Data privacy protection

1. About us

1.1 Welcome to the privacy policy of the Rodos Cars Company. We respect your privacy and are committed to protecting your personal data. The present privacy policy informs you about the way we safeguard your personal data as a customer and it provides updates on your privacy rights and protection afforded by the law. Our company is responsible for collecting, handling and processing your personal data.

1.2 You are entitled to every right guaranteed by the 2016/679 EU regulations and all relevant European and national legislation. We will process your personal data strictly within the legal regulations.

We will use your personal data when:

we have your full consent;
we must implement the contract that we are about to sign or have already signed with you;
dictated by our legal interests (or the legal interests of a third party) whenever your interests and fundamental rights do not override these interests;
we must conform to legal or regulatory obligations;
dictated by law.

2. Why we process your personal data

We process any personal data you have willingly provided, for which we have secured your full consent, whenever it is necessary for the implementation of the contract between us or when steps are to be taken at your request, before drawing up the contract, and such purposes are specified as: the rental of cars to a third party with or without a driver, the sale of cars to a third party (wholesale or retail), the hire of trucks and vans with or without a driver.

3. Categories of information collected

We have the right to collect, process, store and forward various types of personal data that we have classified as follows:

Identity data include full name (trade name for sole proprietorships), mother and father’s name, date of birth, identity card (number, date of issue/expiry and place of issue), or passport (number, date of issue/expiry and place of issue), residence permit, valid driver’s license (number, date of issue/expiry and place of issue).
Contact data include home address, email, and phone numbers.
Financial data include taxpayer ID, bank account number, payment card details, indication of VAT exemption, activity (for companies), tax office (for companies), headquarters (for sole companies).
Credit ratings and legal documents (for companies).

We do not collect sensitive personal data in any of our activities or countries of operation with the exception of your health data, which we acquire with your consent in case of traffic accident injury, solely to forward to the insurance agency that insures our vehicle.

4. How we collect your data

We collect your personal data in digital form or in print, every time you use our services, when these services are provided by us directly at the points of customer service or in other places where our company legally operates. We also collect your data when you use our websites, our phone services or cellphone applications and our company email. Any user/customer may browse our webpage without providing any personal information. Information about our cookies policy can be found on our company webpage.

We collect personal data of customers or drivers while booking short or long-term car rental or sale of a car, such as full name, address, phone number, driver’s license, credit card details, taxpayer ID, etc. (as specified in paragraph 3).
We may collect personal data with your consent in many ways, such as telephone calls, customer service contacts, websites and other sources, as specified above.

5. How long we keep your personal data

We keep your personal data only as long as needed to fulfil the purposes for which they have been collected, including the fulfilment of any legal or accounting obligation, or mandatory mention.

To specify the length of keeping personal data, we examine the quantity, the nature and the sensitivity of personal data, the potential danger of harm by unauthorized use or disclosure of your personal data, the purposes towards which we process your personal data and whether we are able to fulfil such purposes by other means, within the existing legislation.

The Customer’s tax data are kept for a period of ten (10) years from the date of issue of each tax document, to be made available, as required, to the tax authorities within the time frame of valid tax demands. Any data pertinent to establishing, enforcing and supporting legal claims of the Company or a third party in the presence of any competent court of law or administrative authority are kept for a period starting at the time that the Company demands are generated and up to twenty (20) years or for a longer period up to the statute of limitations and the termination of possible bilateral litigations. The Company may keep the customer’s personal data after fulfilling the purposes of collecting and processing them if such is our legal obligation as stipulated by any relevant legal provision.

6. Protection of your personal data

We have taken all the appropriate organizational and technical precautions to safeguard and protect your personal data from unintentional or fraudulent destruction, accidental loss, distortion, unlawful dissemination or access and any other kind of unauthorized processing.

7. Who the recipients of your data are

Our company guarantees that it will not forward, share, or relinquish your data to others (except the ones mentioned in this document) for any reason or use unless this is dictated by the present legislation or stipulated by public/judicial bodies or authorities. Only the necessary minimum of Company personnel, all of whom are bound to confidentiality will have access to your personal data, which also applies to our partners who comply with our directives and are aligned with the provisions of the 2016/679 EU regulation and they process your data as joint data controllers or as data processors on our account and according to our directives.

Indicatively, recipients of your data are:

the insurance agencies that collaborate with our Company;
collaborating users of our logos and on a case-by-case basis our systems (franchisees). Relevant information can be found on our Company webpage;
the car rental companies (in Europe or elsewhere) that are part of the international car rental system and handle bookings, with whom we share information pertaining to our car rental activities;
companies of sworn auditors that check our Company’s financial statements;
cooperating companies that provide roadside assistance to drivers using our Company vehicles;
cooperating companies in car rentals;
legal service providers (lawyers, law firms) that defend our Company interests;
Public authorities - agencies (Police, Coast Guard, Fire Department, Forestry Service, Military Police, etc.).

8. How we ensure that the processors and sub-processors respect your data

The processors working on our account have agreed with the company and are contractually committed:

to observe confidentiality;
not to forward your data to third parties;
to take safety measures;
to comply with the legal framework concerning personal data protection and particularly regulation 679/2016/EU (GDPR);
to have been informed and observe all relevant laws and regulations towards the protection of personal data.

In the execution of their duties, the processors may at times employ other persons called sub-processors. In this case, the data controller will have authorized them to handle all or part of data processing. As a result, sub-processors have the same obligations and rights as the processors, as these are analyzed in the present policy and always within the bracket of their delegated duties and bear full responsibility as would the processor.

9. Your rights

You have the right to:

request access to your personal data (“subject access request”).
request the correction of your personal data kept by the company.
request that your personal data be deleted subject to time period limitations as stipulated in paragraph 5.
oppose our processing your personal data when you deem that your fundamental rights and freedoms have been violated.
request the restriction of processing your personal data.
request personal data transmission to you or to a third party.
withdraw your consent in case you realize and can prove that it has stopped being lawful.

If you wish to exercise any of the rights above, please contact us.

10. How to exercise your rights

For any clarification concerning the present privacy policy, including any request to exercise your legitimate rights, you can email us at: dpo@rodoscars.gr or write to: Rodos Cars - DPO, Eykalipton str, 85102 Rhodes.

11. Fee

You will not be asked to pay in order to access your personal data (or to exercise any other one of your rights). Nevertheless, we reserve the right to ask for a reasonable fee if your request is blatantly unfounded, repetitive or abusive.

12. What information we may require

We have the right to ask you for certain particulars in order to verify your identity and safeguard your right to access your personal data (or exercise any other one of your rights). It is a protective measure, which ensures that your personal data will not be accessed by unauthorized others. We also have the right to contact you and ask for further information concerning your request, in order to speed up reply time.

13. Reply time

We try to reply to all legitimate requests within the month. We may take longer than a month to reply if the request is particularly complex or if you have submitted a series of requests. In such case, you will be notified accordingly.

14. How you will be informed about any modifications of the present policy

We reserve the right to modify the present policy and effect any changes in the information provided previously, within the constraints of the law. If there are fundamental changes in policy or in the way we use your personal data, we will post the updates on the present policy on our website and you may be informed about any changes there. Let it be made clear that such changes will be effected starting the day they are posted in the amended privacy policy on the Company official webpage www.rodoscars.gr. We encourage you to read the policy at regular intervals so that you can keep up to date about your data protection.