DATA PROTECTION POLICY
PRIVACY POLICY
Who is the data controller?[1]
Noleggiare s.r.l., in the person of its legal representative with registered office in via Del Brennero n.62 38123 Trento (TN), (hereinafter, „Controller“),
How can I contact them The contact details of the company are:
Certified email: [email protected]
Email: [email protected]
Address: via Del Brennero, 62 – 38123 Trento (TN)
Has a DPO been appointed? What are their contact details?
The company has appointed as its DPO the lawyer Antonino Polimeni, who can be contacted at the following email address: [email protected]. The DPO can be contacted to exercise the rights of data subjects and for any information related to the processing of personal data.
1. Introduction
According to the European Regulation on the protection of personal data (GDPR), legal persons are not considered data subjects and therefore the European regulation does not apply. However, if personal data referring to a natural person are entered in the context of the collection of corporate data, they will be considered a data subject pursuant to the aforementioned regulation with consequent applicability of the reference legislation.
2. What processing is carried out through the site? And what are the legal bases, purposes and storage times?
NEWSLETTER AND SENDING OF COMMERCIAL INFORMATION VIA SOFT SPAM
PURPOSE
The purpose of data processing is to allow you to subscribe to the newsletter service and for sending you messages for promotional purposes (DEM).
After signing the rental agreement, your data will be exported to a CRM for sending commercial information on products similar to those being purchased.
LEGAL BASIS
After the purchase, the legal basis for registration can be found in Art. 130 para. 4 of Legislative Decree 196/2003
STORAGE TIMES
We will delete the data after 1 year from the last submission. It will always be possible to exercise the optout at any time.
MORE INFORMATION
In case of rental, the provision of data is automatic
NEWSLETTERS AND DEM
PURPOSE
The purpose of data processing is to send newsletters and DEMs to the User
LEGAL BASIS
Consent Given by the Data Subject
STORAGE TIMES
1 year from the last mailing or until consent is revoked.
MORE INFORMATION
Consent may be revoked at any time. The User is fully free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide the data marked as essential, the Data Controller will not be able to fulfill the stated purpose.
Segmentation according to language, type of product, location of residence or rental.
Transfer of data to third parties: with explicit consent, your data will be transferred to FTH s.p.a. and Tomasi Auto s.r.l. for statistical and/or commercial purposes. FTH s.p.a. and Tomasi Auto s.r.l. are subsidiaries and/or contractually linked to Noleggiare s.r.l.
OPEN A RENTAL POINT
PURPOSE
The purpose of the data processing is to allow you to send us requests for information about the opening of one of our rental points; to exercise or defend a right in litigation.
LEGAL BASIS
Execution of pre-contractual measures carried out at the request of the data subject. In case of litigation, the data will be processed to act and/or defend in court based on the legitimate interest of the Owner.
STORAGE TIMES
We will process the data for the time necessary to carry out the negotiation and they will subsequently be deleted after 12 months from the last email or contact. The data may be kept longer only in case of possible disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
In the event that, as a result of the negotiations, the contract is concluded, specific information will be provided and the data will be transferred to the appropriate system.
Verification of the obsolescence of the data is carried out every 12 months.
MORE INFORMATION
The User has full freedom to release the requested data, since there is no legal obligation to provide them. However, if the User chooses not to provide data reported as essential, the Data Controller will not be able to provide the requested service.
CONTACT US
PURPOSE
The purpose of data processing is to allow you to send us requests for information about a specific product; to exercise or defend a right in litigation.
LEGAL BASIS
Execution of pre-contractual measures carried out at the request of the data subject. In case of litigation, the data will be processed to act and/or defend in court based on the legitimate interest of the Owner.
STORAGE TIMES
We will process the data for the time necessary to carry out the negotiation and they will subsequently be deleted after 12 months from the last email or contact. They may be kept longer only in case of possible disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
Verification of the obsolescence of the data is carried out every 12 months.
MORE INFORMATION
The User has full freedom to release the requested data, since there is no legal obligation to provide them. However, if the User chooses not to provide data reported as essential, the Data Controller will not be able to provide the requested service.
WORK WITH US
PURPOSE
The main purpose of data processing is to allow the sending of a CV for possible recruitment.
LEGAL BASIS
Execution of pre-contractual measures carried out at the request of the data subject.
With regard to the possible inclusion in the CV of „particular“ data pursuant to Art. 9 GDPR, they will be processed on the basis of letter b) „processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the data subject in the field of employment and social security and social protection law“.
STORAGE TIMES
We will keep your CV for one year after sending.
MORE INFORMATION
The User has full freedom to release the requested data, since there is no legal obligation to provide them. However, if the User chooses not to provide data reported as essential, the Data Controller will not be able to provide the requested service.
The selection process will not take place with automated tools.
RENTAL
PURPOSE
The main purpose of the data processing is to rent the car; the secondary purposes are those related to accounting and tax obligations as well as the withdrawal thereof; to exercise or defend a right in litigation.
LEGAL BASIS
The legal basis is the execution of the contract and the fulfillment of legal obligations (including accounting and tax).
In the event of a dispute, the data will be processed for taking action or defense in court and this corresponds to the legitimate interest of the data controller.
STORAGE TIMES
The data will be deleted after 10 years from the return of the car.
The data may be kept longer only in case of possible disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
MORE INFORMATION
The provision of data is obligatory for the conclusion of the contract. In any case of refusal it will not be possible to send the request.
REVIEWS
PURPOSE
The main purpose of data processing is to import the reviews freely left through Google.
LEGAL BASIS
Legitimate interest of Noleggiare to ask for a review.
STORAGE TIMES
The data will be visible until obsolescence or until an advanced deletion request is made to Google.
They may be kept longer only in case of disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
MORE INFORMATION
This specific processing is not carried out by Tomasi Auto, but by Google. The company is limited to importing the reviews freely and spontaneously left by users within its website because this is what they refer to.
How to delete them? You will need to click on the trash symbol next to your evaluation directly from Google.
MONTHLY RENTAL
PURPOSE
The main purpose of data processing is to send us a request for a quote; to exercise or defend a right in litigation.
LEGAL BASIS
The legal basis is the execution of pre-contractual measures carried out at the request of the data subject.
In the event of a dispute, the data will be processed for taking action or defense in court and this corresponds to the legitimate interest of the data controller.
STORAGE TIMES
We will process the data for the time necessary to carry out the negotiation and subsequently they will be deleted after 12 months from the last email or contact. They may be kept longer only in case of possible disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
MORE INFORMATION
The User has full freedom to release the requested data, since there is no legal obligation to provide them. However, if the User chooses not to provide data reported as essential, the Data Controller will not be able to provide the requested service.
BUSINESS RENTAL AGREEMENT
PURPOSE
The main purpose of data processing is to send us a request for a quote; to exercise or defend a right in litigation.
LEGAL BASIS
The legal basis is the execution of pre-contractual measures carried out at the request of the data subject.
In the event of a dispute, the data will be processed for taking action or defense in court and this corresponds to the legitimate interest of the data controller.
STORAGE TIMES
We will process the data for the time necessary to carry out the negotiation and subsequently they will be deleted after 12 months from the last email or contact. They may be kept longer only in case of possible disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
MORE INFORMATION
The User has full freedom to release the requested data, since there is no legal obligation to provide them. However, if the User chooses not to provide data reported as essential, the Data Controller will not be able to provide the requested service.
AGENCIES AND TOUR OPERATOR
PURPOSE
The main purpose of data processing is to send us a request for a quote; to exercise or defend a right in litigation.
LEGAL BASIS
The legal basis is the execution of pre-contractual measures carried out at the request of the data subject.
In the event of a dispute, the data will be processed for taking action or defense in court and this corresponds to the legitimate interest of the data controller.
STORAGE TIMES
We will process the data for the time necessary to carry out the negotiation and subsequently they will be deleted after 12 months from the last email or contact. They may be kept longer only in case of possible disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
MORE INFORMATION
The User has full freedom to release the requested data, since there is no legal obligation to provide them. However, if the User chooses not to provide data reported as essential, the Data Controller will not be able to provide the requested service.
LONG TERM RENTAL
PURPOSE
The main purpose of data processing is to send us a request for a quote; to exercise or defend a right in litigation.
LEGAL BASIS
The legal basis is the execution of pre-contractual measures carried out at the request of the data subject.
In the event of a dispute, the data will be processed for taking action or defense in court and this corresponds to the legitimate interest of the data controller.
STORAGE TIMES
We will process the data for the time necessary to carry out the negotiation and they will subsequently be deleted after 12 months from the last email or contact. They may be kept longer only in case of possible disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
MORE INFORMATION
The User has full freedom to release the requested data, since there is no legal obligation to provide them. However, if the User chooses not to provide data reported as essential, the Data Controller will not be able to provide the requested service.
USED VEHICLE PICKUP WITH LONG TERM RENTAL (Trade-in)
PURPOSE
The main purpose of data processing is to send us a request for a quote; to exercise or defend a right in litigation.
LEGAL BASIS
The legal basis is the execution of pre-contractual measures carried out at the request of the data subject.
In the event of a dispute, the data will be processed for taking action or defense in court and this corresponds to the legitimate interest of the data controller.
STORAGE TIMES
We will process the data for the time necessary to carry out the negotiation and they will subsequently be deleted after 12 months from the last email or contact. They may be kept longer only in case of possible disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
MORE INFORMATION
The User has full freedom to release the requested data, since there is no legal obligation to provide them. However, if the User chooses not to provide data reported as essential, the Data Controller will not be able to provide the requested service.
WEB CHECK-IN
PURPOSE
The main purpose of data processing is to speed up the check-in process following rental; to exercise or defend a right in litigation.
LEGAL BASIS
The legal basis is the execution of the contract.
In the event of a dispute, the data will be processed for taking action or defense in court and this corresponds to the legitimate interest of the data controller.
STORAGE TIMES
We will process the data for 10 years from the return of the car. They may be kept longer only in case of possible disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.
MORE INFORMATION
The provision of data is optional. In any case of refusal it will not be possible to send the request.
BROWSING DATA
PURPOSE
Site security.
LEGAL BASIS
We will process the data based on the legitimate interest of the company in cybersecurity and compliance with legal obligations. The legal basis for the processing of cookies other than those necessary is consent.
STORAGE TIMES
24 months.
MORE INFORMATION
For the regulation on cookies, please refer to the specific information notice.
BLACKLIST
The blacklisting may be decided internally by the company based on the evaluation of contracts you have signed that have been followed by disputes, damages or accidents.
Your personal data will be processed in order to assess your reliability as a customer and prevent possible fraud. This processing is justified by the legitimate interest of the Data Controller pursuant to Article 6(1)(f) of Regulation (EU) 2016/679 (“GDPR”).
Blacklisting is a processing operation aimed at protecting the Data Controller from risks resulting from untrusted behavior. Such processing is carried out with the utmost care and in accordance with the principles of necessity, proportionality, and data minimization, as stipulated in Article 5 GDPR.
It is important to emphasize that there is no automated decision making in blacklisting; every decision is made with human intervention, ensuring that all relevant aspects of your behavior as a customer are carefully evaluated.
In addition, the Data Controller takes appropriate measures to ensure that blacklisted data is correct and up-to-date.
The processing will last for a 5-year period.
3. What else do I need to know?
The data will be treated in a lawful manner, according to fairness and with the utmost confidentiality, in compliance with the appropriate security measures as provided for by the Code and the Regulation. The processing will be carried out by digital means. The data will not be publicly disclosed (with the exception of the name linked to the review) and the user will not be subjected to automated decision-making processes such as profiling unless they consent to this by flagging the appropriate box or by installing cookies or other tracking tools for whose standardization reference is made to the appropriate information notice.
4. To whom will my data be communicated?
The Data Controller may communicate the data to all subjects to whom communication is obligatory by law for the fulfillment of the purposes provided by law.
The Data Controller also makes use of some companies or IT tools that carry out processing activities on the personal data of data subjects in the exclusive interest of the data controller, all appropriately appointed as data processors pursuant to Art. 28 GDPR. The list of data processors can be found on site. For the collection of the car, the data will be communicated to external subjects (collection points) who act as data processors. The data will also be communicated to the payment gateways as independent data controllers. In the event of a merger, sale or any other corporate change and/or in the event of the organization of one of these operations, your data may be shared. In addition, in the event that the company owned by the Data Controller or part of it is sold to a third party, the latter may continue to use your data, again in the manner provided in this privacy policy.
5. What is the place of storage and transfer of data?
The management and storage of personal data will take place on servers located in Europe of the Data Controller or of companies appropriately appointed as Data Processors.
6. What are my rights and how can I exercise them?
a) Rights of the data subject
The user, in their capacity as data subject, has the rights referred to in Art. 15 et seq. of the Regulation and precisely:
1. RIGHT OF ACCESS (Art. 15 GDPR) The data subject has the right to obtain confirmation of the existence or not of personal data concerning them, even if not yet registered, and their communication in intelligible form. |
2. RIGHT TO RECTIFICATION (Art. 16 GDPR) The data subject has the right to obtain the rectification of inaccurate personal data concerning them and also the integration of incomplete personal data. |
3. RIGHT TO ERASURE (Art. 17 GDPR) The data subject has the right to obtain the erasure of personal data in the presence of particular reasons such as withdrawal of consent, objection to processing or if the data are no longer necessary with respect to the purposes for which they were collected and processed or in case of unlawful processing. It will not always be possible to proceed with erasure but it will certainly be the responsibility of the data controller to provide adequate motivation. |
4. RIGHT TO RESTRICTION OF PROCESSING (Art. 18 GDPR) The data subject has the right to obtain restriction of processing in the presence of particular hypotheses such as, for example, in the case of a request for rectification or objection during the request evaluation time. |
5. RIGHT TO PORTABILITY (Art. 20 GDPR) If the processing is based on consent or on the contract and is carried out with automated tools, the data subject can receive them in a structured format, commonly used and readable by the device or ask to transmit them to another controller. |
6. RIGHT TO OBJECT (Art. 21 GDPR) The data subject has the right to object, in whole or in part: a) for legitimate reasons to the processing of personal data concerning them, even if pertinent to the purpose of collection; b) to the processing of personal data concerning them for the pursuit of purposes not contemplated by Art. 2. The user can make a request for objection to the processing of their personal data pursuant to Article 21 of the GDPR in which they give evidence of the reasons that justify the objection: the Data Controller reserves the right to evaluate the request, which would not be accepted in case of existence of compelling legitimate reasons to proceed with the processing that prevail over the interests, rights and freedoms of the user. |
7. RIGHT TO LODGE A COMPLAINT The data subject has the right to lodge a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR if they consider that the processing of their data is contrary to current legislation. |
b) Exercising methods:
The data subject may at any time exercise the rights referred to in the preceding article by contacting the DPO at the following address: [email protected]