Welcome to Expedicar.ro. This document describes how SC AUTOREVOLUTION SRL (“ExpediCAR”) collects, uses, and protects your personal data, in accordance with EU Regulation No. 679/2016 (GDPR) and applicable national legislation. Please read this document carefully before using our services or providing us with personal data.

Data Controller: SC AUTOREVOLUTION SRL (hereinafter “ExpediCAR”)

Definitions — meaning of certain terms

To help you better understand the information contained in this document, we have included below an explanation of the main concepts used throughout it. These definitions are taken from EU Regulation No. 679/2016 (the GDPR), in force since 25.05.2018, with a few explanatory notes to make them easier to understand.

Personal data

Any information relating to an identified or identifiable natural person (the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a unique identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

Note 1: personal data includes, among others: email address, phone number, computer ID, date of birth, address, unique identification number, etc.

Note 2: the unique identification number may consist of the personal identification number (CNP), the series and number of the identity document, the passport number, the driving licence number, or the health social insurance number, as applicable.

Sensitive / special category data

Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, and also data relating to criminal convictions and offences or related security measures.

Processing

Any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Note: merely storing data (even if unused) or merely consulting personal data may fall within the concept of processing.

I. Types of data processed

You provide us with your personal data directly. By way of example, we receive information from you as follows:

• When you subscribe to our newsletter, you provide us with: title (Mrs, Miss, Mr), first name, last name, address, email, phone number.

We do not collect or otherwise process sensitive data, which the General Data Protection Regulation includes in special categories of personal data.

We may also collect and subsequently process certain information about your behaviour while visiting our website, in order to personalize your online experience and provide you with offers tailored to your profile.

On our website, we may store and collect information in cookies and similar technologies, in accordance with our Cookie Policy.

II. Purposes and legal bases of processing

We will use your personal data for the following purposes:

1. To perform the services you request from us

• Processing orders, including renting out the vehicles, making them available, technical assistance, and invoicing them, as well as resolving any issues relating to an order;
• Providing support services, including answering your questions about your orders or the services of ExpediCAR or its partners.

Legal basis: In most cases, processing your data is necessary for entering into and performing a contract between ExpediCAR and you. In addition, certain processing operations falling under these purposes are required by applicable legislation, including tax and accounting legislation.

2. To improve our services

We continually strive to provide you with the highest-quality services. To this end, we may collect and use certain information about your behaviour as a customer, we may invite you to complete satisfaction surveys after a car rental service and related activities have been carried out, or we may conduct, directly or with the help of partners, market studies and research.

Legal basis: Our legitimate interest in carrying out commercial activities, always taking care that your fundamental rights and freedoms are not affected.

3. For marketing

We want you to stay informed at all times about the best offers for the services that interest you. Accordingly, we may send you various messages (email/SMS) containing information about our services, offers, or promotions, as well as other commercial communications such as market research and opinion surveys.

We always ensure that this processing is carried out with respect for your rights and freedoms, and that decisions made on this basis do not produce legal effects concerning you or similarly significantly affect you.

Legal basis: As a rule, we base our marketing communications on your prior consent. You may change your mind and withdraw your consent at any time by contacting the controller at the email address: office@expedicar.ro.

In addition to the above, we may send you marketing communications using your email address if you do not object to receiving such communications. If you have changed your mind and no longer wish to receive messages from us, you may ask us at any time, by the means described above, to stop processing your personal data for marketing purposes, and we will comply with your request.

4. To protect our legitimate interests

We have the right to protect our interests and commercial activity, and we may process certain data for this purpose. By way of example, we mention:

• to prevent and detect fraud, theft, loss, improper use, and the like affecting devices, systems, software, databases, servers, emails, and in general the assets and resources used by ExpediCAR;
• to protect the assets, employees, collaborators, partners, and clients of ExpediCAR;
• to ensure the proper and correct conduct of our activity (for example, to correctly and completely identify the service provided, to invoice services to the client, to prevent the permanent loss of data);
• to ensure the security and compliant use of databases and, in general, of personal data processed by ExpediCAR for itself or for third parties.

Legal basis: The general basis for this processing is our legitimate interest in carrying out our commercial activity under the best conditions and protecting our commercial interests. In addition, in certain cases we base our processing on legal provisions, such as the obligation to ensure the protection of goods and valuables provided for by applicable legislation.

III. Data processed based on consent

In general, your data is not processed based on consent, but on the other legal bases described above.

In the limited cases where data is processed based on your consent, we inform you that:

• you are not obliged to provide us with the data in question or to give your consent for its processing;
• the absence of consent will not affect contractual relationships with us carried out on different legal bases;
• however, the absence of consent will not allow us to provide you with real-time information about certain services of interest to you, about special offers, or about discounts;
• if you have given your consent, you may withdraw it later, at any time, through a simple written notification to the email address: office@expedicar.ro, or sent to ExpediCAR’s contact details. You do not have to justify your decision;
• withdrawing consent means that we will no longer be able to subsequently process the data in question using consent as the legal basis. However, depending on the circumstances, we may continue to process that data for limited purposes on other legal bases — for example, to preserve, exercise, or defend rights in court, to fulfil certain legal obligations, or in other similar cases closely related to the initial processing;
• withdrawing consent will not affect the processing we carried out previously on its basis, nor data processing that is not carried out based on consent.

IV. How long we keep your personal data

As a general rule, we will store your personal data for the duration of the contract.

You may ask us at any time to delete certain information, and we will comply with such requests, subject to retaining certain information even after the contract ends, in situations where applicable legislation or our legitimate interests require it.

V. Updating data

We want to process personal data that is accurate, complete, and up to date. Therefore, to the extent that personal data changes or if you notice errors in connection with this data, please notify us as quickly as possible so that we can update it.

VI. Who we share personal data with

The personal data referred to in this Policy may be provided to affiliated or partner entities, to collaborators of ExpediCAR, or to other independent legal entities, such as:

• Affiliated or partner entities and collaborators with which ExpediCAR has concluded service contracts or other types of contracts (e.g., distributors, suppliers, manufacturers, couriers, banks / payment service providers, marketing service providers, market research service providers, insurers, IT service providers, etc.);
• Natural or legal persons acting as processors for ExpediCAR, in various areas relating to the conclusion, registration, or performance of the contract;
• Accountants, auditors, lawyers, bailiffs and/or other external professional consultants;
• Public authorities, persons vested with public authority, public institutions, relevant courts, etc., in Romania or abroad — in the event of an inspection, at their request, or on our own initiative, in accordance with applicable legislation.

With each of these, we will conclude the contractual clauses required by law, aimed at ensuring the protection of your personal data, including with regard to data security and confidentiality.

VII. We do not transfer data outside the European Union

As of the date of this Policy, ExpediCAR does not transfer and does not intend to transfer your personal data to entities or persons outside the European Union or to international organizations.

The suppliers, partners, and collaborators mentioned in the section above to which we transmit personal data are Romanian persons/entities, as well as foreign ones. However, we cannot rule out that they may transmit your data to other countries, which may be members or non-members of the European Union (for example, if their servers are located in the United States). In the contractual clauses we conclude with them, we will ensure that these entities/persons undertake to have security measures and adequate safeguards in place to ensure the confidentiality and appropriate protection of your personal data.

If ExpediCAR transfers personal data to entities/persons outside the European Union, we will ensure that adequate personal data protection measures are implemented, or we will request your consent for such transfers, having first informed you of the potential associated risks. In exceptional situations where it becomes necessary to transfer data outside the European Union and the above-mentioned conditions are not met, we will ensure that the transfer is carried out only in cases where the law permits express derogations (e.g., Article 49 of the GDPR).

VIII. How we protect the security of your data

ExpediCAR is committed to ensuring the security of personal data by implementing appropriate technical and organizational measures, in line with industry standards.

Due to the way personal data is transmitted electronically, there may be a risk of interception, loss, or copying of information by unauthorized persons through the use of interception equipment or software. Upon notification by users, ExpediCAR will take all measures and make available all files necessary to the competent authorities empowered to address this type of offence. We cannot be held responsible for such vulnerabilities of systems that are not under our control.

ExpediCAR cannot be held responsible for errors arising from the user’s negligence regarding the security and confidentiality of their account and password.

Any access to the database of users’ personal information at www.expedicar.ro, including any attempt at unauthorized access, will be recorded in an access log. The access logs will enable ExpediCAR to identify persons who have accessed personal data without a legitimate reason, with a view to notifying the competent authorities.

Any attempt to access another user’s personal data, to modify the content of the site, or to affect the performance of the server on which the site www.expedicar.ro runs will be considered an attempt to defraud the site and will trigger criminal proceedings against the person or persons who initiated such action.

IX. What your rights are

You have the following main rights regarding your personal data, which may be exercised under the conditions established by law:

The right of access to data

You have the right to obtain information about whether or not your personal data is being processed, the right to obtain access to your data or a copy of the data we hold, as well as the right to obtain information about the type, processing, and disclosure by us of this data, or about the source of your personal data, where this data was not collected directly from you.

You also have the right to request information about the existence of any automated processing of your personal data, including profiling, as well as information about the logic involved and the significance and envisaged consequences of such processing for you. In this case, if the processing is carried out by automated means, you have the right not to be subject to an individual decision.

The right to rectification of data

You have the right to obtain the rectification of your data that we process or control and that is inaccurate. Depending on the purposes for which the data is processed, you have the right to have incomplete data completed, including by providing supplementary statements.

The right to erasure of data (the “right to be forgotten”)

You have the right to obtain from us the erasure of your data that we process or control, in the cases provided for by law.

The right to restriction of data processing

You have the right to obtain from us the restriction of the processing of your data that we process or control, for certain data and limited purposes, according to law (for example, when processing is unlawful and you object to the erasure of the data but instead request the restriction of its use).

The right to object to processing

You have the right to object to the processing of your data by us or on our behalf, in the cases and within the limits provided for by law. In certain situations permitted by law, we may continue processing your data even after you exercise this right.

The right to data portability

You have the right, in the situations provided for by law (for example, processing based on consent, on a contract, or by automated means), to obtain the transfer to another controller of your data that we process or control.

The right to withdraw your consent at any time

In situations where we process your data based on your consent, you have the right to withdraw your consent. You may do so at any time, at least as easily as you initially gave us your consent. Withdrawing consent will not affect the lawfulness of the processing of your data that we carried out before the withdrawal.

The right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the personal data processing supervisory authority regarding the processing of your data by us or on our behalf. The supervisory authority in Romania is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

To exercise one or more of these rights, or to raise any question or concern about any of them, please contact us using the contact details in Chapter X.

We trust that you will not exercise these rights unreasonably, excessively, or otherwise abusively.

If you are not satisfied with the way we have resolved or responded to a request or complaint of yours, or if you consider that the processing is carried out in breach of applicable legislation, you may file a complaint with the data supervisory authority in Romania.

Unsubscribe from ExpediCAR APP notifications – Click here

X. Contact

For any request relating to the processing of personal data, the exercise of the rights provided for in this policy, or any other question regarding confidentiality, you may contact us:

Controller

• SC AUTOREVOLUTION S.R.L. (ExpediCAR controller)
• Address: 2 Johann Strauss Street, Sector 2, Bucharest
• Email: office@expedicar.ro
• Website: www.expedicar.ro

Supervisory authority — ANSPDCP

• Headquarters: 28-30 Gheorghe Magheru Blvd., Sector 1, Bucharest, postal code 010336, Romania
• Email: anspdcp@dataprotection.ro
• Fax: +40.318.059.602
• Website: www.dataprotection.ro