Information on the processing of personal data via social media

In accordance with Articles 13 and 14 of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation"), United Rental Group, s. r. o., Ivanská cesta 4358/43, 821 04 Bratislava, Company ID No.: 44560940 (hereinafter referred to as "United Rental Group") hereby provides information on the processing of personal data by the company's abbreviated name through social media platforms:

FACEBOOK: www.facebook.com

INSTAGRAM: www.instagram.com

YOUTUBE: www.youtube.com

LINKEDIN: www.linkedin.com

The controller processes the personal data of the data subjects in an information system jointly operated by the owners and licensees of Payless - other operators (with the exception of data collected from GPS monitoring devices, which is processed in a separate information system of the controller). In the context of this processing, personal data is transferred within the EU countries (the locations of the respective controllers), whereby the individual controllers are obliged to ensure an adequate level of security of the personal data processed.

Why does the controller process personal data?

The controller processes personal data of data subjects for the purposes of:

• pre-contractual and contractual relations, in particular for the purposes of processing and sending quotations, bookings, preparing and concluding contracts and fulfilling the contractual obligations of the controller, in particular in the context of lease agreements, rental agreements, framework agreements related to contract management, the acceptance and handover of leads, complaints procedures, invoicing, etc... The provision of personal data by the data subject is a contractual requirement. Failure to provide personal data will prevent the conclusion of a contractual relationship with the data subject.
• the unambiguous identification of the data subject on the basis of the consent given by the data subject before making photocopies of the data subject's official documents and/or other electronically made and recorded copies and descriptions of official documents (scanning of documents, authentication of documents stored on electronic media, etc.), provided that the controller, in justified cases, requests such copies of official documents from the data subject. The provision of consent is voluntary.
• security, protection of property and financial interests arising from the contractual relationship entered into and the legitimate interest of the controller derived therefrom. To this end, selected rental vehicles are secured by monitoring their location via satellite tracking (GPS) (tracking of rental vehicles during their use and after their theft). The processing of personal data (resulting from the vehicle location information obtained) occurs if the rented motor vehicle is used by a single natural person, i.e. if at the time of use of the rented motor vehicle the operator is able to identify a specific natural person and the vehicle is equipped with a monitoring device. In this case, personal data will be processed to the extent of the GPS information obtained about the occurrence of the vehicle and the inferable characteristics of the data subject. The hirer is informed when taking delivery of the vehicle that the hired vehicle is equipped with a GPS monitoring device.
• the recovery of damages and claims incurred, the settlement of insurance claims, the storage of documentation and records made and on the basis of other necessary legitimate interests of the operator.

How to legally provide personal data about another natural person ?

• The provision of personal data to the controller about another natural person, even without his/her consent, is only authorised by the lessor, who is the employer of the natural person, solely in connection with the establishment of pre-contractual and contractual relations related to the rental of the vehicle and only to the extent of: title, first name, surname, job classification, job title, functional classification, employee's personal number or employee number, professional department, place of work, telephone number, fax number, workplace e-mail address and employer identification data, if necessary in connection with the performance of the job duties, official duties or functional duties of the person concerned. The disclosure of personal data shall not undermine the dignity, respect and safety of the data subject.
• Providing personal data to the controller about another natural person, even without his consent, is only permitted by the natural person who is the lessor in accordance with applicable law and the terms and conditions of the contract only if he thereby protects his legally protected interests, e.g. in the event of an insurance claim.
• In other cases, the data subject is only obliged to provide the controller with the personal data of another natural person with his or her consent, which he or she is obliged to provide to the controller. By providing the data of another natural person, the data subject expressly declares that he or she has adequate authorisation to provide the personal data of that person to the controller.

Within what time limits is the personal data STORED ?

• The personal data obtained from the monitoring of vehicles is kept for a period of 2 years after the proper termination of the contractual relationship.
• Photocopies of official documents are kept for the duration of the contractual relationship and are destroyed within 3 years at the latest, unless they are used by the controller on the basis of legitimate interests (e.g. in the context of dealing with damages, insurance claims and theft).
• Personal data processed for other purposes shall be retained for the period necessary to achieve the purpose of their processing as determined by specific legislation or in the context of the legitimate interest of the controller, but no longer than 10 years and only to the extent necessary for the purposes of keeping accounting records.

To which recipients is the personal data provided ?

• Control authorities in the performance of their activities within the meaning of a specific legal regulation (e.g. Slovak Trade Inspection),
• Courts and law enforcement authorities at their request or in the context of the legitimate interests of the controller,
• insurance companies with which the operator has concluded an insurance contract related to the rented vehicle,
• a contracted intermediary: United Automotive Group, s. r. o. IČO: 50202511; United Finance Group, s. r. o. IČO: 44560486, contractual intermediaries within the branch network of Payless Slovakia. Information about current intermediaries can be obtained via the hotline +421 2 2030 2100, or electronically (by e-mail) upon request sent to the e-mail address customerservice@paylesscar.sk.
• and other recipients to whom the controller is obliged to provide personal data pursuant to a special law or legitimate interest.

What are the rights of the data subject in the processing of his/her personal data ?

The data subject has the right to:

• to information about the processing of his or her personal data;
• to obtain access to the personal data processed and stored about him or her;
• to request the rectification of his/her personal data which are incorrect, inaccurate or incomplete;
• request the erasure of their personal data when they are no longer necessary or when the processing is unlawful;
• object to the processing of your personal data for marketing purposes or on grounds relating to a particular situation;
• request the restriction of the processing of your personal data in specific cases;
• receive their personal data in a machine-readable format and/or request its transfer to another controller;
• withdraw his or her consent at any time, without affecting the lawfulness of processing based on consent given prior to its withdrawal, where such consent has been given by the data subject;
• to request that decisions based on automated processing which concern or significantly affect him or her, based on his or her personal data, be carried out by natural persons and not by automated technical means, where the personal data are so processed by the controller. The data subject shall have the right to express his or her point of view and to object to the controller's decision;
• lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, and the right to an effective judicial remedy if he or she considers that the processing of his or her personal data is unlawful. The supervisory authority in the territory of the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12 Bratislava;
• submit a request or complaint to the controller in relation to the protection and processing of her personal data. Any data subject who wishes to make a request or complaint and exercise his or her rights may do so:
• in writing at United Rental Group, s.r.o., Ivánska cesta 4358/43, Bratislava 821 04.
• electronically at: customerservice@paylesscar.sk,
• by telephone on the hotline: +421 2 2086 2620