+420 602 333 369 Sign in EN CZ DE EN CZK CZK EUR CHF
Home / Privacy Policy

Privacy Policy

GDPR — Personal Data Processing Policy

PART 1 – Privacy Statement

The protection of personal data is a priority for Nobless Line s.r.o., with its registered office at Václavské náměstí 19, 110 00 Prague 1, Company ID No.: 25609815 (hereinafter referred to as “Nobless Line” or “the controller”) is a priority. We are committed to processing personal data transparently, lawfully, and to the extent necessary, and to ensuring a high level of protection for such data.

This document explains what personal data we process, why, on what legal basis, for how long, to whom we disclose it, and what rights you have as a data subject.

We are committed to ensuring that personal data will not be misused and will be protected in accordance with the highest possible technical and organizational standards.

PART 2 – Basic Terms

Personal Data

Information about an identified or identifiable natural person (e.g., name, email, phone number, date of birth).

Data Subject

A natural person to whom the personal data relates.

Data Controller

The entity that determines the purposes and means of processing. Unless otherwise specified, the controller is Nobless Line.

Processor

A person or company that processes personal data on behalf of the controller based on the controller’s instructions.

Processing of personal data

Any operation involving personal data—collection, storage, modification, use, disclosure, erasure, etc.

Legal Framework

Processing is governed primarily by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data.

PART 3 – What Personal Data We Process

We process only the data necessary for the provision of our transportation services:

  • first and last name
  • date of birth
  • email address
  • phone number
  • IP address
  • Information about reservations, trips, and travel profile
  • camera recordings from the vehicle interior and trunk (see Section 10)
  • Technical data from communications with customer service

The accuracy and completeness of personal data are a condition for the valid conclusion of a transportation contract.

By purchasing a ticket, the passenger confirms that the information provided is true and complete. The intentional provision of false, incomplete, or invalid information (including a phone number) constitutes a violation of the terms of carriage and may result in the invalidity of the contract of carriage or refusal of boarding without entitlement to compensation.

PART 4 – Purposes of Personal Data Processing

1. Performance of the Contract of Carriage

Legal basis: Article 6(1)(b) of the GDPR—processing is necessary for the performance of a contract to which the passenger is a party.

This includes, in particular:

  • creating and managing the reservation and selling the ticket
  • unambiguous identification of the passenger during check-in (the ticket is personal and non-transferable; the information on the ticket must match the travel document)
  • operational communication regarding schedule changes, delays, or service cancellations
  • handling complaints and cancellation policies
  • setting up a customer account

Without providing this information, the contract of carriage cannot be concluded or fulfilled.

2. Compliance with the carrier’s legal obligations

Legal basis: Article 6(1)(c) of the GDPR—processing is necessary for compliance with a legal obligation to which the controller is subject.

These include, in particular, obligations arising from:

  • Regulation (EU) No. 181/2011 of the European Parliament and of the Council on the rights of passengers in bus and coach transport — the carrier’s obligations regarding compensation, assistance, and communication with passengers in emergency situations (Articles 7, 9, 16, and 17 of this Regulation)
  • Act No. 563/1991 Coll., on Accounting, and relevant tax regulations (mandatory archiving of documents)
  • Act No. 111/1994 Coll., on Road Transport
  • obligations toward insurance companies in the settlement of insurance claims
  • obligations toward the Czech Police and foreign authorities in criminal or administrative proceedings

3. Legitimate Interests of the Controller

Legal basis: Article 6(1)(f) of the GDPR — processing is necessary for the purposes of the controller’s legitimate interests, and the interests or fundamental rights of the data subjects do not override those interests.

Legitimate interests include:

  • the secure operation of IT systems and the prevention of fraud and misuse of reservations
  • direct contact with each adult passenger—reservations for individual passengers are independent of one another; the lead passenger may cancel their reservation, while other passengers may continue their journey; direct contact with each adult passenger is the only guarantee that the carrier will fulfill its obligations toward every person being transported; for minor passengers, the phone number of the accompanying adult is accepted
  • Protection of passengers’ property (locating the owners of found items, documents, and electronic devices)
  • preservation of evidence in the event of disputes, complaints, or insurance claims
  • Operation of a video surveillance system in the vehicle and luggage compartments (for more details, see Section 10)

4. Marketing and Newsletters (only with consent)

Legal basis: Article 6(1)(a) of the GDPR—consent of the data subject.

If you agree to subscribe to the newsletter, we use your contact information to send you information about news, events, operational changes, and travel recommendations. You may withdraw your consent at any time without affecting the lawfulness of prior processing.

PART 5 – How Long We Retain Data

  • Data for the performance of a contract: for the duration of the contractual relationship and thereafter for the statutory retention period (typically 5–10 years in accordance with accounting and tax regulations).
  • Data processed to comply with a legal obligation: for the period specified by applicable laws.
  • Data processed based on legitimate interest: for as long as necessary, typically 3 years to defend our rights in the event of a dispute.
  • CCTV recordings: for as long as strictly necessary, but no longer than permitted by applicable laws and the technical capabilities of the system.
  • Data processed based on consent: until consent is revoked.

PART 6 – Who Has Access to Personal Data

Employees of the controller

Only to the extent necessary to perform their job duties.

Processors — contractual partners

Based on a personal data processing agreement pursuant to Article 28 of the GDPR. Currently:

  • eSports.cz, s.r.o., Doudlebská 836/30, Plzeň (IT services and reservation system)
  • ProfiSMS s.r.o., Rohanské nábřeží 678/29, Prague 8 (SMS gateway)

Processors comply with all requirements for the security of personal data.

Public Authorities

Personal data may be transferred to public authorities (Czech Police, foreign authorities, tax authorities, etc.) only if required by law.

PART 7 – Withdrawal of Consent

Consent to the processing of personal data for marketing purposes may be withdrawn at any time via:

  • email: noblessline@noblessline.cz (with the subject line “GDPR — Withdrawal of Consent”)
  • in writing to the company’s registered office

Contact information for the data controller
: Nobless Line s.r.o.
, Václavské náměstí 19
, 110 00 Prague 1

Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

Communications may be monitored for security reasons and to comply with legal obligations.

PART 8 – Your Rights Under the GDPR

As a data subject, you have the right at any time to:

  • a) withdraw your consent to processing
  • b) request access to your personal data being processed (Article 15 of the GDPR)
  • c) request the rectification of inaccurate or incomplete data (Article 16 of the GDPR)
  • d) request the erasure of personal data (“right to be forgotten”) — subject to the conditions set forth in Article 17 of the GDPR
  • e) request restriction of processing (Article 18 of the GDPR)
  • f) object to processing, particularly when processing is based on a legitimate interest or for direct marketing purposes (Article 21 of the GDPR)
  • g) to data portability (Article 20 of the GDPR)
  • h) to be informed of a personal data breach
  • i) file a complaint with the supervisory authority—the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz

You may exercise your rights in writing at the company’s registered office or via email: noblessline@noblessline.cz. To protect your data, we may ask you to verify your identity.

SECTION 9 – Is the provision of data mandatory?

Providing personal data is:

  • required for making a reservation and entering into a transportation contract—without providing the required data, we cannot enter into a transportation contract or provide transportation services,
  • voluntary for marketing communications — failure to provide consent for marketing does not affect the ability to enter into a transportation contract.

The intentional provision of false, incomplete, or invalid data constitutes a violation of the terms of carriage and may result in the invalidity of the contract or refusal of check-in without entitlement to compensation.

PART 10 – Video Surveillance

The interior of the vehicle, luggage compartments, and access areas may be monitored by a camera system for the purpose of:

  • ensuring the safety of passengers and crew
  • protecting the health and property of passengers and the carrier
  • preventing unlawful conduct
  • documenting extraordinary events, complaints, and damage incidents

Legal basis: Article 6(1)(f) of the GDPR — the carrier’s legitimate interest.

Camera recordings are made available only to authorized employees of the carrier, the Czech Police, and foreign authorities in criminal or administrative proceedings, as well as to entities authorized to investigate extraordinary events or damage incidents. The recordings may be used as evidence in complaint proceedings and investigations of damage claims.

PART 11 – How We Protect Your Personal Data

Data Controller:

  • uses security measures commensurate with the current state of the art
  • regularly tests system security and updates protective mechanisms
  • minimizes the scope of processed data to the necessary minimum
  • enters into personal data processing agreements with all processors

Nevertheless, for objective reasons, no system can be considered absolutely impenetrable. The data subject is obligated to protect their own passwords and login credentials from misuse.

PART 12 – Contact Information for the Data Controller

Nobless Line s.r.o.
Václavské náměstí 19, 110 00 Prague 1
Email: noblessline@noblessline.cz
Phone: +420 602 333 369
Website: www.noblessline.cz

Technical booking traces and abuse prevention

When you register, sign in, or create a reservation on the website, we record technical data: your IP address and the country derived from it, browser and operating system type, browser language, and a random device identifier stored in the technical cookie nl_zar. This cookie contains no personal data, is not used for marketing, and is not shared with any third party.

We process this data on the basis of legitimate interest (Art. 6(1)(f) GDPR) to prevent abuse of the reservation system and to enforce the contractual conditions of carriage — in particular to detect fictitious reservations, circumvention of an account block, and repeated failure to appear for departure. The system only flags suspicious reservations; any decision to restrict an account or reservation is always made by a member of the carrier's staff. In the event of a serious breach of the conditions of carriage, the recorded data may serve as the basis for a contractual penalty or a claim for damages.

Technical traces are kept for 12 months; after that, the IP address is automatically shortened and browser details are deleted, so the records can no longer be linked to a specific person. You may object to processing based on legitimate interest at any time at rezervace@noblessline.cz.

This Privacy Policy is effective as of December 1, 2025, and may be updated from time to time. The current version is always available on the carrier’s website.