage), used purely to conveniently continue the chat.
• Analytics – measure traffic and behaviour on the website (e.g. Google Analytics 4). Stored only with your consent.
• Marketing – used to measure and target advertising and remarketing (e.g. Google Ads, Meta, TikTok). Stored only with your consent.

You grant and manage consent to analytics and marketing cookies through the consent management tool shown when you visit the website; you can change or withdraw your choice at any time. Cookie settings can also be adjusted directly in your browser. Declining optional cookies does not affect the basic functionality of the website.

Based on your consent, we may use the third-party tools below. They are deployed via a tag manager (Google Tag Manager) and only activate after consent is given:

• Google Analytics 4 – analysis of traffic and user behaviour.
• Google Ads – conversion measurement, remarketing and ad targeting; we use enhanced conversions, in which contact data (e-mail, phone, name) is irreversibly hashed (SHA-256) before being sent, so we transmit it in a form that cannot be read directly.
• Meta (Facebook/Instagram) – advertising pixel and conversion measurement via the Conversions API, both from the browser and from the server; as part of conversion measurement we may also share with Meta the information that an enquiry led to an agreed order (an offline conversion). Contact data (e-mail, phone, name) is irreversibly hashed (SHA-256) before being sent, so we transmit it in a form that cannot be read directly.
• TikTok – advertising pixel and conversion measurement.
• Google Business Profile – display of ratings and reviews from our business listing.

The operators of these tools may act as independent or joint controllers for the purposes of ad measurement and targeting. Details of their processing can be found in their own privacy policies, for example Google’s privacy policy.

We disclose your data only to the extent necessary to the following categories of recipients:

• IT and hosting providers – operation of the website and servers (an EU server-infrastructure provider and a content-delivery and security network provider).
• AI interface provider – Google (Google Gemini API) for the assistant, photo estimate and speech-to-text features.
• Map service providers – Google (map of the place of business location).
• Analytics and advertising tool providers – Google, Meta, TikTok (subject to consent).
• Communication-channel providers – the operator of WhatsApp (Meta Platforms Ireland Ltd.) and the WhatsApp Business API provider (360dialog GmbH, Germany), if you contact us via that channel.
• Subcontractors and cooperating technicians – to the extent needed to perform the service (e.g. a paint shop); bound by confidentiality.
• Providers of accounting, tax and legal services.
• Public authorities – where required by law.

With processors who process personal data on our behalf we conclude data processing agreements under Art. 28 GDPR. We do not sell your data.

Some providers (in particular Google, Meta and TikTok) may process data outside the European Economic Area, for example in the United States. Such transfers take place under the safeguards required by the GDPR – in particular a European Commission adequacy decision (the EU–US Data Privacy Framework, where the recipients are certified) or standard contractual clauses approved by the European Commission, where appropriate with additional technical and organisational measures.

We retain personal data only for as long as necessary to fulfil the purpose:

• Enquiry data that did not lead to an order – as a rule for 12 months from the last communication, after which we delete or anonymise it.
• Customer data and contractual documentation – for the duration of the contractual relationship and then for the running of limitation periods (as a rule 3 years, longer for some claims) to protect legal claims.
• Accounting and tax documents – for the period set by law (as a rule 10 years).
• Data processed on the basis of consent (marketing, cookies) – until consent is withdrawn, and no longer than the validity of that consent.
• The assistant conversation stored on your device – remains in your browser until you delete it (e.g. via the conversation restart button or by clearing your browser data).

In relation to your personal data you have, in particular, the following rights under the GDPR:

• the right of access to your data and to a copy of it;
• the right to rectification of inaccurate data or completion of incomplete data;
• the right to erasure (“right to be forgotten”), unless a legal obligation to retain the data prevents it;
• the right to restriction of processing;
• the right to data portability for data processed on the basis of consent or a contract;
• the right to object to processing based on legitimate interest, including direct marketing;
• the right to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal;
• the right to lodge a complaint with a supervisory authority.

You can exercise your rights at the e-mail above. We may ask you to verify your identity so that we do not disclose data to the wrong person. We will handle your request without undue delay, at the latest within one month.

If you believe that our processing of your data infringes the law, you have the right to lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or misuse – in particular encrypted transmission (HTTPS), restricting access to authorised persons, and hashing contact data passed to advertising platforms. However, transmission of data over the internet cannot be guaranteed to be completely secure.

The website and our services are not intended for children. We do not knowingly collect children’s personal data. If we discover that we have unintentionally obtained a child’s data without the consent of a legal guardian, we will delete it without undue delay.

We may update this policy from time to time, for example in response to changes in processing or in the law. The current version is always available on this page, showing the date of the last update.