PRIVACY POLICY ON THE PROTECTION OF PERSONAL DATA

A. GENERAL

The société anonyme under the corporate name “LION RENTAL SOCIÉTÉ ANONYME, COMMERCIAL AND TOURIST COMPANY, RENTAL OF MOTOR VEHICLES, MOTORCYCLES, BOATS AND MACHINERY” and trading as “LION RENTAL S.A.” (the “Company”) is an official franchisee of SIXT GmbH in Greece. Our Company, as a controller and in compliance with the GDPR and Law 4624/2019, hereby provides you with the following information on the processing of your personal data, as well as on your rights as a data subject.

B. PERSONAL DATA PROCESSED BY US

Our Company, as controller within the meaning of Article 4 (7) of the GDPR, collects and further processes personal data that you voluntarily provide to us, as well as your personal data that it collects from third parties as necessary for our transactions and the communication between us. In particular, we may collect personal data from you for the purposes set out below, especially when you rent a vehicle from us, when you send us your CV for the purpose of applying for a job, when you cooperate with our Company in the context of its business operations, when you participate as a shareholder or a shareholder's representative in the Company's general meetings, when you use our website or other websites accessible through our website, when you sign up for our online services, when you create an account on our website and/or on our mobile applications (apps), when you request to receive updates on our Company's promotional activities (newsletter), when you join or comment on the Company's social media accounts (e.g. on Facebook, Instagram, Twitter, YouTube, etc.), when you participate in surveys or competitions organized by our Company and when you submit requests, complaints, comments, reviews or contact us on any issue.

In particular, we may collect from you directly or from third parties (such as travel or other agencies with which we cooperate), the following categories of your personal data:

  • - Identification details, such as full name, father's name, gender, date/place of birth, marital status, profession, nationality and other demographic data, driving license details, ID card/passport number or any other equivalent document, Tax Identification Number (TIN), which are collected as part of your transactions with the Company, either in its stores through your physical presence, or on the Company's websites.
  • - Details of your account on the Company's website and/or on social media (LinkedIn, Facebook, etc.), such as your username, if you interact with us through these channels/media.
  • - Data you enter when you create a user account on the Company's websites and/or apps, such as e-mail address, password, first name, last name, telephone number, etc.
  • - Contact data, such as postal and/or e-mail address (personal and/or business), landline and/or mobile telephone number (personal and/or business), etc.
  • - Data on your status as a shareholder/shareholder representative, such as identification data (full name, father's name, ID card or other equivalent document), number and class of Company shares, data regarding the participation and exercise of voting rights in the Company's General Meetings, as well as relevant supporting documents.
  • - Financial data, such as credit or debit card details including card payment number, security code, expiry date, holder's name and address, bank account information.
  • - Company's historical rental data, such as the locations where vehicles were rented, reservation numbers, the time and place of return/delivery of the vehicles to the Company, payment details, insurance preferences, natural gas consumption, mileage, license plate numbers and other information related to the rental of vehicles by you.
  • - Credit rating data, such as bankruptcy applications, bankruptcy decisions, payment execution orders, real estate/movable asset auction programs, changes in commercial companies, mortgages and mortgage prenotations, seizures and checks based on Legislative Decree 17.7/13.8.1923, bad checks, dishonoured bills of exchange and promissory notes.
  • - Your image and sound that we can collect for the production of audio-visual material (video) on our premises.
  • - Vehicle geolocation data (GPS tracking system).
  • - Data of the rented vehicle, including traffic violation data, accident information, declarations and other data in case of accident.
  • - Data you provide to us about your preferences for quantity/quality survey purposes.
  • - Curriculum Vitae data, such as information on studies, skills, knowledge of foreign languages, professional experience.
  • - Identification data (full name, father's name, Tax Identification Number, Social Security Number) and certificates of studies/conscription data of your dependants.
  • - Data arising from any service provided to you as a customer or prospective customer under the contracts you have concluded with our Company and the technical service orders.
  • - Data about your interests, preferences and the services you use, which help us recommend specific products and services that are of interested to you and/or for which have shown a preference, in order to provide you with a personalized offer or update from us.
  • - Data we collect on the use of cookies when you browse on our website. Learn more about how to use cookies on our website by clicking here: https://motodynamics.gr/cookies/
  • - Special categories of personal data within the meaning of Article 9 (1) of the GDPR, in particular health data.

 

C. LEGAL BASES FOR PROCESSING

The legal bases for processing your personal data include the following, as applicable:

a) The fulfilment of contractual and pre-contractual obligations (Article 6 (1), first subparagraph, item b’, GDPR): You have to declare any personal data required for the preparation and completion of the transactional relationship between us. Without the said data we are unable to process your request or to conclude and/or perform the contract between us.

b) The processing is necessary for the conclusion of an employment contract or, after such conclusion, the performance of the contract (article 27(1) of Law 4624/2019).

c) The Company's compliance with its legal obligations (Article 6(1), first subparagraph, item c’, GDPR): If the required data are not provided to us, we will not be able to comply with these legal obligations.

d) The fulfilment of the Company's or third parties' legitimate interests (Article 6 (1), first subparagraph, item f’, GDPR).

e) Your consent (Article 6 1), first subparagraph, item a’, GDPR): If you have granted your consent for specific purposes, the purposes result from the respective content of such consent. Where you are required to provide data for this purpose, we will explicitly indicate this to you. If the said data are not provided to us, we will not be able to comply with your will, as included in your consent. You may withdraw your consent at any time without the lawfulness of the processing carried out on the basis of the consent being affected until such consent is withdrawn.

f) Your consent as an employee of the Company (article 27(2) of Law 4624/2019) for specific processing purposes arising from the content of the consent, which you may withdraw at any time, without, however, affecting the lawfulness of the processing carried out on the basis of the consent until such consent is withdrawn.

g) In the cases specified in article 25(1) of Law 4624/2019.

Especially for the processing of special categories of your personal data within the meaning of Article 9(1) of the GDPR, the legal bases for the processing of such categories include the following, as applicable:

a) Your consent (Article 9(2), item a’, GDPR) which you have explicitly granted to us for one or several specific purposes, which result from the respective content of the consent. You may withdraw your consent at any time without the lawfulness of the processing carried out on the basis of the consent being affected until such consent is withdrawn.

b) The exercise of rights or the fulfilment of legal obligations arising from labour law, social security and social protection law (article 27(3) of Law 4624/2019).

c) The data have been explicitly disclosed by the data subject (Article 9(2), item e’, GDPR).

d) The processing is necessary for the establishment, exercise or defence of legal claims (Article 9(2), item f’, GDPR).

e) The processing is necessary for the purposes of assessing the ability to work (article 22(b) of Law 4624/2019).

f) In the cases specified in article 25(2) of Law 4624/2019.

D. DATA CONCERNING MINORS

Any processing of personal data of minors under the age of 15 shall be carried out subject to the prior consent of their legal representatives.

E. PURPOSES OF PROCESSING

We process your personal data for the following purposes:

  1. Conclusion and performance of the Company's contracts (including for vehicle reservations and rentals) and in particular:

a) for communication purposes regarding any issue arising in the context of our contract/transaction, in particular for the preparation/processing/submission of offers, the administration of the contracts concluded, the execution/facilitation of vehicle reservation/rental, the confirmation of your details and your identification, in any case required, the receipt/activation of any gifts following a contest draw, the response to specific requests/queries/complaints you send to us, the record-keeping for your previous reservations, as well as the overall service provided to you;

b) for the collection of the fee for our products or services and the issuance of the statutory invoices, for the avoidance of payment default options and the avoidance of property violations (in particular for fraud, theft, embezzlement), as well as for the assessment of your creditworthiness by receiving the corresponding information from credit agencies;

c) for the defence of the legal rights and the exercise of legal claims of the Company before judicial or other Authorities;

d) to ensure the correctness and accuracy of the data so that the transaction can be executed;

e) to communicate with you in case of an existing risk regarding a vehicle of our Company.

2. Losses – Guarantees – Insurance

In the event of damage (total or partial destruction or breakdown) to our vehicles, your data, including your personal data, will be processed also for the following purposes where applicable:

  • - Receiving and processing complaints.
  • - Exercising legal claims.
  • - Processing of damages resulting from accidents (processing based on information provided by you and third parties, such as the police, witnesses, etc.).
  • - Assistance in the form of road assistance services provided by associated companies.
  • - Fulfilment of legal obligations (e.g., provision of information to law enforcement and prosecution, investigative, judicial authorities).
  • - Retention and assertion of any claims we may have against you, for instance claims arising out of non-payment or damage caused to our vehicles.

We also process your data in the context of the provision of guarantee and insurance coverage if this is necessary for the fulfilment of our legitimate interests and if this is required for the performance of the contract between us.

3. Promotion – Advertising – Customer Profiling (Marketing)

We contact you by electronic means and provide you with information about our Company's offerings and products, following a previous transaction or communication with you. However, you may choose whether to receive such communications or not. In particular, if you have provided your consent, the Company may process your data for the following purposes:

a) promoting products and services;

b) conducting a quality/quantity survey and/or analysis;

c) participating in promotional activities and sending invitations to events;

d) implementing bonus programs;

e) optimizing offers to our customers and all our business processes as well as your personalized care as customers and prospects. This includes, for example, the preparation and evaluation of rental reports, the implementation of capacity planning to improve vehicle allocation procedures, the creation of a database, the analysis and correction of error sources and the conduct of customer satisfaction surveys. The above operations are carried out using algorithms in order to create profiles, probability values in relation to future rentals and absorption prices for our offers;

f) optimising our online presence.

4. Other purposes

We process your personal data in order to comply with our disclosure duties to the authorities and comply with the processing requirements as specified by commercial and tax laws.

F. DATA RECIPIENTS

1. The Company guarantees that it will not transfer or in any manner disclose your data to any third parties (other than the recipients mentioned herein) for any purpose or use unless it is mandatory to do so under applicable laws or is required to do so by public/prosecution/judicial authorities.

2. Recipients of your personal data to whom your data are disclosed include, without being limited to the following:

a) employees of the Company, only to such extent as necessary, who are bound by confidentiality and privacy clauses;

b) affiliated and partner companies, such as insurance companies, companies providing services in the fields of telecommunications, technical support, advertising, printing, etc. and third parties cooperating with us and offering repair, painting and maintenance services for vehicles rented by our customers, including insurance companies and airlines, as processors within the meaning of Article 4(8) of the GDPR, which process your data on our behalf and are subject to our instructions and orders;

c) certified audit firms that audit the Company's financial statements;

d) companies cooperating with us to provide roadside assistance to drivers using our Company's vehicles;

e) external partners of the Company, such as legal, insurance and other advisors, to whom the Company entrusts the execution of specific actions and are bound by confidentiality clauses;

f) partners and service providers in general, to whom your data are transferred in order to process a request or to perform a contract with you or to fulfil legitimate interests, such as, for example, credit institutions, transport service providers or similar providers;

g) companies of the SIXT GmbH network, including both the parent company SIXT SE and its subsidiaries, and companies of the SIXT GmbH franchise network;

h) public bodies, or public prosecutors and judicial authorities, or tax authorities to which we must transfer your personal data.

3. We may transfer your personal data to suppliers or service providers established outside the European Economic Area (EEA). In such case, your data will continue to be subject to an adequate level of protection and appropriate safeguards provided for by the law.

4. In the case data transferred to our third partners, the Company will ensure that the processors on its behalf meet the requirements and provide sufficient assurances (guarantees) for the implementation of the appropriate technical and organizational measures, in order to ensure the processing of your personal data.

G. DATA RETENTION TIME

We store your personal data only for as long as it is required for the fulfilment of the purposes, as described herein and/or in the contractual documents between us or - as long as your consent has been granted - as long as you do not withdraw your consent. We further store your data within the required time frame of the commercial and tax obligations on their retention. In any case, the said time shall not exceed twenty (20) years.

After the expiration of the said period, your data are destroyed. In particular, we delete your personal data immediately, when there is no legal basis for their processing, or if they are no longer necessary for the purpose of the preparation and execution of the contract concluded between us, and if there is no other specific legal basis, in case of objection on your part, unless further processing is permitted in accordance with relevant provisions, if we are obliged to do so for other legitimate reasons, and in any case after twenty (20) years. It is specifically noted that the CVs that you may send to us as part of a job application to the Company and subject to paragraph article 27(6) of Law 4624/2019 are kept in the Company's records for a period of six (6) months from their dispatch to the Company and are subsequently deleted.

In cases where the retention of your personal data is necessary for the exercise or defence/exercise of legal rights of the Company before judicial or other authorities provided by the applicable legislation, the above deadline shall be extended until the end of the period during which such data are no longer necessary for the above purposes.

We use our best endeavours to minimise the personal data we use over time and to anonymise such data so that they can no longer be associated with you or render you identifiable. In the case of anonymised data, we may use such data without further notice.

Η. COMMUNICATION WITH THE COMPANY AND EXERCISE OF DATA SUBJECT RIGHTS

In accordance with the applicable laws on the protection of personal data, you have the following rights:

  1. - To withdraw at any time, in accordance with Article 7 of the GDPR, your consent granted for the processing of your personal data, in cases where the processing takes place after your consent or, in the case of the processing of personal data in the context of employment relationships, your consent in accordance with Article 27(2)(b) of Law 4624/2019. In such case, we will stop processing your personal data without this affecting the lawfulness of the processing that will have already taken place until your consent is withdrawn.
  2. - Without prejudice to the provisions of Article 33 of Law 4624/2019, to request access to your personal data, in accordance with Article 15 of the GDPR. In particular, you may receive information on which personal data concerning you are or have been processed, the categories thereof, the purposes for which we process them, their origin, the categories of recipients to which they are transferred and the period for which they are retained. Upon your request, the Company will provide you with a copy of your personal data being processed.
  3. - Without prejudice to the provisions of Article 35 of Law 4624/2019, to raise objections at any time and to object to the processing of your data at any time, in accordance with Article 21 of the GDPR.
  4. - Without prejudice to the provisions of Article 34 of Law 4624/2019, to request the deletion of your data if they are no longer necessary for the purposes for which they were collected or otherwise processed, if you withdraw the consent on which the processing is based or if the personal data were unlawfully processed (Article 17 of the GDPR).
  5. - To request the rectification of your personal data that we retain. This enables you to correct any incomplete or inaccurate information we have collected about you (Article 16 of the GDPR).
  6. - To request restriction of the processing of your personal data, only for specific purposes, including in the event of data being challenged or unlawful processing (Article 18 of the GDPR).
  7. - You have the right to the portability of your personal data to another controller, provided the processing is based on your consent and is carried out by automated means (Article 20 of the GDPR).
  8. - To submit a petition/complaint to the Hellenic Data Protection Authority, 1-3 Kifissia Street, Postal Code 115 23, Athens, tel.: 210 6475600, fax: 210 6475628, Authority's website: www.dpa.gr, e-mail: complaints@dpa.gr.

For the exercise of the above rights, as well as for the communication between us or for any questions regarding the processing of your personal data, you may contact Data Protection Officer, or write to the postal address: LION RENTAL S.A., 10, Germanikis Scholis Athinon, Maroussi, Postcode 15123, or by e-mail: customer.service@sixt.gr, or by telephone at 210 5786392, or by fax: 210 5777501, and we shall make sure to reply as soon as possible.

I. OBLIGATIONS OF COMPANY

The Company is required to take all reasonable measures in order to ensure the confidentiality and security of the processing of data and their protection against accidental or unlawful destruction, accidental loss, alteration, forbidden dissemination, abuse or access by any person and any other form of unlawful processing.

Without your prior knowledge and/or consent, your personal data will not be processed for any purpose other than those provided for herein.

I. CHANGES IN THE DATA PROTECTION POLICY

This Privacy Policy may change from time to time and any changes will be communicated to you by email or a notice on our website.