Privacy Policy

This privacy policy has been created to inform you about the types of data processed by AERCAR and about the purposes of such data processing. We would also like to inform you about important legal aspects of data protection, such as your rights. You are not contractually or legally obliged to provide us with your personal data, however note that you cannot enter into a vehicle rental contract with us if we are not permitted to process your data for the following purposes.
 
Categories of personal data
 
The following categories of personal data may be processed by us in connection with our services:

• Master data: first name, surname, gender, date of birth, address (private and/or business)

• Communication data: telephone number, e-mail address (private and/or business in each case), third party phone numbers, communication content (in particular from e-mails)

• Contract data: driver’s license data, ID card and passport data, vehicle categories, pick-up and return branch, booked extras/services, reservation and rental contract number

• Finance data: credit card data, account and bank details

• Voluntary data: These are personal data that you provide to us on a voluntary basis, without us having explicitly requested them, and include information such as your preferences with regard to the vehicle’s equipment and category, nature of complaint or answers to a survey

• Third-party data: personal data, e.g. of relatives, passengers within the scope of your rental contract

• Vehicle data: e.g. vehicle identification number, model, manufacturer, license plate,

• Special categories of data: in the event of an accident, damage to the vehicle or similar incidents, we process data relating to the respective course of events and the damage incurred. This data may be provided by customers, passengers or injured parties. The data processed in such circumstances can include health-related data such as data on injuries, blood alcohol levels, driving under the influence of narcotic substances, and the like.

 
C: The legal basis for data processing at AERCAR
 
Art. 6 (1) sentence 1 point a) of the General Data Protection Regulation (GDPR): Pursuant to this provision, the processing of your personal data is lawful if and to the extent that you have given your consent to such processing.
Art. 6 (1) sentence 1 point b) GDPR: Pursuant to this provision, the processing of your personal data is lawful if such processing is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract (e.g. when making the vehicle reservation).
Art. 6 (1) sentence 1 point c) GDPR: Pursuant to this provision, the processing of your personal data is lawful if such processing is necessary for compliance with a legal obligation to which AERCAR is subject.
Art. 6 (1) sentence 1 point f) GDPR: Pursuant to this provision, the processing of your personal data is lawful if such processing is necessary for the purposes of the legitimate interests pursued by the controller, i.e., AERCAR, or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, i.e., you yourself.
Art. 9 (2) point a) GDPR: Pursuant to this provision, special categories of personal data may be processed if you have given your consent to the processing of special categories of personal data.
Art. 9 (2) point f) GDPR: Pursuant to this provision, certain special categories of personal data can be processed if such processing is necessary or the establishment, exercise or defense of legal claims. These special categories of personal data include the health data of the data subjects.
 
 
 
 
D: The purposes of data processing at AERCAR
 

1. Setting up an AERCAR account

 
Purposes of data processing
You may set up an AERCAR account via our website to avoid having to input data again when making further reservations/rentals. In order to set up an AERCAR account, we need your master data and communication data.
To ensure that you only use a validated AERCAR account, we regularly check our customer databases. If several AERCAR accounts have been created for or by you, they can be merged into a single AERCAR account.
Legal basis for the above processing
Art. 6 (1) sentence 1 point b), f) GDPR
Our legitimate interest in merging your personal data in case of several AERCAR accounts is to optimize our customer database by preventing unnecessary multiple storage.
 

2. Reserving vehicles

 
Purposes of data processing
If you would like to rent a vehicle, you can make a reservation in advance by using our website or over the phone. In this context, we process your master data, communication data and contract data, as well as your financial data, where applicable. If you book your vehicle via travel agencies, online travel agencies or other agents, then your master data, communication data, rental information and, if applicable, financial information, will be transferred to us by our partners.
We use financial service providers to process payment transactions (including security deposits for credit cards).
Legal basis for the above processing
Art. 6 (1) sentence 1 point a) GDPR if consent is given.
Art. 6 (1) sentence 1 point b) GDPR for data processing for reservation of vehicles including payment processing and customer service.
Art. 6 (1) sentence 1 point c) GDPR for data processing for the purpose of compliance with regulatory requirements for payment transactions and retention periods under commercial and tax law.
 

3. Renting vehicles

 
Purposes of data processing
We process your master data, communication data, contract data, vehicle data, financial data and any data you have provided voluntarily for the performance of your rental contract.
We process the master data, communication data, vehicle data and contract data for customer relations purposes, for example to handle any complaints or changes of reservation that you contact us about.
We are furthermore legally obliged – for purposes of preventing and investigating criminal offences – to compare your master and communication data with official perpetrator lists provided to us. Such comparisons also serve to ward off dangers and to facilitate prosecution by the authorities.
Once the rights and obligations under the rental contract have been fulfilled by both parties, your master, payment, vehicle and contract data will continue to be stored until the mandatory retention periods as stipulated by the legislature or regulators.
Legal basis for the above processing
Art. 6 (1) sentence 1 point b) GDPR applies to the processing of data to the extent required to conclude and perform rental contracts including payment processing and customer service.
Art. 6 (1) sentence 1 point c) GDPR applies to the processing of data to the extent required to detect, prevent and investigate criminal offences, to comply with regulatory requirements for payment transactions, to examine and store driver’s licence data, and to comply with retention periods under commercial and tax law.
Art. 6 (1) sentence 1 point f) GDPR applies to the processing of data to the extent required to settle accounts vis-à-vis third parties, to assert our own claims, and to mitigate risks and prevent fraud.
Our legitimate interests in using your personal data to improve our services and customer services lie in the fact that we want to offer you the best possible services and to sustainably improve customer satisfaction.
 

4. Returning vehicles

 
Purposes of data processing
When returning the vehicle, we check and document the return time, the vehicle condition, possible damages and any deviations from the reservation details originally agreed on in the rental agreement (e.g late return) in order to be able to issue the invoice correctly and thus process the end of the rental.
Here we process your master, communication and contract data as well as vehicle data.
Legal basis for the above processing
Art. 6 (1) sentence 1 point b) GDPR.
 

5. Business customers/payment by third parties

 
Purposes of data processing
You can reserve and rent our vehicles with conditions of your employer. In this case, your personal data are processed in accordance with this Privacy Policy. This also applies mutatis mutandi if a third party is to pay the invoice. We transmit personal data collected during the rental (in particular in the form of invoices and rental contracts, possibly also in the form of monthly statements, as well as possible traffic tickets and accident reports) to your employer or the third party who is to pay your invoice.
Legal basis for the above processing
The relevant legal basis applicable to processing data under this Privacy Policy is determined by how the data are specifically processed.
Art. 6 (1) sentence 1 point b) GDPR applies to the processing of data to the extent required to implement reservations, to conclude and perform rental and framework agreements and for customer relations purposes, otherwise Art. 6 (1) point f) GDPR.
Insofar as the processing of data for the purpose of settling the account with your employer or third parties or for clarification of facts (in particular in the case of accidents or administrative offences) is concerned, our legitimate interest is in being able to assert invoice amounts and other claims or to determine the party against which the damage claim is asserted.
Recipients of your data
For the purposes described in the foregoing, we disclose your data to your employer or the third person that will settle your invoice.
 

6. Damage and accidents

 
Purposes of data processing
In the event of damage being done to our vehicles, or our vehicles being involved in accidents, we process your personal data for the following purposes:

• providing customer services in cases of damage,

• handling claims,

• processing damage resulting from accidents (processing based on information provided by you and third parties such as the police, subsequent renters, witnesses, etc.),

• settling claims,

• receiving and processing complaints,

• providing help and assistance,

• securing and asserting our own claims.

In this context, we process your master data, communication data, contract data, financial data, third-party data, vehicle data and, where applicable, special categories of personal data (health data).
Legal basis for processing
Art. 6 (1) sentence 1 point b), c), f) GDPR and Art. 9 (2) point f) GDPR.
Our legitimate interest in processing your personal data is to reconstruct and handle damage and accident cases and to thereby protect our company against damage. This also includes our legitimate interest in exercising or defending legal claims when handling damages and accidents. We also have a legitimate interest in always providing you with damage-free vehicles. We are moreover obliged, pursuant to our contractual relations with third parties (e.g. insurance companies), to process your data for the purpose of settling claims. Our legitimate interests in this respect lie in ensuring that we observe the contract terms.
 

7. Breach of contract or the law

 
Purposes of data processing
In the event of signs of criminal activity, e.g. theft, embezzlement, unauthorized use of vehicles or of vehicles being used in breach of contract, e.g. exceeding the maximum rental period or subrenting, we will take the following action for the purposes of preventing damage and protecting the ownership of our vehicles:

• Forwarding your data to the authorities: we may forward your master data, communication data, contract data, financial data to the (criminal investigation) authorities in cases of criminal conduct or a risk being posed to public safety.

Should the competent authorities suspect you of having committed an administrative (e.g. speeding or parking illegally) or criminal offence with one of our vehicles then we will process not only the master data pertaining to you that we have stored, but also the data conveyed to us by the competent authorities.
Legal basis for processing
Art. 6 (1) sentence 1 point c), f) GDPR in conjunction with the respective statutory regulation.
Our legitimate interest in using your personal data lies in protecting our property by means of the aforementioned measures so as to protect our company against damages. We also have a legitimate interest in protecting our fleet of vehicles as well as our contractual rights.
 

8. Customer Service

 
Purposes of data processing
You can contact our Customer Service by telephone, e-mail, chat and classic mail. Depending on the reason for your request, we may process master data, communication data or contract data in this context.
For our chat service, we store message histories for up to 90 days. You can decide at any time which personal data you would like to disclose during the chat.
Legal basis for processing
Art. 6 (1) sentence 1 point b) GDPR.
 
 

9. Access records

 
Purposes of data processing
When you access our websites, we process the data that your browser transmits in order to enable you to visit the websites. This is a technically necessary process in which data is transmitted (such as IP address, date and time of the request, operating system, browser type including language and version). The data is used to ensure stability and security, i.e. to control server capacities, to find and eliminate errors and to defend against as well as to analyze attacks or security incidents. For this purpose, the data is processed for a limited period of time in so-called protocols or log files and deleted or anonymized after analysis. In the case of anonymization, the data is modified in such a way that information relating to identified or identifiable persons can no longer be attributed to a person or can only be attributed to a person with a disproportionate expenditure of time, cost and manpower.
Legal basis for processing
Art. 6 (1) sentence 1 point f) GDPR
Our legitimate interest in processing your personal or personally identifiable information is, as just mentioned, to ensure the stability and security of our websites.
 
E: Sources of your data
 
Generally, we collect your data directly from you. In the following cases, however, we may receive your master, communication and contract data and, if applicable, financial data from the following third parties if they make a reservation for you:

• Travel agencies, price comparison portals or other travel intermediaries

• Your employer or your employer's travel manager

• Road assistance service providers

 
F: Categories of recipients of your data
 
We may also transfer your personal data to other recipients such as public authorities, e.g. for statutory disclosure requirements to tax authorities and prosecuting authorities or to fining authorities for administrative offences, to credit institutions, e.g. to handle payments,to experts, e.g. to manage claims, or to lawyers, e.g. to defend and assert legal claims.
 
G: Duration of storage
 
We store your personal data until it is no longer necessary in relation to the purposes for which it was collected or otherwise processed. Your account will be deleted if you do not use it to rent a vehicle from us for six years. We carry out such deletions once a year.
Where we are under legal obligation to store personal data, we will store personal data for the preservation period stipulated by law. These include statutory periods of limitation. There may also be retention periods stipulated of between six and twelve years for tax and commercial reasons under the Cyprus Tax Law. During this period, your data may be subject to restricted use within day-to-day operations if its processing serves no further purposes. The legal basis for this storage is Art. 6 (1) sentence 1 point c) GDPR in conjunction with the respective statutory regulation.
 

H: Rights of data subjects

 
You can assert the rights mentioned below. Your requests to assert data protection rights and our responses to them will be stored for documentation purposes for a period of three years after the end of the year in which we responded to your request and in individual cases longer for the establishment, exercise or defense of legal claims.
Legal basis for the above processing
Art. 6 (1) sentence 1 point f) GDPR
Our legitimate interest is protecting against claims or fines under Art. 82, 83 GDPR and fulfilling our accountability obligations under Art. 5 GDPR.
 

     Right of access by the data subject, Art. 15 GDPR

 
You have the right to, at reasonable intervals, obtain information about your personal data under storage. The information you are entitled to includes information about whether or not we have stored personal data concerning you, about the categories of personal data concerned, and about the purposes of the processing. Upon request, we will provide you with a copy of the personal data that are processed.
 

     Right to rectification, Art. 16 GDPR

 
You also have the right to obtain from us the rectification of inaccurate personal data concerning you or to have incomplete data completed.
 

     Right to erasure, Art. 17 GDPR

 
You furthermore have the right to obtain from us the erasure of personal data concerning you. We are under obligation to erase personal data in certain circumstances, including if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, if you withdraw the consent on which the processing is based, or if the personal data have been processed unlawfully.
 

     Right to restriction of processing, Art. 18 GDPR

 
Under certain circumstances, you have the right to have the processing of your personal data restricted. These include circumstances in which you contest the accuracy of your personal data and we then have to verify such accuracy. In such cases, we must refrain from further processing your personal data, with the exception of storage, until the matter has been clarified.
 

     Right to data portability, Art. 20 GDPR

 
Should you opt to change to a different vehicle rental company, you have the right either to receive, in a machine-readable format, the data that you provided to us based on your consent or on a contractual agreement with us, or to have us transmit, also in a machine- readable format, such data to a third party of your choice.

6.     Right to withdraw, Art. 7 (3) GDPR

 
If data processing at AERCAR is based on your consent, then you have the right to, at any time, withdraw the consent you granted. The withdrawal of consent shall not affect the lawfulness of processing between the time consent was granted and the time it was revoked.
 
 

General information

We reserve the right to amend and adapt this Privacy Policy with effect for the future.
 
 
Current version: December 2018