Dear Customer,
this document (« Policy« ) is intended to provide guidance on the processing of information, as specified below, which will be provided by you and will be treated by Sicily Rent Car Srl for the purposes set out below. The Policy, in particular, is provided pursuant to EU Regulation no. 679/2016 (« GDPR« ) and subsequent national rules of adaptation.
1. Identity and contact details of the Data Controller
The owner of the data is Sicily Rent Car S.r.l. that you can contact at the following address: info@sicilyrentcar.it.
2. Categories of personal data processed
Within the limits of the purposes and methods described in this Policy, information may be processed that may be considered (I) as « Simple personal data », which includes your personal details, your bank details, your contact details (such as, for example, mobile phone number, e-mail address). Hereinafter, jointly, « Personal Data » and (II) as « Particular Data » because they are characterized, according to the Applicable Law, by a particular nature; they refer, in fact, to the physical health and, more generally, they are able to provide information on the health status of the user (e.g. data related to the law 104). For convenience of reference, in this Policy, the expression « Personal Data » should be understood as referring to all your personal data, unless otherwise specified.
3. Methods of data processing
Personal Data will be processed by manual, computer or telematic devices that guarantee security and confidentiality and will be carried out by personnel duly trained to comply with the GDPR. In addition to the cases in which it is necessary to contact you for needs related to the management of your position, where you consent to the processing of your data, for the purposes referred to in paragraphs 4 and 4.1, you may be contacted by e-mail, SMS, or any equivalent electronic media or by mail or call via operator at all contact details provided. If you give your consent in relation to the purposes referred to in paragraphs 4 and 4.1., your personal data will be made visible and stored in an electronic archive of customer relationship management (CRM), owned by the writer.
4. Purpose and legal basis of the treatment
point 4 letter a): for the management of your contractual relationship or for the implementation of pre-contractual measures (such as, for example, requests for information or requests for estimates). In this case, you are free to provide your Personal Data, even if particular; however, failure to provide it will not allow you to establish the aforementioned relationship and satisfy your request. The processing is necessary in relation to the execution of a contract to which you are a party
point 4, letter b): subject to your specific consent, for the performance (and subsequent use) of surveys and / or market research carried out in the interest of the owner to contact you, at the addresses provided, in order to verify the quality of service provided to you and your degree of satisfaction
point 4, letter c): subject to your specific consent, to send you (I) reminders and promotional communications relating to Sicily Rent Car S.r.l.; and (II) communications relating to events organized by the writer or its business partners (« marketing purposes »)
point 4, letter d): subject to your specific consent, your personal data may be disclosed to companies associated with Sicily Rent Car S.r.l., as independent holders, who may process information concerning you for marketing and profiling purposes.
4.1. Purpose of the treatment: the profiling (and its legal basis)
Article 4 of the GDPR defines profiling as ‘any form of automated processing of personal data consisting in the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects of that natural person’s occupational performance, economic situation, health, personal preferences, interests, reliability, conduct, location or travel’. Therefore, it must be considered as the whole of the activities of collecting and processing data concerning the users of a service, in order to divide them into groups according to their behaviour. As part of the activities of the owner, if you express your specific consent (letter e – « Profiling »), your personal data may be processed by the writer to trace a « history » of its business relationship with the writer, considering any different contact (participation in events, request for quotes, etc.. Whether offline or online); by determining what « customer » interaction methods you have used and what your objectives could be based on established performance indicators: this processing is aimed at developing your profile to customize our offer of products and services of sale and assistance and specific services requested by you. The processing, as described, therefore guarantees the security and confidentiality of your information. The cancellation of any of the data provided by you will result in the updating, rectification and / or cancellation of your data in our possession.
5. Scope of communication of Personal Data – Dissemination
Your personal data may be transferred to:
• to third party companies that provide services relating to the activities of Sicily Rent Car S.r.l. that have been specifically appointed as Data Processors: agencies for processing practices, external consultants for tax and accounting advice, communication agencies and event organizations, etc. … You can request the complete list of managers, by writing an email to info@sicilyrentcar.it.
• The information may also be communicated whenever the communication may be necessary to comply with requests from the Judicial Authority or Public Security. The data collected will not be disclosed under any circumstances.
6. Period of data retention (criteria for determining)
Below are the indications of the storage times (i.e. the criteria for determining) of the Personal Data:
Point 4, letter a) (contract management) For the entire duration of the relationship and subsequently for 10 years (ordinary limitation). In addition, contact information and vehicle identification information may be retained for (I) 40 years from the date of manufacture of the vehicle for information relating to chassis data and recall campaigns; (II) 20 years from the date of manufacture of the vehicle for warranty claims; (III) 10 years from the date of delivery of the vehicle or 5 years from the date of the last contract activated (or 5 years from the date of the last claim) for warranty extension contracts. In any case, the storage period of your data will be exclusively represented by the time necessary to pursue the purposes set out above and will be equal to the duration of the service relationship between you and the Data Controller, except for the need for contractual, administrative, fiscal, accounting or legal obligations following the termination of the relationship.
point 4, letter b – c – d) Your personal data processed for the purposes of number 4 b – c – d will be kept until you request to revoke your consent to the processing of data, in particular the data relating to your profiling will not be kept for a period longer than 24 months from the time you gave your consent.
7. Rights that are granted to you
We inform you that you may exercise the rights recognized by the GDPR including, without limitation, the right (I) to access your Personal Data (and know the origin, purpose and purpose of the processing, the data of the persons to whom they are disclosed, the period of retention of data or the criteria used to determine it), (II) to request its correction, (III) cancellation (« oblivion »), if no longer necessary; incomplete, incorrect or collected in violation of the law, (IV) to request that the processing be limited to a part of the information concerning you; (V) to the extent technically possible, to receive in a structured format or to transmit to you or to third parties indicated by you the information concerning you (c.d. « portability » of the information concerning you and of that which you have voluntarily provided); (VI) as well as to revoke your consent at any time, if this constitutes the basis of the processing. The revocation of consent, however, does not affect the lawfulness of the processing based on the consent given before the revocation itself.
You also have the right to object to the processing of your Personal Data, including profiling. The above-mentioned rights may be exercised by means of a written request addressed without formalities to the Data Controller.
The Data Controller must do so without delay and, in any case, no later than one month after receipt of the request. The deadline may be extended by two months, if necessary, taking into account the complexity and number of requests received by the Holder. In such cases, the Holder shall inform you within one month of receipt of your request and shall inform you of the reasons for the extension.
We would like to remind you that if you are not satisfied with the response to your request, you may address and lodge a complaint with the Data Protection Authority (http://www.garanteprivacy.it/web/guest/home_en) in accordance with the terms of the GDPR.