Read our updated Privacy Policy

Download a PDF of the policy.

Return to top

Privacy Notice

Most recent update: January 2019

This data privacy policy is to inform you, as required by articles 13 and 14 of the GDPR, about the extent and purpose for which we, Avis Autovermietung GmbH (hereinafter "we"), process your personal data when you make use of our services or even when you only visit our website or our rental location, and what rights you have as the data subject, that is, the person affected by the data processing.

The protection of your data is of great importance to us, which is why we process them in strict accordance with the applicable laws.

As you can only exercise your data protection rights if you are given transparent information about the processing of your data, we have tried to formulate this data privacy policy as transparently as possible.

For that reason we start, in Chapter I of this Data Privacy Policy ("General information"), by giving you some basic information on the processing by us of your personal data.

In the various other chapters of this data privacy policy you will find information on how we process your personal data if and when you …

Chapter II…visit our website

Chapter III…rent a vehicle from us or are the additional driver of a rented vehicle

Chapter IV…take out additional insurance

Chapter V…use one of our "connected cars"

Chapter VI…use one of our mobile WiFi devices

Chapter VII…visit our rental locations which have a CCTV system

Chapter VIII…receive our newsletter or other promotional material

Chapter IX…call our service hotline

If you are only affected by one or some of these cases, please scroll or page down to the chapter(s) concerned.

 

Chapter I    General information

In this chapter you will find some of the general information which is relevant to our processing your personal data and which applies to all the chapters below. Please therefore read this information first.

1.    Entity responsible for the data processing

The entity responsible under data protection law for the data processing described in this data privacy policy (the data controller) is

Avis Autovermietung GmbH

Laaer Berg Strasse 43

A-1100 Vienna

Email: customer.service@budget.at

Tel.: +43 (0) 1 60187

 

2.    Our Data Privacy Officer

Avis Autovermietung GmbH is part of the Avis Budget Group. The Avis Budget Group has appointed a data privacy officer whom you can contact in connection with the data processing done by Avis Autovermietung GmbH.

You can use the following contact data for the Data Privacy Officer:

Data Privacy Officer

Avis Budget House, Park Road, Bracknell, Berkshire,

RG12 2EW,

United Kingdom

Email: dpo@abg.com

Tel.: +44 (0) 1344 426644

 

3.    Your data protection rights

(i)       You have the right to obtain confirmation from us as to whether or not we process personal data concerning you, which data these are and what the circumstances of this processing are. Furthermore, you have the right to request a copy of your personal data processed by us (right to access, article 15 GDPR).

(ii)      Where the personal data which we process are incorrect or incomplete you have the right to require us to correct them (right to rectification, article 16 GDPR).

(iii)    Where the processing of your data does not have, or no longer has, a basis in law, or an existing legal basis has lapsed due to your withdrawal of consent or your objection, or the processing is unlawful, you have the right, under specified circumstances, to require us to erase your personal data (right to erasure, right to be forgotten, article 17 GDPR).

(iv)    In certain cases where the processing of your data by us is unlawful or of questionable legality, you may require us to restrict the processing of your personal data to the processing purposes specified in article 18 (2) GDPR (right to restriction of processing, article 18 (2) GDPR).

(v)     Where the processing of your data is based on a legitimate interest of ours (article 6 (1) f) GDPR), you may under specified circumstances object to that processing on grounds relating to your particular situation. You may at any time object to processing for direct marketing purposes (right to object, article 21 GDPR).

(vi)    Where the processing of your data is based on your consent (article 6 (1) a) GDPR) or based on its being necessary for the performance of a contract (article 6 (1) b) GDPR), you may require us to let you have the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit these data to another data controller or have them transmitted by us to another controller (right to data portability, article 20 GDPR).

(vii)   Where the processing of your data is based on your consent (article 6 (1) a) GDPR), you may withdraw such consent at any time. Except where the present provisions stipulate a specific modality for the withdrawal of your consent, you may effect such withdrawal by email or by letter to the (email) address stated above. If and when you withdraw your consent, we will cease to process your personal data on the basis of consent (right to withdraw consent).

(viii)  If you consider that our processing of your data, or reply to your enquiry, infringes your data privacy rights, you may lodge a complaint with the data protection authority. The contact data for the Austrian supervisory authority can be found at www.dsb.gv.at.

 

 

 

Chapter II – Use of our website and our smartphone app

This chapter gives you information on how we process your personal data when you visit and use our website and when you use our smartphone app.

If you use our website or the app to make a reservation, please also refer to chapter III in addition to this chapter II.

If you use our website or the app to register for our newsletter, please also refer to chapter VIII in addition to this chapter II.

 

1.    Purposes of processing

We process your personal data in connection with your use of our website for the following purposes only:

a)    Carrying out reservations and voucher purchases via our website or our smartphone app

b)    Analysing the use of our website; improving and safeguarding its performance

c)    Classifying messages sent via the website contact form and your customer account or via our app and replying to such messages

d)    Providing a log-in environment; you might be able to log into your user account on our website

e)    Display of invoice copies; when you have rented a car from us, you can use our website to retrieve you invoice(s). To be able to display your invoices, we process personal data of yours that is necessary for this purpose.

f)     Collection of location data via the smartphone app – subject to your consent – in order to make available to you certain functions of the app (such as speedy renting and prompt collection at the rental location where you happen to be, or display of the nearest rental location)

g)    Enforcement of or defence against legal claims; for this purpose certain activities which you perform on our website are recorded in log files, for example the fact that in the course of a reservation you click on a check box to accept our Terms and Conditions. We can thus later prove that you accepted our Terms and Conditions

h)    Compliance with recording, information and reporting obligations where legally necessary; this includes in particular the data retention obligation for contact enquiries and reservation data as required by section 212 UGB (Austrian commercial code); it also includes the data processing we do when we reply to a request made by you for information under data protection law (article 15 GDPR).

 

2.    Source of the personal data

We collect these data exclusively from you yourself when you provide them by completing our contact form in the course of a reservation or a registration, or we collect them via your use of our website or our app.

 

3.    Legal basis for the processing of your personal data

·Data processing for purpose 1a):

The legal basis for our data processing of your personal data for this purpose is that the processing is necessary in order to perform the reservation contract or the voucher purchase contract with you (article 6 (1) b) GDPR).

·Data processing for purposes 1b) and 1g):

The legal basis for the data processing for this purpose is that processing is necessary in order to pursue our legitimate interest in improving and safeguarding the performance of our website and in making our website as attractive as possible for you. It is also necessary in order to pursue our legitimate interest in enforcing any legal claims which could arise in connection with our website and in defending against such claims (article 6 (1) f) GDPR).

·Data processing for purpose 1c):

The legal basis for the processing of the data which you enter in our website contact form for this purpose is that such processing is necessary for us to be able to receive, process and reply to your contact enquiry (article 6 (1) b) GDPR).

·Data processing for purposes 1d) and 1e):

The legal basis for the processing of data for these purposes is that such processing is necessary for us to be able to perform our contract with you (article 6 (1) b) GDPR).

·Data processing for purpose 1f):

The legal basis for the processing of data for this purpose is that you have expressly consented to the processing via a particular pop-up in the app (article 6 (1) a) GDPR). You can withdraw this consent at any time by setting the smartphone app not to use your vehicle location data.

·Data processing for purpose 1h):

The legal basis for the processing of data for this purpose is that the processing of these data is necessary in order to enable us to fulfil our legal obligations, namely the statutory recording, information and reporting requirements (article 6 (1) c) GDPR). This applies in particular to the data retention obligation for contact enquiries and reservation data as required by section 212 UGB; it also includes the data processing we do when we reply to a request made by you for information under data protection law (article 15 GDPR).

 

4.    Transfer of your personal data

·Group companies:

We are part of Avis Budget Group and we try to use synergies within our group in order to provide you with a service as attractive as possible. For this reason, some of the processing described above under Section 1. is conducted by our group companies as processors. For this reason, your personal data may be transferred to these group companies for the purposes listed above (1a to 1h).

Some of the group companies are based outside the EEA. In cases where the European Commission has not decided that the country in question ensures an adequate level of data protection, the transfer of data is based on standard contractual clauses as provided for in article 46 (2) c) GDPR. A copy of the standard contract clauses can be requested at dpo@abg.com.

·IT service providers:

To ensure the safety, availability and efficiency of our website and our work environment we make use of IT service providers as processors. They too will possibly be given access to your personal data for the purposes specified above (1a to 1h).

·Legal disputes, information and reporting requirements:

Where necessary for the above stated purpose 1g), we are allowed to pass on your personal data to our lawyers and to courts of law. Where necessary for the fulfilment of the above stated purpose 1h) and mandatory in law, we will pass on your personal data to empowered authorities or authorised third parties.

 

 

 

5.    Retention of your personal data

Your personal data are retained by us only for as long as we reasonably regard this retention to be necessary for the achievement of the purposes referred to above and for as long as is permissible under the applicable laws. We store your personal data in any case for the period of data retention prescribed in law (in particular the seven-year data retention period laid down in section 212 UGB) or until the statutory limitation period for potential legal claims has expired. We will retain your data for a longer period where and for as long as we need them for the enforcement of or defence against legal claims.

In concrete terms this means, in particular:

-          General reservation data and the relevant contact enquiries are retained for seven years after the end of the rental (section 212 UGB, section 132 BAO (Austrian federal fiscal code));

-          if you are a member of a loyalty scheme, we retain data relating to such membership for the duration of your membership of the scheme, so that we can ensure you enjoy any benefits it may deliver;

-          where individual data are relevant in specific proceedings for the enforcement of or defence against legal claims, we retain such data until the end of the proceedings.

6.    Voluntary provision of personal data

The provision of your personal data is in principle voluntary. If you do not provide the data, however, you will possibly not be able to use all the functions of our website, or you will perhaps not be able to book a vehicle via our website, or we will not be able to process the bookings and possibly not be able to process your contact enquiry.

In the case of online booking, in the contact form, in the invoice display and for registration, the data which you are obliged to state are marked as such. The provision of all other data is voluntary and is not needed to enable you to use the particular function.

7.    Cookies

We use cookies on our website for the purposes specified above in section 1b). Further information on this can be found at https://www.budget.at/cookie-richtlinie.

8.    Google Analytics

This website uses Google Analytics, a web analysis service provided by Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics utilises so-called "cookies", text files which are stored on your computer and make it possible for your use of the website to be analysed. The data processing using the Google Analytics service is carried out for the purpose listed as 1b).

The information generated by the cookie on your use of this website (including your IP address and the URLs of the accessed websites) is transmitted to a Google server in the USA and stored there. Google is certified under the US-EU Privacy Shield and thus ensures, under article 45 GDPR, an adequate level of data protection in the US as well. We do not store any of your data that are collected in connection with Google Analytics.

This website uses the IP anonymisation facility offered by Google Analytics. Your IP address is therefore abbreviated/anonymised by Google as soon as it receives such address. On our behalf Google will use this information in order to analyse your use of the website, to compile reports on the website activities and perform for us other services related to the use of the website and the use of the internet. The IP address transmitted by your browser in connection with the Google Analytics service is not combined with other Google data. The analysis is therefore based only on anonymised data.

You can prevent the storage of the cookies by means of the relevant setting on your browser software. We must however inform you that in this case you will possibly not be able to make full use of all the functions of the website. You can moreover prevent Google from collecting your data in connection with Google Analytics by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

 

 

More detailed information on Google's terms of use and Google's privacy policy can be found, respectively, at https://www.google.com/analytics/terms/us.html and https://policies.google.com/?hl=en.

 

Chapter III – Rental and use of a vehicle

In this chapter you will find information on how we process your personal data in connection with the rental and use of one of our rental vehicles. The data processing described here also applies to the data of authorised additional drivers.

If you use our website or smartphone app to book your vehicle, please take note of chapter II in addition to this chapter.

If you booked additional insurance when renting a vehicle, please take note of chapter IV in addition to this chapter.

If you have booked a "Connected Car", please take note of chapter V in addition to this chapter.

If, when renting a vehicle, you additionally booked a mobile WiFi device, please take note of chapter VI in addition to this chapter.

Please also take note of Chapter VII and Chapter VIII.

If you call our service hotline in connection with your booking or rental of a vehicle, please also take note of Chapter IX.

1.    Purposes of processing

We process your personal data for the following purposes in connection with the rental of a vehicle:

a.    Performance of the rental agreement and rendering of the services due under contract:This involves in particular the provision of the booked vehicle and the booked extras.

b.    Transaction of the payments due from you in connection with the rental of the vehicle: This involves in particular the processing of your payment data in order to carry out an advance authorisation or debit a deposit and to debit the rental amount owed.

c.     Conducting security checks before handing over the vehicle: Before we hand over a vehicle we conduct a check on your identity and your credit status in order to ensure that you are eligible for the rental of a vehicle and that you are in a position to pay us the fee owed under the rental agreement. We also check whether a company in the Avis Budget Group has a claim on you for amounts which you have not paid. You will however definitely not be subjected to an automated decision procedure; the final decision that you have not passed a security check is in every instance taken by one of our staff.

d.    Processing of (presumed) accidents, damage events or vehicle losses in which you were involved: This concerns in particular checking on the question of culpability and obtaining police reports and statements by witnesses.

e.    Combating and preventing fraud: This involves in particular the analysis of your booking record for irregularities which signal an intention to defraud (e.g. renting a large number of vehicles at the same time, frequent damage events related to vehicles rented by you, etc.). You will however definitely not be subjected to an automated decision procedure; the final decision as to whether your record of booking and use must be classified as fraudulent is in every instance taken by one of our staff.

f.     Customer service and making contact: This involves in particular making contact with you, for example when we find that objects have been left behind in the vehicle at the end of the rental, but also when we have to contact you in connection with your booking (e.g. because a booked vehicle has unexpectedly become unavailable).

g.    Check on your driving licence.

h.    Statistical recording of your rental, so as to make our services and products as attractive as possible.

i.      Compliance with recording, information and reporting requirements where legal obligations make this necessary. This refers in particular to statutory data retention obligations (section 212 UGB, section 132 BAO). It also refers in particular to statutory information and reporting requirements (driver identification, section 103 (2) KFG (Austrian motor vehicle act); requests for information by law enforcement authorities).

j.     Enforcement of or defence against legal claims. This involves in particular the enforcement of legal claims against you for non-payment or short payment of rental fees, unpaid fuel charges or administrative fees; and of legal claims for damages following damage to or loss of a vehicle or its accessories against you or against third parties (insurers, other drivers). It also involves in particular defence against legal claims on grounds of poor performance, on grounds of purportedly excessive rental fees or on grounds of wrongfully charged fees.

 

2.    Source of personal data

The data which we process for the purposes specified in section 1, above, are as a basic rule, received from you and you alone. These are data which you provide to us in the course of booking. when you take over the vehicle, when you report damage or submit an accident report or in some other manner.

In the cases below we receive the following personal data concerning you from third parties as well:

·Accident, damage or loss related to the rented vehicle:

If you were involved in an accident we can in certain cases obtain information on how the accident happened, the damage caused and the question of fault from the opposing accident party, witnesses, the police, law enforcement authorities or insurers and process such data for the purposes specified in section 1, above (in particular purposes 1d and 1j).

·Fines:

If a fine is imposed on you for speeding, incorrect parking, toll evasion or other administrative offences, information on such violation will possibly be transmitted to us by the police or other administrative and law enforcement authorities.

·Bookings via third-party providers:

If you rent the vehicle from a third-party provider (e.g. travel agency, reservation services, hotels, event agencies etc.), the data you have given the third-party provider for the purposes of the booking will be transmitted to us by that provider.

·Booking via a company account or the account of an organisation:

If the vehicle is rented for you via a company account or the account of an organisation, the data which we need for the booking (contact data, data on permission to drive, date of birth, data on special requests, where applicable payment data) will possibly be transmitted to us by the company or organisation that carries out the booking.

·Cross-border rental:

If you rent a vehicle outside Austria but return it inside Austria, information on your rental will be transmitted to us by the Avis Budget Group company from which you rented the vehicle, in order to enable us to take delivery of the vehicle.

·Security checks:

If we conduct a security check on you, we will possibly seek and obtain data on your identity, your driving licence, previous violations of traffic laws and your credit status from public authorities (e.g. licensing authorities), verification service providers or credit protection associations.

 

3.    Legal basis of processing of your personal data

·Data processing for purpose 1a):

The legal basis for the processing of your personal data for this purpose is that this data processing is necessary for the performance of your rental contract with us (article 6 (1) b) GDPR).

If you have asked us about a vehicle for disabled persons, we process any information provided about the disability only to the extent necessary for the provision of a suitable vehicle. This data processing is based on your consent to our processing the information for this purpose (article 6 (1) a), article 9 (2) a) GDPR). You can withdraw this consent at any time. To do so, please contact a rental location employee, our customer service or our data privacy officer (dpa@abg.com).

·Data processing for purpose 1b):

The legal basis for the processing of your personal data for this purpose is our legitimate interest in charging payments which you owe us under the rental agreement in the contractually agreed amount direct to your payment card and our legitimate interest in reserving an appropriate advance authorisation on your payment card or alternatively debiting an appropriate deposit from your payment card as security for our claims to the fee which you owe us under the rental agreement (article 6 (1) f) GDPR).

·Data processing for purpose 1c):

The legal basis for the processing of your personal data for this purpose is our legitimate interest in conducting a security check before we hand over the vehicle to you, in order to ensure that you are entitled to drive the vehicle and that you are in a position to pay the agreed rental fee (article 6 (1) f) GDPR).

·Data processing for purpose 1d):

The legal basis for the processing of your personal data for this purpose is our legitimate interest in dealing with accidents, damage claims and cases of loss of vehicle, determining the damage amount, processing any possible insurance claims and settling the question of culpability, in order to assert any claims to which we may be entitled against you or third parties (article 6 (1) f) GDPR).

·Data processing for purpose 1e):

The legal basis for the processing of your personal data for this purpose is our legitimate interest in combating fraud and taking preventive action against cases of fraud (article 6 (1) f) GDPR).

·Data processing for purpose 1f):

The legal basis for the processing of your personal data for this purpose is our legitimate interest in offering you good customer service and ensuring that you have a satisfactory experience as a customer (article 6 (1) f) GDPR).

Where we are contractually obliged to make contact with you (for example because we unexpectedly find we cannot provide the vehicle that was booked), the legal basis is that this data processing is necessary in order to perform the contract with you (article 6 (1) b) GDPR).

·Data processing for purpose 1g):

The legal basis for the processing of your personal data for this purpose is that it is necessary to fulfil our legal obligation to check on your entitlement to drive before we hand over the vehicle to you (section 103 (1) Z 3 KFG; article 6 (1) c) GDPR).

·Data processing for purpose 1h):

The legal basis for the processing of your personal data for this purpose is our legitimate interest in using statistical analysis to make our services and products as attractive as possible (article 6 (1) f) GDPR).

·Data processing for purpose 1i):

The legal basis for the data processing for this purpose is that the processing of these data is necessary to enable us to fulfil our legal obligations, namely the statutory retention requirements (in particular under section 212 UGB and section 132 BAO), information requirements (in particular checks on who was driving the vehicle under section 103 (3) KFG and requests for information from law enforcement authorities) and reporting requirements (article 6 (1) c) GDPR).

·Data processing for purpose 1j):

The legal basis for the data processing for this purpose is that we have a legitimate interest in enforcing any possible legal claims which exist or could arise against you in connection with the renting of our vehicles and in defending ourselves against any such claims (article 6 (1) f) GDPR).

 

4.    Transfer of your personal data

If and when you rent a vehicle from us, we will possibly transfer your personal data to third parties for the purposes stated above (1a – 1j). This section defines the third parties in question.

·Data transfer in case of cross-border rental:

If you rent a vehicle in Austria but return it to a rental location in another country (one-way rental), we will transmit your data to the Avis-Budget company concerned, which operates the rental location where you return the vehicle, for the purpose of carrying out the return procedure (purpose 1a).

Where this country is not in the EEA and the European Commission has not decided that the country ensures an adequate level of data protection, the transfer is based on the necessity of transmitting data for the performance of a contract as provided for in article 49 (1) b) GDPR or alternatively on standard contractual clauses as provided for in article 46(2) c) GDPR. You can request a copy of the standard contractual clauses at dpo@abg.com.

·Group companies:

We are part of the Avis Budget Group and we endeavour to employ synergies within the group to offer you the most attractive service range possible. Consequently some of the processing referred to above in section 1 is done by our group companies as contracted processors. For that reason your personal data will possibly be transferred to the group companies for the purposes specified above (1a to 1h).

Some of the group companies are based outside the EEA. In cases where the European Commission has not decided that the country in question ensures an adequate level of data protection, the transfer of data is based on standard contractual clauses as provided for in article 46 (2) c) GDPR. You can request a copy of the standard contractual clauses at dpo@abg.com.

·Security checks:

For the purpose of conducting security checks before the vehicle is handed over (purpose 1c), we transfer your personal data to the relevant public authorities, verification service providers and our group companies.

Some of the group companies are based outside the EEA. In cases where the European Commission has not decided that the country in question ensures an adequate level of data protection, the transfer of data is based on standard contractual clauses as provided for in article 46 (2) c) GDPR. You can request a copy of the standard contractual clauses at dpo@abg.com.

·Data transfer in case of damage claims, loss of vehicle or after accidents:

Should the vehicle or its accessories be damaged, lost or stolen during a rental or the vehicle be involved in an accident, we can transfer your personal data, for the above-stated purposes 1d, 1i and 1j, to the police, law enforcement authorities, insurers, opposing accident parties, experts and our legal representatives. 

·Reservations service providers, travel agents:

If you have booked one of our vehicles via a third party, for example a reservations service provider or a travel agency, we can also transfer the data concerning your rental to such third parties in order to be able to perform the rental contract, provide you with the desired vehicle and transact payments and refunds (purpose 1a, 1b). Should you use the discount code of a third party, we can also transfer your master and contact data to such third party, in order to check on your entitlement to the discount (purpose 1e).

·IT and payment service providers:

To ensure the availability, safety and efficiency of our services and our work environment we make use of IT service providers as processors. They too are, in certain circumstances, given access to your personal data for the purposes specified above (1a to 1j). In order to achieve the purpose stated above as 1b), your personal data will possibly be passed on to payment service providers.

·Roadside Assistance providers:

If you have a breakdown and make use of our Roadside Assistance service, the service may possibly be rendered by a service provider. In order to enable this Roadside Assistance service to be performed we will pass on your personal data to the service provider concerned.

·Legal disputes, information and reporting requirements:

Where necessary for the above-stated purpose 1j), we are allowed to pass on your personal data to our legal representatives, collection agencies and courts of law. Where necessary and mandatory in law for achievement of the above-stated purpose 1i), we will pass on your personal data to empowered authorities or authorised third parties.

5.    Retention of your personal data

Your personal data are retained by us only for as long as we reasonably regard this retention to be necessary for the achievement of the purposes referred to above and for as long as is permissible under the applicable laws. We store your personal data in any case for the period of data retention prescribed in law (in particular the seven-year data retention period laid down in section 212 UGB) or until the statutory limitation period for potential legal claims has expired. We will retain your data for a longer period where and for as long as we need them for the enforcement of or defence against specific legal claims.

In concrete terms this means, in particular:

-          General contract data, payment and invoice data and the relevant communications are retained by us for seven years after the end of the calendar year in which you returned the vehicle (section 212 UGB, section 132 BAO (federal fiscal code)).

-          If you are a member of a loyalty scheme , we retain data relating to such membership for the duration of your membership of the scheme, so that we can ensure you enjoy any benefits it may deliver.

-          Data on accidents, damage claims and loss of vehicle are retained by us for defence against any possible claims for damages until the end of the absolute period of limitation, namely 30 years after the end of the rental.

-          Where individual data remain relevant beyond the above-stated limitation period in specific proceedings for the enforcement of or defence against legal claims, we retain such data until the end of the proceedings.

 

6.    Voluntary provision of personal data

When you book a vehicle with us, the data which you are obliged to give in order to book a vehicle with us are marked as such. If you do not provide these data, we cannot rent out a vehicle to you. The data which are not marked as obligatory do not have to be given for us to be able to rent out a vehicle to you.

Your rental agreement documents refer to other information which, in certain circumstances, you are required to give us (e.g. a damage report in the event of an accident). In this connection the said documents also state the consequences which failure to provide the data will have for you.

 

Chapter IV – Taking out additional insurance

This chapter supplies you with information on how we process your personal data if and when you take out additional insurance with us.

The additional insurance which we offer in connection with the renting of our vehicles is provided by AIG Europe S.A. Your contract partner for the insurance policy is therefore also AIG Europe S.A.

As distinct from what is stated in chapter I, therefore, AIG Europe S.A. is the responsible controller under data protection law for all the data processing referred to in this chapter in connection with additional insurance.

You can contact AIG Europe S.A. at:

AIG Europe S.A., Direktion für Österreich
Herrengasse 1 - 3
A-1010 Vienna

Tel:      +43 1 5332500
Fax:     +43 1 5332500-80

Email: info.oesterreich@aig.com

Further information on how AIG processes your personal data in connection with additional insurance can be found in AIG's data privacy policy at: https://www.aig.co.at/datenschutzrichtlinie.

If you rent a vehicle from us and take out additional insurance, we will therefore pass on your master, contact and payment data to AIG Europe S.A. Furthermore, in the event of an accident or damage, we will transfer data concerning the accident or damage to AIG Europe S.A. so that they can process the claim.

The legal basis for this transfer is that it is necessary in order to enable us to broker the additional insurance for you and to enable the additional insurance to make payments to you (article 6 (1) b) GDPR).

 

Chapter V – Use of "connected cars"

 

In this chapter you will find information on how we process your personal data when you rent a vehicle that is a "connected car".

The operating instructions (in the glove box) will show you whether the vehicle you have rented is a "connected car". You can also ask the staff at the rental location.

In addition to this chapter, please also take note of the general information on data processing in connection with vehicle rental in chapter III.

If your connected car is a vehicle from Vauxhall/GM (OnStar), Peugeot or Citroen, data will be obtained and processed by the particular manufacturer in addition to the data processing by us. The manufacturer in question is, under data protection law, the data controller responsible for this processing.

More detailed information can be found in the privacy policy of the particular manufacturer. You will find these policies for …

…Vauxhall/GM (OnStar) vehicles at http://www.vauxhall.co.uk/onstar/index.html

…Peugeot vehicles at http://www.peugeot.co.uk/privacy-policy/

…Citroen vehicles at http://www.citroen.co.uk/privacy

If you are not sure whether your connected car offers such services or whether the manufacturer obtains and processes additional data, please speak to a member of our team or contact the manager of your rental location. You can also call our customer service.

1.    Purposes of the processing

We process your personal data for the following purposes in connection with your use of a connected car:

a)    Measurement of fuel tank level at the start of your rental period and when you return the connected car at the end of that period, in order to calculate any fuel costs you may have to meet when you return a car with a fuel tank that is not full.

b)    Measurement of fuel consumption (in generalised form) for the analysis of fuel consumption and variations of cost-effectiveness across our whole fleet.

c)    Collection and processing of information relevant to diagnosis and servicing of the connected car, in order to ensure that the connected car will be placed at your disposal in roadworthy condition; this applies in particular to the following information: warning lights, tyre pressure, maintenance requirements and oil levels.

d)    Collection and processing of information relevant to diagnosis and servicing of the connected car, in order to detect, and where possible prevent, a possible breakdown of the connected car in advance, and to plan efficient maintenance, servicing and repair services for the connected car.

e)    Collection and processing of information relevant to diagnosis and servicing of the connected car, in order to detect and record any damage that may have been caused during the rental period and – where possible – attribute such damage to a renter.

f)     Recording of mileage at the start of your rental period and when you return the connected car, in order to calculate the exact amount of any additional costs which you may have to pay in connection with the mileage, and to ensure that you do not have to pay for more mileage than you have actually driven.

g)    Recording of mileage in order to identify maintenance and servicing requirements on the basis of mileage.

h)    Recording of mileage in order to collect statistical data (in generalised form) on the mileage covered by vehicles across the whole range of our rental agreements.

i)     Recording of locking and unlocking commands issued to the vehicle, in order to determine, in case of theft, whether access to the vehicle was blocked or not before the theft.

j)     Collection of location data in order to locate the vehicle, subject to statutory requirements, in the event of an accident or vehicle breakdown (so-called eCall System; more details on this can be found in point 7, below.)

k)    Collection of location data in order to be able to locate the vehicle in case of theft or supposed theft, and to be able to record whether the vehicle had left the rental location and/or been returned to it – this is done only in case of theft or supposed theft: we do not track your journey during the rental period.

l)     Collection of data via the Infotainment System in order to offer you the functions of the system accessed by you so that you can use them; this applies for example when you combine your mobile phone with the Infotainment System in order to play and store the music you have chosen; in this case your music libraries can be imported by your mobile phone; this can only happen if you actually use the Infotainment System; these data are only stored and processed locally in the Infotainment System.

 

2.    Source of the personal data

These data are collected – exclusively on the basis of your use of the connected car – by the systems built into the connected car.

3.    Legal basis for the processing of your personal data

In this section you will find information on the legal basis for the data processing that is done for the purposes listed above in chapter V under the heading "1. Purposes of the processing".

·Data processing for purpose 1a):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in calculating as exactly as possible the amount of any fuel costs which you are required to pay, so that you do not have to pay for more fuel than you have actually consumed (article 6 (1) f) GDPR).

·Data processing for purpose 1b):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in determining the statistics of fuel consumption and the variations of cost effectiveness inside our fleet, so as to make the vehicles as cost effective as possible and place the environment under the least possible strain (article 6 (1) f) GDPR).

·Data processing for purpose 1c):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in ensuring that the connected car is placed at your disposal in roadworthy condition and that possible hidden defects are detected at an early stage (article 6 (1) f) GDPR).

·Data processing for purpose 1d):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in detecting and where possible preventing a potential breakdown of the connected car in advance and in planning efficient maintenance, servicing and repair services for the connected car (article 6 (1) f) GDPR).

·Data processing for purpose 1e):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in detecting and recording damage possibly caused during the rental period and attributing the damage – where possible – to a renter, so that – if the renter is responsible for the damage – possible legal claims can be asserted against the renter (article 6 (1) f) GDPR).

·Data processing for purpose 1f):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in calculating the exact amount of any additional costs which you may have to pay in connection with the mileage, and to ensure that you do not have to pay for more mileage than you have actually driven (article 6 (1) f) GDPR).

·Data processing for purpose 1g):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in identifying the maintenance and servicing requirements on the basis of mileage (article 6 (1) f) GDPR).

·Data processing for purpose 1h):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in collecting statistical data on the mileage covered by vehicles across the whole range of our rental agreements and thus being able to ensure the performance capacity and efficiency of our vehicle fleet (article 6 (1) f) GDPR).

·Data processing for purpose 1i):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in determining, in case of theft, whether access to the vehicle was blocked or not before the theft (article 6 (1) f) GDPR). This could indicate whether the renter was (partly) to blame for the theft or not.

·Data processing for purpose 1j):

The legal basis for our processing of your personal data for this purpose is that new vehicles are required by law to be equipped with a so-called eCall System which enables the vehicle to be located in case of an accident (article 6 (1) c) GDPR). The system only becomes active when it detects an accident. More details on this can be found in section 7, below.

·Data processing for purpose 1k):

The legal basis for our processing of your personal data for this purpose is that the processing is necessary to enable us to pursue our legitimate interest in being able to locate the vehicle in case of theft or supposed theft and to record whether the vehicle had left the rental location and/or or been returned to it (article 6 (1) f) GDPR).

·Data processing for purpose 1l):

The legal basis for our processing of your personal data for this purpose is that by connecting your mobile phone to the Infotainment System you consent to this data processing (article 6 (1) a) GDPR). You can withdraw this consent at any time by detaching your phone from the system and deleting the entered data in the system. If you need assistance with this, please consult the vehicle's operating instructions (kept in the glove box) or call our customer service or ask a rental location employee.

 

4.    Transfer of your personal data

If and when you use one of our connected cars, we will possibly pass on your personal data to third parties for the purposes stated above (1a – 1l). This section tells you the third parties in question.

·Cross-border rental:

If you rent a vehicle in Austria but return it to a rental location in another country (one-way rental), we will transmit your data to the Avis-Budget company concerned, which operates the rental location where you return the vehicle, for the purpose of carrying out the return procedure (purposes 1a, 1f).

Where this country is not in the EEA and the European Commission has not decided that the country ensures an adequate level of data protection, the transfer is based on the necessity of transmitting data for the performance of a contract as provided for in article 49 (1) b) GDPR or alternatively on standard contractual clauses as provided for in article 46 (2) c) GDPR. You can request a copy of the standard contractual clauses at dpo@abg.com.

·Accident, damage claim or theft:

Should the vehicle or its accessories be damaged, lost or stolen during a rental or the vehicle be involved in an accident, we can transfer your personal data, for the above-stated purposes 1e, 1i and 1k, to the police, law enforcement authorities, insurers, opposing accident parties, experts and our legal representatives.

If the eCall system installed in the vehicle is activated in case of an accident, we will pass on your location data to the emergency services for the above-stated purpose 1j so that you get help as quickly as possible.

·Roadside Assistance providers:

If you have a breakdown and make use of our Roadside Assistance service, the service may possibly be rendered by a service provider. In order to enable this Roadside Assistance service to be performed we will pass on your personal data, which were collected for the identification of the breakdown, to the service provider concerned.

·IT service providers:

To ensure the availability, safety and efficiency of our services and our work environment we make use of IT service providers as processors (e.g. data hosters, agitators and providers of Cloud services and diagnosis services). Some of our group companies also operate as such IT service providers. They too are, in certain circumstances, given access to your personal data for the purposes specified above (1a to 1l).

Some of the group companies are based outside the EEA. In cases where the European Commission has not decided that the country in question ensures an adequate level of data protection, the transfer of data is based on standard contractual clauses as provided for in article 46 (2) c) GDPR. A copy of the standard contractual clause can be requested at dpo@abg.com.

5.    Retention of your personal data

Your personal data are retained by us only for as long as we reasonably regard this retention to be necessary for the achievement of the purposes referred to above and for as long as is permissible under the applicable laws. We store your personal data in any case for the period of data retention prescribed in law (in particular the seven-year data retention period laid down in section 132 BAO) or until the statutory limitation period for potential legal claims has expired. We will retain your data for a longer period where and for as long as we need them for the enforcement of or defence against specific legal claims.

In concrete terms this means, in particular:

-          Data which are relevant to invoicing and are evidence that we have rendered our services (purposes 1a, 1c, 1f) are retained by us for seven years after the end of the calendar year in which you returned the vehicle (section 132 BAO).

-          Data on accidents, damage claims and loss of vehicle (1e, 1l, 1k) are retained by us for defence against any possible claims for damages until the end of the absolute period of limitation, namely 30 years after the end of the rental.

-          Data which are collected in the Infotainment System are – except when you erase them yourself – erased immediately by one of our rental location staff after your rental period has ended.

-          Where individual data remain relevant beyond the above-stated limitation period in specific proceedings for the enforcement of or defence against legal claims, we retain such data until the end of the proceedings.

 

6.    Deactivation of networked services

The collection of data in case of an accident via the so-called eCall system (see above, purpose 1j) is prescribed by law and cannot be deactivated by you.

The collection of data for all the other purposes mentioned in this chapter is on a voluntary basis and you can deactivate such data collection and processing.

Deactivation of data processing by the Infotainment System:

The Infotainment System only collects personal information concerning you if you actually use the system and connect it to your mobile phone or enter other data. This use is however voluntary: you can end it any time and prevent the Infotainment System from processing your personal data with effect for the future (exercise of your right to withdraw your consent). For this purpose please disconnect all your devices from the Infotainment System. Then erase all the personal data contained in the system by selecting the data erasure function in the system itself. If you need assistance with this, please consult the vehicle's operating instructions (kept in the glove box) or call our customer service or ask a rental location employee.

Deactivation of all other data processing:

You can deactivate all other data processing (purposes 1a – 1i; 1k) by pressing the built-in "private" button in the vehicle itself. If you cannot find it, please consult the vehicle's operating instructions (kept in the vehicle's glove box) or ask a rental location employee or call our customer service.

This data protection function is not available in all our connected cars. To see whether the vehicle you have rented has the function, you can consult the operating instructions or ask a member of our service team. If your vehicle is one of those that does not have the function, please speak to a member of our team and we will terminate the collection of data in our systems. Alternatively, if this is not possible, we will place another connected car at your disposal, one that will allow you to use the said function (or otherwise replace the connected car with an unconnected one).

7.    eCall system

It is now mandatory in law for new vehicles registered in the EU to be equipped with a so-called eCall system.

The eCall system detects that the vehicle is involved in an accident and calls the emergency services. The eCall system can generally not be deactivated.

The eCall system makes a continuous record of your location, but immediately erases all locations except the last three (which are needed to determine direction and speed). The system therefore does not record your route. These location data are not made accessible to anyone (including us) unless the eCall system detects that there has been an accident and sends an emergency call stating your location data. Further details can be found in the operating instructions for the vehicle you have rented. 

 

Chapter VI – Use of mobile WiFi

In this chapter you will find information on how we process your personal data if you book and use a mobile WiFi device in addition to a rented vehicle.

1.    Purposes of the processing

We process your personal data in connection with your use of mobile WiFi for the following purposes only:

a)    Trouble-shooting; for this purpose we collect and process data about your log-in session (e.g. time of registration, call-in country)

 

b)    Enforcement of and defence against legal claims

2.    Source of the personal data

For the above-stated purposes we collect data about your log-in session and no other data. We have no access to data collected by the network operator, such as IP address or MAC address.

3.    Legal basis for the processing of your personal data

In this section you will find information on the legal basis for the processing of data for the purposes listed above in chapter VI under the heading "1. Purposes of the processing".

·Data processing for purpose 1a):

The legal basis for our processing of your personal data is that the processing is necessary to enable us to pursue our legitimate interest in identifying and resolving any problems you may have with the mobile WiFi (article 6 (1) f) GDPR).

·Data processing for purpose 1b):

The legal basis for our processing of your personal data is that the processing is necessary to enable us to pursue our legitimate interest in enforcing any legal claims to which we may be entitled in connection with your use of the mobile WiFi system or in defending ourselves against legal claims resulting from such use (article 6 (1) f) GDPR).

4.    Transfer of your personal data

If and when you use one of our mobile WiFi devices, we will possibly pass on your personal data to third parties for the purposes stated above (1a – 1b). This section tells you the third parties in question.

·IT service providers:

For the above-stated purpose 1a) we make use of IT service providers that may possibly be given access to data about your log-in session.

·Enforcement of and defence against legal claims:

For the above-stated purpose 1b) we can transfer data about your log-in session to our legal representatives and the responsible courts and public authorities.

5.    Retention of your personal data

Your personal data are retained by us only for as long as we reasonably regard this retention to be necessary for the achievement of the purposes referred to above and for as long as is permissible under the applicable laws. We store your personal data in any case for the period of data retention prescribed in law or until the statutory limitation periods for potential legal claims have expired. We will retain your data for longer than the limitation period where and for as long as we need them for the enforcement of or defence against specific legal claims.

6.    Voluntary provision of your personal data

If you do not wish your personal data to be processed for the above-stated purposes (1a, 1b), you will not be able to use the mobile WiFi device.

 

Chapter VII – Cameras and CCTV

In this chapter you will find information on how we process your personal data in connection with the CCTV systems operated at our rental locations.

The basic rule applied here is that wherever a CCTV system is operated you will be informed by means of clear and distinct signs to that effect.

1.    Purposes of the processing

CCTV systems are operated at our rental locations for the following purposes and the CCTV material thus recorded is processed for the following purposes:

a)    Preventive protection of our rental locations and our vehicles against damage and theft

b)    Securing evidence of thefts, accidents and damage to property at our rental locations

c)    Enforcement of and defence against legal claims in connection with events that can be seen happening in the CCTV recordings; this applies in particular to claims against persons who are responsible for damage to vehicles, vehicle accessories or equipment and against persons who steal or attempt to steal vehicles or their accessories within the perimeter of our rental locations.

 

2.    Source of the personal data

These CCTV recordings are made exclusively at rental locations where there are clear signs that a CCTV system is being operated.

3.    Legal basis for the processing of your personal data

In this section you will find information on the legal basis for the processing of data for the purposes listed above in chapter VII under the heading "1. Purposes of the processing".

·Data processing for purposes 1a) – 1b):

The legal basis for our processing of your personal data for these purposes is that this data processing is necessary to enable us to pursue our legitimate interest in preventive protection of our rental locations against theft of our vehicles and in securing evidence of thefts, accidents and damage to property at our locations (article 6 (1) f) GDPR; section 12 (2) Z 4 in conjunction with section 12 (3) Z 2 DSG (Austrian data protection act)).

·Data processing for purpose 1c):

The legal basis for our processing of your personal data for these purposes is that we have a legitimate interest in enforcing any legal claims that may arise from events seen happening in the CCTV recordings and in defending ourselves against any such claims (article 6 (1) f) GDPR).

4.    Transfer of your personal data

These CCTV recordings are as a basic rule accessible only to members of our staff who have been specially trained and tasked for the purpose. In the event that a damage event, an accident, a theft, damage to property or an assault on one of our staff can be seen on a CCTV recording, we can pass on such recording to the responsible authorities and our legal representatives.

5.    Retention of your personal data

The CCTV material recorded at our rental locations is stored for 72 hours and then erased, except where it is necessary to retain particular recorded material in order to assert or defend against specific legal claims.

Where events can be seen in particular recordings which are necessary for asserting or defending against specific legal claims, these recordings are retained until such time as retention is no longer necessary for that purpose, and they are then erased.

6.    Voluntary provision of your personal data

If a rental location of ours operates a CCTV system and there are signs to that effect, it is unfortunately impossible for you to visit the location without potentially becoming visible in the CCTV footage.

 

Chapter VIII – Marketing

In this chapter you will find information on how we process your personal data if you have registered for our newsletter or take part in one of our competitions, or if you have rented a vehicle from us.

1.    Purposes of the processing

We process your personal data in connection with our marketing activities for the following purposes only:

a)    Sending you marketing material and customer surveys; this can take the form of an email newsletter, normal surface mail or (if you have given your consent) by SMS or telephone

b)    Conducting competitions.

2.    Source of the personal data

For the above-stated purposes we use only data which you yourself have given us, either when you registered for our newsletter or for marketing messages or for a competition, or when you rented a vehicle from us.

3.    Legal basis for the processing of your personal data

In this section you will find information on the legal basis for the processing of data for the purposes listed above in chapter VIII under the heading "1. Purposes of the processing"

·Data processing for purpose 1a):

If you have registered with us for our newsletter or other promotional mailings (e.g. via our website or by ticking a box during the renting process), the legal basis for this data processing is your consent to receipt of the particular mailings (article 6 (1) a) GDPR). You can withdraw this consent at any time. There are a number of possibilities open to you:

-          Click on the "Deregister" link which can be found on every promotional email, or

-          log in on your account and deactivate there the receipt of marketing mailings, or

-          contact our customer service (by email or telephone) and ask them to deactivate the mailings.

If you have already rented a vehicle from us, we can send you advertising information on our rental car offers using the contact addresses stated during those processes even if you have not expressly consented to such mailings. The legal basis for this data processing is our legitimate interest in informing you about products similar to those you have booked from us in the past (article 6 (1) f) GDPR).

You can of course object to these mailings at any time. There are a number of possibilities open to you:

-          Click on the "Deregister" link which can be found on every promotional email, or

-          log in on your account and deactivate there the receipt of marketing mailings, or

-          contact our customer service (by email or telephone) and ask them to deactivate the mailings;

 

·Data processing for purpose 1b):

If you have registered with us for a competition and in doing so provided us with personal data concerning you, we will process these data in order to conduct the competition. The legal basis for this processing is that you consented to such processing by registering for the competition (article 6 (1) a) GDPR). You can withdraw this consent at any time. To do so, please contact our customer service (by email or telephone).

 

4.    Transfer of your personal data

·IT, marketing and delivery service providers:

For the above-stated purpose 1a) we make use of IT, marketing and delivery service providers and possibly give them access to your contact data.

·Competition service providers:

For the above-stated purpose 1b) we make use of competition service providers, which conduct the competition on our behalf. These service providers will possibly be given access to the data you provided to us when you registered for the competition.

 

5.    Retention of your personal data

Your personal data are retained by us only for as long as we reasonably regard this retention to be necessary for the achievement of the purposes referred to above and for as long as is permissible under the applicable laws. We store your personal data in any case for the period of data retention prescribed in law or until the statutory limitation periods for potential legal claims have expired. We will retain your data for longer than the limitation period where and for as long as we need them for the enforcement of or defence against specific legal claims.

In detail this means:

-          If you have consented to receiving promotional mailings from us, we retain the data necessary for the purpose until such time as you withdraw your consent or we discontinue this type of mailing.

-          If we send you promotional mailings because you have rented a vehicle from us, we retain the data necessary for such mailings until such time as you object to the mailings or we discontinue this type of mailing.

-          Data relating to your participation in competitions are, under section 212 UGB, retained by us for seven years.

 

6.    Voluntary provision of your personal data

The receipt of promotional mailings is entirely voluntary and there is no necessity to conclude a contract with us. You can therefore at any time withdraw your consent to the receipt of such mailings or object to such receipt (see above).

If and when you register with us for a competition, the registration procedure states which data you are obliged to provide in order to participate in the competition. If you do not give us these data, you will unfortunately not be able take part in the competition.

Chapter IX– Service hotline

In this chapter you will find information on how we process your personal data if and when you call our hotline.

If you use the hotline to make a reservation, please take note of chapter III in addition to this chapter.

1.    Purposes of the processing

We process your personal data in connection with your call to our hotline for the following purpose and no other:

a)    Recording the call as a quality control and for training purposes.

2.    Source of the personal data

If you call our service hotline, the call is recorded as a quality control and for training purposes. You are told this when you call. If you do not want the call to be recorded, you can object to the recording and there will be no adverse consequences for you.

3.    Legal basis for the processing of your personal data

The legal basis for the processing of data for the above-stated purpose 1a) is that the processing is necessary for us to pursue our legitimate interest in checking on and improving the quality of our hotline service (article 6 (1) f) GDPR).

4.    Transfer of your personal data

From time to time our service hotline can be operated by a service provider as a processor. In this case the recording is also made accessible to the service provider.

We also use IT and telecommunications service providers to operate our service hotline. These providers can likewise be given access to the recording for the above-stated purposes.

5.    Retention of your personal data

Your personal data are retained by us only for as long as we reasonably regard this retention to be necessary for the achievement of the purposes referred to above and for as long as is permissible under the applicable laws. We store your personal data in any case for the period of data retention prescribed in law or until the statutory limitation periods for potential legal claims have expired. We will retain your data for longer than the limitation period where and for as long as we need them for the enforcement of or defence against specific legal claims.

In concrete terms this means that we erase recordings of calls as soon as they are not longer relevant to quality controls or needed for training purposes. Recordings of calls are in any case erased after three years at the latest.

6.    Voluntary provision of your personal data

Your consent to the recording of your call is entirely voluntary. There will be no adverse consequences for you if you object to the recording when you call our service hotline.

 

Still have questions? Just contact our customer service (customer.service@budget.at) or our data privacy officer (dpo@abg.com)!