Travel Information - 353 Car Rental

353 Car Rental Privacy Policy

Table of contents

1. Who processes your personal data collected through this website?

2. For what purposes does Executive Trust Limited collect your personal data?

3. Who are the data recipients of the personal information we collect about you?

4. For what period will Executive Trust Limited retain your personal data?

5. What rights can you exercise with respect to the processing of your personal data?

6. Who to contact when you have a query regarding the processing of your personal data?

7. How does Executive Trust Limited protect your personal data?

8. What rules apply to the processing of your personal data when clicking on links placed on Executive Trust. Limited website directing to Executive Trust Limited partner's websites or other websites?

9. Changes to this Privacy Policy

1. Who processes your personal data collected through this website?

Executive Trust Limited trading as 353 Car Rental ("353 Car Rental"), whose registered office is located at 35 Northwood Court, Northwood Business Park, Santry, Dublin 9 Ireland (hereinafter referred to as "353 Car Rental") is responsible for the processing of your personal data (i.e. any information that would allow to identify you, either directly or indirectly) collected through this website.

2. For what purposes does 353 Car Rental collect your personal data?

353 Car Rental processes personal data that you voluntarily provide to 353 Car Rental through this website for the following purposes:

a) Your registration as 353 Car Rental member, creation of your account and providing you with a 353 Car Rental ID. This processing is necessary to identify you and to prepare and facilitate your future booking / rental agreements with 353 Car Rental.

b) Your booking and your car rental agreement:

i. to confirm and guarantee your booking;

ii. to modify or cancel your booking;

iii. to exchange with you in relation to your booking / rental (e.g. to provide you with information on your booking / rental, to send you reminder notice before your check-in / check-out, to respond to your questions or suggestions);

iv. to manage your rental (delivery and return of the vehicle);

v. to manage your invoices;

vi. to manage the payment of arrears;

vii. to manage potential claims;

viii. to manage the recovery of potential damages to 353 Car Rental vehicle;

ix. to manage your insurance.

This processing is necessary for the booking and the performance of the rental agreement concluded with 353 Car Rental.

c) Your payment for 353 Car Rental products / services.

This processing is necessary for the performance of the rental agreement. For your full information, 353 Car Rental can only retain your credit card information, subject to your express consent in order to facilitate future payments.

d) The improvement of 353 Car Rental products / services on the basis of customer surveys you have completed.

This processing, aiming at having a better understanding of 353 Car Rental members' needs and offering you customized functions to enhance your experience of 353 Car Rental products / services, is based on 353 Car Rental's "legitimate interest".

e) The operation of 353 Car Rental live web chat to provide you with preliminary online assistance.

This processing, aiming at creating more proximity and establishing a closer relationship with you by notably answering more quickly your queries, is based on 353 Car Rental "legitimate interest".

f) Promotional and marketing activities, namely:

i. the sending of email and SMS notifications for special promotions / deals;

the recording of your rental history to suggest you preferred products / services when looking for new booking / rentals

ii. the recording of your rental history to send you special offers and make you benefiting from special advantages depending on your volume and frequency of your orders;

iii. the sending of emails about a booking you did not complete or send you a summary about a booking enquiry;

iv. the management of your loyalty program and membership card;

v. the organization of promotional contests / sweepstakes;

vi. the management and update 353 Car Rental's customers / prospects database.

Direct marketing processing activities, i.e. any commercial message from 353 Car Rental aiming at promoting 353 Car Rental products / services, are subject to your express consent.

By exception, if you are already an 353 Car Rental existing customer and that the message concerns products / services similar to those you have already purchased, the underlying processing aiming at promoting these products / services will not be based on your consent but on 353 Car Rental "legitimate interest".

g) The management of fines, in particular:

i. to transfer to the Transport Infrastructure Ireland or it’s nominated servants or agents in respect of tolls, An Garda Siochana in relation to driving offences or Council Authorities in respect of parking violations the identity of the driver (or potential driver);

ii. to satisfy fines collection procedure to which 353 Car Rental may be subject.

This processing is required by law.

h) The management and update of a watch list of customers presenting certain contractual risks based on:

i. payment incidents which have given rise to legal proceedings;

ii. vehicle accidents or repeated damages caused by 353 Car Rental customer;

iii. accidents or damages caused voluntarily by 353 Car Rental customer;

iv. use of 353 Car Rental vehicles in breach of the general terms and conditions for rental of vehicles.

This processing, aiming at reducing 353 Car Rental risks exposure in the performance of the rental agreements, is based on 353 Car Rental "legitimate interest". Should you appear on 353 Car Rental watch list, your booking / rental request will be rejected. As the case may be, you will be entitled to contest such decision by contacting dpo@europcar.ie.

i) Telematics:

The following data points are collected from each vehicle tracked by 353 Car Rental through services provided by a Telematics Service Provider:- position, speed, acceleration, impact data (location, g-force and direction of impact) and the identifier of the device in the vehicle.

This data is collected for the following reasons: -

• Detection and prevention of loss or theft of the company vehicles

• Management of insurance claims

• Identification of unauthorised vehicle movements

• Monitoring and improving customer driving behaviour

• Management of vehicle inventory

The Telematics Service Provider uses data hosting service providers in Europe to host the information it collects, and use technical measures to secure data.

The Telematics Service Provider and 353 Car Rental will adhere to the following obligations under GDPR law:-

• The Telematics Service Provider will only process personal data in accordance with 353 Car Rental’s written instructions (including when making an international transfer of personal data) unless required to do so by law.

• The Telematics Service Provider will ensure that people processing the data are subject to a duty of confidence and will take appropriate measures to ensure the security of processing.

• The Telematics Service Provider will only engage a sub-processor with the prior consent of the data controller and a written contract.

• The Telematics Service Provider will assist 353 Car Rental in providing subject access and allow data subjects to exercise their right under GDPR.

• The Telematics Service Provider will assist 353 Car Rental in meeting its GDPR obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments.

• The Telematics Service Provider will delete or return all personal data to 353 Car Rental as requested at the end of the contract.

• The Telematics Service Provider will submit to audits and inspections, provide 353 Car Rental with whatever information it needs to ensure they are both meeting their Article 28 obligations, and tell 353 Car Rental if it is asked to do something infringing the GDPR or other data protection law of the EU or a member state.

This processing, for the purpose of protecting the integrity of our fleet, is based on our legitimate interests.

For your full information, 353 Car Rental carries out certain processing of your personal information through "cookies" and other tracers collected every time you visit 353 Car Rental website. These processing are governed by 353 Car Rental Cookies Policy, which we encourage you to review. You can accept or reject these cookies and other tracers by following the instructions provided in 353 Car Rental Cookies Policy.

3. Who are the data recipients of the personal information we collect about you?

3.1 Categories of recipients

Your personal data will be disclosed, as necessary / relevant, to:

a) to the authorised personnel of 353 Car Rental and of entities of the same group and/or of entities of 353 Car Rental franchise network, or agent / sales intermediary appointed by 353 Car Rental for the purposes described in this privacy policy;

b) third party IT service providers for technical purposes in order to help 353 Car Rental in providing you with its products / services. The main IT service providers are:

i. Cap Gemini, for business applications development and maintenance;

ii. Sopra Steria, for data center maintenance and user support services;

iii. Unisys, for hardware implementation and maintenance;

iv. SalesForce, for automation marketing services;

v. Google Inc., in particular for hosting services and business applications.

vi. Rentalmatics for the provision of vehicle Telematics data and services.

vii. Capricorn Ventis for Business Intelligence application development

viii. Trilogy Technologies for IT Managed Services in the area of Helpdesk Support and escalation services

ix. Silveram Solutions for business application development and maintenance

x. GoCanvas for mobile forms capture

xi. Jimpisoft, Lda for Car Rental Management System

xii. Mailchimp for email communication

xiii. SurveyMonkey and Clear Market Intelligence for customer feedback surveys

xiv. Microsoft for email communication and productivity systems

c) regarding the information processed for the payment of fines, to Transport Infrastructure Ireland or it’s nominated servants or agents in respect of tolls, An Garda Siochana in relation to driving offences or Council authorities in respect of parking violations.

d) regarding the information processed for the purpose of the management and update of a watch list of customers presenting certain contractual risks, to the vehicle rental agencies branch of the Car Rental Council of Ireland to the benefit of their members

353 Car Rental can also disclose your personal data to the extent required by law and/or by competent authorities. 3.2 International transfers

As necessary to provide you with 353 Car Rental services, 353 Car Rental will, to the extent necessary for the purposes set forth herein, transfer your personal data outside the EU to the abovementioned third parties.

Depending on the case, certain recipients may be located in countries which have been recognized by the European Commission as ensuring an adequate level of data protection or in countries which has not been recognized as ensuring such a level of protection. In any case, 353 Car Rental has put in place appropriate safeguards to protect your personal data, in compliance with the EU regulation no.2016/679.

To find more information regarding the countries where your personal data can be transferred, their level of data protection and the potential safeguards put in place by 353 Car Rental please contact us in accordance with Section 6(a) of this policy.

4. For what period will 353 Car Rental retain your personal data?

Your personal data are retained for different period, depending on the purposes of the processing:

Purpose	Retention period
Payment – Payment card information	Upon effective completion of the payment. However, payment card information (excluding the visual cryptogram): that may evidence a payment (i.e. card number and date of validity) is subject to an intermediate archiving policy for a period of time of 13 months after the effective payment for a credit card and 15 months for a deferred debit card, to be used only if the transaction is disputed; can be retained for a longer period, subject to your express consent to facilitate future payments. In any case, when the payment card is expired, related information will be deleted.
Vehicles monitoring through the use of vehicle connected devices	All identifiable customer data is purged after 4 years unless it is still required under legislation. We own the information we collect in its aggregate and anonymized form and we reserve the right to use such aggregate, anonymized information without restriction.
Cookies	Please check 353 Car Rental Cookies Policy
Payment of fines	For the time necessary to identify the driver (or the potential driver) liable for the infraction leading to the fine. However, relevant information can be kept for a longer period of up to 12 months after receipt of the fine, subject to an intermediate archiving policy.
The management and update of a blacklist of customers presenting certain contractual risks, namely: payment incidents which have given rise to legal proceedings vehicle accidents or repeated damages caused by 353 Car Rental customer accidents or damages caused voluntarily	3 years as from the occurrence of the relevant event
the use of 353 Car Rental vehicles in breach general terms and conditions for rental of vehicles	5 years as from the occurrence of this event
Promotional and marketing activities	For 353 customers, 3 years as from the end of the relationship with 353 Car Rental. ▪ For prospects – who are not 353 Car Rental customers – 3 years as from the collection of your personal information OR as from the last request for information you made.
Your registration as 353 Car Rental member, the creation of your account and the provision of your with 353 Car Rental ID Your booking and your car rental	For the duration of the commercial relationship. However, information that may evidence a right or a rental agreement, or that must kept in compliance with a legal requirement, may be subject to an intermediate archiving policy for a period of time that does not exceed the time that is necessary for the purposes for which it is kept, in accordance with applicable legal provisions.

5. What rights can you exercise with respect to the processing of your personal data?

At any time, you can view and/or update your personal profile, which includes member registration, driver information and car rental preferences information, through the "My Europcar" link, accessible through the main navigation bar of 353 Car Rental website. You will be able to change your password, secret question, update or correct phone number, address, email, and driving licence information and update your car rental and travel preferences including insurance, means of payment and frequent traveler membership.

As per EU regulation no.2016/679, you can also benefit from the following rights:

a) right of "access": right to obtain confirmation as to whether or not your personal data are being processed by 353 Car Rental and, where that is the case, to access to these personal data and to obtain further information on the characteristics of our processing ;

b) right "to rectification": right to obtain the rectification of inaccurate personal data or the right to have incomplete personal data completed, including by means of providing a supplementary statement;

c) right to "erasure" (or the so-called "right to be forgotten"): right to obtain the deletion of your personal data in certain circumstances ; right to "object": at any time, a right to object to the processing of your personal data to prevent 353 Car Rental from continuing to carry out such processing:

i. where your data are processed for direct marketing purposes;

ii. where your personal data are processed on the basis of 353 Car Rental legitimate interest. In that case, your request will be satisfied only if you provide 353 Car Rental with a description of the particular situation legitimating your request and save if 353 Car Rental can demonstrate overriding legitimate grounds in light of your particular situation. d) right to "withdraw your consent": where the processing of your personal data is based on your consent, a right to withdraw your consent to the processing of your personal data at any time and to prevent 353 from continuing to carry out such processing;

d) right to "data portability": where the processing of your personal data is based on your consent and carried out by automated means, the right to receive your personal data provided to 353 Car Rental in an Excel spreadsheet and to transmit those data to a designated third party;

e) right of a "deceased person": right to define guidelines regarding the processing of your personal information after your death.

If you wish to exercise any of these rights, please contact dpo@europcar.ie as set out below in section 6. To protect your privacy and security, we will take reasonable steps to verify your identity before granting access or making corrections.

As per article 77 of the EU regulation no. 2016/679, you can lodge a complaint about the processing of your personal data with the body regulating data protection in your country if you consider that the processing of your personal data infringes the said EU regulation no. 2016/679.

6. Who to contact when you have a query regarding the processing of your personal data?

Depending on the purpose of your query, you will find below

a) For general query regarding the processing of personal data carried out by 353 Car Rental: DPO e-mail: dpo@europcar.ie.

b) To exercise your rights (access, rectification, erasure, restriction, etc.): send an email to res@europcar.ie.

7. How does 353 Car Rental protect your personal data?

353 Car Rental is committed to protecting the information it collects through this website.

In particular, 353 Car Rental uses appropriate physical, technical and organizational security measures to prevent unauthorized or unlawful processing, accidental loss of or destruction of or damage to your personal data.

353 Car Rental's systems are configured with data encryption, or scrambling technologies, and industry-standard firewalls. When you send personal information to a 353 Car Rental website over the Internet, your data is protected by "Transport Layer Security" (TLS) technology to ensure safe transmission.

Any credit card transaction you make through 353 Car Rental websites is done through our Secure Server Technology. This technology notably:

a) assures your browser that your data is being sent to the correct computer server, and that the server is secure;

b) encodes the data, so that it cannot be read by anyone other than the secure server;

c) checks the data being transferred to ensure it has not been altered.

8. What rules apply to the processing of your personal data when clicking on links placed on 353 Car Rental website directing to partner's websites or other websites?

You may find various links to 353 Car Rental’s partners websites or other third party websites (e.g. for travel services) on this website. 353 Car Rental would like to draw your attention to the fact that this privacy policy does not apply to the processing of your personal data carried out by our partners or other third parties when visiting their respective websites and that 353 Car Rental is not responsible for these kind of processing. We encourage you to review the privacy policies of 353 Car Rental's partners and other third parties to further understand the rules applicable to the processing of your personal data carried out by the same.

9. Changes to this Privacy Policy

This privacy policy was published on 24th May 2018. In case of changes to this privacy policy implemented by 353 Car Rental such changes will be identified by 353 Car Rental on this webpage.

When a change materially impacts a processing carried out on the basis of your consent, 353 Car Rental will contact you to obtain a new consent.