‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

‘Controller’ means the natural or legal person, who determines the purpose and means of the processing of personal data; it is the person with whom the applicant for a service would conclude or has concluded one or more contracts.

A. PERSONAL DATA COLLECTED DIRECTLY FROM YOU :

1. The data we collect include:
   • First and last names;
   • Email address (if you make online reservations and for confirmation of booking);
   • Home address for billing;
   • Details of employer and company address (if you are a Member of a company program);
   • telephone numbers we can contact you;
   • date of birth (for validating the permit and legal requirements);
   • age of the driver, for the management of additional charges for drivers under 21;
   • payment information, such as credit or debit card details to block a cash guarantee the value of which varies according to the type of car rented;
   • information from the driving license, including whether you are an additional driver (for validating the license)
   • information in identification documents such as national identity card/id or passport;
   • special requests and preferences, including:
     • your preference for optional additional products such as protection products (rear window insurance, windscreen, bodywork, tire insurance, road assistant) and any other optional supplements you have requested, for example: child seat;
     • if a delivery or take-over service is required, the address at which we will hand over and take over the vehicle for the purpose of handling the additional charges;
2.  In the event of accident, loss, theft or damage to the vehicle during hire or in the event of a mechanical breakdown, we will collect information on the incident, including your report on it and any reports of the police or third parties, including details of those involved, nature of personal injury and/or damage to the vehicle. This information is processed for the purpose of the performance of the concluded contract (the lease of the vehicle and/or the terms of any kind of optional supplement such as insurance); to defend our legitimate business interests (e.g. to recover costs in the event of loss/damage to the vehicle); to comply with any legal obligations incumbent on us (e.g. to respond to various requests from the competent authorities).
3. In connection with the execution of the lease, we will process data such as the date, time and location of the vehicle take-over, the date, time and location of its return, the accident history and other information regarding the vehicle and its use by you. This information is necessary for the provision of rental services or legitimate business interests (e.g. for the purpose of monitoring the use of the car fleet).
4. We also process information about any offenses/fines/offenses (e.g. speeding, irregular parking, toll non-payment, etc.) found in connection with the rented car and its period of rent. Such data shall be processed in order to respond to requests by the competent authorities in relation to such matters, or to deal with any contentious situations in connection with such incidents.

B. PERSONAL DATA COLLECTED INDIRECTLY (OBSERVED/DERIVED DATA)

1. Data captured by video recordings and online identification of individuals (video recordings:location and images captured by surveillance cameras installed at SMART PREMIUM RENT A CAR SERVICES SRL offices, audio recordings of phone calls, IP address captured when using SMART PREMIUM RENT A CAR SERVICES SRL websites and applications). The data is needed to ensure security and protection at SMART PREMIUM RENT A CAR SERVICES SRL locations, to improve the services offered, to deal with complaints and any requests from customers, and to ensure the technical functionalities of the online platforms used by SMART PREMIUM RENT A CAR SERVICES SRL).
2. Vehicle GPS tracking system data that passively collects data and provides accurate and reliable real-time information on vehicle location, vehicle status, fuel consumption, maintenance programming.

SMART PREMIUM RENT A CAR SERVICES SRL collects and processes your personal data for the following purposes:

Booking making and booking management: We use your personal data to make and manage the booking including validation, provision of services and their billing, resolution of cancellations, etc.

The performance of the contract and the resolution of any problems arising from the contract between the parties relating to the services offered, including post-service activities, including customer service services.
Issuing of the documents of release or collection of pre-authorized amounts to banking entities.
Issue of insurance certificates and handling of car damage files.

Ensure the necessary security measures at the premises of the company by video surveillance as well as the goods by using GPS systems on vehicles to prevent, detect and investigate the unauthorized use of our vehicles and systems under lease agreements and to ensure that we comply with the law and that the vehicles are used only in the country according to the contract between the parties. The GPS device detects driving rule violations, such as speed, and sends alerts by placing the fleet manager in a position to remotely immobilize the vehicle and prevent unauthorized use. The device also allows "geo-fence"; once the vehicle crosses a predefined geographical boundary, an alert will be sent and the vehicle engine will be automatically immobilized. As a result, GPS vehicle tracking technology significantly reduces road accidents and controls fleet maintenance costs, improves operational efficiency, manages vehicle reliability and improves driver safety.
Customer Reviews: We can use your data to send you a short questionnaire about your booking. This helps us understand and improve our car rental service and the services offered by our business partners.

Marketing activities: We use your personal data for marketing activities, which may include: Contacting you by email, telephone or SMS with special offers, discounts and updates, including details about our products and services.
Fraud Detection and Prevention: To provide reliable and secure services, we use your personal data to detect and prevent fraud and other illegal or unwanted activities. To identify who is authorized to trade on behalf of our customers, beneficiaries, suppliers and/or service providers. We may use your data to verify users and bookings. This may mean that sometimes it is possible to hold certain reservations.

Handling of complaints and requests, in particular cases, we need to identify you in order to be able to respond to complaints or requests from you.
Legal purposes: In some cases, we need to use your personal data to resolve legal disputes, regulatory investigations, compliance reasons, or to ensure we apply our terms and conditions accurately.

The operator processes your personal data on a legal basis:

1. concluding and executing the lease agreement to which you are a party, as well as carrying out the steps prior to concluding the lease agreement;
2. the legitimate interest of the Operator;
3. your consent;
4. a legal obligation of the Operator.

In addition to personal data obtained directly from data subjects, we may obtain and process data through our website, if you provide it to us personally, for example as part of a registration, by completing forms, by sending e-mails or especially by booking a rental car.

Your personal data may be communicated, to the extent necessary and only on the basis of a confidentiality commitment, to the following categories of recipients on the basis and within the limits of legal provisions or as a result of express requests made by:

• contractual partners bound by the obligation of confidentiality regarding the transmitted data (translation offices, consultants, accountants, auditors and auditors, service providers: IT services, car fleet monitoring services; physical and / or electronic archiving; courier; technical services payment facilitation (eg Visa and Mastercard);
• state authorities (tax authorities, consumer protection authorities, other state authorities), as a result of a legal obligation of the Operator;
• courts or arbitrators, notaries public, lawyers, bailiffs, other authorized services, expert evaluators.

All these recipients to whom we communicate your personal data, are subject to the same legal provisions and offer at least the same level of protection as the Operator.

SMART PREMIUM RENT A CAR SERVICES SRL does not transfer personal data to other companies outside the European Economic Area.

We will retain your personal data for as long as necessary or permitted in view of the purpose (s) for which they were obtained and in accordance with those set out in this Information Note. The criteria used to determine the lengths of retention periods include:

1. The processing (including storage) is performed during the validity of the contracts, but also after the termination of the contractual relationship for a period of 10 years.
2. The processing of data (including storage) in case a contractual relationship has not been concluded, will be carried out for a period of 5 years according to Law no. 129/2019 for the prevention and sanctioning of money laundering, as well as for the establishment of measures to prevent and combat the financing of terrorist acts.
3. If you have consented to the processing of personal data for the purpose of direct marketing, your data will be processed for this purpose during the contractual relationship with SMART PREMIUM RENT A CAR SERVICES SRL, as well as for a period of 1 year from the termination its. If you withdraw your consent to the processing of your personal data for direct marketing purposes, your data will no longer be processed for this purpose, from the moment the consent is withdrawn, without such withdrawal of consent affecting the lawfulness of the processing operations. previous.
4. Data processing by recording images captured by video cameras and voice processing are kept for a period of 30 days (randomly) from the date of their recording.
5. The data captured by the GPS monitoring system is kept for a period of 6 months from the time of its collection.
6. When we no longer need your personal data, we will securely delete or destroy it. We will also analyze whether and how we can minimize the personal data we use over time and whether we can anonymize your personal data so that it can no longer be associated with or identify you, in which case we may use this information without further ado. additional notification.

We also inform you that, at any time, you can exercise any of the following rights regarding the processing of personal data:

1. The right of access to personal data and information such as the purposes of the processing, the categories of personal data concerned, recipients or categories of recipients where applicable, the period of storage of personal data. If personal data is not collected directly from you, you can request information about the source of this data.
2. The right to rectification of personal data, in case they are inaccurate or incomplete.
3. The right to erasure of personal data (the right to be forgotten), in accordance with the legal provisions in force.
4. The right to withdraw your consent. In the event that you withdraw your consent to the processing of certain personal data, the Operator will immediately stop processing such data and will delete them if they are not associated with other processing based on another justified reason.
5. The right to restriction of processing. In the event that you dispute the accuracy of personal data, the restriction operates for the period that allows the Operator to verify the accuracy of the data. You also have the right to obtain a restriction on the processing of data if it is illegal and you oppose the deletion of the data; if the Operator no longer needs your data for the purpose of processing, but request the retention of data for the establishment, exercise or defense of a right in court, for the period of time in which it is verified whether the legitimate interests of the Operator prevail over your interests.
6. The right to data portability, which consists in the possibility of retrieving from the Operator the information provided, in a structured form, currently used, automatically readable, with the possibility of the data being transferred to another Operator.
7. Right to object to data processing. This right may not be exercised in respect of the processing of personal data necessary for the performance of the individual employment contract.
8. The right not to be subject to a decision based solely on the automatic processing of your data, including the creation of profiles that produce legal effects or significantly affect you. With regard to the adoption of a decision based solely on automatic processing, you have the opportunity to express your views, to request the intervention of a human operator, and to be able to challenge such a decision.
9. The right to file a complaint with the National Authority for the Supervision of Personal Data Processing and to apply to the competent courts. You have the right to file a complaint with ANSPDCP, respectively to address the courts competent to defend any rights guaranteed by the applicable legislation in the field of personal data protection, which have been violated.

For more information on the processing of personal data, please consult the "GDPR" section of the "Privacy " section of the Operator's website: www.bsmart-rent.ro.

We also inform you that the National Authority for the Supervision of Personal Data Processing ("ANSPDCP") operates in Romania and that you have the right to file a complaint when you consider that your rights have been violated, by accessing the website www. dataprotection.ro.