Data Privacy Policy pursuant to Art. 13 and 14 GDPR

In the following we would like to inform you about the types of data processed by CityLink Executive and about the purposes of such data processing. We would also like to inform you about important legal aspects of data protection, such as your rights.

The party responsible for processing your data (controller) is CityLink Executive Limited, 96C Mayes Road, London, N22 6SY (hereinafter also referred to as CLE).

If you have any questions on data protection, please contact us at office@citylinkexecutive.co.uk.

The following categories of personal data can be processed by us in connection with our services:

  • Master data: These include, for example, a person’s first name, surname, address (private and/or business), date of birth.
  • Communication data: These include, for example, a person’s telephone number, email address (private and/or business) fax number if applicable, as well as the content of communications (e.g., emails, letters, faxes).
  • Contract data These include, for example, the rental information (vehicle category, pick-up and return dates, pick-up and return branch, booked extras/services), rental contract number, reservation number, driver’s licence data, driver’s licence photograph, license plates of the vehicle you rented, and information on customer loyalty and partner programmes.
  • Financial data such as credit card data.
  • Voluntary data: These are data that you provide to us on a voluntary basis, without us having explicitly requested them, and include information such as your preferences with regard to the vehicle’s equipment and category.
  • Special data categories: In the event of an accident, damage to the vehicle, or similar incidents, we process data relating to the respective course of events and the damage incurred. These data can be provided by customers, passengers or injured parties. The data processed in such circumstances can include health-related data such as data on injuries, blood alcohol levels, driving under the influence of narcotic substances, and the like.
  • Third-party data If, within the scope of your vehicle rental, you provided us with personal data of third parties (e.g., family members, second drivers, passengers), then we will also process these data.

Art. 6 (1) point (a) of the General Data Protection Regulation (GDPR): Pursuant to this provision, the processing of your personal data is lawful if and to the extent that you have given your consent to such processing.

Art. 6 (1) point b) GDPR: Pursuant to this provision, the processing of your personal data is lawful if such processing is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract (e.g., when making the vehicle reservation).

Art. 6 (1) point c) GDPR: Pursuant to this provision, the processing of your personal data is lawful if such processing is necessary for compliance with a legal obligation to which CLE is subject,

Art. 6 (1) point f) GDPR: Pursuant to this provision, the processing of your personal data is lawful if such processing is necessary for the purposes of the legitimate interests pursued by the controller, i.e., CLE, or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, i.e., you yourself.

Art. 9 (2) point f) GDPR: Pursuant to this provision, certain special categories of personal data can be processed if such processing is necessary for the establishment, exercise or defence of legal claims. These special categories of personal data include the health data of the data subjects.

1. Reserving and renting motor vehicles

Purposes of data processing

We process your master data, communication data, contract data, financial data and any data you have provided voluntarily, for purposes of implementing your reservations and facilitating the conclusion and performance of your rental contract.

We moreover use the master data, communication data and contract data for customer services purposes, for example to handle any complaints or changes of reservation that you contact us about.

If you book your vehicle via travel agencies, online travel agencies or other agents, then your master data, communication data, rental information and, if applicable, financial information, will be transferred to us by our partners.

We also use your master data, and contract data for purposes of settling accounts (e.g., com-missions and sales processing) with, for example, travel agencies, other agencies, franchise partners and cooperation partners. We also transfer your data to partner companies in the event that we do not have the vehicle or vehicle type requested by you available.

We are furthermore legally obliged – for purposes of preventing and investigating criminal offences – to compare your master and communication data with official perpetrator lists provided to us. Such comparisons also serve to ward off dangers and to facilitate prosecution by the state authorities.

We furthermore use your data for your and our security, for example to avoid payment defaults and to prevent property offences (in particular fraud, theft, embezzlement). If you request to pay for your rental by invoice, then we process your master and financial data in order to assess your creditworthiness by obtaining the corresponding information from credit agencies.

Once both contracting parties have fulfilled their obligations under the rental contract, your master data, financial data and contract data will be stored until the statutory retention period expires.

Legal basis for the above processing

Art. 6 (1) point b) GDPR applies to the processing of data to the extent required to implement reservations, to conclude and perform contracts and for customer relations purposes.

Art. 6 (1) point f) GDPR applies to the processing of data to the extent required to settle accounts vis-à-vis third parties, to assert one’s own claims, and to mitigate risks and prevent fraud.

Art. 6 (1) point c) GDPR applies to the processing of data to the extent required to detect, prevent and investigate criminal offences, to examine and store driver’s licence data, and to comply with preservation periods under commercial and tax law.

Legitimate interest, to the extent that Art. 6 (1) point f) GDPR applies to the type of processing concerned

Our legitimate interests in using your personal data to improve our services and customer services lie in the fact that we want to offer you the best possible services and to sustainably improve customer satisfaction.

To the extent that data processing is required to perform analyses with a view to preventing damage to our company and our vehicles, our legitimate interests lie in maintaining security for costs and preventing economic disadvantages such as those arising from non-payment or the loss of our vehicles.

Categories of recipients of your data

For the purposes described in the foregoing, we disclose your data to the following recipients: IT service providers, call centres, collection companies, financial services providers, credit agencies, agency partners, franchise partners and other cooperation partners.

2. Marketing and direct advertising

Purposes of data processing

We process your master data, communication data and contract data for purposes of promoting customer loyalty, implementing bonus programmes. The customer loyalty programmes we promote include our own programme and the programmes of our cooperation partners.

We use your email address in order to recommend similar products and services offered by us. You may at any time object to your email address being used without incurring more than the cost of transmission as per the applicable basic fees. 

Legal basis for processing

Art. 6 (1) point a) GDPR applies to data processing for purposes of implementing direct marketing measures that require explicit advance consent.

Art. 6 (1) point f) GDPR applies to data processing for purposes of implementing direct marketing measures that do not require explicit advance consent, and of implementing the marketing measures mentioned (→ Purposes of data processing).

Legitimate interest, to the extent that Art. 6 (1) point f) GDPR applies to the type of processing concerned

Our legitimate interests in using your personal data for purposes of implementing direct mar-keting measures and the marketing measures mentioned lie in the fact that we want to convince you of our services and promote a lasting customer relationship with you.

Categories of recipients of your data

For the purposes described in the foregoing, we disclose your data to IT service providers, call centres, advertising partners and providers of customer loyalty programmes.

3. Damage, accidents, administrative offences

Purposes of data processing

If you discover damage to our vehicles, if you or another person cause/causes such damage, or if you or another person are/is involved in an accident with one of our vehicles, then we will process you master data, communication data, contract data, financial data and, if applicable, data concerning health for the following purposes:

  • receiving and processing complaints,
  • providing customer services in cases of damage,
  • settling claims, and
  • processing damages resulting from accidents (processing based on information provided by you and third parties such as the police, subsequent renters, witnesses, etc.).

This includes the processing of the aforementioned data categories for purposes of settling claims, for example vis-à-vis insurance companies

When dealing with cases of damage and accidents, we also process you master data, communication data and contract data with a view to providing help in the form of our CLE damage assistance services and mobility guarantee.

We also process you master data, communication data and contract data for purposes of fulfilling legal obligations (e.g. providing information to investigating authorities).

Should the competent authorities suspect you of having committed an administrative or criminal offence with one of our vehicles, then we will process not only the master data pertaining to you that we have stored, but also the data conveyed to us by the competent authorities.

We also process your master data, communication data, financial data, contract data and, if applicable, data concerning health, for purposes of upholding and asserting any claims that we may have against you, for example claims resulting from non-payment or damage caused to our vehicles.

Legal basis for processing

Art. 6 (1) point b) GDPR applies to data processing for purposes of complaints management, providing customer services in cases of damage, and processing damages resulting from accidents.

Art. 6 (1) point c) GDPR applies to data processing for purposes of processing damages resulting from accidents. Art. 6 (1) point f) GDPR applies to data processing for purposes of settling claims, asserting any claims that we may have against you, and handling claims relating to administrative offences.

Art. 9 (2) point f) GDPR applies to the processing of data concerning health for purposes of establishing, exercising or defending legal claims.

Legitimate interest, to the extent that Art. 6 (1) point f) GDPR applies to the type of processing concerned

Our legitimate interests in using your personal data for purposes of settling claims and asserting any claims that we may have against you lies in our desire to ward off damage to our company and to ensure that we can provide our customers with undamaged vehicles. We are moreover obliged, pursuant to our contractual relations with third parties (e.g. insurance com-panies), to process your data for purposes of settling claims. Our legitimate interests in this respect lie in ensuring our contractual fidelity.

Recipients/categories of recipients of your data

For the purposes described in the foregoing, we disclose your data to the following recipients: Public authorities (investigating authorities; regulatory authorities; police authorities), collecting companies, experts, assistance services providers, lawyers and insurance companies.

4. Website

Purposes of data processing

Your personal data is recorded via CLE website if you actively provide such data to us, for instance as part of a registration procedure, by filling out forms, by sending emails, and, primarily, by making a vehicle reservation. We use these data for the purposes described above or for purposes that arise from the respective request, for example, to process specific reservation requests or preferences.

The data are only used for advertising purposes to the extent that such advertising is our own (including tell-a-friend features).

Security, SSL technology

CLE has implemented a variety of technical and organisational measures in order to protect your personal data, in particular against random or intentional manipulation, loss, destruction and access by unauthorised persons. These security measures will be continually adapted in accordance with technological developments. The transfer of personal data between your computer and our server invariably takes place by encrypted connection (Secure Socket Layer (SSL)).

Online tracking

Some new browsers use “Do not track” functions. If this is the case, our website may not respond to “Do not track” requests or may be unable to retrieve the headers of such browsers. To find out more about what your settings are and about whether you want to deny certain providers access to your information, please click here for the US, here for Canada, and here for Europe (please note that opting out will not mean that you are no longer displayed any advertising at all. Rather, you will still receive generic advertising).

Cookies

Visits to our website may result in information being stored on your computer in the form of “Cookies”. Cookies are small text files that are copied from a web server onto your hard disk. Cookies contain information that can later be read by a web server within the domain in which the cookie was assigned to you. Cookies cannot execute any programmes or infect your computer with viruses. The cookies used by us neither contain personal data nor are they connected to any such data.

Most of the cookies used by us are so-called session cookies, which are required in order to maintain consistency during your visit, for example by ensuring that the preferences you entered when making your reservation request, as well as any other information entered, are remembered for the duration of your session. We also need session cookies in order to ensure that any offers (e.g., promotional offers) you click on are assigned to your request. Session cookies are automatically deleted after each session. We furthermore use cookies in order to determine, when you pay return visits to our website, whether you are interested in certain types of offers. This enables us to be more targeted about the offers we show you on our website. If you are already registered with us and have a customer account, it will be possible for us to compare the information recorded by the cookies used with the information known to us. This in turn enables us to tune our offers more finely to your needs and wishes. These cookies have a lifespan of one year, after which they are automatically deleted. We also need cookies for purposes of settling accounts with our advertising partners, because cookies are able to record the page or promotional campaign that led the customer to us. As with other data, we record this data exclusively in abstract form so as to ensure that it cannot be used to identify the data subject. A cookie of this type has a lifespan of 31 days.

You have the opportunity to accept or to reject cookies. Most web browsers accept cookies automatically. Generally, however, you will be able to adjust your browser settings so as to reject cookies. If you opt to reject cookies, you may find that you are unable to use some of the website’s functions. If you accept cookies, you can opt to delete such accepted cookies at a later point in time. You can delete cookies in Internet Explorer 8 by selecting “Tools” > “Delete Browsing History” and then clicking on the button “Delete Cookies”. If you delete the cookies, all settings controlled by these cookies, including advertising settings, will be deleted, possibly irrecoverably.

Use of Google Analytics (this text is provided by Google, Inc)

This website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses so-called “cookies”, which are text files placed on your computer to help the website analyse how you use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data collected about you by Google in the manner and for the purposes set out above.

Google AdWords/Double Click

Advertising shown by us is based on the interest in products our customers previously exhibited. We record information about our customers’ surfing patterns for purposes of providing them with interest-based online advertising. For this, cookies are stored on the respective user’s computer; these contain a multiple-digit identification number. If you do not agree with having your user behaviour analysed, you can adjust your browsers settings so as to prevent analysis cookies from being set. Please note, however, that this may prevent you from being able to use in full all the functions of this website.

The search engine program Google AdWords, provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Google), facilitates the systematic display on our website of advertising based on Google search terms. For this, Google sets a cookie in the user’s browser as soon as an advert appearing in the Google search or advertising network is clicked on.

For options on how to object to such tracking, please go to: https://www.google.com/ads/preferences.

Through its AdWords cookie-based conversion methods, Google can measure the number of people who, after clicking on an AdWords advert, went on to purchase or use the product/service offered. To the extent that Google Ads link to offers from this website, this website will receive statistics from Google about the number of purchases made after clicking on the respective Google AdWords advert.

The options for disabling this tracking function are as follows: You can adjust your browser so as to block the setting of cookies by the domain googleadservices.com or by third parties in general. You can also delete the Google conversion cookie in your browser’s cookie settings.

This website uses Google Remarketing on the basis of Doubleclick, another Google Inc service, to display interest-based advertising. The process of reviewing the pages shown and of allocating adverts is based on a pseudonymous identification number in the Doubleclick cookie. The cookie-generated information about the pages shown is then transferred to and stored on Google servers for evaluation purposes. To read the Google Privacy Policy, please go to https://www.google.de/policies/privacy.

For options on how to object to such tracking, please go to: https://www.google.com/ads/preferences

CLE stores your personal data until they are no longer necessary in relation to the purposes for which they were collected or otherwise processed (see → Purposes of data processing at CLE). Where CLE is under legal obligation to store personal data, it will store personal data for the preservation period stipulated by law. The preservation period for commercial documents, which include bookkeeping documents and accounting records (including invoices), is 10 years. During this period, your data may be subject to restricted use within day-to-day operations if its processing serves no further purposes. 

Rights pursuant to Art. 15 – 18 and 20 GDPR

You have the right to, at reasonable intervals, obtain information about your personal data under storage (Art. 15 GDPR). The information you are entitled to includes information about whether or not personal data concerning you are stored, about the categories of personal data concerned, and about the purposes of the processing. Upon request, CLE will provide you with a copy of the personal data that are processed.

You also have the right to obtain from CLE the rectification of inaccurate personal data concerning you (Art. 16 GDPR).

You furthermore have the right to obtain from CLE the erasure of personal data concerning you (Art. 17 GDPR). We are under obligation to erase personal data in certain circumstances, including if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, if you withdraw the consent on which the processing is based, and if the personal data have been unlawfully processed.

Under certain circumstances, you have the right to have the processing of your personal data restricted (Art. 18 DSGVO). These include circumstances in which you contest the accuracy of your personal data and we then have to verify such accuracy. In such cases, we must refrain from further processing your personal data, with the exception of storage, until the matter has been clarified.

Should you opt to change to a different vehicle rental company, you have the right either to receive, in a machine-readable format, the data that you provided to us based on your consent or on a contractual agreement with us, or to have us transmit, also in a machine-readable format, such data to a third party of your choice (Right to data portability, Art. 20 GDPR). 

No contractual or legal obligations to provide data/consequences of failure to provide data

You are not contractually or legally obliged to provide us with your personal data. Please note, however, that you cannot enter into a vehicle rental contract with us or avail of other services provided by us if we are not permitted to collect and process the data as required for the purposes specified in the foregoing (see → The purposes of data processing at CLE) 

Right to object pursuant to Art. 21 GDPR

If the processing of your data by CLE is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Art. 6 (1) point e) GDPR) or if it is necessary in the legitimate interests of CLE, then you have the right to object at any time, on grounds relating to your particular situation, to the processing of your data. CLE will then end the processing, unless we can present compelling legitimate grounds for such processing that supersede the grounds for ending the processing.

You may object, at any time and without restriction, to the processing of your personal data for purposes of direct advertising. 

Right to withdraw consent at any time

If data processing at CLE is based on your consent, then you have the right to, at any time, withdraw the consent you granted. The withdrawal of consent shall not affect the lawfulness of processing between the time consent was granted and the time it was revoked. 

Last amended in: May 2018