Information regarding the processing of personal data
(in compliance with European Regulation n°679/2016 and Leg. Decree 196/03 and subsequent amendments)
Dear Sir / Madam /Company,
We wish to inform you that European Regulation n ° 679/2016 and Legislative Decree 196/03 with the subsequent amendments and integrations provide that individuals must be protected with regard to the processing of their personal data. The information contained in this document is provided to individual users and to individuals representing and operating on behalf of legal companies, entities and organisations pursuant to art. 13 of European Regulation 679/2016 (GDPR).
Therefore, Genova Car Sharing S.r.l., as Data Controller, hereby provides you with the information regarding the processing of the personal data requested in connection with and for the provision of the services you have requested, as well as those collected for the management of contractual or pre-contractual procedures.
We kindly ask you to print or save a copy of the present document for future reference.
The Data controller is:
- Genova Car Sharing S.r.l.;
- Via Brigate Partigiane, 1 - 16129 Genova;
Data Protection Officer (DPO)
The Group this Company is part of has nominated a Data Protection Officer who supports the Data Controller with regard to the application of national and European data protection laws, in cooperation with the Supervising Authority and acting as contact and mediator between the involved parties. The Data Protection Officer can be reached at the following address: firstname.lastname@example.org
Purpose and legal basis of the processing
The personal data, including the data relating to online traffic (for example: internet IP address, geographical location of the terminal, etc.) and geolocation of the rented vehicle, provided when you requested and registered for our services and/or acquired subsequently during the execution of the contract, are collected and may be processed for the following purposes:
- To offer car sharing/car rental services as provided under the General Contract Conditions, and to manage requests for booking and assistance via the website, smartphone app or telephone;
- To manage ongoing contracts and to execute pre-contractual measures, in particular to fulfil instrumental aims needed to perform business activities, such as the operational, technical and administrative management of customer relations in connection to the provision of services, storage, billing, management of payment (and relative treatment - according to the law - of the payment data, including credit card details) for the services requested and for any accessory economic charges, and, in any case, to the extent that the processing is necessary for the execution of the obligations deriving from the contracts themselves; to this end, the Company may use your contact details to send notices of an exclusively informative nature regarding changes to the contractual conditions, updates on service operations and any other information regarding services that the Company may consider useful for the customer to know;
- To manage relations with third party authorities and public bodies for purposes related to particular requests, the fulfilment of legal obligations or particular procedures (i.e. re-notification of the actual violator following a violation of traffic laws);
- To answer questions and manage requests for commercial assistance received by e-mail, through an online form, or by phone through the designated telephone numbers;
- To send commercial and promotional newsletters following the customer’s voluntary subscription to the mailing list through the form available on the Genoa Car Sharing website.
The processing of personal data for the purposes referred to in letters a), b) and c) is carried out in execution of the contract that you are party of and in relation to which Genova Car Sharing S.r.l. is the data controller. The processing of personal data received by the Company for the purposes referred to in letters d) and e) is carried out on the basis of your explicit consent.
Furthermore, we inform you that the data acquired by the fleet management system installed on board vehicles acquires and sends data regarding the vehicle’s geographical position, average speed, fuel consumption and progressive kilometres travelled.
These data are processed exclusively to satisfy logistic and billing needs, to ensure a more efficient management and maintenance of the fleet, to ensure safety and ultimately to prevent and fight criminal actions against the company’s assets.
The personal data acquired by the localization system are processed with the aid of an automated IT tool and protected by appropriate security measures.
Nature of data provision
The provision of data for the purposes referred to in letters a), b) and c) is necessary in order to provide the services requested and/or to manage or execute contractual obligations arising from our existing relationship. Any refusal to provide such data could lead to failure to perform or partial performance of the related contractual or pre-contractual services.
The provision of data for the purposes referred to in letters d) and e) is optional and its processing, which requires the consent of the interested party expressed at the time of activation of the requested services or even subsequently and which remains valid until revocation, can be used improve products and services; any failure to provide data will not affect the provision of the requested services and/or the contractual relationship.
The processing of personal data takes place through manual, electronic or in anyways automated computerized and electronic processing instruments, with strict correlation with the aims and purposes and, in any case, in order to guarantee the security and confidentiality of the data.
Recipients/types of recipients
The data will not be disseminated and, in relation to the aforementioned purposes, your personal data may be communicated or accessible, depending on the scope of the processing and the nature of the respective contractual relationship, to the following subjects or categories of subjects:
- companies and/or subjects that perform functional and/or auxiliary services for the management of Car Sharing activities with which the Company has various types of agreements;
- suppliers of software, technologies and systems for managing vehicles, invoicing and payment, necessary for the provision of the services described in the agreement;
- persons in charge of debt collection activities and insurance companies who handle the settlement of claims;
- Institutional entities, authorities and organisations, as well as experts, consultants and lawyers, Police Forces and other Public Administrations, for the fulfilment of obligations required by law, or by EU regulations and legislation.
These parties may process the data as "Holders" in full autonomy, pursuant to national and European legislation, being outside the original processing carried out by Genova Car Sharing Srl, or as "Managers" for specific processing based on contractual agreements with Genova Car Sharing relating to the outsourcing of certain services. Your data may also be disclosed to individuals appointed by the Data Controller, such as employees, collaborators, consultants, as well as employees of external companies attributable to the subjects referred to in the aforementioned list, who are assigned to the area and to support the central corporate functions and operating activities. The updated list of the Data Processors designated by Genova Car Sharing S.r.l. in relation to the performance of services is kept at the Company’s registered office.
Foreign transfer of data
Your data may also be communicated and transferred abroad, for the purposes of providing the services referred to in the previous paragraphs and/or for the use of services in the cloud (also outside the European Union).
Automated decision-making processes
The Data Controller does not in any way use automated decision-making processes regarding customers’ personal data.
Data retention period
- In relation to the purposes referred to in letters a), b) and c) the personal data provided by you will be collected and stored by the data controller for the time needed to manage the mutual contractual relations and to comply with legal obligations, also with regard to taxes and accounting, and in any case no more than 10 years from the end of the business relations between parties.
- The data collected for the purposes referred to in letter d) processed for the time necessary to manage your requests and in any case not beyond the time necessary to make them anonymous.
- The contact details for which you provide consent to receive commercial communications will be used for the purposes referred to in letter e) for the time deemed useful by Genova Car Sharing S.r.l. and in any case no later than 24 months after initial collection.
Rights of the interested party
At any time, the interested party may exercise his rights, as listed below, according to the provisions of EU Regulation 679/2016 and current national legislation:
- Right of access: the interested party has the right to obtain confirmation that his personal data is being processed and if so, to obtain access to his personal data. He may, at any time, request access to the following information: the reason and purpose for which his data is being processed, the types of processed data, the recipients to whom the data are or will be communicated, the data retention period, his rights, the origin of the data and the possible existence of an automated process.
- Right of rectification: the interested party has the right to obtain from the data controller the rectification of inaccurate personal data concerning him without unjustified delay. In addition, he has the right to obtain the integration of incomplete personal data, even providing a supplementary declaration. In this case, the data controller will have the obligation to inform each recipient to whom the personal data has been transmitted about any amendments.
- Right of cancellation: the interested party has the right to obtain the cancellation of personal data concerning him without unjustified delay. Moreover, if his data has been made public, the owner will delete it and take reasonable measures, also technical, to inform the data controllers who are processing it that the subject has requested that all copies of his personal data be cancelled.
- Right to limitation of treatment: if the interested party deems it appropriate, he can request the limitation of the processing of personal data concerning him and limit treatment of future data. In this case, the data controller will communicate to each of the recipients if there are any limitations to the data they’ve received, unless this proves impossible or involves a disproportionate effort.
- Right to data portability: the interested party has the right to receive, in a structured format, commonly used and readable by automatic devices, the personal data concerning himself and to preserve the data for his future personal use; the interested party has the right to request the direct transmission of his data to another holder without impediments, if this is technically possible.
- Right to object to processing: the subject has the right to object at any time, for reasons connected with his particular situation, to the processing of any personal data that concerns him.
- Right to withdraw consent: in the case of processing of data based on consent, the subject may revoke consent. However, this act does not affect the validity of the processing carried out by the holder up to that time.
- Right to file a complaint with the Supervising Authority: if the interested party considers that his data has been processed illegitimately and in violation of the rules and principles regarding the protection of personal data, he has the right to contact the Control Authority (Privacy Guarantor) to file a complaint, in accordance with the procedures defined by the latter.