Information on the Processing of Personal Data

How we process and store your data

United Rental Group, s.r.o., Ivánska cesta 4358/43, Bratislava 821 04, ID No.: 44 560 940, registered in the Commercial Register of the Municipal Court Bratislava I, Section: Sro, file no. 56233/B (hereinafter referred to as the “controller”) in accordance with Article 13 of REGULATION (EU) (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter also referred to as the “General Data Protection Regulation”) provides data subjects with the following information regarding the processing of personal data:

The controller processes the personal data of data subjects in an information system jointly operated by the owners and licensees of Payless Car- other controllers (with the exception of data obtained from GPS monitoring devices, which is processed in a separate information system of the controller). As part of this processing, personal data is transferred within EU countries (where the relevant controllers are based), and individual controllers are required to ensure an adequate level of security for the personal data being processed.

Why does the controller process personal data?

The controller processes the personal data of data subjects for the purposes of:

• pre-contractual and contractual relationships, in particular for the purposes of processing and sending price quotes, reservations, preparing and concluding contracts, and fulfilling the controller’s contractual obligations, particularly under lease agreements, lease agreements, framework agreements related to contract management, vehicle handover and return, complaint proceedings, invoicing, etc. The provision of personal data by the data subject is a contractual requirement. Failure to provide personal data will make it impossible to enter into a contractual relationship with the data subject.

• Unambiguous identification of the data subject based on consent granted by the data subject prior to making photocopies of the data subject’s official documents and/or by other means of electronically produced and recorded copies and descriptions of official documents (scanning of documents, verification of the authenticity of documents stored on electronic media, etc.), provided that the controller, in justified cases, requests such copies of official documents from the data subject. The provision of consent is voluntary. For the purpose of unambiguous identification of the data subject, the controller may also use electronic verification mechanisms to an appropriate extent, in particular verification of the email address, sending a one-time authorization code, a verification link, or another security feature, and recording the result of such verification.

• security, protection of property, and financial interests arising from the concluded contractual relationship and the controller’s legitimate interest derived therefrom. For this purpose, selected rental vehicles are secured by monitoring their location via satellite tracking (GPS) (tracking of rental vehicles during their use and after their theft). The processing of personal data (arising from the information obtained regarding the vehicle’s location) occurs if the rented motor vehicle is used by a single natural person, i.e., if at the time of use of the rented motor vehicle the operator is able to identify a specific natural person and the vehicle is equipped with a monitoring device. In this case, personal data will be processed to the extent of the obtained GPS information regarding the vehicle’s location and the characteristics of the data subject that can be derived therefrom. Upon picking up the vehicle, the renter is informed that the rented vehicle is equipped with a GPS monitoring device.

• the recovery of damages and claims, the resolution of insurance claims, the retention of documentation and records, and based on other necessary legitimate interests of the controller.

• communication with the data subject via electronic communication tools, in particular chatbots, voicebots, and other automated or AI-supported communication tools, for the purposes of processing requests, reservations, changes to reservations, the conclusion and management of contractual relationships, customer support, the resolution of complaints, claims, claims, verifying the identity of the data subject, verifying the authority to act, and protecting the rights and legally protected interests of the controller, including the prevention of fraudulent conduct and misuse of services.For this purpose, the controller may process, in particular, identification, contact, contractual, transactional, and communication data of the data subject, including the content of communications, data on the course and result of identity verification, data on the authentication elements used, and technical records of communications.
  For the purpose of identity verification, the operator may use the email address provided by the data subject as an identifier and send to it, or via another agreed communication channel, a one-time authorization code, a verification link, or another security element as part of two-factor authentication. The provision of this data is a contractual or pre-contractual requirement; without it, it may not be possible to process the data subject’s request, enter into a contractual relationship, or securely provide access to information regarding the reservation or rental. 
   

How can personal data about another natural person be lawfully provided?

• The lessor, who is the employer of the natural person, is authorized to provide personal data about another natural person to the controller even without that person’s consent, exclusively in connection with the establishment of pre-contractual and contractual relationships related to vehicle rental, and only to the extent of: title, first name, last name, job title, position, functional classification, employee ID number or employee number, department, place of work, telephone number, fax number, work email address, and employer identification details, if necessary in connection with the performance of the data subject’s work duties, official duties, or functional duties. The provision of personal data must not compromise the integrity, dignity, or safety of the data subject.

• A natural person who is a landlord is authorized to provide personal data about another natural person to the controller even without that person’s consent only in accordance with applicable laws and contractual terms, and only if if doing so protects their legally protected interests, e.g., in the case of resolving insurance claims.

• In all other cases, the data subject is required to provide the controller with personal data of another natural person only with that person’s consent, which the data subject must submit to the controller. By providing data about another natural person, the data subject expressly declares that they have adequate authorization to provide the controller with that person’s personal data.

For how long is personal data STORED?

• Personal data obtained from vehicle monitoring is retained for a period of 2 years following the proper termination of the contractual relationship.

• Photocopies of official documents are retained for the duration of the contractual relationship and are destroyed no later than 3 years after its termination, unless the controller uses them based on legitimate interests (e.g., in the context of claims resolution, insurance claims, and theft).

• Personal data processed for other purposes are retained for the period necessary to achieve the purpose of their processing, as determined by specific legal regulations or within the scope of the controller’s legitimate interest, but no longer than 10 years, and only to the extent necessary for accounting purposes.

• Personal data processed in the context of communication via chatbots, voicebots, and other automated or AI-supported communication tools, including records of the course of communication, logs, technical records, and data regarding identity verification, are retained for the period necessary to fulfill the purpose of their processing, in particular to demonstrate the content of the communication, protecting the rights and legally protected interests of the controller, and resolving complaints, disputes, damages, and claims, generally for the duration of the contractual relationship and subsequently for the duration of the applicable limitation and retention periods, but for no longer than 10 years, unless a specific legal regulation or the controller’s legitimate interest requires a longer retention period.

To whom are personal data provided?

• To supervisory authorities in the course of their activities pursuant to specific legislation (e.g., the Slovak Trade Inspection),

• to courts and law enforcement authorities upon their request, or within the scope of the controller’s legitimate interests,

• Insurance companies with which the controller has concluded an insurance contract related to the leased vehicle,

• a contractually authorized intermediary: United Automotive Group, s. r. o., ID No.: 50202511; United Finance Group, s. r. o., ID No.: 44560486, and contractual intermediaries within the Payless Car Slovakia branch network. Information about current intermediaries can be obtained via the info line at +421 2 2030 2100, or electronically (via email) by sending a request to customerservice@paylesscar.sk,

• providers of information technology, cloud services, communication platforms, authentication and verification services, providers of chatbots, voicebots, and other AI solutions, as well as other contractual intermediaries who provide technical operation, maintenance, support, security, user authentication, recording and archiving of communications, to the extent necessary to fulfill their contractual obligations to the controller,

• and other recipients to whom the controller is required to provide personal data pursuant to a specific law or legitimate interest.

What are the data subject’s rights regarding the processing of their personal data?

The data subject has the right:

• to information regarding the processing of their personal data;

• to access the personal data being processed and stored about them;

• request the correction of their incorrect, inaccurate, or incomplete personal data;

• request the erasure of their personal data when it is no longer necessary or if the processing is unlawful;

• object to the processing of their personal data for marketing purposes or on grounds relating to their particular situation;

• request the restriction of the processing of their personal data in specific cases;

• receive your personal data in a machine-readable format and/or request its transfer to another controller;

• withdraw consent at any time without affecting the lawfulness of processing based on consent given prior to its withdrawal, if the data subject has given such consent;

• request that decisions based solely on automated processing of personal data concerning them and which produce legal effects or similarly significantly affect them, be reviewed by a natural person if the personal data are processed in this manner by the controller; the data subject has the right to express their opinion and object to such a decision;

• to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, at the place of work or in the place of the alleged infringement, and the right to an effective judicial remedy if they believe that the processing of their personal data is in violation of the law. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, Bratislava;

• submit a request or complaint to the controller regarding the protection and processing of their personal data. Any data subject who wishes to submit a request or complaint and exercise their rights may do so:

• in writing at the address: United Rental Group, s.r.o., Ivánska cesta 4358/43, Bratislava 821 04.

• by email at: customerservice@paylesscar.sk,

• by phone at the hotline: +421 2 2030 2100