PRIVACY POLICY ON THE PROTECTION OF PERSONAL DATA

Α. GENERAL

The société anonyme under the tradename “LION RENTAL EMPORIKI KAI TOURISTIKI SINGLE MEMBER SOCIETE ANONYME, EKMISTHOSIS AUTOKINITON, MOTOSIKLETON, SKAFON KAI MICHANIMATON” and the distinctive title “LION RENTAL SINGLE MEMBER S.A.” is the official franchisee of Sixt GmbH in Greece. Our Company, as the controller, in compliance with GDPR and Greek Law 4624/2019, hereby provides you with the following information for the processing of your personal data, as well as your rights as data subject.

B. PRIVATE DATA WE PROCESS

Our Company, as data controller under the meaning of article 4 (7) of GDPR, collects, and processes further, personal data that you voluntarily provide us with, as well as data obtained from third parties (e.g., collection by the lessee of your personal data, in your capacity as the authorized driver of the rented vehicle), that is necessary for our transactions and the communication between us. In particular, we may collect personal data from you, for the purposes mentioned herebelow, especially when we rent a vehicle  to you, when you submit a resume for the purpose of filling a job position, when you associate with the Company within the frame of its business activity, when you participate as shareholders or shareholder representative in the Company's General Meetings, when you use our website or other websites accessible through our website, when you sign up for our electronic services, when you create an account on our website and / or our mobile apps, when you request to receive our Company’s newsletter, when you become a member or comment on the Social Media accounts of the Company (such as Facebook, Instagram, Twitter, YouTube etc.), when you participate in surveys or contests that our Company organizes and when you submit requests, complaints, comments, reviews or contact us on any matter.

More specifically, we may collect, directly from you or from third parties (such as travel or other kind of agencies that we associate with), the following categories of data that concern you:

  • Identification data, such as name, father’s name, gender, date / place of birth, marital status, occupation, citizenship and other demographics, driving license details, ID number / passport number or other equivalent document, TIN, which are collected during your transactions with the Company, either when you are physically present at our stores, or via Company’s websites.
  • Your account details on the Company’s website and / or social media account details (LinkedIn, Facebook, etc.), such as username, if you interact with us through these channels / media.
  • Data submitted during the creation of a user account on the Company’s websites and / or its apps, such as e-mail, password, name, last name, phone number etc..
  • Contact data, such as postal and / or e-mail address (personal and / or professional), landline and / or mobile phone number (personal and / or professional), etc.
  • Data on your status as a shareholder / shareholder representative, such as identification data (first and last name, father’s name, ID number or other equivalent document), number and category of Company’s shares, data concerning the participation and exercise of voting rights in the General Meetings of the Company, as well as relevant proving documents.
  • Financial data, such as credit or debit card information including card payment number, security code, expiration date, holder name and address, bank account information.
  • Data of preparation of vehicle rental history of the Company, such as the locations where the vehicles were rented, reservation numbers, time and place in which the vehicles were returned / delivered to the Company, payment details, insurance preferences, natural gas consumption, kilometers driven, license plates of rental vehicles and other information related to your vehicle rentals.  
  • Creditworthiness data, such as bankruptcy applications, decisions on bankruptcy applications, orders for payment, real estate / movable assets auction programs, changes of commercial companies, mortgages and mortgage prenotations, seizures and checks based on Greek Legislative Decree of 17.7 / 13.8.1923, bad checks, protested bills of exchange and order drafts.
  • Your image and sound that we may collect for the production of audiovisual material (video) in our facilities.
  • GPS tracking system of the vehicle.
  • Rental vehicle data, such as violation data, accident information, declarations and other data in case of an accident.
  • Data related to your preferences that you provide us with for the purpose of quantitative / qualitative survey.
  • Curriculum vitae data, such as studies, skills, knowledge of foreign languages, professional experience.
  • Identification data (first and last name, father’s name, TIN, Social Security Number) and certificates of study / enlistment of your protected members.
  • Data that derive from your service as a customer or prospective customer, from the contracts you have concluded with our Company and the technical service orders.
  • Data related to your interests, your preferences and the services you use, which help us to suggest you specific products and services that interest you and / or in which you have shown a preference, in order to receive a personalized offer or information from us.
  • Data that we collect using cookies in your browser on our website. Learn more about how we use cookies on our website by clicking: https://motodynamics.gr/cookies/
  • Special categories of personal data within the meaning of article 9 par. 1 of GDPR, health data in particular.

C. LEGAL BASIS FOR PROCESSING

The legal basis for processing your personal data may be, per case, the following:

a) The fulfillment of our contractual and pre-contractual obligations (article 6(1), first section, case (b) of GDPR): It is necessary to provide us with the personal data required in order to prepare and carry-out the contractual relationship between us. Without this data, we are not able to process your request or to execute the contract between us;

b) The processing is necessary for the conclusion of an employment contract or, after the conclusion, for its execution (article 27 par. 1 of Law 4624/2019);

c) Compliance with the Company's legal obligations (article 6(1), first section, case (c) of GDPR): If the required data is not provided to us, we may not be able to abide by our obligations under law;

d) The fulfillment of the legitimate interests of the Company or third parties (article 6 (1), first section, case (f) of GDPR);

e) Your consent (article 6(1), first section, case (a) of GDPR): If you have provided your consent for specific purposes, these purposes arise from the corresponding content of that consent. In cases where you have to provide data for this purpose, we will explicitly mention it to you. If this data is not provided to us, we will not be able to comply with your will, as set forth in your consent. You may withdraw your consent at any time, which, however, will not affect the lawfulness of the processing based on your consent before its withdrawal;

f) Your consent as an employee of the Company (article 27 par. 2 of Law 4624/2019), for specific purposes of processing arising from the content of the consent, which you may withdraw at any time, but without prejudice to the lawfulness of the processing based on your consent before its withdrawal;

g) In the cases of article 25 par. 1 of Law 4624/2019.

Specifically for the processing of special categories of your personal data, within the meaning of article 9 par. 1 of GDPR, the legal bases for its processing are, per case, the following:

a) Your consent (article 9 (2) case (a) of GDPR) which you have expressly provided to us for one or more specific purposes that arise from the respective content of the consent. You may withdraw your consent at any time, but without prejudice to the lawfulness of the processing based on your consent before its withdrawal;

b) The exercise of rights or the fulfillment of legal obligations deriving from labor law, social security law and social protection law (article 27 par. 3 of Law 4624/2019);

c) The data has been manifestly made public by the data subject (article 9 (2) case (e) of GDPR);

d) Processing is necessary for the establishment, exercise or defense of legal claims (article 9 (2) case (f) of GDPR);

e) The processing is necessary for the purposes of assessing the ability to work (article 22 case (b) of Law 4624/2019);

f) In the cases of article 25 par. 2 of Law 4624/2019.

D. DATA CONCERNING MINORS

Any processing of personal data of minors under 15 years of age is carried out if and to the extent that consent has been given by their legal representatives.

E. PURPOSES FOR PROCESSING

We process personal data that concern you for the following purposes:

1. Conclusion and execution of the Company's contracts (inter alia, for reservations and vehicle rentals) and in particular:

a) to communicate on any matter arising from our contract/transaction, especially for the preparation / processing / submission of tenders, the processing of contracts concluded, the execution / delivery of the order / rental of the vehicle / vehicles, the confirmation of your details and your identification, in any case required, the receipt / activation of any gifts after a lottery, the answer to specific requests / questions / complaints that you direct to us, as well as your general service;

b) for the collection of the consideration for our products or services and the issuance of the legally required documents, for the avoidance of property infringements (especially for the cases of fraud, theft, embezzlement), as well as for the assessment of your creditworthiness by receiving the corresponding information from credit bureaus;

c) for the defense of the legal rights and the exercise of the legal claims of the Company before judicial or other authorities;

d) to ensure the correctness and accuracy of the data, so that any transaction can be executed properly;

e) to communicate with you in case of an existing risk related to a vehicle or any other goods imported by our Company.

f) to grant the use of the rented vehicle under your capacity as an authorized driver of the lessee.

2. Damages - Warranty - Insurance

In case of damage (total or partial destruction, or malfunction) to our vehicles, your data, including your personal data will be processed and, as applicable, for the following purposes:

  • Receipt and processing of complaints.
  • Exercise of legal claims.
  • Processing of damages arising from accidents (processing based on information provided by you and third parties, such as police, witnesses etc.).
  • Provision of assistance in the form of assistance services for damages provided from related companies.
  • Fulfillment of legal obligations (e.g., provision of information before law enforcement authorities, as well as the prosecutorial, investigative, judicial authorities).
  • Preservation and pursuing of any claims which may arise against you, such as claims deriving from lack of payment or damage dealt to our vehicles.

We also process your data for the purpose of providing warranty and insurance coverage, if necessary for the fulfillment of our legitimate interests and provided that it is required for the fulfillment of the contract between us.

3. Promotion-Advertising-Creation of customer profile (marketing)

We contact you electronically and provide you with information about offers and products of our Company, following a previous transaction or communication between us. However, you can choose whether or not to receive such communications. In particular, if you have provided your consent, the Company may process your data for the following purposes:

a) promotion of products and services;

b) conducting qualitative / quantitative research, and / or analysis;

c) participation in promotions and invitations to events;

d) executing bonus programs;

e) optimizing offers to our customers and all our business processes, as well as for your personalized care as customers and prospective customers. This includes, for example, the composition and evaluation of rental reports, implementation of capacity schedule for the improvement of the process of vehicle distribution, database creation, review and correction of error source, as well as customer satisfaction survey. The abovementioned tasks are executed via algorithms for profiling purposes, as well as s to determine the prices for our proposals and future rental prices;

f) optimizing our online presence.

4. Other Purposes

We process your personal data in order to comply with our disclosure duties to the authorities and to comply with the processing requirements as defined by commercial and tax legislation.

F. RECIPIENTS OF DATA

1. The Company guarantees that it will not transmit or disclose your data in any way to third parties (other than the recipients mentioned herein) for any purpose or use, unless required by applicable law or required by public / prosecutor / judicial services / authorities.

2. Recipients of your personal data, to whom it is disclosed are indicatively:

a) employees of the Company, only to the extent necessary, which are bound by confidentiality clauses;

b) related and cooperating companies, such as insurance companies, companies that provide services in the fields of telecommunications, technical support, advertising, printing, etc., and third parties that cooperate with us and provide repair, painting and maintenance services to rental cars of our customers, including insurance and airline companies, as processors under the meaning of article 4 (8) of GDPR, which process your data on our behalf and are subject to our instructions and mandates;

c) certified auditing companies that audit the financial statements of our Company;

d) cooperating companies which provide roadside assistance to drivers using our Company’s cars;

e) external associates of the Company, such as legal, insurance and other advisors, to whom the Company assigns the exercise of specific actions and which are bound by confidentiality clauses;

f) associates and service providers in general, to whom the data is transmitted to process a request or to execute a contract with you or to safeguard legitimate interests, e.g., credit institutions, transport service providers or providers of similar services;

g) companies of the SIXT GmbH network, including both the parent company SIXT SE and its subsidiaries, as well as the companies integrated to the franchise network of SIXT GmbH;

h) public authorities or prosecutor and judicial authorities or tax and customs authorities to whom we are obliged to disclose personal data that concern you.

3. We may transfer your personal data to suppliers or service providers established outside the European Economic Area (EEA). In this case, your personal data will continue to be subject to an adequate level of protection and appropriate safeguards provided for by law.

4. In case data is disclosed to our third-party associates, the Company will ensure that the processors acting on its behalf meet the conditions and provide sufficient assurances (guarantees) for the implementation of appropriate technical and organizational measures to ensure the protection of your personal data.

G. DATA RETENTION PERIOD

We retain your personal data only for the duration necessary to achieve the purposes, as entailed in this document, or generally in our contractual documents or -if your consent has been granted- until you withdraw your consent. We further retain your data within the required period for commercial and tax retention obligations. In any case, this period shall not exceed twenty (20) years.

After the expiration of the above period, your personal data is destroyed. In particular, we delete your personal data immediately, when the legal basis for its processing does no longer exist, if it is no longer necessary for the purpose of drafting and executing our contract and if no other special legal basis for processing exists, in case of objection on your part, unless further processing is permitted according to the relevant legal provisions, if we are obliged to do so for other legitimate reasons and in any case after twenty (20) years. It is especially pointed out that any CV that you may send us in order to apply for a job posting in the Company and is subject to par. 6 of article 27 of Law 4624/2019 is retained by the Company for a period of six (6) months from sending it to the Company, after which it is deleted.

In case retention of personal data is necessary for the exercise or defense of the Company's legitimate rights before judicial or other authorities provided for under the applicable law, the above period is extended until the end of the period during which such data is no longer necessary for the above purposes.

We make every effort to minimize the personal data we use over time, and to anonymize it, so that it can no longer be associated with you or render you identifiable. In the case of anonymized data, we may use it without further notice.

H. COMMUNICATE WITH THE COMPANY AND EXERCISE YOUR RIGHTS

According to the applicable data protection legislation you have the following rights:

1. At any time, in accordance with Article 7 of GDPR, to withdraw your consent to the processing of your personal data, in cases where the processing takes place with your consent or, in case of processing of your personal data under employment relations, your consent according to article 27 par. 2 case (b) of Law 4624/2019. In this case, any processing will cease, without this affecting the lawfulness of the processing based on your consent before withdrawal;

2. Without prejudice to the provisions of article 33 of Law 4624/2019, to request access to your personal data, according to article 15 of GDPR. Specifically, you can receive information regarding which personal data that concern you is or has been processed, its categories, the purposes for which we process it, its origin, the categories of recipients to which it is transmitted and the retention period. Upon request, the Company will provide you with a copy of your personal data being processed;

3. Without prejudice to the provisions of article 35 of Law 4624/2019, to object to the processing of data that concern you, according to article 21 of GDPR, at any time;

4. Without prejudice to the provisions of article 34 of Law 4624/2019, to request the deletion of your data, if it is no longer necessary for the purposes for which it is collected or otherwise processed, if you withdraw your consent on which the processing is based or if the personal data have been processed illegally (Article 17 of GDPR);

5. To request the correction of your personal data that we retain. This allows you to correct any incomplete or inaccurate information we have collected about you (Article 16 of GDPR);

6. To request the restriction on the processing of your personal data, only for specific purposes, including the case of contested accuracy of the data or illegal processing (Article 18 of GDPR);

7. You have the right to the portability of your personal data to another controller, provided that the processing is based on your consent and is carried out by automated means (Article 20 of GDPR);

8. To submit a report / complaint to the Hellenic Data Protection Authority, 1-3, Kifissias Avenue, PC 115 23, Athens, tel : +30 210 6475600, fax: +30 210 6475628, web portal of the Authority: www.dpa.gr, e-mail address: complaints@dpa.gr.

For the exercise of the above rights, as well as for the communication between us or for any questions regarding the processing of your personal data, you can contact the Data Protection Officer, in writing to the postal address: LION RENTAL SINGLE MEMBER S.A., 10, Germanikis Scholis Athinon Str., Maroussi, Attica, P.C. 15123, or at the e-mail address: customer.service@sixt.gr, or by phone at +30 211 95 50000, or by fax: +30 210 5777501, and we will make sure to reply to you as soon as possible.

I. COMPANY OBLIGATIONS

The Company is obliged to take every reasonable measure to ensure the confidentiality and security of data processing and its protection against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access by any other form of unfair treatment.

Your personal data will not be processed for any purpose other than those provided herein, without your prior knowledge and / or your consent provision.

J. CHANGES IN DATA PROTECTION POLICY

This Privacy Policy may change from time to time, and any changes will be communicated to you via e-mail or a notice on our website.