INFORMATION ABOUT THE PROCESSING OF PERSONAL DATA OF INDIVIDUALS AND LEGAL REPRESENTATIVES/CONTACT PERSONS OF LEGAL ENTITIES

The following information is designed to inform you of the most important aspects regarding the processing of your personal data and your rights regarding this processing in accordance with the General Data Protection Regulation 2016/679 ("GDPR/RGPD" or "Regulation") and applicable national legislation.

1. General information

Protection of your personal data is important to us, which is why we follow strict principles in this regard.
When we process your personal data, we, TIRIAC AUTO RENT SRL, with registered office in Bucharest, B-dul Expozitiei no. 2, Building C7, floor 1, sector 1, registered at ORC Bucharest under no. J40/9433/2022, having CUI 46153088, ("Tiriac Auto Rent" or "The Company") we act as an operator in accordance with the provisions of the GDPR.
For any aspect regarding the processing of personal data, you can contact our data protection officer at the following contact details:
- e-mail address: office@tiriacautorent.ro
- telephone: 0743.332.453

2. When do we collect data about you?

We collect your personal data when, for example:
•    you are interested in our rental services and contact us through one of the available channels (e-mail, phone, visit our offices, website);
•    you are a representative or contact person of a legal entity that wishes to or does business with us;
•    use our car rental services;
•    create a user account on our website;
•    subscribe to marketing communications (Newsletter), alerts or other services offered by us;
We use cookies (small text files stored in your browser) and other techniques such as web beacons (small, transparent image files used to track your movements on our website). For further details about this and how to opt-out, please see the Cookies section of our website www.tiriacautorent.ro.

3. Purposes of processing

We process your personal data for the following purposes:
•    to ensure interaction when you are interested in our services (activities prior to the signing of a rental agreement);
•    to ensure interaction and establish a relationship with you when we have a contractual relationship or legitimate interest;
•    to ensure interaction and establish a relationship with the entity you represent, whether you are an empowered legal representative (e.g., manager, director, chairman of the board of directors, etc.) or a contact person for a current or prospective customer - legal entity (company, foundation, association, institution or public authority, etc.) with which we intend to execute or have executed an agreement;
•    to create and administer the user account, and to take over vehicle rental requests from the user account;
•    to fulfil our legal obligations;
•    to pursue our legitimate interests;
•    to present/provide information about other services offered by our Company’s partners, but only if you have agreed to receive such information;
 ▶ to provide information and invitations to Company events;
 ▶ to participate in market analyses and trends concerning the dynamics of the car rental market;
 ▶ to participate in questionnaires following your participation in events organised by the Company;
 ▶ to participate to interviews, used in qualitative research, which involve questions concerning your perceptions, attitudes, opinions, beliefs and preferences regarding the services offered by the Company;
 ▶ to inform you by e-mail or telephone that you can like us or leave reviews online, in order to recommend the services offered by the Company.

4. Categories of personal data processed

We will be able to process the following categories of data:
•    Personal details: such as first and last name, personal data contained in the copy of the ID document (personal identification number, ID document series and number, DOB, place of birth, ID document expiry date) and personal data contained in the copy of the driving licence (licence number, category, validity period).
•    Capacity: customers which are individuals or representative/contact person of a legal entity;
•    Contact details: such as e-mail address, phone number, street address and postcode;
•    Booking information: start and end date of the reservation, vehicle pick-up location;
•    User account information: such as e-mail address and account settings;
•    Location information: when you use a rented vehicle we can find out your location;
•    Financial information: credit/debit card number, payment history with Tiriac Auto Rent;
•    Information concerning your customer status: customer status, service history, information processed in our software;
•    Information concerning communications/contact with company consultants: recording of a phone call, a letter or an e-mail sent;
•    Marketing and survey preferences - your consent concerning marketing preferences;
•    Your browsing history. If you have given us permission, TIRIAC AUTO RENT collects the categories of websites you have browsed on your mobile, device or PC, for example sports, music or news. However, we do not have a history of the websites you browse, because this is limited to a short period of time, to allow you to log in. We use this information about your interests to send you personalized marketing offers or to show you personalized ads. You can opt-out of ads under the Cookies section on our website www.tiriacautorent.ro or, in the case of marketing, via Unsubscribe;
TIRIAC AUTO RENT does not intentionally collect special categories of personal data from you for storage (special categories of personal data reveal your racial and ethnic origin, political opinions, religious and philosophical beliefs, trade union affiliation, genetic data, biometric data, health data or data relating to your life or sexual orientation).

5. Legal basis of processing

The legal basis for the processing of your personal data, for each of the above purposes is:
•    the need to perform the rental agreement to which you are a party or your request before an agreement is executed;
•    the legitimate interests of the Company, such as:
•    prevention, detection and investigation of offences, including fraud and money laundering or terrorist financing, as well as the analysis and management of commercial risks, where appropriate, depending on the type of agreement;
•    the establishment, enforcement or defence of a right in court;
•    protection of Company’s assets and values and those of our customers, improving our services, fulfilling our obligations towards other contractual partners, if applicable.

Whenever we rely on this legal basis to process your personal data, we assess our commercial interests to ensure that they do not override your rights. In addition, in some cases you have the right to object to such processing. We may also rely on our legitimate interest to exercise our statutory rights in our favour, to take legal action against any illegal or damaging activity against the Company;
•    Compliance with a mandatory legal requirement, for example:
•    accounting and fiscal requirements, reporting;
•    applying KYC measures to prevent and combat money laundering;
•    carrying out activities related to controls and requests for information from authorities such as the National Agency for Fiscal Administration (ANAF), the National Authority for Consumer Protection (ANPC), the National Supervisory Authority for the Processing of Personal Data (ANSPDCP), the Romanian Police;
•    Other, depending on the investigation.
•    Or that are regulated by strict internal policies (such as retention periods). In some cases, you may object to such processing.

6. Categories of recipients to whom personal data collected may be disclosed:

•    accountants, auditors, forensic experts, lawyers or other such external advisors to the Company or to third parties providing products and services to the Company (security service providers, IT system providers, financial consultants, data protection consultants);
•    Company’s suppliers directly/indirectly involved in the marketing and promotion process;
•    Company’s suppliers directly/indirectly involved in the customer satisfaction measurement process;
We make every effort to ensure that all entities we work with store your personal data in a safe and secure manner.

7. Automatically collected data

When you visit the Website, we automatically collect data through your browser or device through the use of cookies and similar technologies. Please refer to our Cookies Policy for additional information about these practices, https://www.tiriacautorent.ro.

8. Marketing communications

If you no longer wish to receive marketing communications from us (Newsletter), update your preferences by:
•    Changing the settings in your customer account;
•    Accessing the unsubscribe link available on the website;
•    Accessing the “Unsubscribe” link found in the messages you receive from us;
•    or by contacting Tiriac Auto Rent using the communication methods listed below.
If you opt out of receiving marketing communications from us, we may continue to send you messages about your orders, or about updates to our policies, which are required under an ongoing agreement with you.

9. Storage period

We will keep your personal data for as long as it is necessary, or permitted in view of the purpose(s) for which they were obtained and as set out in this Information Notice. Criteria used to determine the retention periods include:
•    Duration of the agreement between you and Tiriac Auto Rent;
•    The period of time required to provide information when you request it;
Please note that copies of your ID document/driver’s licence provided during the reservation process will be stored as follows:
•    If you cancel your reservation, they will be stored for 2 days;
•    If you do not cancel your reservation, they will be stored for 180 days after the drop-off date of the rented vehicle.

10. Transfer to third countries and safety measures

We may transfer your personal data to countries located within the EU, EEA or to countries that have been recognized by the European Commission as ensuring an adequate level of protection of your personal data, if necessary for the permitted purposes, as described above.
In exceptional situations, under the permitted purposes, we may transfer personal data to countries that have not been recognized by the European Commission as providing an adequate level of protection. In this case, transfers will be made based on the standard data protection clauses adopted by the European Commission (hereinafter referred to as “Data Transfer Agreements”) as well as on other appropriate safeguards recognised by the General Data Protection Regulation.

11. Services offered by third parties

This Information Note does not cover the processing carried out by third parties acting as independent operators (for example, third parties whose websites can be accessed through links located on our website). Tiriac Auto does not assume responsibility for the way in which the data of its visitors are processed after they access some links to third-party websites.

12. Changes to the Information Notice

Our information regarding the processing of personal data may change from time to time and any change to it will be communicated by means of an e-mail or an announcement on our website. You will receive the email as long as you are registered in our databases with an email address.

13. Personal data security

We follow strict security procedures regarding the storage and disclosure of your personal data and protect it against accidental loss, destruction or damage. We may disclose your information to trusted third parties for the purposes set forth in this Notice.

14. Your rights

You are entitled to receive information from the Company regarding the processing of your personal data. In this sense, you benefit from the rights detailed in the following.
• Right to withdraw at any time a consent given in order to stop data processing based on your consent. Withdrawal will not affect the lawfulness of the processing based on the consent given prior to withdrawal.
• Right to object - your right to object to the processing of your personal data when the processing is necessary for the performance of a task carried out in the public interest or in the legitimate interest of the controller. Where the processing of personal data is for the purpose of direct marketing or based on express consent, you have the right to object to the processing at any time.
• Right to rectification - refers to the correction of inaccurate personal data without any undue delay. The correction will be notified to each recipient to whom the data were transmitted, unless this proves impossible or involves disproportionate effort.
• Right to erasure of data (“right to be forgotten”) - means that you have the right to request the erasure of personal data, without undue delay, where one of the following grounds applies: they are no longer necessary in relation to the purposes for which they were collected or otherwise processed; you withdraw your consent and where there is no other legal ground for the processing; you object to the processing and there are no overriding legitimate grounds for the processing; the personal data have been unlawfully processed; the personal data have to be erased for compliance with a legal obligation; the personal data have been collected in relation to the offer of information society services to a minor person, under the age of 16.
• Right to restriction of processing - can be exercised if the accuracy of the personal data is contested by the data subject, for a period enabling us to verify the accuracy of data; the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead; if Tiriac Auto Rent no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims; if the data subject has objected to the processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
• Right to lodge a complaint - can be exercised if you consider that your rights as a data subject have been violated. You can address anytime, with a complaint or referral in this regard, to the National Supervisory Authority for the Processing of Personal Data, with registered address B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania (fax: +40 318 059 602, e-mail: anspdcp@dataprotection.ro). You can also file a lawsuit with the competent courts.
To exercise these rights, as well as for any additional questions regarding this information or regarding the Company's use of personal data, please contact the data protection officer, choosing any of the communication methods described below.
• By email - at: office@tiriacautorent.ro; sau
• In person or through a request sent by post - to the Company Headquarters (at the address mentioned in point 1); or
• By phone - at: 0743.332.453

Additional details as well as possible updates of this information regarding the protection of your data - can be found on the Company's website – https://www.tiriacautorent.ro/nota-de-informare-gdpr.

Last update:    12/08/2022