Privacy Policy

PRIVACY STATEMENT  

Last updated: 10/03/2024 

For the company with the name “FLEXCAR RENTAL AND SALE OF VEHICLES SINGLE MEMBER  PUBLIC LIMITED COMPANY” (No. GEMI 147820101000, Taiapiera no.6-8, Athens) (hereinafter  “FlexCar” or “Controller” or “We”) the protection of Personal Data of our customers and  partners and respecting the individual’s privacy is a self-evident commitment and the  company takes all necessary measures to collect and process personal data in accordance  with the General Data Protection Regulation (EU) 679/2016 (hereinafter “GDPR”) and other  applicable national and European legislation. We take all the necessary organizational and  technical measures required to ensure the security, availability and validity of our customers’  and partners’ data.  

It is very important to us that this strong commitment is clear to all our customers and  partners. For this reason, we have created this “Privacy Statement” (hereinafter  “Statement”) which describes and explains what kind of personal data of our customers and  partners we collect, how we manage it and for what purpose. Please, take some time to read  and understand this update.  

What is personal data?  

The term “personal data” refers to information of natural persons, such as indicative name,  postal address, e-mail address, contact telephone number, etc., which identify or can identify  you, hereinafter “Personal Data or Data”.  

What is Personal Data Processing?  

Any act or series of acts performed with or without the use of automated means, on Data or  sets of Data, such as collecting, recording, organizing, structuring, storing, adapting or  changing, retrieving, searching for information, use, disclosure by transmission, dissemination  or any other form of disposal, association or combination, restriction, deletion or destruction.  

How do we collect your Data?  

Your personal Data is collected before your use of the App directly from you or directly from  representatives of our company or by other means of remote communication and mainly  through the FlexCar platform that operates at the electronic address flexcar.gr (other means  of remote collection may be on a case-by-case basis e-mail, electronic forms, phone/fax  etc.). In some cases, it is possible that you have provided your data in the past, in the context  of a previous cooperation or relationship with FlexCar. Finally, in specific cases of  cooperation, it is possible after your explicit information, to collect your data from other  agencies or registries, in the context of a possible check of your creditworthiness for the  purposes of checking the solvency, financing or insurance of claims of our company. 

For what purposes do we process your Data?  

FlexCar only collects Personal Data that is absolutely necessary to satisfy the requests of our  customers and partners, to carry out our cooperation with them and the smooth conclusion  and operation of contractual relations with them, the rental and sale of vehicles and  commercial activity in general and its operation. Also, part of this Data is collected and used,  in order for our company to meet its legal obligations towards public authorities (tax, 

insurance, health legislation, etc.). Furthermore, data collection and processing take place  for critical functions of our business, such as the control of its credit policy, the solvency of  its customers and the insurance of its claims. In case additional, optional information is  sought on our part, you will be informed about it during the data collection. Finally, your  contact data (such as your e-mail address, telephone or postal address) may be used by our  company in order to inform you about new vehicles, offers, discounts and other promotional  activities. In any such communication from us, you will be given the immediate and cost-free  option to opt out of receiving such future updates and communications from FlexCar in any  way.  

Which Data of yours do we collect?  

In the course of the commercial activity of our company, we may collect the following  Personal Data of our customers, partners or prospective customers and partners:  

● Personal information (such as full name, patronymic, address, VAT number, identity card  number, sample signature).

● Details of financial transactions (such as bank account numbers, debit or credit card  details and generally other methods and through payment, such as PayPal). You should  know that by entering into a vehicle rental contract with FlexCar, in the case of using a  credit card or PayPal, you authorize FlexCar to take over the costs corresponding to the  monthly rental during the predetermined time, as well as any other overdue debt owned  by you in respect thereof, without your prior notice and consent. Following this, we  necessarily collect and process all data regarding your payment methods and details to  FlexCar.  

● Evidence of financial status (such as declarations of tax authorities, balance sheets,  accounting data, certificates of courts or chambers and in general data concerning the  financial status).  

● Contact information (telephone, contact e-mail, mailing address).  

● Accident report details, car accident data with our company’s vehicles.

● In our vehicles there is the possibility of installing GPS systems, which are only activated  in cases of theft of the vehicle, following relevant information to the lessee/driver.

● As part of your rental relationship with FlexCar, we also collect data that is necessary for  the legal and orderly execution of the contract, such as your driver’s license, details of  the vehicle you have rented from FlexCar, the details regarding its maintenance, and also  the person(s) authorized to use it.  

● Recording of telephone conversations for the purposes of professional communication if it  is necessary to prove the specific conversation took place and had a specific content (such  as in the case of recording complaints, requests by you or third parties to provide  information in questions concerning cases of vehicle management, damage, etc.).

● Identification data to the extent required, in order to satisfy any of your rights (access,  deletion, correction, etc.) for the purpose of identifying you and settling your request.

● Information collected from the use of cookies in your browser on our website.

● Finally, as part of your relationship with FlexCar you may be required to provide evidence  of your creditworthiness, such as tax returns proving your income.  

What is the legal basis for processing your Personal Data?  

In the context of the purposes described in this Statement, FlexCar processes Personal Data of  its customers, prospective customers and partners, only when it has a legal reason to carry  out the relevant processing based on the following legal bases, in the case of more specific  processing operations: 

● Contract performance: processing necessary to fulfill and comply with our contractual  obligations.  

● Fulfillment of legal obligations of our company, such as recording in our accounting  books, fulfillment of tax and other legal obligations (e.g. issuance and registration of  legal documents, etc.).  

● Managing our customers and suppliers and ensuring the smooth running of our company  and the proper service and processing of customer and supplier requests.

● To safeguard our legitimate interests, to the extent that processing does not violate  the superior legitimate interests of the subjects, such as for example the management  of our customers and suppliers to ensure their proper service, the protection of our  vehicles and other assets, the maintenance of data to defend our company against  legal claims, assertion of claims, as well as documentation in case of administrative  and similar nature checks of our counterparties and processing for credit insurance  purposes.  

● Your consent, for example in the event that our company communicates to your  updates about new products, offers, discounts and other promotional activities. In  such a case, you will always have the possibility to immediately, easily and  inexpensively withdraw your consent, as a result of which any sending of such material  will immediately stop.  

Who do we share your Personal Data with?  

FlexCar does not disclose your Personal Data to non-affiliated third parties, unless this is  required for the purposes of legitimately fulfilling our professional and business needs, in  order to meet our contractual obligations to our customers and partners, or is required or  permitted by the law or there is express consent of the data subject for this purpose.  

The Data of our customers and partners are processed in the context of what is defined  herein, by departments and employees of our company who are responsible for the  conclusion, the execution and management of our contractual commercial relations, as well  as by any of our partners for the same reasons. Likewise, they will be processed by the other  departments of our company in the context of our legal operation, to fulfill our obligations by  law (e.g. accounting, legal service).  

Furthermore, your Data to the extent that this is appropriate for the fulfillment of our  contractual or other obligations and to better serve you, satisfy your requests and our smooth  cooperation, may be transmitted to Banking Institutions or other payment service providers or  to providers cooperating with the Company, such as insurance companies, cooperating debtor  information companies, companies providing consulting and auditing services, any  cooperating record keeping and management companies, cooperating IT companies,  cooperative providing printing, organization and delivery of forms, cooperating advertising  and promotion companies, garages and vehicle technicians, etc. FlexCar, in any case where  such data transmission becomes necessary, makes sure to transmit to third parties, if and only  if they meet high levels of security and confidentiality of the data and provide sufficient  guarantees and commitments for their protection, which they undertake, among other things,  by virtue of written contracts.  

Your data may, in addition, be subject to processing for the purposes of examining your  solvency, creditworthiness and for the purposes of our company’s credit insurance with  notification to relevant bodies and registers, as well as to cooperating claim insurance  companies. 

To top it all, the company may disclose data to public authorities of all kinds (public services,  tax authorities, insurance organizations, etc.) or to judicial or independent authorities,  prosecutorial authorities or investigate bodies, if this is foreseen or required by law or  absolutely deemed necessary to defend our legal rights.  

If we are going to transfer your Data to a recipient established in a third country we take care  to ensure an adequate level of protection of your Protection Data that is transferred, in  accordance with Articles 46-49 of the GDPR.  

What is the retention period of your Personal Data?  

The Personal Data is kept for the period that is absolutely necessary for the execution and  completion of the processing purposes mentioned above. The exact retention time of each  category is linked: (a) to the time necessary, in reasonable commercial and operational  contexts to fulfill our contractual and commercial obligations (b) to any applicable statutory  provisions on data retention from time to time, indicatively such as valid compliance with the  accounting and tax records of our company or the data reported to insurance organizations  (c) with the duration of our commercial or contractual relationship with our customers or  partners (d) with the possible necessity to retain data for the defense of our legal interests,  proof of compliance , defense against claims and the judicial pursuit of our claims (e) if the  processing is based on consent of the subject the retention time is determined by the  retention time of this consent.  

As an example, the usual retention times that apply on a case-by-case basis to the Personal  Data we process are:  

● Data that we keep within the framework of the contractual relationship are kept for a  maximum period of twenty (20) years from the end of the lease relationship.

● Data which fall into the pre-contractual stage, and which we process in the context of  submitting offers and/or evaluating applications for the conclusion of a lease contract,  if the contract does not proceed, are kept for two (2) years after the end of the year  in which the offer has ended.  

● Data submitted through accident reports are kept for five (5) years from the end of  the year they were submitted unless legal claims are raised for this reason in which  case they are kept for twenty (20) years.  

● The data of the driver/owner of the vehicle will be kept for five (5) years from the  date of cessation of use of the vehicle by the respective driver. This period may be  extended in case of legal claims or criminal proceedings in which the driver is  involved.  

● Call recording data in the context of communication between us will be kept for thirty  (30) days from the date of each communication.  

● The data you provide us to satisfy your right related to personal data (access,  correction, deletion, etc.) is kept for two (2) years from the processing of the request.  

How do we ensure the privacy and the security of your Personal Data?  

FlexCar maintains appropriate technical and organizational measures to ensure the  confidentiality and integrity of Personal Data and to protect it from accidental or unlawful  destruction, loss, alteration, unauthorized access or disclosure, as well as any other  unlawful form of processing. The processing of Data by FlexCar is carried out only in a way  that ensures the privacy and security of the Data, based on the latest developments, the  cost, the nature, the context and the purposes of the processing, with an assessment of  the risks and their probability of occurrence and the effects thereof on data subjects. In 

this context, we ensure that the processing is carried out exclusively by staff authorized  for this purpose, who are bound by confidentiality obligations and provide the necessary  protection guarantees. The same goes for all our possible partners, who may be involved  in the process and for whom we ensure their commitment to comply with the appropriate  protection measures through relevant contractual guarantees.  

What are your Rights?  

In accordance with existing national and European legislation, you have the following  rights in relation to your Personal Data:  

● Right to information and access: You have the right to receive information from  FlexCar about the processing of your Personal Data. As long as we process your  Data, you have the right to receive information about the purpose of the  processing, the type of your Data, the recipients of the Data and their storage  period, the case where automated decision-making takes place, but also about  your other rights, such as are detailed herein.  

● Right to rectification: You have the right to request the correction of inaccurate or  incomplete Data held by us.  

● Right to erasure: You have the right to request the erasure of your Data. We  remind you that this right is not absolute and is subject to the limitations of the  law. We may have legitimate reasons not to respond to such a request.  

● Right to restriction of processing: You have the right to request the restriction of  processing of your Data, i.e. you have the right to request that their further  processing ceases and that your Data is simply retained by our company. The  exercise of this right is subject to the condition that such possibility is granted to  you by the existing legislation. If the legal requirements are not met, the company  may not be obliged to fulfill your request.  

● Right to portability: You have the right to receive the Data concerning you in a  readable form and to request its transfer to another controller, as long as this is  technically possible.  

● Right to object: You have the right to object at any time to the processing of your  Data, within the limitations provided for in existing legislation. Your request may  not be accepted in case they are proven legitimate grounds that make the  processing imperative and override your right.  

● Right to withdraw your consent: As long as the processing of your personal Data is  based on your consent, you have the right to immediately, easily and inexpensively  withdraw your consent at any time in order to stop this processing. The withdrawal  of your consent does not affect the lawfulness of the processing carried out on the  basis of consent before its withdrawal.  

● Right to file a complaint with the Personal Data Protection Authority: If you believe  that your rights have been violated, you have the right to file a complaint with the  Personal Data Protection Authority at the following details: Address: 1-3 Kifissias  Ave., Athens, P.O. 11523, Contact Phone: 210 6475600, Email: contact@dpa.gr.  

● In order to exercise any of your rights, as well as for any information or  clarification regarding them and the conditions for exercising them, as well as your  information about the progress of your submitted requests, you can contact the  Data Protector Officer of FlexCar at the e-mail address: dpo@flexcar.gr. Likewise,  you can address any queries, questions, comments or complaints regarding the  management of your Data to the Data Protection Officer of our company. FlexCar  will respond to your request, depending on its validity, within 30 days. In the event 

that your request is complex or we have received a large number of your requests  we will inform you within the aforementioned time frame whether we need to  obtain an extension of an additional (2) two months to respond to you. If upon  examination of your requests we find that they are manifestly unfounded or  excessive, FlexCar may ask you to pay a reasonable fee, the amount of which is  determined by its processing costs, for its execution. It is pointed out that FlexCar  may reasonably refuse to respond to your request.  

How do we process Cookies?  

Cookies are small text files that are stored by the browser on the computer or  electronic device you use when you visit a website. Cookies allow online  applications to tailor their functionality to your needs by gathering and  remembering information about your preferences. For more information about  cookies and how you can configure their operation, please see FlexCar’s Cookie  Policy, which is posted on our website.  

Changes to this Privacy Statement  

FlexCar may unilaterally and at any time modify this Privacy Statement, so that it  reflects any changes regarding the existing relevant policies and practices of our  company. We recommend that you regularly visit our company’s website in order to  be immediately informed of any changes to this Privacy and Personal Data  Protection Policy.  

The Privacy and Personal Data Protection Policy was updated on 10/03/2024.  What are our Contact Details?  

The following details are available if you wish to contact us, submit a complaint or  manage your account details:  

✔ You can send us your request in writing to the following postal address:  Taiapiera no.6-8, P.O. 11523, Athens, Greece.  

✔ You can call us at: +30 211 234 7499  

✔ You can send an e-mail to dpo@flexcar.gr.