GB

PRIVACY POLICY

In this Privacy Policy you will find all the relevant information on the processing of data carried out under the ownership and co-responsibility of GUERIN RENT A CAR S.L.U. (hereinafter "PEPECAR") and CAETANO RETAIL ESPAÑA S.A.U. (hereinafter "CAETANO group"), entities belonging to GRUPO SALVADOR CAETANO SGPS, S.A, for the group of interested parties, such as customers and potential customers, interested in products and services marketed by the entities and the network of dealers and garages belonging to the group.

 

PLEASE TAKE A FEW MINUTES TO READ OUR PRIVACY POLICY, IT WON'T TAKE YOU LONG. WE WANT TO EXPLAIN TO YOU IN A SIMPLE, CLEAR AND TRANSPARENT WAY HOW WE TREAT AND PROTECT YOUR PERSONAL INFORMATION AND YOUR RIGHTS. YOUR SECURITY AND THAT OF YOUR PERSONAL DATA IS FUNDAMENTAL TO PEPECAR AND WE TAKE ITS ADEQUATE PROTECTION VERY SERIOUSLY.

WHO DOES THIS POLICY APPLY TO?

This policy applies to all users of the Website, whether or not they are PEPECAR customers (hereinafter, indistinctly, "the user" or "the users") who are considered natural persons. By personal data, we mean any information about an identified or identifiable natural person.

This Website is aimed at users over 14 years of age, and its use is forbidden to minors under this age and for registration as well as the contracting of services or payment for the services that may be offered therein, to those under 18 years of age. Furthermore, the user responsibly acknowledges that he/she has sufficient legal capacity to be able to subscribe, if applicable, to the services offered by PEPECAR.

Minors under 14 years of age must obtain prior permission from their parents, guardians or legal representatives, who will be considered responsible for the acts carried out by the minors in their care, in accordance with current legislation.

PROCESSING INFORMATION

In accordance with the provisions of the EU General Data Protection Regulation (hereinafter GDPR) of 27 April 2016, the user must receive timely and specific information from the data controller and the uses and purposes of the processing.

For this purpose, the following information is indicated:

IF YOU BROWSE OR USE OUR WEB PLATFORM WHO IS THE DATA CONTROLLER?

We are two commercial entities belonging to the same business group, acting as the data controllers of your personal data in the sense indicated in this document in accordance with the provisions of Article 26 of Regulation (EU) 2016/679 (hereinafter, the "GDPR"):

 

CO-RESPONSIBLE FOR THE TREATMENT

CO-RESPONSIBLE FOR THE PROCESSING

GUERIN RENT A CAR S.L.U.

CAETANO RETAIL ESPAÑA S.A.U.

Direction: C/Aragoneses nº 18, 28.108 (Alcobendas) Madrid.

https://www.pepecar.com

Direction: C/Aragoneses nº 18, 28.108 (Alcobendas) Madrid.

https://www.caetanoretail.es

Data Protection Delegate"DPD" de Grupo Empresarial, with contact details: protecciondedatos@caetanoretail.e

 

WHAT KIND OF DATA DO WE PROCESS?

The processing of your data is necessary to give you access to the contents and/or functionalities of our Website or, if you so require, to be able to send you information or provide you with the services available through this Website. In this regard, we maintain a firm commitment to treat your personal data in a legitimate and consistent manner in accordance with the principles and legal obligations provided by the current legislation on personal data protection.

When you browse through our Website and, in particular, when you interact, you provide us with data directly, for example, when you fill in any form or request provided online in accordance with the processing purposes indicated in each case

 

All fields marked with an asterisk (*) in the forms provided to you must be completed. Failure to do so may make it impossible for us to attend to you and provide you with the information or services requested. Therefore, you must provide truthful information, and the use of aliases or means to hide your identity is prohibited, except when we expressly request the creation of a nickname or alias as a user name.

In the event that it is necessary to create a private access password, we advise you to keep it safe at all times. You are solely responsible for the use of your personal account, whether authorised or unauthorised, and in this respect you undertake to make diligent use of this information, not to make it available to third parties, and to report its loss or theft.

In order to ensure that the information provided is always up to date and does not contain errors, you must notify us as soon as possible of any changes and corrections to your personal data as they occur, as indicated in the "Rights" section.

In summary, we process the personal data that you have provided us, related to our vehicles, services and products in which you have shown interest, of any interested party, for example, both customer and potential customer, from being informed about all the news, campaigns and promotions related to our services and products to the purchase of a vehicle.

We will always ask you for data that is adequate, relevant and limited to what is necessary for the aforementioned processing purposes (principle of minimisation of personal data):

Contact and Identifying Data, name, surname, first name, postal address, telephone number, email address.

Contractual data, those necessary to process the reservation, e.g. vehicle category, pick-up and delivery date, pick-up and delivery place, extras of equipment or other contracted services, reservation number.

Commercial and Preferences, information you provide about your preferences, e.g. the type of vehicle, service or product you are interested in.

Transactional and economic information, those necessary for registration, processing a purchase or a return (not limited or exclusive); name, surname, delivery address, contact email and payment card information.

Data relating to the External Ethics and Whistleblowing Channel, if used by the user.

 

Browsing data, all websites collect visitor browsing data through cookies. Similarly, when you browse our Website you should be aware of the cookies that are installed on your terminal or device as this involves the processing of your personal data according to the type of cookies reported and their specific purposes. For more information on Cookies, please go to the "Cookies Policy" link.

 

Connection data, IP of the device or equipment used and which is provided by the browser you use to connect to a Website. The purpose of an IP address is to make it possible to connect to the network, to make the identification of each device unique and thus to prevent errors, fraud, etc. We will not use the IP address of your computer or device for any processing related to your personal data or to identify you or associate your browsing data with you.

FOR WHAT PURPOSES DO WE USE YOUR DATA?

Our website is maintained and updated with the utmost responsibility. The personal data you provide us with will be processed for the purpose stipulated in this privacy policy and for the purpose for which they were collected in the various data forms provided in this policy. In this sense, the personal data that you provide us with your consent, as well as any other data that you provide us with during the business/contractual relationship, may be processed as described in the contract between the parties.

Your data will be processed for the following purposes:

  • To enable you to browse our Website, thereby allowing you to access the information and content provided therein.
  • To attend to and manage your queries and requests.
  • Management of services related to the reservation of the vehicle, including (but not limited to):
    • Confirming and guaranteeing your reservation.
    • Modifying or cancelling your reservation.
    • Exchanging communications with you in relation to your booking.
    • Arranging the delivery and return of the vehicle.
    • Manage your invoices.
    • Manage debt claims.
    • Manage the payment of arrears.
    • Handle possible claims.
    • Manage the recovery of possible damages to the vehicle.
    • Handling insurance.
    • Return of articles or objects that may be left in the vehicle.
    • Management of fines, including:
    • Communicating the identity of the driver to the competent authorities.
    • Complying with the fine collection procedure to which PEPECAR may be subject.
    • Any other information that may be necessary to rent you a vehicle and/or provide you with services.

 

  • Promotional and marketing activities.
    • If you expressly accept, or if there is sufficient legal basis to do so, to send you information about offers, products, services, promotions, raffles, gifts and campaigns related to our products and services. The channels we usually use are: email, post, telephone, SMS, Push message.
    • Sending you communications similar to those services or products contracted or for which you have shown interest.
    • Record your rental history to suggest preferred products or services to you when you are looking for new bookings.
    • Recording your rental history to send you special offers and make you benefit from particular advantages.
    • Sending you e-mails about a booking you have not completed or a summary of a booking enquiry.
    • Management of your loyalty programme and membership card.
    • To carry out a quality control on our products and services by carrying out possible opinion surveys. This processing is intended to better understand the needs of customers and to offer and improve our services and products.
  •  In case you have accepted the cookies policy, for the development of the purposes associated with the different types of cookies informed through this, in particular, those of analytical type (navigation/user profile), to perform such analysis and statistics associated with the navigation of the Website in order to be able to improve our services and the quality in the provision of these without identifying the user. At any time, if you so wish, you may configure the use of analytical cookies, having the right to revoke your consent regarding the purposes associated with these cookies. We inform you that revoking your consent to the processing of your data with respect to certain types of cookies, such as session or technical cookies, may prevent you from browsing our Website.
  •  To adopt all applicable protection measures in accordance with current legislation, including the possible anonymisation of your personal data by applying the appropriate techniques available for this purpose. Therefore, in this area, anonymisation and pseudonymisation treatments may also be carried out for the better protection of their personal data.
  • Apply the relevant security, technical or organisational measures on your personal data according to the existing risk at all times.
  • Where appropriate, deal with the complaints submitted through the External Ethics and Whistleblowing Channel provided by PEPECAR
  • In general, to comply with the regulations applicable to PEPECAR according to its activity sector, including actions aimed at the detection of fraud and the prevention of crimes or illegal actions.
  • To comply with legal procedures and obligations, including compliance with the law or requests from the competent authorities, we are obliged by law to provide certain data to the Security Forces and Law Enforcement Agencies, as well as to Judicial Authorities, when they request it.

CAETANO RETAIL ESPAÑA, S.A.U., in its capacity as parent company, processes your data for the following purposes in the course of its internal administrative functions:

  • - Assistance, maintenance, custody and integral protection of the corporate databases of the companies that make up the business group, including PEPECAR, in accordance with the performance of its functions as parent company.
  • - Management of the groups of affected interested parties who provide data through the CAETANO Group's websites or social networks (clients, potential clients, representatives and contact persons, job seekers), as well as the tasks that are proper to it as the parent company of the CAETANO Group in relation to business management.
  • - In the event that you authorise us to send you advertising information on discounts, offers, promotions, gifts and campaigns related to mobility and automotive products and services of Grupo Salvador Caetano SGPS S.A., subsidiaries and affiliates located in the European Union, to send such information as long as we have your authorisation to do so.
  • - To adopt all applicable protection measures in accordance with current legislation, including the possible anonymisation of your personal data by applying the appropriate techniques available for this purpose. Therefore, in this area, anonymisation and pseudonymisation treatments may also be carried out for the better protection of their personal data.

What happens if you provide us with data of third parties?

If you provide us with Personal Data of third parties, you warrant that you have informed them about the purposes for which and the manner in which we need to process their personal data.

How do we collect your data?

- When you contact PEPECAR or CAETANO group directly, for example through the Website or through the different telephone hotlines, in order to request information about our products or services.

- When you participate in our marketing campaigns, through the Website or physically in events, product presentations, participating in any promotion or raffles of PEPECAR or CAETANO group.

- When, with your express authorisation, third parties provide us with your personal data.

 

ON WHAT BASIS DO WE LEGITIMATELY PROCESS YOUR DATA?

 

Purposes of treatment by PEPECAR

Legitimate basis for processing

Enable you to browse our platform, thereby allowing you access to the information and content provided therein.

The processing of your data is based on your consent (art. 6.1, a of the RGPD) and, as the case may be, satisfaction of the legitimate interest (art. 6.1, f of the RGPD), either our own or of third parties, associated with the proper management, maintenance, development and evolution of the platform, tools, network and associated information systems, allowing its correct functioning, functionalities, access to content and services, as well as the general security of all of the above.

To deal with and manage your queries and requests.

The processing of your data is based on the application of pre-contractual measures (art. 6.1, b of the GDPR).

Management of services related to the reservation of the vehicle.

The processing of your data is based on the application of pre-contractual and contractual measures (art. 6.1, b of the GDPR), for the purpose of booking, execution and fulfilment of rental contracts and (art. 6.1, c of the GDPR) for the fulfilment of legal obligations

To provide customer services in an appropriate manner.

The processing of your data is based on the application of pre-contractual measures (art. 6.1, b of the GDPR) and, where applicable, your consent (art. 6.1, a of the GDPR).

When your query is related to the management of incidents or complaints, the processing is necessary to take pre-contractual or contractual measures (art. 6.1, b of the GDPR).

When your query is related to the exercise of rights, the processing is necessary for compliance with legal obligations (art. 6.1, c of the GDPR).

Promotional and marketing activities...

The processing of your data is based on your consent (art. 6.1, a of the GDPR).

If you are already a PEPECAR customer and the message is related to products and services similar to those you have already contracted, such commercial communications may be covered by the provisions of article 21.2 of Law 34/2002, of 11 July, on information society services and electronic commerce, in the legitimate interest* (art. 6.1, f of the RGPD) of PEPECAR.

To carry out quality control on our products and services by conducting possible opinion surveys.

The processing of your data is based on your consent (art. 6.1, a of the GDPR) and, where applicable, legitimate interest (art. 6.1, f of the GDPR) of PEPECAR in order to improve the quality of the services and products contracted by customers.

If you have accepted the cookie policy provided for this purpose, to allow the development of the processing purposes associated with them and, in particular, to perform the relevant analysis derived from your web browsing for analytical and/or statistical purposes.

The processing of your data is based on your consent (art. 6.1, a of the GDPR).

Adopt all applicable protection measures in accordance with current legislation, including the possible pseudonymisation and anonymisation of your personal data by applying the appropriate techniques available for this purpose. 

The processing is necessary for compliance with legal obligations (art. 6.1, c of the GDPR) and with Spanish personal data protection legislation, Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, the "LOPDGDD"). In the case of processing intended to ensure the security of the platform, the network and the associated information system, the legitimate interest (art. 6.1, f of the GDPR) of PEPECAR or, where appropriate, of a third party may be invoked (Recital 49 of the GDPR).

To apply the relevant technical and/or organisational security measures on your personal data in accordance with the risks existing at any given time.

The processing is necessary for compliance with legal obligations (art. 6.1, c of the GDPR) and the LOPDGDD. In the case of processing intended to ensure the security of the platform, the network and the associated information system, the legitimate interest (art. 6.1, f of the GDPR) of PEPECAR or, where appropriate, of a third party may be invoked (Recital 49 of the GDPR). 

Where appropriate, deal with complaints submitted to the External Ethics and Whistleblowing Channel.

The processing of your data is based on a legitimate interest (art. 6.1, f of the RGPD) in order to comply with a legal obligation (art. 24 of the RGPD) and the LOPDGDD. 

In general, to comply with the regulations applicable to PEPECAR in accordance with its sector of activity, including actions aimed at the detection of fraud and the prevention of crimes or illicit actions in the development of PEPECAR's compliance programmes.

The processing is necessary for compliance with legal obligations (art. 6.1, c of the GDPR), or legitimate interest (art. 6.1, f of the GDPR) overriding PEPECAR's legitimate interest as regards fraud detection or prevention activities (Recital 47 of the GDPR).

 

Purposes of processing by CAETANO RETAIL ESPAÑA, S.A.U.

Legitimate basis for processing  

Comprehensive maintenance of customer data in the corporate databases of the companies that make up the group of companies in accordance with the performance of its functions as a parent entity. 

We will process your data on the basis of legitimate interest (art. 6.1, f of the GDPR), to transmit them to other entities of the corporate group for administrative and organisational purposes and to ensure the security of the platform, the network and the associated information system (Recital 47 and 49 of the GDPR).

In the event that you authorise us to send you advertising information about discounts, offers, promotions, gifts and campaigns relating to automotive and mobility products and services of Grupo Salvador Caetano SGPS S.A., subsidiaries and affiliates located in the European Union, we will send you such information as long as we have your authorisation to do so.

The processing of your data is based on your consent (art. 6.1, a of the GDPR).

 

When the legitimate basis for the processing of your personal data is your consent, we remind you that you have the right to revoke it at any time simply and free of charge by writing to us at protecciondedatos@caetanoretail.es.

  •  Legal basis legitimate interest, sometimes, in order to carry out our activity, it is necessary to process your personal data in accordance with a series of legitimate interests that you hold and we explain in detail:

Communications similar to those services or products contracted or for which interest has been shown, PEPECAR processes the data of its Clients or Potential Clients in order to send them information, by any means, including electronic means, about its products and services that are similar to those that the Clients or Potential Clients have contracted in the past. The information provided by PEPECAR may be adapted to the profile and interests of the Clients or Potential Clients, according to the information provided by them to PEPECAR or the information that has been generated as a result of the relationship that the former have with the latter. The communications PEPECAR makes to its Clients or Potential Clients covered by the legitimate interest of direct marketing, also include all those carried out within the framework of loyalty programmes, courtesy communications (birthday or specific festivities greetings), follow-up of requested offers, invitations to events organised by PEPECAR, informative communications related to PEPECAR's activity or sector.

Contact with companies and self-employed entrepreneurs, when our Clients or Potential Clients are companies or self-employed entrepreneurs, we process their data or that of their representative or contact person, in order to contact them, with the aim of establishing commercial or professional relations of any kind, including the sending of commercial communications by any means, other than electronic means.

Internal administrative and organisational purposes, the transmission of your personal data to other entities of the business group (see "Recipients") for internal administrative and organisational purposes.

Satisfaction surveys, when Customers or Potential Customers contract a product or service, or contact PEPECAR, we use their data to control the quality of the services we provide, to manage any complaints they may send in relation to them and to improve them as far as possible.

Security, PEPECAR or CAETANO group may contact its Clients or Potential Clients in case of urgency, for their security, or to communicate the existence of service measures to be applied, as long as it can be reasonably understood that such treatment could prevent or reduce any kind of potential damage for its Clients or Potential Clients.

HOW LONG DO WE KEEP YOUR DATA?

Personal data associated with the purposes of processing reported by PEPECAR

Time limits or criteria for the retention of your personal data

To enable you to browse our platform, thereby allowing you to access the information and content available on it.

In general, your data will be kept for these purposes for the time that is essential and necessary to enable you to correctly browse and use our platform and the content available through it that you access.

With regard to the data associated with your browsing profile, in relation to the analytical cookies that you have accepted as indicated in the PEPECAR cookies policy, you must pay attention to the section relating to the temporality of these.

To deal with and manage your queries and requests

For the time strictly necessary to resolve or attend to the same.

Management of services related to the reservation of the vehicle.

We will retain the data for the duration of the contract, for the periods stipulated by binding legislation, e.g. on taxation, taxes and guarantees, and for ten years thereafter, in order to be able to respond to any subsequent queries or complaints.

To provide customer services in an appropriate manner.

For the time strictly necessary to solve or attend to them.

Promotional and marketing activities.

For three years from the date on which we last obtained your consent to send you marketing communications or until such time as you exercise your right to withdraw your consent to the processing of your data for advertising and/or promotional purposes or, where applicable, you object to the processing for direct marketing purposes pursuant to Article 21(2) of the GDPR.

To carry out quality control on our products and services by conducting possible opinion surveys.

As long as there is a pre-contractual/contractual relationship with the user.

If you have accepted the cookie policy provided for this purpose, to allow the development of the processing purposes associated with them and, in particular, to perform the relevant analysis derived from your web browsing for analytical and/or statistical purposes.

They will be maintained as indicated in the Cookie Policy (visit the Cookie Policy).

Adopt all applicable protection measures in accordance with current legislation, including the possible pseudonymisation and anonymisation of your personal data by applying the appropriate techniques available for this purpose.

As long as the user's personal data is processed, including the retention of such data for the legally stipulated periods, and irrespective of the legitimate basis for processing used by PEPECAR.

To apply the relevant technical and/or organisational security measures on your personal data in accordance with the risks existing at any given time.

As long as the user's personal data is processed, including the retention of such data for the legally stipulated periods, and irrespective of the legitimate basis for processing used by PEPECAR.

Where appropriate, deal with complaints submitted to the External Ethics and Whistleblowing Channel.

The data of the person making the communication as well as the data of third parties will be kept in our system only for the time necessary for the investigation of the communication in accordance with article 24.4 of Organic Law 3/2018, 5 December.

In general, to comply with the regulations applicable to PEPECAR in accordance with its sector of activity, including actions aimed at the detection of fraud and the prevention of crimes or illicit actions in the development of PEPECAR's compliance programmes.

10 years in accordance with the Money Laundering and Terrorist Financing Act.

 

Personal data associated with the purposes of the processing reported by CAETANO RETAIL ESPAÑA, S.A.U

Time limits or criteria for the storage of your personal data

Maintenance, custody and integral protection of the corporate databases of the companies that make up the business group, including PEPECAR in accordance with the development of its functions as parent entity

We will retain the data for as long as your personal data is processed and for the applicable legal periods, regardless of the legal basis for processing, and for at least three years for the purpose of determining any possible liabilities from the perspective of the personal data protection regulations that may apply.

In the event that you authorise us to send you advertising information regarding discounts, offers, promotions, gifts and campaigns related to automotive and mobility products and services of Grupo Salvador Caetano SGPS S.A., subsidiaries and affiliates located in the European Union, to send such information as long as we have your authorisation to do so. 

We will retain the data until such time as you exercise your right to withdraw your consent to the processing of your data for advertising and/or promotional purposes or, as the case may be, you object to the processing for direct marketing purposes in application of the provisions of Article 21.2 of the GDPR.

 

In any case, and without prejudice to the foregoing, the user is also informed of the following:

  • Our data retention periods are based on business needs, they will be retained for the time necessary to fulfil the purpose for which they were collected, unless a longer retention period is legally permitted or required.
  • In accordance with current personal data protection regulations, in all matters concerning the correct processing of personal information, we may retain information for three years securely from collection/capture (statute of limitations for infringements in this area).
  • With regard to the length of time cookies are kept, users are advised to consult our cookie policy.
  • In general, when the personal data is no longer necessary for the purposes for which it was collected, it will be blocked, remaining available only to the competent authorities for the possible purge of legal responsibilities during the processing of these, always in accordance with the applicable regulations, and may not be used for purposes other than these. After the corresponding legal deadlines have elapsed in the event of blocking, such personal data will be deleted in accordance with the applicable regulations, and may also, if applicable, be securely anonymised by (anonymised/non-personal data).

WHAT ARE THE CONSEQUENCES OF NOT PROVIDING US WITH YOUR DATA?

We try to request or apply the minimum and essential data to carry out the processing of personal data that we carry out in full development of our object and social purposes. All of this is in accordance with the principles contained in the applicable regulations.

 

You may choose not to provide the information described above. If you do so, please note that failure to provide your personal data may make it impossible for you to:

  • You can browse our website correctly (non-acceptance of technical or session cookies).
  • Process your specific request or application (for example, due to the lack or insufficient completion of the corresponding form or application).

 

In any case, the information and personal data that you provide us with, depending on each case, must be in any case:

  • Sufficient, although adjusted, limited and proportionate to the legitimate purposes of processing reported in each case, with the utmost respect for the principles of purpose limitation and minimisation of personal data.
  • Accurate, up-to-date and truthful, in order to be able to adequately verify identity, capacity and, where appropriate, representation, as well as to be able to adjust, in each case, the data processing carried out to their specific needs and actual situation. This is in accordance with the principle of the accuracy of personal data.

Users shall be fully responsible for the personal data and information they provide to PEPECAR within the framework of the platform and, where appropriate, for the services they require or contract from us.

DO WE SHARE YOUR PERSONAL DATA WITH THIRD PARTIES?

In general, we do not share your data with third parties, nor do we sell or offer it to them, although it is possible that in order to fulfil the purposes indicated in this Privacy Policy we may communicate your minimum personal data to collaborating companies that provide us with support in the services we offer, for example (not limited or exclusive):

- In order to complete the vehicle reservation request, it is necessary and essential that we provide your personal data to third party partners that help us provide the rental service:

o Owner of the rental vehicle.

o Payment service provider

In the event of a dispute or any other type of incident/claim, we may need to transfer booking and payment details about the incident/claim to the relevant entity.

- Insurance companies to provide roadside assistance and accident assistance to drivers.

- Owner of the rented vehicle, for the sole purpose of complying with the obligation to identify the driver to the competent authority in the event of a traffic offence committed at the time of the rental contract.

- Fraud detection and prevention entities.

- Technology service providers (storage, security and maintenance).

- Marketing and advertising service providers and partners

- Fraud detection and prevention entities, in the event that you have a certain and enforceable debt with PEPECAR, the payment of which has been previously requested without having been paid within the term established in the General Terms and Conditions, this information may be transferred to an information file on solvency and creditworthiness.

- With regard to the data relating to possible applications, information or curricula vitae that you send us through the section of the platform "I want to work with you": https://www.pepecar.com/contacto/, these will be sent to the CAETANO group, which is the entity in charge of processing these personal data.

These companies that provide us with other types of services only have access to the personal information they need to carry out these services and they are required to keep the personal information they can access confidential and may not use it in any way other than that which we have requested of them.

In compliance with legal and regulatory obligations, your data will be communicated to (not limited or exclusive).

- Public administrations.

- Judges, courts and law enforcement agencies, for the attention of the possible responsibilities arising from the processing, in their respective competences at their request

- Competent traffic authorities, as provided for by Royal Legislative Decree 6/2015, approving the revised text of the Law on Traffic, Circulation of Motor Vehicles and Road Safety

- Insurance companies contracted to provide roadside assistance and accident assistance to drivers.

Due to the efficiency of the service, some service providers may be located in territories outside the European Economic Area that do not provide a level of data protection equivalent to that of the European Union. In such cases, we inform you that we transfer your data with appropriate safeguards to ensure the security of your data, such as Standard Contractual Clauses or any other relevant supplementary measures.

If you have expressly authorised the transfer of your data to companies of Grupo Salvador Caetano SGPS, S.A., you accept that your personal data will be processed by the following:

SALVADOR CAETANO AUTO, SGPS, S.A. 

Tax identification number: 505185130

Registered office: Av. Vasco da Gama 1410, 4430 247, Vila Nova de Gaia (Oporto)

Company object: Holding company

 

CAETANO BAVIERA - COMÉRCIO DE AUTOMÓVEIS, S.A.

Tax identification number: 500003165

Registered office: Rua do Barreiro, 547, 4409 513 Vila Nova de Gaia Freguesia (Oporto)

Company object: Automotive sector

 

CAETANO RETAIL, SGPS, S.A.

Tax identification number: 503201332

Registered office: Rua do Barreiro, 547, 4409 513 Vila Nova de Gaia Freguesia (Oporto)

Company object: Holding and provision of technical, administrative and management services to subsidiaries.

 

FINLOG - ALUGUER E COMÉRCIO DE AUTOMÓVEIS S.A

Tax identification number: 502584866

Registered office: Avenida Vasco da Gama, nº 780, 4430 247, Vila Nova de Gaia (Oporto)

Company object: Rental of motor vehicles and provision of mobility services.

 

CHOICE CAR, S.A.

Tax identification number: 504041762

Registered office: Avenida Vasco da Gama, n.º 780, 4430 247, Vila Nova de Gaia (Oporto)

Company object: Rental of motor vehicles and provision of mobility services.

 

GUERIN - RENT - A - CAR (DOIS) LDA

Tax identification number: 501738681

Registered office: Avenida Severiano Falcão, no 3, Lisboa Concelho: Loures Freguesia: Sacavém e Prior Velho 2685 379 Prior Velho

Company object: Renting of motor vehicles and provision of mobility services.

 

CAETANO RETAIL ESPAÑA S.A.U.

CIF: A-81.250.458

Registered office: Calle Aragoneses nº 18, 28108, Alcobendas (Madrid).

Registration details: Registered in the Mercantile Register of Madrid, in volume 9.898, folio 34, page

number M-158.619, inscription 5ª.

 

CAETANO BENET, S.L.U.

CIF: B-92.558.584

Registered office: Calle Aragoneses nº 18, 28108, Alcobendas (Madrid).

Registration details: Registered in the Mercantile Register of Madrid, volume 33.489, folio 181,

section 8, page number M-602.846, 2nd entry.

Corporate purpose: automotive sector.

 

CAETANO RETAIL ESPAÑA, S.L.U.

CIF: B-93.125.482

Registered office: Calle Aragoneses nº 18, 28108, Alcobendas (Madrid).

Registration details: Registered in the Mercantile Register of Madrid, volume 33.528, folio 213,

section 8, page number M-603.512, 2nd entry.

Corporate purpose: automotive sector.

 

IBERICAR FÓRMULA CÁDIZ, S.L.U.

CIF: B-72.125.669

Registered office: Ronda del Puente, s/n, Polígono exterior Zona Franca, Cádiz, 11011.

Registration details: Registered in the Mercantile Register of Cádiz in volume 1.927, folio 33, page

number CA-38.361.

Company object: automotive sector.

 

IBERICAR MOTORS CÁDIZ, S.L.U.

CIF: B-11.258.530

Registered office: Calle Gibraltar, s/n, Cádiz, 11011 (Cádiz).

Registration details: Registered in the Mercantile Register of Cádiz in volume 634, folio 81, page number

CA-1.536.

Company object: automotive sector.

 

CAETANO MOTORS MÁLAGA, S.L.U.

CIF: B-92.847.862

Registered office: Calle Aragoneses, number 18, 28108, Alcobendas (Madrid).

Registration details: Registered in the Mercantile Register of Madrid, in volume 34.297, folio 47, page

number M-616.986, 2nd entry.

Corporate purpose: automotive sector.

 

IBERICAR MÓVIL SUR, S.L.U.

CIF: B-93.112.159

Registered office: Calle Aragoneses nº 18, 28108, Alcobendas (Madrid).

Registration details: Registered in the Mercantile Register of Madrid in volume 33.475, folio 149, section 8, sheet number M-602.159, page number M-602.159, page number M-602.159, page number M-602.159.

8, page number M-602.586, 2nd entry.

Corporate purpose: automotive sector.

 

IBERICAR BARCELONA PREMIUM, S.L.

CIF: B-64.942.618.

Registered office: Carrer Entença, 332-334, 08029, Barcelona.

Registration details: Registered in the Mercantile Register of Barcelona, volume 41.802, folio 209,

sheet number B-376.033, 1st inscription.

Company object: automotive sector.

 

IBERICAR CUZCOMOTOR, S.L.U.

CIF: B-80.200.868

Registered office: Calle Salvatierra, nº 11-13, Madrid.

Registration details: Registered in the Mercantile Register of Madrid, in volume 1.943, folio 199, section 8, sheet number M-34.868, page number M-34.868, page number M-34.868, page number M-34.868.

8, page number M-34.800, 1st entry.

Corporate purpose: automotive sector.

 

IBERICAR MÓVIL, S.L.U.

CIF: B-85.191.807

Registered office: Calle Aragoneses nº 18, 28108, Alcobendas (Madrid).

Registration details: Registered in the Mercantile Register of Madrid, in volume 24.642, folio 214, page 214, sheet

M-443.560, 1st entry.

Company object: automotive sector.

IBERICAR QUERMOTOR, S.L.U.

CIF: B-81.047.904

Registered office: Calle Aragoneses nº 18, 28108, Alcobendas (Madrid).

Registration details: Registered in the Mercantile Register of Madrid, volume 9.078, page 152, sheet M-146.075.

number M-146.075.

Corporate purpose: automotive sector.

IBERICAR REICOMSA, S.L.U.

CIF: B-78.392.149

Registered office: Calle Raimundo Fernández Villaverde, nº 45, Madrid.

Registration details: Registered in the Mercantile Register of Madrid, in volume 1.161, folio 114, page

number M-21.967.

Corporate purpose: automotive sector.

IBERICAR TECHNIK, S.L.U.

CIF: B-28.859.031

Registered office: Calle Aragoneses nº 18, 28108, Alcobendas (Madrid)

Registration details: Registered in the Mercantile Register of Madrid, volume 5.022, folio 86, page number M-82.442.

number M-82.442.

Corporate purpose: automotive sector.

IBERICAR GESTOSO, S.L.U.

CIF: B-36.193.59

Registered office: Avenida Fernando Conde, 123, A Estrada, Pontevedra.

Registration details: Registered in the Pontevedra Mercantile Register, volume 1.332, folio 182,

sheet number PO-10.039, 1st inscription.

Company object: automotive sector.

CARPLUS SERVICIOS INTEGRALES, S.L.U.

CIF: B-86.692.985

Registered office: Calle Aragoneses 18, 28108, Alcobendas (Madrid).

Registration details: Registered in the Mercantile Register of Madrid, volume 31.245, folio 206, section 8, page M-562.404, 1st entry.

Company object: automotive sector.

 

Likewise, without prejudice to the existing co-responsibility agreement between PEPECAR and CAETANO RETAIL ESPAÑA S.A.U., we inform you that both co-responsible for the processing are part of the same business group and that, in accordance with Recital 48 of the RGPD, both entities have a legitimate interest in transmitting personal data to each other within the same business group for internal administrative purposes.

Likewise, PEPECAR and CAETANO group have several processors of personal data under their control, allowing access to them, as trusted suppliers, and to the extent strictly necessary for the provision of the services contracted with them. Such data processors operate under a service contract under the terms, conditions and guarantees contained in Article 28 of the GDPR, PEPECAR carrying out the corresponding controls, inspections and audits in this area to verify that such data processors strictly comply with the contracts signed for this purpose and the applicable regulations.

Finally, you are informed that your data may be transferred to the competent authorities and bodies in accordance with the legislation applicable in each case.

ARE YOUR PERSONAL DATA TRANSFERRED INTERNATIONALLY?

We inform you that your data will not be communicated to entities outside the European Economic Area without your express consent, except in cases where an imperative rule allows such communication, in such cases we will inform you whenever possible of the purposes of such communication.

Without prejudice to the foregoing, our cookies policy informs you of the existence of possible international transfers of personal data, in relation to the services provided to us by certain companies (third-party cookies). All these international transfers are fully guaranteed in accordance with the applicable regulations.

WHAT RIGHTS DO YOU HAVE AND HOW CAN YOU EXERCISE THEM?

We undertake to respect the confidentiality of your personal data and to guarantee you the exercise of your rights.

The co-responsible parties agree that you may exercise these rights free of charge by

- By writing an email to the only email address, protecciondedatos@caetanoretail.es, indicating in the subject of the email "Request exercise of rights", the right you are requesting to exercise and reason.

- You can also send the request to the postal address, c/ Aragoneses nº 18, 28.108 (Alcobendas) Madrid, indicating the reference "Solicitud ejercicio de derechos", stating the right you are requesting to exercise and the reason.

In order to identify you correctly and guarantee the security of your data (e.g. to avoid identity theft), we request that you send us a copy of a document proving your identity; DNI, NIE or passport.

In particular, regardless of the purpose or legal basis under which we process your data, you have the right to:

 

Law

What is it?

Right to

information

Right to be provided by PEPECAR with appropriate information, both at the time when your personal data has been collected (whether obtained from you or from a third party), and at any time thereafter with regard to the processing of your personal data. You decide about your personal information.

Right of access

Right to obtain from PEPECAR confirmation as to whether or not your personal data are being processed, and to basic information concerning such processing, as well as to obtain a copy of the personal data undergoing processing.

Right of rectification

Right to obtain without undue delay from PEPECAR the rectification of your personal data.

Right of erasure

Right to obtain without undue delay from PEPECAR the erasure of your personal data.

Right to restriction of processing

Right to obtain from PEPECAR the restriction of the processing of your data when:

-You contest the accuracy of your personal data, for a period of time that allows PEPECAR to verify its accuracy.

-The processing is unlawful and you object to their erasure (and request their restriction instead).

-PEPECAR no longer needs the personal data, but you need them for the formulation, exercise or defence of claims.

Right to data portability

Right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format or to transfer it to another data controller where technically possible.

Right to object

Right to object at any time to the processing of your personal data, including profiling, where such processing is based on the legitimate interest of PEPECAR or a third party.

Right not to be subject to a decision based solely on automated processing (including profiling)

Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or significantly affects you.

Right to withdraw your consent

You have the right to withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of the processing carried out by PEPECAR based on your consent prior to its withdrawal.

Right to lodge a complaint with the competent supervisory authority (AEPD)

This implies the possibility of bringing a complaint before the supervisory authority in the event that you consider your rights to the protection of personal data to have been violated.

 

We recommend that before filing any complaint or claim with the Spanish Data Protection Agency (AEPD), you contact us in order to analyse the specific situation and try, if necessary, to find an effective and amicable solution.

 

Your exercise of these rights is subject to certain exceptions for reasons of general interest, such as the prevention or detection of crime, or for our own interests, such as maintaining the confidentiality of legal advice. If you exercise any of these rights, we will check that you are in fact entitled to do so, and we will respond to you within one month (in accordance with the GDPR), which may be extended by a further two months if necessary, taking into account the complexity and number of requests.

 

HOW SECURE IS YOUR PERSONAL DATA?

 

PEPECAR and CAETANO group is committed to fulfilling its obligation of secrecy, duty to keep them and adopt the necessary technical and organisational measures to ensure the security of personal data and avoid its alteration, loss, treatment or unauthorised access.

The information provided by the user is considered confidential and may not be used for purposes other than those related to the services contracted with PEPECAR.

Third parties collaborating with PEPECAR and having any kind of intervention in the services provided, are committed not to disclose or make use of the information they have accessed.

All our suppliers, who act as Data Processors, operate under a service contract under the terms, conditions and guarantees contained in article 28 of the RGPD

Although it is not possible to guarantee absolute protection against intrusion when transmitting data over the internet or from a website, we and our subcontractors and business partners make every effort to maintain physical, electronic and procedural safeguards to ensure that your data is protected in accordance with the applicable legal requirements in this area.

The measures we use include the following:

a) Physical:

 

- Clean desk policy.

- Document shredder.

- Fireproof cabinets with specific locks.

- Classified and labelled documents.

- Workplaces protected with key access, making it impossible for unauthorised persons to access them.

- Procedures for the use of media outside the office.

b) Logical:

- Limit access to your data to only those persons who need to know about it in view of the tasks they perform.

- As a general rule, transfer collected data in encrypted format.

- Store the most sensitive data (such as credit card data) only in encrypted format.

- Install perimeter protection systems for IT infrastructures ("firewalls") to prevent unauthorised access, e.g. by hackers.

- Regularly monitor access to IT systems to detect and stop any misuse of personal data.

- Business transactions are carried out in a secure server environment under SSL protocol.

- Original and up-to-date software.

- Computer equipment with access by means of a unique and non-transferable username and password.

- Disk encryption.

- Backup and restore capability.

- Procedures for use of automated devices, recording of incidents and use of media outside the office.

- User locked when not in use, screensaver with password lock.

Where we have given you (or where you have chosen) a password that enables you to access certain parts of our websites or any other portal, application or service under our control, you are responsible for maintaining the secrecy of that password and for complying with any other security procedures that we notify you of.

We recommend some of the precautions we advise you to take to ensure the security of your personal data:

- Do not give your username and password to anyone.

- Do not write it down in easily accessible places: computer, diary.

- Always use our SSL security system.

- Always disconnect the browser session after having accessed a security area or after having entered the user or password into the system.

 

c) Training:

Training in PEPECAR and GRUPO SALVADOR CAETANO SGPS, S.A, in data protection, cybersecurity and related matters is continuous.

Security measures are periodically reviewed, both manually and by means of specific software.

 

VALIDITY AND MODIFICATION OF THE PRIVACY POLICY

PEPECAR reserves the right to modify this policy in order to adapt it to future legislative, doctrinal or jurisprudential developments that may be applicable, or for technical, operational, commercial, corporate or business reasons, informing you in advance and reasonably of the changes that may occur whenever possible. In any case, it is recommended that, each time you access this platform, you read this policy in detail, as any modification will be published through this.

Likewise, PEPECAR may inform you personally and in advance of the planned changes in this policy, before their entry into force, whenever it is technically and reasonably possible, in particular when you are a registered user or a PEPECAR customer.

 

JURISDICTION AND APPLICABLE LAW

 

In general, any dispute and conflict shall be submitted preferentially by the parties to the knowledge of these for the purpose of seeking an amicable and mutually agreed solution using, for this purpose, the channel and email provided in this policy.

 

In the event that this is not possible, in accordance with the criteria contained in the RGPD for determining the competence of the leading or main authority in order to hear any conflict, controversy or claim regarding this privacy policy, at least in administrative proceedings, it is hereby stated that this authority will be the Spanish Data Protection Agency (AEPD), and in any case, the provisions of article 56 of the RGPD must be complied with. As regards the right to effective judicial protection against PEPECAR in these cases, the provisions of article 79.2 of the RGPD shall also apply, and the corresponding action may be brought before the Judges and Courts of the City of Madrid insofar as the entity responsible is a company based in Spain. The current Spanish and European regulations applicable in this area shall be complied with.