Source: https://eventtransportation.sixt.com/en/privacy-policy/
Timestamp: 2019-04-20 22:12:55+00:00

Document:
In the following we would like to inform you about the types of data processed by SIXT CRS and about the purposes of such data processing. We would also like to inform you about important legal aspects of data protection, such as your rights.
The party responsible for processing your data (controller) is Sixt Chauffeur Reservation Systems GmbH & Co. KG, Hausvogteiplatz 2, 10117 Berlin (hereinafter also referred to as SIXT CRS).
If you have any questions on data protection, please contact our data protection officer at dataprotection-chauffeur@sixt.com. You can also contact our data protection officer at the following address: Sixt Chauffeur Reservation Systems GmbH & Co. KG, Datenschutzbeauftragter, Hausvogteiplatz 2, 10117 Berlin.
Master data: These include, for example, a person’s first name, surname, address (private and/or business), date of birth.
Communication data: These include, for example, a person’s telephone number, email address (private and/or business) fax number if applicable, as well as the content of communications (e.g., emails, letters, faxes).
Contract data These include, for example, pick-up and drop-off dates and locations, payment information, and information on customer loyalty and partner programmes.
Voluntary data: These are data that you provide to us on a voluntary basis, without us having explicitly requested them, and include information such as your preferences with regard to the vehicle’s equipment and category.
Art. 6 (1) point (a) of the General Data Protection Regulation (GDPR): Pursuant to this provision, the processing of your personal data is lawful if and to the extent that you have given your consent to such processing.
Art. 6 (1) point b) GDPR: Pursuant to this provision, the processing of your personal data is lawful if such processing is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract (e.g., when making the vehicle reservation).
Art. 6 (1) point f) GDPR: Pursuant to this provision, the processing of your personal data is lawful if such processing is necessary for the purposes of the legitimate interests pursued by the controller, i.e., SIXT, or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, i.e., you yourself.
Art. 9 (2) point f) GDPR: Pursuant to this provision, certain special categories of personal data can be processed if such processing is necessary for the establishment, exercise or defence of legal claims. These special categories of personal data include the health data of the data subjects.
We process your master data, communication data, contract data, financial data and any data you have provided voluntarily, for purposes of implementing your reservations and facilitating the conclusion and performance of your contract.
In the Sixt CRS booking process, you have the option of depositing a credit card and thus paying for your trip by credit card. (The actual debiting takes place only after the end of the journey).
Sixt CRS has engaged a professional payment service provider (PSP), certified according to the PCI-DSS security standard, for payment processing with credit cards, which is required to protect your credit card data.
Sixt CRS itself does not store any credit card information about you; in order to enable you to reuse an already registered card for future booking processes, we only store a reference number that uniquely identifies your card.
Art. 6 (1) point b) GDPR applies to the processing of data to the extent required to implement reservations, to conclude and perform contracts and for customer relations purposes.
For the purposes described in the foregoing, we disclose your data to the following recipients: contractual partners for the booking of vehicles (limousine service providers).
If you use our company to reserve vehicles that you want to rent in third countries, we send your personal data to your contracting partner in the third country concerned. The transfer of your data to a third country is based on an adequacy decision by the European Commission. If no adequacy decision by the European Commission exists for the respective third country, then the transfer to that third country will take place subject to appropriate safeguards as per Art. 46 (2) GDPR. We can also transfer your data to a third country subject to the conditions set forth in Art. 49 GDPR. You can request copies of the aforementioned safeguards from SIXT CRS by writing to the address specified above (see → Controller). Third countries are countries outside the European Economic Area. The European Economic Area comprises all countries of the European Union as well as the countries of the so-called European Free Trade Association, which are Norway, Iceland and Liechtenstein.
We process your master data, communication data and contract data for purposes of promoting customer loyalty, implementing bonus programmes and optimising customer offers. The customer loyalty programmes we promote include our own programme and the programmes of our cooperation partners.
We use your email address in order to recommend similar products and services offered by us. You may at any time object to your email address being used without incurring more than the cost of transmission as per the applicable basic fees.
Art. 6 (1) point a) GDPR applies to data processing for purposes of implementing direct marketing measures that require explicit advance consent.
Art. 6 (1) point f) GDPR applies to data processing for purposes of implementing direct marketing measures that do not require explicit advance consent, and of implementing the marketing measures mentioned (→ Purposes of data processing).
Our legitimate interests in using your personal data for purposes of implementing direct marketing measures and the marketing measures mentioned lie in the fact that we want to convince you of our services and promote a lasting customer relationship with you.
For the purposes described in the foregoing, we disclose your data to IT service providers, call centres, advertising partners and providers of customer loyalty programmes.
The transfer of data to third countries takes place within the scope of partner programmes. The transfer of your data to a third country is based on an adequacy decision by the European Commission. If no adequacy decision by the European Commission exists for the respective third country, then the transfer to that third country will take place subject to appropriate safe-guards as per Art. 46 (2) GDPR. We can also transfer your data to a third country subject to the conditions set forth in Art. 49 GDPR. You can request copies of the aforementioned safeguards from SIXT by writing to the address specified above (see → Controller). Third countries are countries outside the European Economic Area. The European Economic Area comprises all countries of the European Union as well as the countries of the so-called European Free Trade Association, which are Norway, Iceland and Liechtenstein.
To ensure high quality customer service, Sixt CRS can track the coordinates of the drivers on the mobile phone (GPS tracking). These location data are not stored and are used exclusively to enable the execution of a reserved trip or to inform customers about an upcoming trip. To make it easier for you as a customer to book from your current location as a pick-up location with Sixt CRS mobile applications (Android and iOS Apps), our apps locate your location (if you have agreed to transfer your GPS data in the app). Sixt CRS does not store transaction data at any time.
Your personal data is recorded via SIXT CRS websites (e.g mydriver.de) if you actively provide such data to us, for instance as part of a registration procedure, by filling out forms, by sending emails, and, primarily, by making a vehicle reservation. We use these data for the purposes described above or for purposes that arise from the respective request, for example, to process specific reservation requests or preferences.
SIXT CRS has implemented a variety of technical and organisational measures in order to protect your personal data, in particular against random or intentional manipulation, loss, destruction and access by unauthorised persons. These security measures will be continually adapted in accordance with technological developments. The transfer of personal data between your computer and our server invariably takes place by encrypted connection (Secure Socket Layer (SSL).
Some new browsers use “Do not track” functions. If this is the case, our website may not respond to “Do not track” requests or may be unable to retrieve the headers of such browsers. To find out more about what your settings are and about whether you want to deny certain providers access to your information, please click here for the US, here for Canada, and here for Europe (please note that opting out will not mean that you are no longer displayed any advertising at all. Rather, you will still receive generic advertising).
The SIXT CRS website uses the HotJar analytics services for purposes of improving customer friendliness and customer experiences. These services can record mouse clicks as well as scroll movements. They can also record information entered on this website via keyboard. Such information is not personalised and thus remains anonymous. HotJar does not record such information on pages that do not use the HotJar system. You can deactivate the HotJar service by contacting HotJar via the following link: https://www.hotjar.com/contact.
This website integrates so-called social plugins (e.g. “Like-Button”) of the social network Facebook, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). If you interact with the plugins, e.g. by clicking the “like” button, you as a Facebook registered user can automatically leave a note in your facebook profile telling your network that you like the content you are visiting .
In this respect, our website enables ongoing data exchange with Facebook. Please note that a data exchange or the link already takes place when you access our website and does not depend on the activation of the social plugin / “Like-Button” or on a login to Facebook. If you don’t want Facebook to be able to create a personalized motion profile of you, please log out of Facebook. Closing the Facebook page is not enough. Please see the purpose and scope of data collection and the further processing and use of the data by Facebook as well as your rights and setting options for the protection of your privacy at http://www.facebook.com/policy.php.
Our website uses the so-called Facebook pixel created by the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are resident in the EU, by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). This tool serves to present users of our website with advertising (“Facebook ads”) that matches their interests during their visits to Facebook. In this way we ensure that our Facebook ads correspond with the interests of the respective users and are therefore not perceived as a nuisance. We also use the Facebook pixel to track how many users click on our Facebook ads. This enables us to assess the effectiveness of those ads, which is useful for statistical and market research purposes. The Facebook pixel is activated by Facebook as soon as you open our website. It can store so-called cookies on your computer. If you log into Facebook after visiting our website, or visit Facebook while still logged in, then Facebook will assign this information to your personal Facebook account. The data recorded about you in no way allows us to draw inferences regarding your identity as a user. The collection and processing of the data by Facebook complies with the provisions of the Facebook Data Policy. For more information in this respect, please go to: https://www.facebook.com/about/privacy. You can, at any time, object to the recording of data by the Facebook pixel and the use of your data to present Facebook ads. To do so, please visit the page specially set up by Facebook for this purpose (when there, see the settings for use-based advertising), while you are still logged in to Facebook: https://www.facebook.com/settings. The settings are platform-independent, meaning that they will be assumed for all devices, whether desktop computers or mobile devices.
Our website uses the ADITION service provided by ADITION technologies AG, Oststraße 55, 40211 Düsseldorf, Germany. ADITION sets cookies to control and optimise the ways in which advertising measures implemented by ADITION customers are displayed. It can, for example, maximise the display frequency of advertising for users. When setting cookies, ADITION does not store any personal data such as names, email addresses, or any other personal information. All information gathered is anonymised and comprises technical data such as, for example, the advertising frequency and advertising date of advertising measures, as well as the browsers used and operating systems installed. All data gathered is stored on servers located within the Republic of Germany. For information on ADITION’s Data Privacy Statement, please go to www.adition.com/en/privacy/. You can object to such data processing by using an opt-out cookie. For more information in this respect, please go tohttps://www.adition.com/datenschutz/?optout=trueAdTraxx.
Art. 6 (1) point f) GDPR applies where personal data is processed.
Our legitimate interests in processing your personal data via our website lie in our desire to optimise our internet offering and, as such, offer our customers best possible services and sustainably increase customer satisfaction.
Your data is only transmitted to third parties if this is necessary for performance of the contract, for example, in order to inform a local rental partner about your reservation or to process a credit card payment through your credit card company. In such cases, we transmit your data to IT service providers, call centres, collection companies, financial services providers, agency partners, franchise partners and other cooperation partners.
We moreover transmit data to Google, Inc and Facebook Ireland Ltd. in the aforementioned scope (see → Purposes of data processing).
As part of our measures to prevent fraud, we also transmit – in situations where third parties have been, or are at risk of being, defrauded – personal data to such third parties having suffered, or at risk of, fraud.
If business customers use our services to reserve vehicles that are to be rented in a third country, we transmit the personal data of the driver to our contractual and business partners in such third country. The transfer of your data to a third country is based on an adequacy decision by the European Commission. If no adequacy decision by the European Commission exists for the respective third country, then the transfer to that third country will take place subject to appropriate safeguards as per Art. 46 (2) GDPR. You can request copies of the aforementioned safeguards from SIXT by writing to the address specified above (see → Controller). Third countries are countries outside the European Economic Area. The European Economic Area comprises all countries of the European Union as well as the countries of the so-called European Free Trade Association, which are Norway, Iceland and Liechtenstein.
SIXT CRS stores your personal data until they are no longer necessary in relation to the purposes for which they were collected or otherwise processed (see → Purposes of data processing at SIXT CRS). Where SIXT CRS is under legal obligation to store personal data, it will store personal data for the preservation period stipulated by law. The preservation period for commercial documents, which include bookkeeping documents and accounting records (including invoices), is 10 years (Section 257 (4) of the German Commercial Code). During this period, your data may be subject to restricted use within day-to-day operations if its processing serves no further purposes.
You have the right to, at reasonable intervals, obtain information about your personal data under storage (Art. 15 GDPR). The information you are entitled to includes information about whether or not personal data concerning you are stored, about the categories of personal data concerned, and about the purposes of the processing. Upon request, SIXT CRS will provide you with a copy of the personal data that are processed.
You also have the right to obtain from SIXT CRS the rectification of inaccurate personal data concerning you (Art. 16 GDPR).
You furthermore have the right to obtain from SIXT CRS the erasure of personal data concerning you (Art. 17 GDPR). We are under obligation to erase personal data in certain circumstances, including if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, if you withdraw the consent on which the processing is based, and if the personal data have been unlawfully processed.
Should you opt to change to a competitor of SIXT CRS, you have the right either to receive, in a machine-readable format, the data that you provided to us based on your consent or on a contractual agreement with us, or to have us transmit, also in a machine-readable format, such data to a third party of your choice (Right to data portability, Art. 20 GDPR).
You are not contractually or legally obliged to provide us with your personal data. Please note, however, that you cannot enter into a vehicle rental contract with us or avail of other services provided by us if we are not permitted to collect and process the data as required for the purposes specified in the foregoing (see → The purposes of data processing at SIXT CRS).
If the processing of your data by SIXT is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Art. 6 (1) point e) GDPR) or if it is necessary in the legitimate interests of SIXT CRS, then you have the right to object at any time, on grounds relating to your particular situation, to the processing of your data. SIXT CRS will then end the processing, unless we can present compelling legitimate grounds for such processing that supersede the grounds for ending the processing.
If data processing at SIXT CRS is based on your consent, then you have the right to, at any time, withdraw the consent you granted. The withdrawal of consent shall not affect the lawfulness of processing between the time consent was granted and the time it was revoked.

References: Art. 6

Art. 6

Art. 6

Art. 9

Art. 6
 Art. 46
 Art. 49

Art. 6

Art. 6
 Art. 46
 Art. 49

Art. 6
 Art. 46
 Art. 20