PRIVACY POLICY

Table of contents

1. Who processes your Personal Data?

2. What Personal Data do we collect about you?

3. For what purposes do we process your Personal Data?

4. Who are the recipients of your Personal Data?

4.1 Categories of recipients
4.2 International transfers

5. How long do we keep your Personal Data?

6. What rights can you exercise regarding the processing of your Personal Data?

7. How do you exercise your rights?

8. How do we protect your Personal Data?

9. What rules apply to the processing of your Personal Data when you click on
links placed on our website, redirecting to our partners’ or other sites?

10. Changes to this Privacy Policy

Privacy Policy 717/6/09/23 1

 Thank you for renting with Europcar

1. Who processes your Personal Data?

- Payment data: account numbers, card numbers, etc;
Europcar Group UK Limited, whose registered office is 1 Great
Central Square, Leicester, LE1 4JS, United Kingdom (hereinafter
- Financial data: your invoices;
referred to as “we”, “us” or “our(s)”) is the “Data Controller” of
your Personal Data collected and processed via this website, our
- As the case may be, data relating to traffic ​violations
mobile applications, our rental stations or through any other
or other fines and penalties;
contact you may have with us in order to offer you mobility
solutions and services.
- Information about your flight in the event that the
pickup location of your vehicle is an airport;
The terms “Europcar”, “we”, “us” or “our” that we use in this
policy refer to Europcar Group UK Limited. In accordance with
- Information on your vehicle reservation, in particular
the applicable regulations on the protection of personal data,
for the management of any loyalty programs;
Europcar Group UK Limited is the “Data Controller”.
- Data relating to your navigation on our website or our
Europcar Group UK Limited is a member of the Europcar Mobility
mobile applications;
Group. The term “our Group” refers to Europcar Mobility Group.
- Data relating to your satisfaction surveys or from your
When you communicate Personal Data to us or when we collect
interactions on our dedicated social media pages;
Personal Data about you, we undertake to use it in accordance
with this Policy.
- Voice, audiovisual and electronic data: recordings of
your communications by email, chat or telephone with
our customer service department;
2. What Personal Data do we collect
about you? - Information collected through our Connected Vehicle
As a provider of mobility solutions, we collect and process various (if the vehicle that you rent is a Connected Vehicle):
categories of Personal Data in connection with this website and vehicle status, damage or accident information,
our mobile applications and in order to provide you with our vehicle performance data, operational and diagnostic
products and services. data, mileage information, acceleration and braking
speeds, fuel consumption and fuel levels, tyre
By Personal Data, we mean not only data that identifies you pressure, odometer readings, vehicle location and
directly, but also data that identifies you indirectly. other vehicle information. For any information
regarding the data processing of Europcar’s
The categories of Personal Data that we collect in the context of Connected Vehicles, please consult the dedicated
our services and the use of our website and our mobile Privacy Policy at:
applications include the following:
https://www.europcar.com/files/live/sites/erc/files/connecte
- Your identification data: surname, first name,email d-cars/privacy-policy.pdf; and
address, telephone number, postal address, date of
birth, account identifier; - Data related to cookies and other similar
technologies. For information on the use of cookies,
- If applicable, identification data of additional driver(s): please consult our policy.
surname, first name, email address, telephone number,
postal address; We collect most of your Personal Data directly from you but we
may receive Personal Data from third parties, including the
- Your driver’s licence and that of any additional driver(s); competent authorities in charge of managing fines for traffic
violations.

Privacy Policy 717/6/09/23 2

3. For what purposes do we process your Personal Data?
We collect and process your Personal Data for various purposes and on the following legal basis:

Purposes of the processing Legal basis of the processing

The creation and management of your customer account This processing activity is based on the acceptance of the terms
and conditions of use of our website or our mobile applications.

The management of your reservation and rental contract, in

particular for:
- confirming, modifying or cancelling your reservation;
- to communicate with you regarding your reservation and
rental (for example, to provide you with information about your These processing activities are necessary for the execution of the
reservation and rental, to send you reminder notifications rental services contract that you enter into with us.
before you return your vehicle, to answer your questions or You can choose to register your credit card for your future
suggestions); bookings.
- manage your rental;
- manage your payment and invoices;
- manage the collection of amounts due, including costs such
as fines for traffic violations; damage to the vehicle or
compensation for damage to the vehicle);
- managing any claims;
- purchase and manage insurance for your vehicle.

Fight against credit card fraud This processing is based on our legitimate interest in protecting
ourselves against credit card fraud.

Fight against fraud and other criminal activity.

We may obtain information about you from credit reference

agencies, insurance data sources (including the Claims This processing is based on our legitimate interest in protecting
Underwriting Exchange and MIB) and fraud prevention ourselves against fraud and other criminal activity relating to the
agencies to assess creditworthiness and prevent fraud and rental and use of our vehicles.
other criminal activity. This information may include a search
that will appear on your credit report and be visible to other
credit providers. Please see section 4 for further details of the
agencies and databases we access or contribute to and how
this information may be used. Further information is available
on request

Conducting satisfaction surveys to improve your experience This processing is based on our legitimate interest to improve our
with our products / services knowledge of our customers’ needs and to improve our services
and customer service.

Chatting in real time on our website. This processing is based on our legitimate interest in answering
website users’ questions about our products and services.

Conducting business development and marketing activities, Our commercial and marketing activities, i.e. the sending of
including : commercial messages to promote our products and services (i to
- sending emails and SMS notifications about special offers iv) are subject to your consent.
and promotions; In the event that you are already our customer, you may receive
- recording your rental history to suggest our products and commercial messages for products and services similar to those
services to you when you search for new bookings or to send we have already provided to you.
you special offers and benefits; The sending of these messages will be based on our legitimate
- managing your loyalty program and membership card; interest in communicating about our products and services.
- organising contests and prize draws; Processing activities included in category (v) are based on our
- sending emails about a booking we have not completed or legitimate interest to simplify and speed up the reservation
about the status of your booking requests; process for our customers.
- the management and updating of the prospect database Processing activities included in category (vi) are based on our
legitimate interest to manage our prospect database.

The management of fines and penalties, in particular for:

- the transfer of information to the police or other enforcement This processing activity is based on our legal obligations, in
agencies or issuing authorities to enable them to identify the particular our obligation under legislation such as the Road Traffic
driver (or potential driver) of our vehicle in the event of a driving Act 1988 and/or other similar legislation.
offence or suspected driving offence;

Privacy Policy 717/6/09/23 3

 The management and maintenance of a list of customers This processing activity is based on our legitimate interest, in
presenting certain risks to our business and/or staff, with particular our interest in asserting our rights, to prevent risks and
regard to : fraud related to the execution of your contract and to prevent and
- payment incidents resulting in legal proceedings; manage abusive behaviour towards our employees.
- traffic accidents or repeated damage; In this respect, we seek to maintain a fair balance between the
- inappropriate or abusive conduct towards our employees or need to process your Personal Data and respect for your rights
our customers; and freedoms, in particular the protection of privacy. If you appear
- the use of our vehicles in violation of the general rental on this list of at risk customers, your reservation request will be
conditions including the use of our vehicles for criminal or rejected. You may challenge this decision by sending an email to
alleged criminal activity. the following address: uk.security@europcar.com

This processing activity is based on our legitimate interest in

Video surveillance on our premises ensuring the safety of property and persons in our Branches, by a
deterrent effect or in such a way as to be able to identify the
perpetrators of damage, theft or aggression.

Analysis of navigation data on our website and mobile This processing is based on our legitimate interest in improving
applications our products and services.

Assess eligibility; prevent bad debts and fraud We will carry out a soft credit check with the credit reference
agency Experian to (i) verify your identity; (ii) help us ensure that
you meet our eligibility criteria by having the capacity to pay in full
the fees under the vehicle rental contract (and any associated
charges); and (iii) prevent fraud and other criminal activity.

We will use credit scoring and an automated decision-making

process to make this eligibility assessment. This soft credit check
does not affect your credit score and it will not appear as a visible
search on your credit report.
The underlying information about your credit history is held by
Experian. See
https://www.experian.com/blogs/ask-experian/what-is-a-soft-inqui
ry/ for more information about soft credit checks. You can access
your credit file by contacting Experian on 0800 013 8888.
Experian’s Privacy Policy can be found
at:https://www.experian.co.uk/consumer/privacy.html and you can
contact their Data Protection Officer at uk.dpo@experian.com.

If we decline your application to rent a vehicle on the basis of the

eligibility check you will be notified of this and of your entitlement
to make representations to Europcar and how to contest the
decision. You have a number of privacy rights (as set out in
section 6) including the right to object to the use of your data
when it is processed on the basis of legitimate interests. See
section 7 for details of how to contact Europcar to exercise your
privacy rights.
If you have questions about the soft credit check process
including our affordability criteria which are used to make
eligibility decisions, please contact our Customer Qualification
Team at uk.qualification@europcar.com.
A Decline decision does not affect your ability to rent a car with
another rental company or your ability to rent a car with Europcar
at a future date.

Legal basis of the processing: This processing is based on: (a)

our legitimate interests in (i) protecting ourselves against bad
debtors and fraud relating to the rental and use of our vehicles;
and (ii) to protect consumers by preventing over-indebtedness;
and (b)
contractual necessity, in order to deliver the contractual services.

4. Who are the recipients of your personal data?

4.1 Categories of recipients

a. to our employees, our authorised representatives,
If necessary, your Personal Data may be communicated: other companies within our Group and our franchise
Privacy Policy 717/6/09/23 4
 network, our agents and intermediaries mandated to - Nectar 360 Limited
provide you with our products and services;
b. to our subcontractors, in particular our IT service We may also disclose your Personal Data in accordance with
providers for hosting, maintenance or development applicable laws and regulations to the relevant authorities.
purposes, who assist us in providing you with our
products and services or collection agencies which Use of Facebook
help us recover unpaid sums. These may be entities
that are members of our Group or external service All Facebook features and services available on our website or
providers; applications are governed by the Facebook Privacy Policy,
c. to our insurance services companies to purchase and which you can read for more information about your rights and
manage insurance for your vehicle; settings options.
d. advertising agencies, marketing agencies, social
networking and digital agencies to help us carry out By using one of our website/applications, you can:
advertising, marketing and sales campaigns and to - Use Facebook social plug-ins, such as “like” or
analyse the effectiveness of these campaigns; “share” our content on the Facebook Platform;
e. to law enforcement bodies (and their foreign - Accept cookies from our website or applications
counterparts in the case of offences committed (also known as “Facebook Pixel”), which will help us
abroad) and other public and private sector bodies understand your activities, including information
for the purposes of dealing with alleged or actual about your device, how you use our services, the
road traffic or driving offences and/or associated purchases you make, and the ads you view, whether
fines; and private parking companies dealing with or not you have a Facebook account or are logged in
alleged or actual breaches of contract; to Facebook.
f. for the management and updating of the list of
persons presenting certain contractual risks, to the When you use these Facebook features we collect data
vehicle rental industry generally and its staff. The that help us to:
register is managed by our trade association the
British Vehicle Rental and Leasing Association - Display ads that may be of interest to you on
(BVRLA). For more details visit www.bvrla.co.uk. Facebook (or Instagram, Messenger or any other
g. to companies providing operational support to our Facebook service);
business including authentication of you, your driving - Measure and analyze the effectiveness of our
licence and driving history (including, but not limited website, applications and advertisements.
to, the DVLA and Synectics Solutions Limited);
h. to our partners or those of our Group that enable you Full Credit Check
to collect loyalty points when you are a member of
their program: If you fail to pay the rental charges to Europcar (or any
applicable additional charges such as for vehicle damage)
List of Europcar Mobility Group’s partners: within 28 days of the debt becoming due or you do not agree to
the terms of a payment plan with Europcar, your payment
- AAdvantage performance data relating to the outstanding debt will be shared
- Accor Hotel with Experian in accordance with standard industry practices. A
- Aeroflot full credit check will be carried out in such circumstances with
- Air Europa credit reference agencies, see section 2.2.3.2 of the terms and
- American Express Rewards conditions of hire for more information.
- Asia Miles
- Biglife SDN BHD (Air Asia) 4.2 International transfers
- Delta Airlines
- Ecos Mobility & Hospitality Private Limited In order to provide you with our products and services we
- Emirates SkyWard may use service providers located outside the European
- Finnair Plus Union (in particular in the United States, Morocco and
- Fly SAS Israel). In the event that the vehicle is booked abroad,
- Flying Blue data transfers will be carried out in the country in question
- Gulf Air Falcon Flyer in order to provide you with our mobility solutions.
- Lufthansa
- Melia Rewards Depending on the assumptions, some recipients may be
- Miles & More located in countries recognized by the European
- Oman Air Sindbad Commission as providing an adequate level of protection
- Qatar Privilege Club of Personal Data or in countries that have not been
- Radisson Rewards recognized by the European Commission as providing
- Routes Car Rental such a level of protection. In any case, we have
- Royal Air Maroc implemented appropriate protection measures to protect
- Shouqi Car Rental & Leasing Limited Liability Company your Personal Data in accordance with data protection
- Silvercar regulations.
- Singapore Krisflyer
- TAP Miles & Go For more information about the countries to which your
- Times Mobility Co LTD Personal Data may be transferred, their level of data
- Turkish Airlines protection and the potential protective measures
- Ubeeqo implemented by EC, click here:
- UIA Panorama Club https://www.europcar.com/files/live/sites/Europcar/files/Pri
vacy%20Policy/List%20of%20intra-group%20recipients%20
List of Europcar Group UK partners: of%20personal%20data%20for%20Europcar%20entities.pdf
Privacy Policy 717/6/09/23 5
5. How long do we keep your Personal Data?
Your Personal Data are kept for different periods of time, depending on the purposes of the processing concerned:

Purposes of the processing Data retention periods

The creation and management of your customer account For the duration of the business relationship and 5 years after the
end of the business relationship.

The processing of your reservation and rental contract, in

particular for:
- Confirming, modifying or cancelling your reservation;
- Communicating with you regarding your reservation and rental
(for example, to provide you with information about your
reservation and during your rental, to send you reminder
notifications before you return your vehicle, to answer your For 5 years after the end of the reservation.
questions or suggestions);
- manage your rental;
- manage your payment and invoices;
- manage the collection of sums due (including subsequent costs
such as fines for traffic violations, or compensation for damage to
the vehicle);
- managing claims;
- taking out and managing your vehicle insurance

The data are kept for a period of 12 months. In the event of

damage or offences against property, investigation of damage
Monitoring of Connected Vehicles and accidents caused to the vehicle, Personal Data may be
retained until the cases are resolved (including until the closure of
any legal or judicial proceedings).

Verifying your identity and to carry out credit and fraud 13 months from the effective payment
prevention checks prior to releasing a vehicle to you at the start
of the rental and where subsequently required

Fight against fraud and other criminal activity For the duration for which the risk exists which may in some
cases be indefinitely where fraud or criminal activity has been
identified.
Where no fraud or criminal activity is identified the data is subject
to the retention periods as set out in this section 5.

The improvement of our products and services according to 3 years from our last contact
your preferences by carrying out satisfaction surveys.

Chatting in real time on our website. 3 years from our last commercial contact

Conducting business development and marketing activities,

including:

- Sending emails and SMS notifications about special offers

and promotions; - if you are a Europcar customer, 3 years from the end of the
- Recording your rental history to suggest products/services to business relationship with EC.
you when searching for new bookings or to send you special - If you are not a Europcar customer, 3 years from the collection
offers and benefits; of your Personal Data OR from the last time you requested
- sending emails relating to a booking that we have not information from us.
completed or reporting the status of your booking requests;
- managing your loyalty program and membership card;
- organising contests and prize draws;
- the management and updating of the prospect database.

The management of fines, in particular for: For the time necessary to identify the driver responsible for
-the transfer of information to the police or other enforcement committing the offence giving rise to the contravention, which
agencies or issuing authorities to enable them to identify the should not exceed 45 days from receipt of the contravention.
driver (or potential driver) of our vehicle in the event of a driving However, relevant information may be retained for a longer period
offence or suspected driving offence; of time from the receipt of the request, for reasons of archiving.

Privacy Policy 717/6/09/23 6

 The management and maintenance of a list of customers
presenting certain risks to our business and/or staff, with regard
to:

- payment incidents resulting in legal proceedings;

- traffic accidents or repeated damage 3 or 5 years from the date of creation or modification of the last
- inappropriate or abusive conduct towards our employees or our rental and depending on the nature of the event
customers;
- the use of our vehicles in violation of the general rental
conditions including the use of our vehicles for criminal or alleged
criminal activity.

Video surveillance on our premises No more than a month.

Analysis of navigation data on our website and mobile Please, refer to our Cookie Policy which can be found at
applications https://www.europcar.co.uk/cookie-policy

6. What rights can you exercise regarding the (ii) is based on your consent or on the execution of
a contract binding us
processing of your personal data?
- request the limitation of the processing of your
Within the limits and conditions allowed by the regulations
Personal Data, which means that we will not be able
in force, you can:
to use your Personal Data for a defined period of
time. You can exercise this right when:
- access your Personal Data and obtain further
information as to the characteristics of the processing
(a) you dispute the accuracy of your Personal Data
we carry out;
for a period of time that allows us to verify the
accuracy of your Personal Data;
- have your Personal Data corrected, updated and
deleted, it being specified that deletion can only be
(b) the processing of Personal Data is unlawful and
carried out when
you object to the deletion of your Personal Data
and instead demand that its use be restricted;
(i) the data is no longer necessary in relation to the
purposes for which it was processed,
(c) we no longer need your Personal Data but they
are still required for the establishment, exercise
(ii) you withdraw your consent and there is no other
or defence of legal claims;
legal basis for the processing,
(d) you object to the processing for reasons relating
(iii) you object to the processing of your Personal
to your particular situation, while we are
Data and there is no compelling legitimate
checking whether the legitimate reasons we
reason for the processing
pursued by Europcar Group UK Limited take
precedence over your own.
(iv) it has been established that your Personal Data
has been processed unlawfully,
​- withdrawing your consent to treatment based on
your consent
(v) the Personal Data must be deleted in order to
comply with one of our legal obligations
- submit a complaint to a Supervisory Authority. In
England, the Supervisory Authority is the Information
- you object to the processing of your Personal Data
Commissioner’s office at https//: ico.org.uk/.
based on legitimate interest, which you can check by
taking a look at the table shown in part 3 of this
Privacy Policy (“For what purpose do we process 7. How do you exercise your rights?
your Personal Data”) and in particular the column
entitled “Legal basis of the processing” If you would like to know more about the provisions of this
Privacy Policy or to contact our Data Protection Officer,
- you object to the processing of your Personal Data you can also write to us at the following address:
for commercial prospecting purposes
Director of Legal Services, Europcar Group UK Limited,
- receive the Personal Data you have provided us with 1 Great Central Square, Leicester LE1 4JS
or request us to pass them on to a third party when
the processing of your Personal Data or by e-mail to: dpo@europcar.com

(i) has been carried out by automated means; and To exercise your rights, you must prove your identity by
clearly indicating your surname, first names, driver ID and
any useful information enabling us to identify you (such as

Privacy Policy 717/6/09/23 7

 the place and date of your last vehicle rental). You must
also give us the e-mail address or the physical address to b) encodes the data, so that it cannot be read by
which you would like the reply to be sent to you. anyone other than the secure server;

8. How do you exercise your rights? c) checks the data being transferred to ensure it has not
been altered.
Europcar Group UK Limited is committed to protecting the
information it collects through this website. 9. What rules apply to the processing of your
Personal Data when you click on links
In particular, ECI uses appropriate physical, technical and
placed on our website, redirecting to our
organisational security measures to prevent unauthorised
or unlawful processing, accidental loss of or destruction of partners’ or other sites?
or damage to your personal data.
On this site you will find various links to the websites of
Europcar Group UK Limited’s systems are configured with our partners (e.g. for travel services). We would like to
data encryption, or scrambling technologies,and draw your attention to the fact that this Privacy Policy does
industry-standard firewalls. When you send personal not apply to the processing of your Personal Data by our
information to a Europcar Group UK Limited website over partners or other third parties, which may occur when you
the Internet, your data is protected by “Transport Layer visit their websites, and that we are not responsible for
Security” (TLS) technology to ensure safe transmission. such data processing. If you would like information on how
these partners and third parties process your Personal
Any credit card transaction you make through Europcar Data, we invite you to consult their Privacy Policies.
Group UK Limited websites is done through our secure
server technology. This technology notably: 10. Changes to this Privacy Policy

a) assures your browser that your data is being sent to This Privacy Policy was last updated on 1 September
the correct computer server, and that the server is 2023.
secure;

Privacy Policy 717/6/09/23 8