Privacy Policy

GDPR

If you are a job applicant, a customer, or a visitor to our website, you are entrusting us with your personal data. We are responsible for its protection and security. Please read the following information about how we process your personal data and the rights available to you.

The processing of personal data is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”).

Who is the controller of your personal data?

Your data is processed by the following joint controllers:

  • LUTO Automotive CZ, s.r.o., registration no.: 28684320, Korunní 588/4, Vinohrady, 120 00 Prague, Czech Republic
  • LUTO Services s.r.o., registration no.: 04937384, Holandská 2, 639 00 Brno, Czech Republic
  • LUTO Group SK, s.r.o., registration no.: 36681105, Štúrová 27, 040 01 Košice, Slovak Republic
  • MVT – Partners, s.r.o., registration no.: 47881259, Štúrová 27, 040 01 Košice, Slovak Republic
  • LUTO GROUP, s.r.o., registration no.: 53515552, Kuzmányho 29, 040 01 Košice, Slovak Republic
  • LUTO Germany GmbH, registered in the commercial register of Amtsgericht Hof, HRB 5812, Schleizer Straße 1, 95 111 Rehau, Germany
  • MM logistics solutions GmbH, registered in the commercial register of Amtsgericht Berlin (Charlottenburg), HRB 265923 B, Victoriastraße 2, 45772 Marl, Germany
  • LUTO Personalservice GmbH, registered in the commercial register of Amtsgericht Hannover, HRB 221774, Victoriastraße 2, 45772 Marl, Germany
  • MV Immobilien GmbH, registered in the commercial register of Amtsgericht Hof, HRB 5937, Schleizer Straße 1, 95 111 Rehau, Germany
  • LUTO Poland Sp. z o.o., registered in the court register KRS, no.: 0000798405, Aleja Jana Pawła II 22, 00-133 Warsaw, Poland
  • Luto Hungary Kft, registered in the commercial register under registration no. (Cg.): 08-09-035002, Kálvária utca 1–3, 9024 Győr, Hungary
  • LUTO Group, registration number (ID): 59324228, Zuid Hollandlaan 7, 2596 AL The Hague, Netherlands

We operate the website lutogroup.com. We process personal data as controllers, meaning we determine how personal data is processed, for what purposes, and for how long.

The representative of the joint controllers is LUTO Automotive CZ, s.r.o., which maintains records of processing activities on behalf of all joint controllers and centrally handles all data subject rights requests. You may exercise your rights (access, rectification, erasure, objection, etc.) with this representative or with any of the joint controllers listed above. An arrangement between the joint controllers governing their respective obligations in the area of personal data protection exists; its substance is available upon request at info@lutogroup.com.

If you wish to contact us, please reach us at: info@lutogroup.com or in writing at: Vyskočilova 1481/4, 140 00 Prague

Our commitment

We declare that, as controllers of your personal data, we comply with all legal obligations required by applicable legislation, in particular the GDPR, and that:

  • we will process your personal data only on the basis of a valid legal ground, primarily legitimate interest, performance of a contract, a legal obligation, or consent given by you,
  • we fulfil the information obligation under Article 13 GDPR prior to the commencement of processing,
  • we will enable and support you in exercising your rights under the GDPR.

When do we process personal data?

  1. When we communicate with each other
  2. When you apply for a job position
  3. When you browse our website (cookies)

1. Personal data in the context of communication with us

If you contact us by email, we process the personal data you provide to us in the course of that communication.

Personal data we process: first name and surname, email address, telephone number (if provided), content of the message.

Why we process the data: Communication is our legitimate interest — we need the data to respond to your enquiries and handle the matters you need to resolve with us. Without processing it, we will not be able to reply to you.

Who may have access to the data: the joint controllers listed above.

How long we process the data: for 3 years from our last communication.

2. Personal data of job applicants

Personal data we process: first name and surname, email address, telephone number, nationality, cover letter, CV (optional), and any other information you provide in your application.

Why and on what basis we process the data:

  • Pre-contractual measures – we process your data in order to assess your application and contact you with a job offer.
  • Consent – on the basis of your consent, we share your data with client companies (companies seeking workers, operating primarily within EU countries) for the purpose of facilitating employment. Consent is given at the time of submitting your application and may be withdrawn at any time at info@lutogroup.com.
  • Consent – after the conclusion of the recruitment process, we may retain your data for the purposes of future suitable positions, exclusively on the basis of your explicit consent, which we will request separately in such a case.

Who may have access to the data:

  • the joint controllers listed above,
  • client companies – companies seeking workers, operating primarily within EU countries (only on the basis of your consent),
  • Webkitty hosting s.r.o., registration no.: 198 63 209, Budilova 161/15, 301 00 Plzeň – web hosting provider,
  • Lukáš Tisoň, registration no.: 063 23 120, Francouzská 966/33, Vinohrady, 120 00 Prague 2 – website administration,
  • other processors as applicable.

Providing personal data is voluntary. However, without it we are unable to include you in the recruitment process.

How long we process the data: for the duration of the recruitment process, and in the event of concluding a contract, for the duration of the employment relationship. If the recruitment process does not result in your selection, we will delete your data within 12 months of its conclusion, unless you grant us consent to retain it for future opportunities.

3. Cookies and website browsing

Our website uses cookies. Detailed information on which cookies we use, their purpose, who has access to them, and how long they are retained can be found in the separate Cookie Policy available on our website.

Security and protection of personal data

We protect personal data using technical and organisational measures corresponding to the current state of the art. We have implemented measures to prevent unauthorised access to, misuse of, or damage or destruction of your personal data.

Transfers of data outside the European Union

We process personal data primarily within the European Union. In the case of job applicants, your data may, on the basis of your consent, be transferred to a client company operating outside the EU. In such cases, we will ensure appropriate safeguards for the protection of personal data, either through standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) or on the basis of your explicit consent to such transfer (Art. 49(1)(a) GDPR). You may request information about the country to which your data is transferred at any time.

Your rights in relation to personal data protection

All rights or enquiries may be exercised at: info@lutogroup.com or in writing at: Vyskočilova 1481/4, 140 00 Prague.

Under the GDPR, you have the following rights:

  1. Right to information – fulfilled by this document.
  2. Right of access – you may request at any time that we inform you, within 1 month, of what personal data we process about you and why.
  3. Right to rectification – if you find that your personal data is outdated or incomplete, you have the right to have it supplemented or corrected.
  4. Right to restriction of processing – you may exercise this right if you believe we are processing inaccurate data about you, if you believe the processing is unlawful but do not wish to have all data erased, or if you have objected to processing.
  5. Right to erasure (right to be forgotten) – you have the right to request the erasure of your personal data. In that case, we will delete all your data from our systems and from the systems of processors and backups, unless we are required by law to retain it. We will inform you when the erasure is complete. We require a period of 1 month to fulfil the right to erasure.
  6. Right to data portability – if you wish to transfer your personal data to another controller, we will provide it to you in a machine-readable format within 1 month.
  7. Right to object – you have the right to object at any time to the processing of personal data carried out on the basis of our legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests or rights.
  8. Right to withdraw consent – if you have given us consent to process your personal data, you have the right to withdraw that consent at any time free of charge, without affecting the lawfulness of processing carried out prior to the withdrawal.
  9. Právo podat stížnost u dozorového úřadu – pokud máte pocit, že s vašimi údaji nezacházíme v souladu se zákonem, máte právo se kdykoli obrátit na dozorový úřad pro ochranu osobních údajů. Stížnost můžete podat u úřadu v členském státě vašeho obvyklého bydliště, místa výkonu zaměstnání nebo místa, kde došlo k údajnému porušení. Příslušné dozorové úřady v zemích, kde působíme:
    • Česká republika: Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz
    • Czech Republic: Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz
    • Slovakia: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk
    • Poland: Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl
    • Germany: Federal Commissioner for Data Protection and Freedom of Information (BfDI), www.bfdi.bund.de
    • Hungary: National Authority for Data Protection and Freedom of Information (NAIH), Falk Miksa utca 9–11, 1055 Budapest, www.naih.hu
    • Netherlands: Dutch Data Protection Authority (AP), Hoge Nieuwstraat 8, 2514 EL The Hague, www.autoriteitpersoonsgegevens.nl
      The authority competent for your country can also be found at www.edpb.europa.eu. We would appreciate it if you first informed us of any such concern so that we may remedy any possible shortcoming.
  10. Right to an effective judicial remedy – if you consider that your rights in relation to the processing of personal data have been violated, you have the right to an effective judicial remedy.

Automated decision-making and profiling

Your personal data is not subject to automated decision-making or profiling within the meaning of Article 22 GDPR.

Confidentiality

Our employees and collaborators who process your personal data are bound by a duty of confidentiality regarding personal data and security measures. This obligation continues after the termination of their contractual relationship with us. Your personal data will not be disclosed to any third party without your consent, unless we are required to do so by law.

This Privacy Policy is effective from 26 June 2026.