Processing of data and information during rental

why does the controller process personal data?

The controller processes the personal data of data subjects for the purposes of:

• pre-contractual and contractual relations, in particular for the purposes of processing and sending quotations, bookings, preparation and conclusion of contracts and the performance of the contractual obligations of the controller, in particular in the context of lease agreements, rental agreements, framework agreements related to contract management, takeover and handover of the lead, complaints procedures, invoicing, etc... The provision of personal data by the data subject is a contractual requirement. Failure to provide personal data will prevent the conclusion of a contractual relationship with the data subject.
• Theunambiguous identification of the data subject on the basis of the consent given by the data subject before making photocopies of the data subject's official documents and/or other electronically made and recorded copies and descriptions of official documents (scanning of documents, authentication of documents stored on electronic media, etc.), provided that the controller, in justified cases, requests such copies of official documents from the data subject. The provision of consent is voluntary. In order to unambiguously identify the data subject, the controller may, to the extent appropriate, also use electronic verification mechanisms, in particular verification of the email address, sending a one-time authorization code, a verification link, or another security feature, and recording the result of such verification.
• security, protection of property and financial interests arising from the contractual relationship entered into and the legitimate interest of the controller derived therefrom. To this end, selected rental vehicles are secured by monitoring their location via satellite tracking (GPS) (tracking of rental vehicles during their use and after their theft). The processing of personal data (resulting from the vehicle location information obtained) occurs if the rented motor vehicle is used by a single natural person, i.e. if at the time of use of the rented motor vehicle the operator is able to identify a specific natural person and the vehicle is equipped with a monitoring device. In this case, personal data will be processed to the extent of the GPS information obtained about the occurrence of the vehicle and the inferable characteristics of the data subject. The hirer is informed when taking delivery of the vehicle that the hired vehicle is equipped with a GPS monitoring device.
• the recovery of damages and claims incurred, the settlement of insurance claims, the storage of documentation and records made and on the basis of other necessary legitimate interests of the operator.
• communication with the data subject via electronic communication tools, in particular chatbots, voicebots, and other automated or AI-supported communication tools, for the purposes of processing requests, reservations, changes to reservations, the conclusion and management of contractual relationships, customer support, the resolution of complaints, claims, and disputes, the verification of the data subject’s identity, the verification of authority to act, and the protection of the controller’s rights and legally protected interests, including the prevention of fraudulent conduct and misuse of services. For this purpose, the controller may process, in particular, the data subject’s identification, contact, contractual, transactional, and communication data, including the content of communications, data on the course and result of identity verification, data on the authentication elements used, and technical records of communications. For the purpose of identity verification, the controller may use the email address provided by the data subject as an identifier and send to it, or via another agreed communication channel, a one-time authorization code, verification link, or other security element as part of two-factor authentication. The provision of this data is a contractual or pre-contractual requirement; without it, it may not be possible to process the data subject’s request, enter into a contractual relationship, or securely provide access to information regarding the reservation or rental.
   

How do I legally provide personal data about another natural person?

• The provision of personal data to the controller about another natural person, even without the consent of the natural person, may be made by the lessor, who is the employer of the natural person, solely in connection with the establishment of pre-contractual and contractual relations related to the rental of the vehicle and only to the extent that: title, first name, surname, job classification, job title, functional classification, employee's personal number or employee number, professional department, place of work, telephone number, fax number, workplace e-mail address and employer identification data, if necessary in connection with the performance of the job duties, official duties or functional duties of the person concerned. The disclosure of personal data shall not undermine the dignity, respect and safety of the data subject.
• Providing personal data to the controller about another natural person, even without his consent, is only permitted by the natural person who is the lessor in accordance with applicable law and the terms and conditions of the contract only if he thereby protects his legally protected interests, e.g. in the event of an insurance claim.
• In other cases, the data subject is only obliged to provide the controller with the personal data of another natural person with his or her consent, which he or she is obliged to provide to the controller. By providing the data of another natural person, the data subject expressly declares that he or she has adequate authorisation to provide the personal data of that person to the controller.
   

for what periods are personal data STORED?

• Personal data obtained from vehicle monitoring is retained for a period of 2 years after the proper termination of the contractual relationship.
• Photocopies of official documents are kept for the duration of the contractual relationship and are destroyed within 3 years at the latest, unless they are used by the controller on the basis of legitimate interests (e.g. in the context of dealing with damage, insurance claims and theft).
• Personal data processed for other purposes are retained for the period necessary to achieve the purpose of their processing as determined by specific legislation or in the context of the legitimate interest of the controller, but no longer than 10 years and only to the extent necessary for the purposes of keeping accounting records.
• Personal data processed in the context of communication via chatbots, voicebots, and other automated or AI-powered communication tools, including records of the communication process, logs, technical records, and data regarding identity verification, are retained for the period necessary to fulfill the purpose of their processing, in particular to demonstrate the content of the communication, protect the rights and legally protected interests of the controller, resolve complaints, disputes, damages, and claims, generally for the duration of the contractual relationship and subsequently for the duration of the applicable statutes of limitations and retention periods, but for no longer than 10 years, unless a specific legal regulation or the controller’s legitimate interest requires a longer retention period.
   

to which recipients is the personal data provided?

• To control authorities in the performance of their activities within the meaning of a specific legal regulation (e.g. Slovak Trade Inspection),
• Courts and law enforcement authorities at their request or in the context of the legitimate interests of the controller,
• insurance companies with which the operator has concluded an insurance contract related to the rented vehicle,
• a contracted intermediary: United Automotive Group, s. r. o. IČO: 50202511; United Finance Group, s. r. o. IČO: 44560486, contractual intermediaries within the branch network of AVIS Slovakia. Information about current intermediaries can be obtained via the infoline 0900 200 200 (this line is charged at 0,60€/minute incl. VAT), or electronically (by e-mail) upon request sent to the e-mail address customerservice@avis.sk.
• and to other recipients to whom the controller is obliged to provide personal data pursuant to a specific law or legitimate interest.
• providers of information technology, cloud services, communication platforms, authentication and verification services, providers of chatbots, voicebots, and other AI solutions, as well as other contractual intermediaries who provide the operator with technical operation, maintenance, support, security, user authentication, and the recording and archiving of communications, to the extent necessary to fulfill their contractual obligations to the operator. 
   

what are the rights of the data subject in the processing of his/her personal data?

The data subject has the right to:

• to information about the processing of his or her personal data;
• toobtain access to the personal data processed and stored about him or her;
• torequest the rectification of his or her incorrect, inaccurate or incomplete personal data;
• request the erasure of their personal data when they are no longer necessary or when the processing is unlawful;
• object to the processing of your personal data for marketing purposes or on grounds relating to a particular situation;
• request the restriction of the processing of your personal data in specific cases;
• receive their personal data in a machine-readable format and/or request its transfer to another controller;
• withdraw his or her consent at any time without affecting the lawfulness of processing based on consent given prior to its withdrawal, where such consent has been given by the data subject;
• request that decisions based solely on automated processing of personal data concerning the data subject, which produce legal effects or similarly significantly affect the data subject, be reviewed by a natural person, if the personal data are processed in this manner by the controller; The data subject has the right to express their opinion and object to such a decision;
• lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, and the right to an effective judicial remedy if he or she considers that the processing of his or her personal data is unlawful. The supervisory authority in the territory of the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12 Bratislava;
• lodge a request or complaint with the controller in relation to the protection and processing of her personal data. Any data subject who wishes to make a request or complaint and exercise his or her rights may do so:
• in writing at United Rental Group, s.r.o., Ivánska cesta 4358/43, Bratislava 821 04.
• electronically at: customerservice@avis.sk,
• by telephone on the hotline: 0900 200 200 (this line is charged at 0,60€/minute incl. VAT)

United Rental Group, Ltd. is an independent Avis licensee and MHT s. r. o. is an independent Avis sublicensee