KeyGroup Zásady ochrany osobných údajov a ochrany údajov

1. Scope and applicability of this document

1.1. This Privacy and Data Protection Policy (hereinafter the “Policy”) in relation to the processing and security of personal data determines the position and intentions of GetRentaCar, Inc. (hereinafter the “Company”) in the field of processing and ensuring the security of personal data in order to respect and protect the rights and freedoms of each person and, in particular, the right to privacy, personal and family secrets, protection of the honor and good name of users of the Company’s service available at https://getrentacar.com or via respective mobile apps (hereinafter the Service).

1.2. In order to maintain business reputation and ensure compliance with the requirements of the current international regulations of personal data protection, the Company considers the most important task to ensure the legitimacy of the processing and security of personal data of subjects in business processes. To solve this problem, the personal data protection system has been introduced, is functioning and is undergoing periodic review (control).

1.3. The Policy applies to all personal data of subjects processed in the Company using automation tools and without using such tools.

1.4. This document determines the Company’s Policy in the field of processing and protecting personal data and is located at https://getrentacar.com. This Policy is applicable to any subject of personal data.

1.5. The Policy is developed and used in conjunction with the consent to the processing of personal data, which any person willing to use the Service as the vehicle owner or the client/renter (hereinafter the “User”) acknowledges and agrees to when completing the User’s registration in the Service. This consent represents the User’s agreement to and acceptance of the terms of this Policy.

1.6. The Company reserves the right to make at its own discretion any amendments to this Policy at any time and without any special notice to this effect. The new version of this Policy shall come into effect upon posting of the same on the https://getrentacar.com (hereinafter the “Website”). Continuing using the Website, the User confirms its consent to comply with the terms and conditions of the Policy in its current version. The Company recommends the Users to review the Policy more often in order to make sure that the User understands the terms, while using the Service. If the User does not agree with the terms of the Policy amended by the Company, he/she shall not be entitled to use the Service.

1.7. Any time frames set forth herein, are stated according to time zone UTC-4, unless otherwise stated in the text of this Policy. The beginning and the end of calendar dates set forth herein, including those used to determine the duration of a term, shall be determined according to the beginning and the end of respective days in time zone UTC-4.

1.8. This version of the Policy shall come into effect on May 20, 2021 and remain valid until approval of a new version.

2. Principles and conditions of personal data processing

2.1. Processing and ensuring the security of User’s personal data in the Company is carried out in accordance with the requirements in the field of personal data of the Delaware Online Privacy Protection Act (DOPPA, 6 Del. C. § 1205C) and the General Data Protection Regulation 2016/679 of the European Union (GDPR).

2.2. When processing personal data, the Company adheres to the following principles: (a) legality and fairness; (b) restrictions on the processing of personal data to the achievement of specific, predetermined and legitimate goals; (c) the reliability of personal data, their relevance and sufficiency for processing purposes; (d) prevent processing of personal data that is incompatible with the purposes of collecting personal data; (e) prevent the merging of databases containing personal data that are processed for purposes that are incompatible with each other; (f) the legitimacy of organizational and technical measures to ensure the security of personal data; (g) processing of personal data that meets the purposes of their processing; and (h) compliance content.

2.3. The Company processes personal data only in the presence of at least one of the following conditions: (a) processing of personal data is carried out with the consent of the subject of personal data to the processing of his personal data; (b) processing of personal data is necessary to achieve the objectives stipulated by law, for the implementation and fulfillment of the functions, powers and responsibilities of the operator imposed by international standards in the field of personal data; (c) processing of personal data is necessary for the execution of the contract, of which either the beneficiary or the guarantor is party, according to which the subject of personal data is, and also to enter into a contract on the initiative of the subject of personal data or the contract on which the subject of personal data will be the beneficiary or surety; (d) processing of personal data is necessary for the exercise of the rights and legitimate interests of the Company or third parties or to achieve socially significant goals, provided that it does not violate the rights and freedoms of the subject of personal data; (e) processing of personal data is necessary when receiving feedback, analyzing the improvement of the quality of the Service, as well as obtaining information about loyalty and satisfaction with the Company’s Service, further research and processing of this information; (f) processing of personal data is carried out, access of an unlimited number of persons to which is provided by the subject of personal data or at his request; and(g) processing of personal data to be published or mandatory disclosure in accordance with international standards in the field of personal data.

2.4. the Company has the right to transfer the User’s personal data to other Users in relation to vehicle rent booked on the Website and to the Company’s business partners, including marketing and advertisement purposes. The Company may also use the User’s personal data, including any video and/or photographic images posted on the Website, for advertising of the Website and/or the relating Company’s services.

2.5. The Company destroys or depersonalizes personal data upon the achievement of processing objectives or in case of loss of the need to achieve the processing objective.

3. Purposes of personal data processing

3.1. The Company processes personal data of the subject of personal data solely for the following purposes: (a) maintaining the Service activity and organization of support services; (b) the conclusion, execution and termination of contracts concluded by Users via the Service; (c) identification of Users; (d) informing about the Company’s or it’s subsidiaries’ or partners’ advertising and/or marketing campaigns, surveys, questionnaires, and marketing research regarding the Service and / or the services provided by the Company’s subsidiaries or partners; (e) communicating with the Users, if necessary, including sending notifications, requests and information related to the Service, as well as processing the User’s requests; (f) improving the quality of services provided, ease of use, development of the new services, and (g) conducting statistical and other studies based on anonymized data.

3.2 The Company collects the following information as a subject of personal data: (a) full name; (b) year of birth; (c) place of registration / residence; (d) phone numbers; (e) email address; (f) data that is transmitted automatically depending on the settings of the software used by the User, including, but not limited to: IP address, cookies data, information about the User’s browser (or another program that allows access to the Service), date and time of access to the Company’s services, addresses of the requested pages and other similar information. The Website has the right to establish requirements for the composition of the Personal Information of the User, which must be provided for the use of its Services. If certain information is not marked as mandatory by the Website, its provision or disclosure is carried out by the User at its discretion.

4. Right of personal data subjects

4.1. The User, whose personal data are processed by the Company, has the right to:

4.1.1. receive from the Company: (a) confirmation of the processing of personal data by the Company; (b) legal grounds and purposes for the processing of personal data; (c) information about the methods of personal data processing used by the Company; (d) name and location of the Company; (e) information on persons who have access to personal data or to whom personal data may be disclosed in accordance with international standards in the field of personal data; (f) a list of processed personal data relating to the User from whom the request was received and the source of their receipt, unless otherwise provided by law for the provision of such data; (g) information on the processing time of personal data, including the storage period; (h) information on ongoing or alleged cross-border transfer of personal data; (i) name and address of the person processing personal data on behalf of the Company; and (j) other information stipulated by international standards in the field of personal data;

4.1.2. require clarification of their personal data, their blocking or destruction if personal data are incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;

4.1.3. demand elimination of illegal actions of the Company in relation to his personal data;

4.1.4. appeal against the actions or inaction of the Company to the supervisory and control authority in the field of personal data protection or in court if a person believes that the Company processes their personal data in violation of the requirements of international personal data standards or otherwise violates its rights and freedoms;

4.1.5. protect their rights and legitimate interests, including damages and / or moral damages in court.

4.2. The withdrawal of consent to the processing of personal data does not affect the legality of data processing based on your consent prior to its withdrawal. If you want to send a request, you should contact the Company in writing using the contact information provided below. The Company makes a decision on your request within four weeks.

4.3. The User has the right to receive personal data about him or her that he or she provided to the Company in a structured, commonly used and machine-readable format and has the right to transfer this data to another operator without objection of the Company if: (a) processing is based on consent in accordance with Article 1.5. of this Policy; (b) processing is carried out by automatic means.

4.4. In exercising its right to data portability in accordance with the provisions of this Section the User has the right to transfer personal data directly from the Company to another operator, where it is technically possible.

4.5. The exercise of the right mentioned in Section does not prejudice the right to delete User data. This right does not apply to the processing required for a task performed in the public interest or in the exercise of official authority granted to the Company.

4.6. The User’s right referred to in this Section shall not adversely affect the rights and freedoms of third parties. When exercising its rights provided for in this Policy, the User may not infringe on third-party rights or the rights of others to protect their privacy and personal data.

5. Order, terms and methods of processing personal data

5.1. The processing of personal data of the User of the Website is carried out in accordance with this Policy, the User Agreement, as well as the consent of the User to the processing of personal data.

5.2. The Company processes personal data both in an automated way and without the use of automation.

5.3. The Company stops processing personal data in the following cases: (a) achieving the goals of personal data processing; (b) withdrawal of the consent of the subject of personal data; (c) identification of illegal processing of personal data; and (d) termination of the Company’s activities.

5.4. The processing of the User’s personal data is carried out by the Company in the following ways: collection, recording (including on electronic media), systematization, accumulation, storage, drawing up of lists, labeling, updating (updating, changing), retrieving, using, transferring (distributing, providing, access), de-identification, blocking, deletion, destruction, cross-border transfer of personal data, obtaining User’s video and photographic images, as well as performing any other actions with personal User data subject to applicable law.

6. Transboundary transfer of personal data

6.1. GetRentaCar, Inc is an international company. In order to achieve the objectives specified in the Policy, the Company reserves the right to transfer personal data to countries other than the country from which they were originally received. In this case the personal data may be transferred to processed by the Company’s subsidiaries, advisors, consultants, business partners, etc.

6.2. In case of cross-border transfer of personal data, the Company protects data in accordance with this Policy and consent to the processing of personal data.

6.3. Information that published on the Website or submit for publication via the Service may be accessible via the Internet throughout the world. The Company cannot prevent third parties from using or misusing such information.

6.4. By posting the information to the Service the User gives his/her expressly consent to the transmission of personal information described in this Section.

7. Ensuring personal data security

7.1. The Company applies the necessary and sufficient organizational and technical measures, including the use of information security tools, the detection of unauthorized access facts, the restoration of personal data, the establishment of rules for access to personal data, and the monitoring and evaluation of the effectiveness of the measures applied.

7.2. All persons authorized by the Company to process personal data are familiar with the provisions of the applicable legislation on personal data, including international requirements for the protection of personal data, documents defining this Policy regarding the processing of personal data, and local acts for the processing of personal data.

7.3. The Company has the following organizational measures: (a) the persons responsible for organizing the processing and ensuring the security of personal data are appointed; (b) developed local acts on the processing of personal data; and (c) internal control over the compliance of the processing of personal data with the requirements for the protection of personal data is carried out.

7.4. When collecting personal data of Users, the Company undertakes to ensure the recording, systematization, accumulation, storage, refinement (update, change), extraction of personal data of Users using databases.

8. Cookies and web beacons

8.1. A cookie is a file that is stored on te User’s computer’s hard drive in the browser. Cookies can be “persistent” or “session”: a permanent cookie will be stored in a web browser and will remain valid until its expiration, unless it is deleted by the User until it expires; the cookie session expires at the end of the User’s session when the web browser is closed. Cookies usually do not contain information that personally identifies the User, but personal information that we store about you may be related to information stored and obtained from cookies.

8.2. A web beacon, also called an internet or pixel tag, is used to collect information about the use of the Internet. Thanks to this, the Company can provide the Users with more specific information. When using the Website, the Company informs any User about which cookies and web beacons are related to the Website, and invites them to consent to the placement of these cookies and web beacons.

8.3. Blocking or deleting all cookies adversely affects the usability of the Website.

9. Sites of third parties

9.1. Webová stránka môže obsahovať hypertextové odkazy na webové stránky tretích strán. Spoločnosť nereguluje a nie je zodpovedná za ich zásady ochrany osobných údajov a aktivity.

10. Zodpovednosť

10.1. V prípade nedodržania ustanovení tejto politiky bude spoločnosť zodpovedná v súlade s platnými zákonmi štátu Delaware, USA.

10.2. Na získanie vysvetlenia ohľadom otázok spracovania osobných údajov je potrebné zaslať oficiálnu žiadosť na emailovú adresu info@getrentacar.com.

10.3. V prípade formálnej žiadosti od správy Webovej stránky, v žiadosťovom texte musí byť uvedené: (a) celé meno Používateľa; (b) číslo hlavného dokumentu preukazujúceho totožnosť subjektu osobných údajov alebo jeho zástupcu, informácie o dátume vydania uvedeného dokumentu a vydávajúcej inštitúcii; (c) informácie potvrdzujúce skutočnosť spracovania vašich osobných údajov Spoločnosťou; a (d) podpis.

10.4. Formálne žiadosti a sťažnosti sú podávané písomne a na uvedenú adresu spoločnosti, predtým zaslanú spoľahlivým spôsobom. Na riešenie akejkoľvek nezhody týkajúcej sa výkladu alebo jurisdikcie sa spoliehajte na jurisdikciu súdov štátu Delaware, USA.

11. Obmedzenie zásad ochrany osobných údajov

11.1. Osoby, ktorých sa týka osobná data, sú povinné zodpovedne a rozumne pristupovať k umiestneniu ich osobných dát v priestore verejnej dostupnosti, vrátane na Webovej stránke v prípade zanechávania komentárov a spätnej väzby.

11.2. Spoločnosť nezodpovedá za konanie tretích strán, ktoré získali prístup k osobným údajom dotknutej osoby z dôvodu zavinenia druhej osoby.

11.3. Spoločnosť si vyhradzuje právo kedykoľvek a vlastným uvážením meniť túto Politiku bez akejkoľvek špeciálnej výzvy. Nová verzia tejto Politiky nadobúda platnosť okamihom jej zverejnenia na Webovej stránke.

12. Obmedzenie zásad ochrany osobných údajov

12.1. Spracovanie osobných údajov: akýkoľvek postup alebo súbor postupov s osobnými údajmi vykonávaný pomocou automatizovaných prostriedkov alebo bez nich, vrátane zbierania, zaznamenávania, systematizácie, hromadenia, ukladania, spracovania (aktualizácia, zmena), ťaženia, využívania, prenosu (distribúcie), de-identifikácie, blokovania, zmazania, zničenia osobných údajov.

12.2. Osobné údaje: Akékoľvek informácie priamo alebo nepriamo vzťahujúce sa na konkrétneho alebo definovateľného používateľa. K týmto informáciám patrí najmä: (a) informácie o počítači, vrátane IP adresy, geografickej polohy, typu, verzie prehliadača a operačného systému; (b) informácie o akejkoľvek aktivite používateľa na webovej stránke, vrátane zdroja odkazovania, dĺžky návštevy, zobrazení stránok a navigačných trás po webovej stránke; (c) e-mailová adresa používateľa, ktorá bola uvedená pri registrácii v službe; (d) informácie, ktoré boli uvedené pri vytvorení profilu v službe, a napríklad, meno, profilové obrázky, pohlavie, dátum narodenia, rodinný stav, záujmy a koníčky, údaje o vzdelaní a zamestnaní; (e) krstné meno, priezvisko a e-mailová adresa používateľa, ktoré boli uvedené na nastavenie odberu e-mailov a / alebo noviniek; (f) informácie, ktoré boli uvedené, keď používateľ navrhuje služby prostredníctvom služby; (g) informácie, ktoré sú vytvorené pri používaní služby, vrátane toho, kedy, ako často a za akých okolností bola použitá; (h) informácie, ktoré akýkoľvek používateľ zverejňuje na webovej stránke a / alebo prostredníctvom služby, čo naznačuje publikáciu na internete, ktoré môžu zahŕňať používateľské meno, profilové obrázky a obsah správ; (i) informácie obsiahnuté v akýchkoľvek správach, ktoré akýkoľvek používateľ pošle spoločnosti e-mailom alebo prostredníctvom služby, vrátane ich obsahu na komunikáciu a metadát; (j) akékoľvek iné osobné informácie, ktoré môžu byť zaslané používateľom prostredníctvom služby alebo spoločnosti.

12.3. Šírenie osobných údajov: Konania, prístup k zverejneniu osobných údajov neurčitému okruhu osôb.

12.4. Súhlas s spracovaním osobných údajov: Povolenie Užívateľa webovej stránky, ktoré udeľuje zainteresovanej strane na prijímanie, zbieranie, ukladanie a používanie osobných informácií o sebe.

12.5. Subjekty osobných údajov: Entita, ktorá je priamo alebo nepriamo určená alebo určená osobnými údajmi.

12.6. Medzinárodný prenos osobných údajov: Prenos osobných údajov na územie cudzieho štátu na vedomie cudzej štátnej autority, cudzej fyzickej osoby alebo cudzej právnickej osoby.