Read our updated Privacy Policy

Avis Budget Group EEA/UK Privacy Notice

Effective Date: 12.12.2023

Last Updated: 12.12.2023

1. INTRODUCTION

Welcome to the Privacy Notice of Avis Budget Group, Inc. and its subsidiaries and affiliates that are located in the European Economic Area and United Kingdom. (We refer to these companies as "ABG", "we", "us" or "our" in this Privacy Notice).

A full list of the companies within the Avis Budget Group that are data controllers under European Union/United Kingdom privacy laws and contact details is included in the Contact Us section.

This Privacy Notice covers the personal information we collect, use and disclose through your use of our websites, mobile applications (each an "App" and collectively, "Apps"), products and services, either online or offline (collectively, "Services").

This Privacy Notice and our processing of your personal information will be subject to applicable data protection laws.

Independent Locations

Please note certain independent locations are owned and operated by an independent licensee and not owned or controlled by ABG or any ABG affiliate or subsidiary. These include independent licensees that may use our name (for example, Avis, Budget, Payless, Maggiore and France Cars). This Privacy Notice only applies to the extent one of our independent licensees has shared your personal information with us as described in the Third Parties  section or where we act as joint controllers with an independent licensee as described below. Otherwise, this Privacy Notice does not apply to processing of your personal information by an independent licensee.

Each of these independent licensees collects, uses and discloses personal information for its own purposes. In relation to these purposes, these independent licensees have their own separate privacy notices. Please review these separate privacy notices to understand how the relevant independent licensees collect, use and share personal information.

When you are dealing with an independent licensee, the licensee is responsible for its own collection and processing of payments and may engage in its own e-mail campaigns and other forms of marketing to you. ABG is not responsible for the compliance of the independent licensee with applicable privacy laws.

However, if you believe the independent licensee is violating applicable privacy laws, you may report this to ABG’s Privacy Office at dpo@abg.com.

For certain processing of your personal information, in particular when both Avis and the independent licensee are processing your personal data for the purposes of bookings and rentals utilising the ABG central booking system, then both parties will act as joint controllers. This Privacy Notice sets out your personal data which is processed in these circumstances. Where we act as joint controllers, ABG and our independent licensees are responsible for complying with their own obligations under applicable data protection law, including responding to any requests to exercise rights under applicable data protection law.

Updates to this Privacy Notice

You can tell when this Privacy Notice was last updated by looking at the date at the top of the Privacy Notice. If we make changes to this Privacy Notice, we will post the changes here.

If we make a change that significantly affects your rights or, to the extent we are permitted to do so, significantly changes how we use personal information or the purpose for which we use it, we will notify you by way of a prominent posting on our Services, prior to the change becoming effective. If you have an account with us, we may also notify you about such changes to this Privacy Notice by e-mail (sent to the e-mail address provided in your account), through our Services, or as otherwise required or permitted by applicable law. Any changes to this Privacy Notice will become effective upon uploading or posting of the revised Privacy Notice. As such, we encourage you to review this website from time to time for the latest information on our privacy practices.

Please note that when you use any of our services, we will collect, use AND DISCLOSE YOUR personal information as described in this PRIVACY NOTICE. If you have questions, comments, or suggestions, you can always contact us using any of the ways described in the Contact Us section.

2. PERSONAL INFORMATION WE COLLECT AND HOW WE COLLECT IT

We collect personal information from you, directly and through third parties, in accordance with this Privacy Notice any time you contact us, interact with us, rent a vehicle (whether through us or a third party), join one of our loyalty programs or use any of our Services.

Please be aware that if you do not provide us with personal information that we need, we may not be able to provide certain Services under our contract with you or comply with our legal obligations. For example, when you rent a vehicle from us, we need your name, address, payment information, and driver’s license, which is personal information. If you refuse to provide us with any of this personal information, we may not be able to rent a vehicle to you. We will let you know when we need personal information from you and the consequences of failing to provide us with that personal information.

3. HOW WE USE PERSONAL INFORMATION

We use personal information for a number of purposes relating to (i) fulfilling your rental booking with us, (ii) providing other products or Services requested by you, (iii) administrating our relationship with you, (iv) managing incidents such as vehicle damage or theft, and (v) marketing the products and services of ours and our business partners to you.

4. LEGAL BASIS OF PROCESSING

We rely on one of a number of grounds under applicable data protection law to permit us to process your personal information.  These include as is necessary to perform our contract with you; for the purposes of our legitimate interests; and where we have collected your consent.

5. HOW WE USE COOKIES AND OTHER SIMILAR TECHNOLOGIES

When you access our websites and Apps, we use cookies and similar technologies to help us understand how you use our websites and Apps and ensure that they function as intended, to optimize user experience, for analytics and to show tailored offers on our website and third party sites.

Further details can be found in the Cookies Policy.

6. HOW WE SHARE PERSONAL INFORMATION

The nature of our business and operations requires us to share personal information within the Avis Budget Group and with our third-party service providers and business partners so that we are able to provide you with your rental booking and other products and services you request (such as insurance and our loyalty reward programs) and customer assistance, as well as to verify your identity and complete fraud checks, support our IT infrastructure, and market products and services that we and our business partners offer or to comply with applicable laws.

7. HOW LONG WE KEEP PERSONAL INFORMATION

We keep personal information for no longer than is reasonably necessary or required by applicable law. How long we keep personal information depends on the type of personal information and the purpose(s) for which we collected it and the applicable legal requirements.

8. HOW WE PROTECT PERSONAL INFORMATION

We take reasonable steps aimed to ensure personal information is protected from unauthorized use, access, disclosure, alteration, destruction, or loss.

9. YOUR RIGHTS AND CHOICES

You may have certain rights and choices that you can make regarding the personal information we have about you.

10. THIRD PARTY WEBSITES

Our Services may include links to and from the websites of our affiliates and business partners. We do not control how personal information is collected or used on those websites, so please review the privacy policy of any website you visit as a result of following any links to or from the websites of our affiliates and business partners.

Many of our branded locations are independently owned and operated. These independent licensees use our name (for example Avis, Budget, Payless, Maggiore and France Cars) but are not owned or controlled by us.

11. CHILDREN’S PRIVACY

Our Services are not for children under the age of 16. We do not knowingly collect personal information from children. If you think we have received personal information from children under the age of 16, please contact us immediately.

12. CONTACT US

If you have questions, comments, or suggestions, you can always contact us. For your protection, we may need to verify your identity before we assist with your request by verifying that you can provide us with information about you that we have previously collected.

Customer Services

Please check the website for details of your customer service contacts.

Data Controllers and Contact Details By Country

If you are making a rental or visiting a local country version of our websites or using our App in the following countries, the data controller is listed in the table below.

You can also contact our Data Protection Officer regarding any issues or questions you have regarding our processing of personal information. They act as the Data Protection Officer in respect of all of the data controllers listed below and can be contacted at:

Email: dpo@abg.com

Postal Address: Data Privacy Officer, Avis Budget House, Park Road, Bracknell, Berkshire, RG12 2EW, United Kingdom

Telephone: +44(0) 1344 417170

Country

Data Controller

Contact Information

Austria

Avis Autovermietung Gesellschaft m.b.H

Lehrbachgasse 2

1120 Wien / Vienna, Austria

Belgium

Avis Belgium SA

Rue Colonel Bourg 122, PO Box 7m 1140Evere, Brussels, Belgium

Czech Republic

Avis Autovermietung GmbH

Organizacni slozka, Klimentska 46, Praha 1, 110 02, Ceská republika

Denmark

Avis Budget Denmark A/S

Roskildevej 14, DK-2620 Albertslund, Denmark

France

Avis Location de Voitures SAS

Immeuble Lnea,1, rue du Général Leclerc, 92800 Puteaux

France

Milton Location de Voitures

1, rue du Général Leclerc, 92800 Puteaux

France

AAA France Cars

11 rue Paul Dubrule, 59 810 LESQUIN

Germany

Avis Autovermietung Gesellschaft mbH

Lehrbachgasse 2, 1120 Vienna, Austria

Germany

Avis Autovermietung Gesellschaft GmbH & Co.KG

Zimmersmuehlenweg 21, 61440 Oberursel/Ts., Germany

Hungary

Avis Budget Group Business Support Centre Kft

Kassak Lajos u. 19-25, 1134 Budapest, Hungary

Italy

Avis Budget Italia SpA

Contact information: OK Viale Carmelo Bene – Roma ;  Registered Office: Via Innsbruck 31 Bolzano

Italy

Bell’Aria S.p.A

Contact information: OK Viale Carmelo Bene – Roma ;  Registered Office: Viale Carmelo Bene - Roma

Luxembourg

Avis Location de Voitures SARL

Aeroport de Findel, L-1110 Findel

Norway

RAC Norway AS

Drengsrudbekken 12, Oslo, Asker, 1383, Norway

Poland

Avis Budget Sp. z o.o.

Ul. Żwirki i Wigury 16C 02-092, Warsaw, Poland

Portugal

Sovial – Sociedade de Viaturas de Aluguer, Unipessoal, Lda.

Av. Severiano Falcão, 9, 2685-379 Prior Velho, Portugal.

Portugal

Sovialma – Sociedade de Viaturas de Aluguer da Madeira, Lda.

Largo António Nobre, 164, 9000-022 Funchal, Madeira, Portugal

Spain

Avis Alquile Un Coche S.A.U. (OpCo)

Avenida de Manoteras 32, Edificio C 28050 Madrid

Spain

Avis Budget Group Contact Centre EMEA SA

Avenida de Manoteras 32, Edificio C 28050 Madrid

World Trade Centre, Edificio Norte 5a Planta, Moll de Barcelona s/n, 08039 Barcelona, Spain

Sweden

Sweden Rent A Car AB

P.O. Box 6050, 171 06, Solna, Sweden

Switzerland

Avis Budget Autovemietung AG

Hofwisenstrassen 36, 8153  Rümlang, Switzerland

Switzerland

Garep AG

Hofwisenstrassen 36, 8153  Rümlang, Switzerland

United Kingdom

Avis Budget UK Limited

Avis Budget House, Park Road, Bracknell, Berkshire, United Kingdom, RG12 2EW

United Kingdom

ACL Hire Limited

Avis Budget House, Park Road, Bracknell, Berkshire, United Kingdom, RG12 2EW

United Kingdom

Avis Budget EMEA Limited

Avis Budget House, Park Road, Bracknell, Berkshire, United Kingdom, RG12 2EW

United Kingdom

Avis Budget Services Limited

Avis Budget House, Park Road, Bracknell, Berkshire, United Kingdom, RG12 2EW

United Kingdom

Avis Europe Risk Management Limited

Avis Budget House, Park Road, Bracknell, Berkshire, United Kingdom, RG12 2EW

United Kingdom

Zodiac Europe Limited

Avis Budget House, Park Road, Bracknell, Berkshire, United Kingdom, RG12 2EW

A

PERSONAL INFORMATION WE COLLECT AND HOW WE COLLECT IT

RENTING A VEHICLE

When you make a reservation or rent a vehicle with us we collect the following personal information:

• name;
• email address;
• home address;
• employer details and business address (if you are a member of a corporate program);
• telephone number;
• date of birth;
• gender;
• payment information such as your credit or debit card details (security code is obtained for transaction only – we do not keep it);
• tax number (if specifically requested);
• information from driver's license and/or other government-issued identification, including if you are an additional driver for the specific rental;
• information from another form of identification documentation such as a passport or national identity card if your driver's license does not include a photo or is not recognizable as you and/or proof of address such as a utility bill. The information we collect and retain will only include your photo ID where you are informed of this;
• special discount codes, partner member numbers, association memberships, corporate rewards programs (if you request discounts, special privileges, and points programs);
• special requests and preferences, including:
  • your preferences regarding optional extras such as damage waivers and other protections;
  • where a delivery or collection service is available, the address where we will drop off or pick-up the vehicle and any optional extras you requested;
• where and when you rented the vehicle, where and when you returned the vehicle, insurance preferences, fuel consumption, mileage, accident history and other personal information related to the vehicle and your use of it;
• where you inform us that you have a medical disability or other health-related requirements that require an adapted vehicle or other driver aid we will use that personal information in order to provide you with the service you requested and where you have given your explicit consent to us using that information;
• ABG maintains a Do Not Rent list of customers who present risks to our business and/or personnel and who will be prevented from making a rental with us as a result of those risks. The personal information ABG processes to maintain this list includes contact and personal details and the reasons why the individual has been included on the Do Not Rent list;
• when returning a vehicle following a rental we may ask you for a fuel receipt and we may retain a copy of that receipt. This fuel receipt may include credit card information, date and location of purchase and is required to confirm that the vehicle has been refueled in accordance with our agreement with you in relation to that rental;
• some vehicles come equipped with a global positioning system (GPS) or similar type tracking connected car technology device that may also collect information about the vehicle and the location of the vehicle and driving style. To learn about Connected Car Data we collect, see the Connected Cars section;
• other personal information that may be required to rent you a vehicle and/or provide you with services; and
• in some locations we may be required to collect specific categories of personal data relating to you and your rental so that this can be provided to law enforcement (such as police) where required by applicable law. This may include the personal data set out above as well as additional personal data as required by law (such as gender). 

TRAFFIC AND MOTORING OFFENCES

We will collect personal information about any speeding, parking, toll or other traffic-related fines that you incur or any traffic offenses that you commit during your rental where these are provided to us by any law enforcement agency, parking authority or toll authority.

ACCIDENTS, MECHANICAL FAILURES, AND VEHICLE DAMAGE OR THEFT

If you have an accident, or suffer any loss, theft or damage to the vehicle during your rental or suffer any mechanical failure, we will collect information regarding such incident including your report of the incident and any police or other third-party reports including details of those involved, together with the nature of any personal injuries and/or damage to the vehicle and optional extras.

CONTACTING US

When you call us, we may record or monitor the call for quality control, training or similar purposes. We will advise you of this recording or monitoring during the call.

When you contact us by email, text or via social media we will keep a record of your name, contact details and the contents of your messages, queries, feedback or complaints.

DRIVING LICENSE VERIFICATION

We may offer you the option to verify your driving license (or other identification documents) online or through our App via our third party verification provider which may enable you to bypass the counter verification process at our rental stations.

If you proceed with this verification online or through our App we will collect an image of your driving license and selfie in order to complete verification.

The processing of your selfie requires biometric verification and will only be completed where you have provided your explicit consent as biometric data is considered a special category of personal data where processed for identification purposes.

Online verification is optional and you can still complete the digital check-in process without completing online verification. You will still need to register your details and verify your driving license / ID prior to your rental but this can be completed at our rental station when you collect your rental vehicle. However, a failure to complete online verification will mean that you are unable to bypass the counter at our rental stations or rent from unstaffed locations.

We may also offer you the option to create an account with us. This will enable us to retain your verification status so that you can use this verification status for future rentals with us without having to complete the online verification process for each future rental. However, we will still require you to re-verify your driving license and identity at regular intervals and where details require updating – such as where your driving license has expired.

Online verification may also involve the receipt of information from third party fraud check and identity document database check providers.

USING WEBSITE OR APP

When you download, visit and use our websites and/or Apps, ABG automatically collects technical information. This section tells you more about the technical information we collect and how we collect it.

IP Addresses & Other Personal Information Collected Automatically

We may collect your IP address when you visit our websites. We do not normally link IP addresses to anything personally identifiable. In select circumstances, we may use IP addresses to help us identify you when we feel it is necessary to enforce compliance with our Website Terms and Conditions or to protect our service, site, users or others.

We may also collect your browser type, Internet Service Provider (ISP), referring/exit pages, the files viewed on our site (for example HTML pages, graphics, etc.), operating system, date/time stamp, and/ or clickstream data.

Session Replay

When you visit our website, we will sometimes record personal information about your browsing session on the website, including which pages you visited and any forms on the website that you completed.

Analytics

We use analytic software, such as Adobe Analytics, Google Analytics, and others, to help us to better understand the functionality of our software on our websites and Apps on your device. These software tools record technical information including about your device together with usage information such as how often you use our website or App, which features you use or don't use in the website or App or which pages you visit on the website, aggregated usage, performance data, where the App was downloaded from and information about your visit to the site, including details of some of the URL clickstream to, through and from our website.

Mobile GPS and Push Notifications

If you let us, when you use our Avis, Budget, Payless, Maggiore Rent and France Cars Car Rental Apps or websites, we may collect location markers using the GPS in your device.

To ensure you receive proper notifications, we will also need to collect certain personal information about your device such as operating system and user identification information.

If you change your mind about sharing your location from the App or your mobile device or receiving push notifications from the App, adjust the settings of your mobile device to turn off transmission of geolocation data or to stop transmission of push notifications at any time. Just remember that if you turn these features off, you will not receive information tailored to your location or special location-based offers and you may not be able to utilise our Apps self-serve functionality.

GIFT CERTIFICATES AND VOUCHERS

When you purchase a gift certificate or voucher, we collect the name and mailing address of the gift recipient as well as your contact information, billing details and payment details in order to fulfill your order.

If you believe that one of your contacts has provided us with your personal information and you would like to request that it be removed from our database, please contact our customer services team at the details set out in the Contact Us section.

INSURANCE PRODUCTS

If you have requested any of the insurance products that we offer including during your rental, such as Personal Accident Insurance, Super Personal Accident Insurance, Loss Damage Waiver, Additional Liability Insurance, Personal Accident and Effects, Supplemental Liability Insurance or equivalent products, we will pass personal information to the insurer that is underwriting that product in connection with you entering into a contract with that insurer for that product. The name of the insurer will be made available to you when you are requesting the relevant product.

In the event that you make any claim under one of these insurance products, personal information relating to the claim will be provided to the insurer and any appointed claims handler. The use of personal information by that insurer will be subject to the terms of that insurer's privacy notice.

DO NOT RENT LIST

ABG maintains a Do Not Rent list of customers who present significant risks to our business and/or personnel and who will be prevented from making a rental with us. These risks include fraud risks (such as non-payment or identity fraud), insurance (such as a higher risk of damage to the vehicle), criminal and anti-terrorism (such as theft or misuse of the vehicle) or other conduct risks (such as inappropriate or unacceptable behaviour towards ABG personnel). The information ABG processes to maintain this list includes:

• contact and personal details such as name and address, driver's licence number, details of membership of any of our loyalty scheme and customer account ID;
• information about why an individual is included on the DNR (such as non-payment of rental fees; having caused damage to rental vehicle; use of stolen ID; allowing unapproved drivers to use the rental vehicle etc.).

If you are included on Do Not Rent list, you will be notified by a letter to your home address, which will include why we have determined that you should be included on the DNR list and details of how you can challenge this decision. In addition, you can exercise your privacy rights in respect of your personal data which is processed for this purpose as described below.

If an individual is included on our Do Not Rent list, our affiliates and licensees will be informed of this when processing a booking or reservation. We do not share the contents of our Do Not Rent List with any other third parties such as other vehicle rental providers, or law enforcement unless required to do so by law.

LOYALTY PROGRAMS

If you decide to join one of our loyalty programs (such as Avis Preferred, Budget, Fastbreak, Perks Club or Maggiore Club) we will collect and retain your name, contact details, driver's license details, and date of birth to create your loyalty account for you in accordance with the terms and conditions of the relevant loyalty program.

PHOTOS AND VIDEOS

Where indicated by signage at the relevant location, ABG rental locations (including rental locations at airports and any airport shuttle bus service operated by ABG) are equipped with video security surveillance systems as well as cameras that record as our vehicles depart/enter our lots and record activity at the rental kiosk.

We may also receive photos or videos of you when you link your ABG account with your social media profile or when we receive a notice of a traffic violation that includes a picture or video.

SOCIAL MEDIA

We may let you share some of our online content on social media websites through hosted sharing links and icons.

We do not track or store a record of each time a third party shares our online content.

If you choose to participate in posting or sharing activities, you should remember that it may be viewed by the public via ABG’s website, in RSS feeds, APIs (application program interfaces) and may also be made available to other websites. As a result, your public activities may appear on third-party websites, blogs, or feeds. ABG is not responsible for the information that may be shared publicly.

Our websites may include social media features, such as the Facebook Like button. These features may collect your IP address, which page you are visiting on our website, and may set a cookie so that the Like button feature works properly. Any social media feature is governed by the privacy policies of the website providing the feature. We encourage you to read the privacy policies of any website you visit.

We also use social media companies to assist us with advertising and promoting our services.  This will involve information relating to you and your use of our website being disclosed to these companies.  Further details can be found in the Cookies Policy.

CONNECTED CARS

What Are Connected Cars and Connected Car Data?

A connected car is a vehicle equipped with features, telematic systems, on-board devices, or associated technologies that is capable of the collection of data about the vehicle and its use, including, for example, the vehicle’s condition; damage and accident records; performance, operation and diagnostic data; information on mileage, acceleration, velocity, fuel consumption, fuel level, tire pressure, odometer, location and direction, and other vehicle-related information (collectively, “Connected Car Data”). Further information about the categories of Connected Car Data collected by ABG are included in the table below.

While you are using one of our connected cars, all Connected Car Data that is directly or indirectly linked to you is your personal information (collectively, “Personal Connected Car Data”). Connected Car Data from our vehicles that cannot be linked to you is not your personal information.

How is Connected Car Data collected?

Connected Car Data is collected when you or any person (whether customers or our employees):

1. 1. uses a connected car (some information is also collected when that connected car is not being used by anyone);
   2. connects a device to the infotainment system of a connected car. To prevent the next driver from accessing your Personal Connected Car Data, please always unpair your device and delete any personal information that may be stored on the vehicle’s infotainment system upon returning the vehicle.

The Purposes for Collecting Personal Connected Car Data and Legal Basis for Processing

The following table describes the Personal Connected Car Data we collect, the purposes for which we collect it and the legal basis which we rely on to process this data. If we need to use Personal Connected Car Data for any permitted purposes not listed in the table below, we will notify you and explain the legal basis for processing. In addition to the processing outlined below, Personal Connected Car Data may also be disclosed or processed if required by law or it is necessary for dealing with a reasonable request by a law enforcement regulatory or competent authority body or agency.

Connected Car Data Collected

Purpose(s) for linking the Connected Car Data to you

Legal Basis of Processing the Personal Connected Car Data

Fuel Readings

1. We collect fuel readings to assist us in determining the fuel tank levels. These readings are taken at the beginning of your rental period (including when you leave the rental location) and when you return the connected car to one of our rental locations at the end of your rental period as well as when you enter or leave one of the locations identified using geo-fence technology.
2. Fuel readings will provide a more accurate reading of the fuel level when you collect the connected car from us at the beginning of your rental period. Fuel Readings also help us calculate any charges due for refueling the connected car to the level it was at when you collected it from us at the beginning of your rental period.
3. We also use fuel readings more generally to better understand fuel consumption rates and driving efficiencies across our fleet.
4. If you use our App, fuel readings will also be displayed on the App.

1. Performance of the Rental Agreement (points 1 and 2) (GDPR, article 6 (1)(b))

2. Legitimate interests (point 3 – to maximise the fuel efficiency and performance of our fleet and 4. Display of fuel readings on App) (GDPR, article 6 (1)(f)).

Diagnostic / maintenance information relating to the connected car (such as warning lights/tyre pressure/service requirements, oil life, etc.).

We collect diagnostic and maintenance information for the following purposes:

1. to efficiently schedule services, maintenance and repairs of the connected car;
2. to anticipate and, where possible, prevent breakdowns of the connected car;
3. to ensure that the connected car is in a roadworthy condition and to understand and assess any damage caused to the connected car during the rental period.

1. Performance of a Rental Agreement (points 1 and 3) (GDPR, article 6 (1)(b)).

2. Legitimate interests (point 2 – to maximise the efficiency and performance of our fleet and to seek to avoid breakdowns impacting your rental) (GDPR, article 6 (1)(f)).

Mileage Readings

We collect mileage readings at the beginning of your rental period (including when you leave the rental location) and when you return the connected car to one of our rental locations at the end of your rental period as well as when you enter or leave one of the locations identified using geo-fence technology. If you are a long term renter we will take these readings remotely on a periodic basis – usually monthly. We collect these mileage readings  for the following purposes:

1. to understand the mileage accumulated by the connected car and by you while driving;
2. to manage the mileage of connected cars across all of our rental agreements (including short term and longer-term agreements);
3. to facilitate the calculation of any mileage-related charges imposed on you in connection with an agreement you have with us;
4. to identify service and maintenance requirements based on mileage; and
5. if you use our App, to display mileage on the App.

1. Performance of a Rental Agreement (points 1, 3 and 4) (GDPR, article 6 (1)(b)).

2. Legitimate interests (point 2 – to maximise the efficiency and performance of our fleet and 5 – display of mileage through the App) (GDPR, article 6 (1)(f)).

Vehicle Commands (unlock etc.)

Where applicable, we will process the information you send as commands to the connected car for the purposes of allowing the connected car to carry out the relevant function associated with the command (for example, a request to lock/unlock the connected car). Some of the connected car features are turned on all of the time, even when other services or other media in the connected car are turned off.

1. Performance of a Rental Agreement (GDPR, article 6 (1)(b)).

GPS data, velocity, acceleration and sensor information

Our connected cars provide information relating to the location of the connected car. We collect a connected car's location data in compliance with legal requirements.

In addition, we use geofence technology to record whether the current location of the connected car is onsite at one of our rental locations or other locations identified using geo-fence technology or offsite.

The GPS location of the connected car is collected at regular intervals. The direction and speed, acceleration in each axis and sensor information of the connection car is also collected . We collect this information where permitted by applicable law including in relation to the establishment and defence of legal claims (e.g. in the event of an accident involving a connected car).

1. Legitimate interests (to ensure the security of our fleet and to record that the connected car has left/been returned to us and in relation to the establishment, exercise and defence of legal claims) (GDPR, article 6 (1)(f))

2. Consent (where required by applicable local law).

3. Processing is necessary for the establishment, exercise or defence of legal claims (where required by applicable local law).

GPS data collected when a connected car is not returned

In the unlikely event that a connected car is not returned to us following the expiry of your Rental Agreement we will need to try to contact the renter to locate the connected car in the event of the theft or suspected theft (and, if relevant, notify the police/ relevant authorities and / or our insurers). We will also process GPS data and the details you provided to us when you signed up to rent a connected car with us to attempt to locate and recover our connected car and to record that the connected car has left/been returned to the rental location.

The GPS location of the connected car is collected periodically and, in these circumstances, used in connection with our attempts to locate and recover the connected car.

1. Legitimate interests under GDPR (including to recover the connected car in the event of a theft, protection of property and monetary interests, clarification of potential criminal offenses) (GDPR, article 6 (1)(f) and where provided for under applicable local law).

2. Consent (where required by applicable local law).

3. Processing is necessary for the establishment, exercise or defence of legal claims (where required by applicable local law).

Details and nature of certain identified locations.

Using geo-fence and GPS technology when the connected car visits certain identified locations we can identify the nature of that location.  These locations include ABG rental and operational locations as well as certain identified airports, stations, docks, hotels, workshops and car impounds.

We use this information to:

1. protect our fleet against potential theft and/or loss of vehicles;
2. better manage the availability and distribution of our fleet including by allowing us to generate inventories of which vehicles are at our locations; and
3. record when a connected car leaves or is returned to our rental locations including to allow us to manage our check-out and check-in procedures.

1. Legitimate Interests (to ensure the security of our fleet, the efficient distribution of the fleet and to record that the connected car has left/been returned to us) (points 1 and 2) (GDPR, article 6 (1)(f)).

2. Performance of the Rental Agreement (point 3) (GDPR, article 6 (1)(b)).

3. Consent (where required by applicable local law).

Information collected by the connected car and the infotainment system (including details of your contacts, call history, and your music preferences).

If you connect your device to the infotainment system within the connected car the infotainment system will process your personal information to make the system's functionality available to you (for example, to play and store your music choices and preferences and to allow you to make calls and receive hands-free communications). This information is only collected if you choose to sync your device to the infotainment system.

We do not receive this information unless you do not remove your data from the infotainment system when you return the connected car to us. See below for further details.

Please note that other businesses (such as smartphone or music app providers) may also receive and use your personal information when you use infotainment systems. Please refer to the terms of use and privacy policies of those third party businesses.

1. Legitimate interests (to provide you with the services available as part of your rental vehicle) (GDPR, article 6 (1)(f)).

2. Performance of a contract ( GDPR article 6 (1)(b)).

Emergency calling (eCall)

Our connected cars may contain eCall technology. In the event of a serious accident, the eCall automatically dials an emergency number. eCall will only transmit the data that is absolutely necessary in case of an accident. Information only leaves the connected car in the event of a severe accident and is not stored any longer than necessary.

We do not get access to eCall data; the data is transferred directly to the governmental response point/ emergency services from the connected car.

1. Legal requirement (GDPR article 6 (1)(c))

We may also use Personal Connected Car Data for the purposes of determining whether a customer will be included in the Do Not Rent list of customers who present significant risks to our business and/or personnel and who will be prevented from making a rental with us. We will only use Personal Connected Car Data for this purpose to the extent permitted by applicable law.

We may aggregate or anonymize Personal Connected Car Data to create anonymous and therefore non-personal information. We may use this information for the purposes of improving our products and services, and we may engage a third party analytic provider to assist us with this. Where we process your Personal Connected Car Data in generating such non-personal information , we process this on the basis of our legitimate interests of improving and developing our products and services. The further processing of this non-personal information is no longer subject to the requirements of applicable data protection law.

Privacy button functionality (if available)

Some of our connected cars allow you to share or hide your location information (for example, by pressing the "privacy button", by sending an SMS to the connected car's manufacturer and/or by clicking through the privacy settings within the in-vehicle systems). The process for disabling location information varies between each car manufacturer and vehicle, so we recommend that you review your privacy settings each time you begin a journey.

If you are unsure how to change your privacy settings or if you prefer that your location information is not collected, please speak to a member of our team or contact your Rental Station Manager. We will explain how to use the privacy settings of the vehicle or do our best to provide you with an alternative connected car that will allow you to amend your privacy settings as you wish. We cannot guarantee that an alternative connected car will be available at the time of your rental.

Please note that regardless of the privacy settings, we will continue to process Connected Car Data (which may include Personal Connected Car Data) relating to the performance and operation of the connected car as set out in the above table, and this Connected Car Data will still be transmitted to the relevant manufacturer and ourselves.

Please note, if you choose to hide your location information, we may nevertheless request this information from the manufacturer of the connected car in the event of theft, suspected theft or if the return of the connected car is overdue in order to recover the vehicle and protect our legal rights.

You can enable the "privacy button" in your vehicle which will cease processing of GPS data as described in the table above (where this functionality is provided by the manufacturer or vehicle)

For further details of your rights in relation to Personal Connected Car Data please see the Your Rights and Choices section.

What other terms apply when you use connected car features?

Use of features in connected cars is subject to the terms and conditions posted by the vehicle manufacturer and/or the technology provider, which may include system and service limitations, warranty exclusions, limitations of liability, wireless service provider terms and user responsibilities. Some or all of these features are turned on at all times, even when other services or other media in the vehicle are turned off.

Vehicle manufacturers may also collect Connected Car Data from our vehicles pursuant to their privacy policy and share the Connected Car Data with us. You can review their privacy policy and other terms and conditions related to Connected Car Data on the applicable vehicle manufacturer’s website. Details on the features in your rental vehicle are set out in the “Vehicle Details” section of the Rental Agreement. We cannot guarantee that a vehicle without these features will be available at your time of rental.

Manufacturer in-built services or other manufacturer provided features and platforms may be included in your rental, and may also collect Connected Car Data that is shared directly with the manufacturer. In these circumstances, the manufacturer may also be a data controller of your Personal Connected Car Data. Please note, that Connected Car Data will first be received by the manufacturer of the connected car prior to it being received by us. We encourage you to read the privacy notices relating to these services to understand what Personal Connected Car Data is being collected and the purposes for which it is being collected. If you are unsure whether your connected car has such services, please speak to a member of our team or contact your Rental Station Manager.

How long do we retain Personal Connected Car Data?

We only retain Personal Connected Car Data for the amount of time necessary to perform the purposes for which it was collected. This means that some Personal Connected Car Data may be overwritten very quickly, however, in any event, we will retain Personal Connected Car Data for no longer than 7 years after the expiry of your rental agreement (unless there has been an insurance claim, accident or damage or there is an applicable legal or regulatory duty which requires us to retain the Personal Connected Car Data).

If you choose to sync a mobile device to the connected car (using Bluetooth, USB or otherwise) please ensure that you take the necessary steps to remove your information from the system when you return the connected car at the end of your rental period. If you do not do this, your information may be retained in the system. If you are unsure whether you have removed all of your information, please speak to a member of the team or your Rental Station Manager.

If you find that a previous customer has forgotten to delete their information please delete it immediately or speak to a member of the team or contact your Rental Station Manager.

THIRD PARTIES

Where you have a booking or other relationship with us we will combine the personal information we receive from you with other information we receive from other sources so we can provide you with a more customized and hassle-free experience. This personal information may include your name, contact information, travel itinerary, booking request and other personal information that is relevant to your booking. These third parties include:

• Travel agents or a third-party booking service that you used to make your reservation;
• Airlines;
• Hotels;
• Membership clubs;
• Payment card companies;
• Payment processing providers;
• Advertisers and other partners;
• Social media providers consistent with your personal information sharing settings on such services;
• Your employer or association if you are using a corporate / association account;
• Our licensees and our affiliates, in order to create a Wizard account or if you are making a booking in one location served by our affiliates or licensees for rental services in another location served by us;
• Police and other law enforcement agencies or toll authorities if you are involved in an accident during your rental, or suffer any loss, damage or theft of the vehicle, or if you incur any speeding, parking, toll or other traffic-related fines or commit any traffic offences during your rental;
• Parking stations or toll authorities if you incur any parking charges or fines during your rental; and
• Other third-party sources that are lawfully entitled to share personal information with us.

LOCATION INFORMATION

We may collect information about your location, which is personal information, from our websites, your mobile devices, and your visits to our locations. You may opt-out of our collection of information about your location from mobile devices at any time by turning off the transmission of geolocation data or push notifications on your mobile device or disabling cookies through your cookies settings or, where available, your preference settings in respect of our websites.

We also use Connected Car Data to collect information about the location of our rental vehicles. As explained above, all Connected Car Data (including location of the connected car) that is directly or indirectly linked to you is your personal information. Connected Car Data from our rental vehicles (including location of the connected car) that cannot be directly or indirectly linked to you is not your personal information.

NON-PERSONAL INFORMATION

We may aggregate, anonymize, pseudonymize, de-identify or aggregate personal information to create non-personal information.

We may use non-personal information for any and all purposes, and we may keep it for as long as we have a business need to do so.

B

HOW WE USE PERSONAL INFORMATION

We use the personal information we collect in order to:

• provide you with our Services such as renting a vehicle, including performing the vehicle rental contract as set out in our General Conditions of Rental, Location Specific Conditions and Rental Agreement, providing any requested optional extras, taking payment, pre-authorisations, and security deposits and providing discounts and offers or other benefits;
• provide you with additional features, functionalities and optional extras (for example, to provide remote lock/unlock, to remote disable engine/cancel ignition, and to automatically receive the vehicle location, odometer, fuel level and other information in connection with your rental);
• administer your rental, manage your rental records and to calculate your fees (for example, to automatically record the start of your rental, any exchange or upgrades, and the fuel or mileage usage and charges);
• otherwise perform our contract with you (for example the terms of any optional extra like insurance);
• provide online digital check-in and biometric verification;
• diagnose problems, analyze trends, and assess our performances;
• provide roadside assistance;
• improve our operations and Services;
• better understand how our vehicles are being used;
• tailor our Services and features to our customers;
• research and develop new features, products, and Services;
• maintain our fleet;
• enable third-party vehicle applications and features;
• improve road safety and reduce traffic;
• ensure the security of our or another’s premises, property or other assets;
• defend, protect or enforce our rights or applicable terms of service;
• prevent and detect fraud or the recurrence of fraud;
• assist in the event of an emergency;
• process medical disability personal information used to adapt vehicle/driver aid;
• where you have shared your device location with us and enabled push notifications, for providing certain services such as arrival and return notifications, providing information about vehicle location, available upgrades, etc.;
• allow you to take the benefits of membership of a loyalty program, including fast-track service at our rental counters, the ability to self-service elements of the rental through our App;
• provide you with further benefits to which you are entitled under a loyalty program such as free upgrades and free rentals;
• help us diagnose problems with our main computers or IT systems;
• for IT system administration;
• report aggregated information to our business partners;
• audit the use of our website;
• enforce compliance with our Website Terms and Conditions and to protect our Service, site, users or others;
• analyze trends in the aggregate and administer our website;
• to fulfill an order for a gift certificate or voucher including redemption of the gift certificate or voucher;
• respond to messages, queries, feedback or complaints;
• provide customer service functions;
• monitor calls and messages for quality control, training, and similar purposes;
• complying with health and safety requirements and policies;
• enforcing our legal rights and manage any dispute and legal claims and take legal or other professional advice;
• recover lost, stolen or towed rental vehicles;
• to prevent, detect, or investigate unauthorised use of our vehicles and systems and/or abuse or mistreatment of our staff and personnel and to protect against those risks, and ensure we comply with law and our policies;
• deal with any traffic, parking, toll or motoring fine or offense in accordance with the terms of your vehicle rental agreement with us;
• respond to legally binding requests from law enforcement, regulatory authorities or other third parties;
• establish, exercise or defend legal claims;
• comply with any legal obligation on us (for example, making any required notification of an incident to appropriate authorities or insurers); and
• comply with applicable law.

MARKETING

We will also use the personal information we collect, to the extent permitted by applicable law and with your consent (where required), in order to:

• send you marketing where you have given us your consent to receive marketing or we are otherwise permitted by applicable law to do so. This includes marketing promotions, discounts or offers from us or our selected third party partners via multiple channels (including electronically by email, by text, to your postal address or by push notification through our App);
• administer any contests, sweepstakes or other promotions. Personal information will only be used for these promotional purposes where you have chosen to enter the relevant contest, sweepstake or other promotion or we are otherwise permitted by applicable law to automatically enter you as a result of a rental or other purchase from ABG;
• analyse your interactions with us, including your rental related searches and behaviour to tailor, personalise and optimise marketing content;
• deliver referral programmes;
• tailor the communications we may send to you and/or the promotions we may offer to you as a member of the loyalty program from time to time;
• better understand our customer's preferences and improve and tailor relevant marketing or offers from us and our third party partners;
• where you have shared your device location with us and enabled push notifications, send you push notifications or other communications based on your location (for example, nearby special offers); and
• where you have shared your device location with us, to assess and analyse the effectiveness of physical advertising.

In addition, where you link your social media and personal device profiles such as Facebook or Twitter with your account with us (such as your Avis, Budget or Payless account) we will use this information (as permitted by applicable law) in order to:

• customize offers and deals on our website;
• send you relevant e-mail offers with special deals and discounts;
• send you relevant offers by mobile phone text messages;
• update your profile information on our website;
• allow you to publish check-in and check-out information to your linked social media accounts;
• allow you to share your upcoming trips with friends; and
• allow you to view your friends that have linked their profiles upcoming trips.

ABG may share personal information with third parties (as detailed in the Who We Share Personal Information With and Why section) to help us with our marketing and promotional projects, such as managing our social media pages, running contests, sweepstakes and other promotions, or sending marketing communications.

Don't want to receive promotional and marketing posts, emails and text messages or push notifications from ABG and our partners? No problem! You can withdraw your consent to direct marketing or tell us you do not want to receive such marketing at any time. See the Your Rights and Choices section to find out how.

INSURANCE PRODUCTS

In addition, if you have requested an insurance product from us during your rental, we will process your personal information in order to:

• enable the insurer to underwrite the relevant insurance product;
• process any claim under the insurance and assist the insurer in processing a claim;
• fulfill the terms of our agreement with you; and
• establish, exercise or defend any associated legal claims.

CONNECTED CARS

Please see the Connected Cars section above for details of why we process Personal Connected Car Data.

C

LEGAL BASIS OF PROCESSING

Under applicable law in the European Economic Area and the United Kingdom, there are a number of legal grounds that permit us to use personal information for the purposes stated within this Privacy Notice.

The legal grounds that apply to our use of the personal information are:

• that you provided your consent to us using your personal information for that purpose (for example, where you have given us your consent to send you electronic marketing) or, in relation to biometric verification, where you have provided your explicit consent;
• that we need to use that personal information in order to fulfill our contract to provide products or Services to you (for example, using your information for vehicle rentals or to join one of our loyalty programs such as Avis Preferred);
• that the processing is necessary for the purposes of our legitimate interests;
• where we need to comply with a legal obligation (for example, responding to government or law enforcement information requests); and
• where processing is necessary for the establishment, exercise or defence of legal claims.

Our legitimate interests for using the personal information are:

• to ensure effective administration and management of your relationship with us, including any rentals with us;
• to understand how our customers use our services and to manage our vehicle fleet;
• to operate and administer our services and business;
• to operate and administer our loyalty programs;
• to carry out research, development, and analysis on what services or products our customers want or how they would like to use or improve and develop our Services, products features and to develop new Services, products, and features and tailor Services to our customers;
• to understand how our customer use our Services and identify any issues in how the Services are used and how we can improve the customers' usage experience;
• to tell our customers about the various products and Services we can offer;
• to understand and respond to customer communications , operate our customer service functions and monitor calls and messages for quality control, training, and similar purposes;
• to better tailor and personalize the promotions and benefits that we can offer to our customers and to present promotions to, and market to, our customers;
• to prevent, detect, or investigate unauthorized use of our vehicles and systems and/or abuse or mistreatment of our staff and personnel and to protect against those risks and ensure we comply with the law and our policies;
• to recover costs of any loss or damage caused to a vehicle;
• to recover lost, stolen or towed vehicles;
• to undertake fraud and security checks and prevent/detect fraud;
• ensure the security of our or another's premises, property or other assets;
• enforce compliance with the applicable terms or service or Website Terms and Conditions;
• defend, protect or enforce our rights or applicable terms of service;
• ensure effective IT system administration and security;
• report aggregated information to our business partners;
• to enforce our legal rights and establish, exercise and defend legal claims;
• complying with health and safety requirements and policies;
• respond to legally binding requests from law enforcement, regulatory authorities or other third parties; and
• to manage any dispute, toll, parking fine, motoring fine, offence and accidents and take legal or other professional advice.

CONNECTED CARS

Please see the Connected Cars section above for details of which lawful basis we rely on in respect of Personal Connected Car Data.

WHO WE SHARE PERSONAL INFORMATION WITH AND WHY

Please see the Who We Share Personal Information With and Why section below for details of which lawful basis we rely on in respect of sharing personal data with certain third parties.

D

WHO WE SHARE PERSONAL INFORMATION WITH AND WHY

Categories of third party recipients

Purpose of disclosure

Legal Basis for Processing Personal Information

Independent licensees and network providers

• Make and confirm your rental reservation;
• Perform our contract with you;
• Understand how you use our services and improve our services;
• Provide our rewards program and update partner points and rewards;
• Connect with your corporate and commercial accounts;
• Assist with navigation assistance or itinerary planning;
• Provide customer assistance;
• Resolve toll, traffic or parking violations;
• Processing any claims relating to accidents and/or injuries;
• Providing roadside assistance services;
• To protect or defend the rights or well-being of us, our employees, customers or others, including through the Do Not Rent list; or
• Verify safe driver criteria for qualified drivers.

• Performance of Contract (GDPR, article 6 (1)(b));
• Legitimate Interests (GDPR, article 6(1)(f));
• Legal obligation (GDPR, article 6 (1)(c)); or
• Consent (GDPR, article 6 (1)(a)).

Travel agents or a third party booking service used to make a reservation including bookings through airlines and hotels

• Make and confirm your rental reservation;
• Perform our contract with you;
• Understand how you use our services and improve our services;
• Process payments and refunds;
• Assist with navigation assistance or itinerary planning;
• Provide customer assistance;
• Providing roadside assistance services; or
• To protect or defend the rights or well-being of us, our employees, customers or others.

• Performance of Contract (GDPR, article 6 (1)(b)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

Your employer or organisation

• Provide corporate/association program benefits;
• Understand how you use our services and improve our services;
• Verify driver’s licenses or other government identification;
• Verify eligibility to use designated account and discount codes;
• Connect with your corporate and commercial accounts; or
• Process billing, payments, and refunds.

• Performance of Contract (GDPR, article 6 (1)(b)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

Brokers

• Make and confirm your rental reservation;
• Perform our contract with you;
• Process payments and refunds;
• Provide customer assistance;
• Handle debt collection;
• Fraud check;
• Credit risk assessment and management; or
• Evaluation of the reliability and punctuality of payments.

• Performance of Contract (GDPR, article 6 (1)(b)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

Booking engines

• Make and confirm your rental reservation;
• Perform our contract with you;
• Understand how you use our services and improve our services;
• Verify eligibility to use designated account and discount codes;
• Process payments and refunds;
• To protect or defend the rights or well-being of us, our employees, customers or others;
• Fraud checks;
• Credit risk assessment and management; or
• Evaluation of the reliability and punctuality of payments.

• Performance of Contract (GDPR, article 6 (1)(b)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

Credit card issuers, Payment card companies, Payment processing providers

• Process payments and refunds;
• Fraud check;
• Handle debt collection;
• Credit risk assessment and management; or
• Evaluation of the reliability and punctuality of payments.

• Performance of Contract (GDPR, article 6 (1)(b)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

Corporate account manager

• Provide corporate/association program benefits;
• Understand how you use our services and improve our services;
• If you are renting with a corporate, membership or another similar commercial entity account, we may share personal information with the organisation that manages the account for their own purposes. We recommend you review their privacy policy to learn more about their privacy practices.

• Performance of Contract (GDPR, article 6 (1)(b)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

Marketing agent

• Provide our rewards/loyalty program and update partner points and rewards;
• Provide corporate/association program benefits;
• Understand how you use our services and improve our services; or
• To protect or defend the rights or well-being of us, our employees, customers or others.

• Performance of Contract (GDPR, article 6 (1)(b)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

IT service providers including IT platform providers and website analytics service providers, data hosters and aggregators and cloud vendors

• Understand how you use our services and improve our services;
• Support our IT systems and infrastructure;
• Provide maintenance services for our IT systems and infrastructure;
• Provision of data hosting and other data processing services; or
• Provide analytics services relating to your use of our website to identify any technical or user interface issues and/or improvements in connection with the website

• Legitimate Interests (GDPR, article 6(1)(f)).

Government, regulatory, police and other law enforcement agencies

• To verify your driver's license and ensure you meet our safe driver criteria;
• As requested by these agencies if the disclosure is required or permitted by law;
• To take action regarding illegal activities, traffic offences or violations of terms of service;
• If we have a good faith belief that there is an emergency that poses a threat to the safety of you or another person; or
• As otherwise required or permitted by law.

• Legal obligation (GDPR, article 6 (1)(c)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

Parking stations or relevant company or local authority operating parking and toll authorities

• If you incur any parking charges or fines or toll charges during your rental we will share personal data where required in relation to the relevant parking violation or toll charges; and
• Resolve toll, traffic or parking violations.

• Legal obligation (GDPR, article 6 (1)(c)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

Emergency services

• Protect your vital interests in the event of an accident or emergency involving one of our vehicles.

• Protection of vital interests (GDPR, article 6 (1)(d)).

Insurance companies and claims handlers in respect of any insurance product you purchase in connection with your rental

• Provide and service the insurance product you have requested; or
• Manage any claims that may be made under the relevant insurance policy

• Performance of Contract (GDPR, article 6 (1)(b)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

ABG Insurance providers

• Manage any claims that may be relevant under ABG insurance policies

• Legitimate Interests (GDPR, article 6(1)(f)).

Marketing, advertising and promotional partners

• To assist in managing our social media pages and running our advertising projects;
• To deliver tailored and dynamic marketing content;
• Provide you with contests, sweepstakes, and other promotions;
• Provide you with information about products and services you may like; or
• To assist in creating more relevant online advertisements for our websites and other websites that display our advertisements.

• Legitimate Interests (GDPR, article 6(1)(f)).; or
• Consent (GDPR, article 6 (1)(a)).

Our Customer Service Centers

• Provide customer assistance including answering any issues, or concerns or other queries you raise with us;
• Monitor customer communications for quality and training purposes;
• Assist with navigation assistance or itinerary planning;
• Resolve toll, traffic or parking violations;
• Processing any claims relating to accidents and/or injuries;
• Providing roadside assistance services;
• Assisting with the processing of payments and issuing of invoices;
• Assisting with the resolution of damage incidents of damage to vehicles;
• Assisting with queries regarding an individual's inclusion on the Do Not Rent list; or
• To protect or defend the rights or well-being of us, our employees, customers or others.

• Performance of Contract (GDPR, article 6 (1)(b));
• Legitimate Interests (GDPR, article 6(1)(f)).; or
• Legal obligation (GDPR, article 6 (1)(c)).

Avis budget group entities and their employees.

• Make and confirm your rental reservation;
• Perform our contract with you;
• Understand how you use our services and improve our services;
• Provide our rewards program and update partner points and rewards;
• Connect with your corporate and commercial accounts;
• Assist with navigation assistance or itinerary planning;
• Provide customer assistance;
• Resolve toll, traffic or parking violations;
• Processing any claims relating to accidents and/or injuries;
• Providing roadside assistance services;
• Assisting with the processing of payments and issuing of invoices;
• Assisting with the resolution of damage incidents of damage to vehicles;
• To protect or defend the rights or well-being of us, our employees, customers or others;
• To investigate, detect and prevent fraud, theft or other incidents relating to rentals and our vehicles;
• Assisting with queries regarding an individual's inclusion on the Do Not Rent list;
• Verify safe driver criteria for qualified drivers; or
• Administrative, management, accounting and reporting purposes.

• Performance of Contract (GDPR, article 6 (1)(b));
• Legitimate Interests (GDPR, article 6(1)(f));
• Legal obligation (GDPR, article 6 (1)(c)); or
• Consent (GDPR, article 6 (1)(a)).

If data includes criminal data:

• Preventing or detecting unlawful acts

Third party mapping provider

• To provide you with location-based services in connection with your rental.

• Performance of Contract (GDPR, article 6 (1)(b)).

Third party contractors and service providers including auditors, legal and other professional advisors, diagnostic service providers, backup and disaster recovery specialists, fraud detection and prevention services, ID and biometric verification providers and debt collection agencies.

• Provide services requested by you;
• Manage and protect the ABG business and its security;
• Detect and protect against fraud, theft or abuse;
• Provide customer assistance; and
• To collect any overdue payments from you.

• Performance of Contract (GDPR, article 6 (1)(b)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

If you rent a vehicle in Spain, personal data (including rental agreement number and vehicle registration number) will be shared with Spanish airport authorities.

• Vehicle registration number is shared to enable use of car park exit / entry systems; and
• Rental Agreement number is shared where required by the airport authority in relation to contractual arrangements with ABG.

• Legitimate Interests (GDPR, article 6(1)(f)).

If you rent a vehicle in Italy, personal data will be shared with the Italian centralized anti-fraud database managed by the National Association of the Car Rental Industry and Automotive Services (ANIASA).

• Protecting the ABG car fleet including prevention of theft, embezzlement and fraud; and
• Protecting ABG assets from use for illegal purposes.

• Legal obligation (GDPR, article 6 (1)(c)); or
• Legitimate Interests (GDPR, article 6(1)(f)).

We may also share personal information with third parties in the event of a merger or acquisition, consolidation, change in control, transfer of assets, bankruptcy, reorganization, or liquidation. To the extent that local laws require it, we will provide you notice on our websites or via e-mail of our intent to transfer personal information to a third party for this purpose.

In addition, we will share personal information with organizations if we believe in good faith that the disclosure is necessary in order to meet any applicable legal, regulatory or other enforceable governmental or regulatory request or order, detect, prevent or otherwise address fraud, security or technical issues and to protect against harm to the rights, property or safety of us or our group as required/permitted by applicable law.

We may share non-personal information, including Connected Car Data that does not relate to you or your passengers and aggregated/anonymized data, with our third party service providers and partners as reasonably necessary to meet our business needs.

Please note that some of the third parties we share your personal data with act as data controllers such as our independent licensees, travel agents and third party booking services, your employer or organisation, credit card issuers, card providers, payment processors, government, regulatory, police and other law enforcement agencies, parking stations, toll authorities, insurers and other Avis Budget group entities. This means these organisations will process your personal data for their own purposes. Please review the privacy notice of the relevant third party for further information. For example, where we provide your personal data to our third party provider for the purposes of processing transactions and ancillary services that third party provider will also act as a data controller.

INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

In operating our business and providing Services you request, we may transfer personal information internationally.

Transfers

As we offer the ability to rent vehicles and benefit from our Services in many locations globally, we will transfer personal information to our affiliates, independent licensees and travel agents in these locations for the purposes of fulfilling your rental request and/or entering into a rental agreement and dealing with customer service issues. Further purposes of processing are set out in the Who We Share Personal Information With and Why section above. The exact location of where personal information will be transferred depends on the location of your rental. A list of these locations is available on your local ABG website. Where these transfers are made, personal information will be stored with the affiliate, independent licensee or travel agent locally.

Given the global nature of our business, we also transfer personal information within the group companies of Avis Budget Car Rental, Inc. as for certain activities the group uses shared IT functions and customer service capabilities. In addition our data centres are located in the UK and US and customer service centres located in USA, UK, Mexico, Philippines, Hungary and Spain.

Your personal information may also be transferred to, and stored by, IT vendors who operate on our behalf. This personal information will be shared with our booking engine hosting provider located in the United States and IT service provider located in India. We also transfer personal information to marketing providers – such as CRM and marketing service providers. These providers are primarily located in the United Kingdom, Canada and United States.

The purpose of the disclosure and legal basis of processing is set out in detail in the Who We Share Personal Information With and Why section.

How we ensure your personal information is kept safe

We only transfer personal information in accordance with applicable data protection laws regarding the international transfer of personal information. We ensure that adequate safeguards are in place including, where required, by putting in place standard data protection clauses.

Many of the countries to which your personal information may be transferred for these purposes that are located outside the European Economic Area (or, for users located in the United Kingdom, countries located outside the United Kingdom or the European Economic Area) and do not benefit from an adequacy decision issued by the EU Commission (or UK Government / Information Commissioner's Office for UK transfers) regarding protection afforded to personal information in that country.

Adequacy of data protection is ensured by standard data protection clauses that we may have in place with the relevant recipient. A copy of these standard data protection clauses may be downloaded on the European Commission’s (for EU standard data protection clauses) or Information Commissioner's (for UK standard data protection clauses) website or requested via our Data Protection Officer at the address set out in the Data Controllers and Contact Details By Country section. Alternatively, these transfers are made because they are necessary for the performance of a contract to which you will be a party, or for pre-contractual measures.

E

HOW LONG WE KEEP PERSONAL INFORMATION

We have set out how long we will typically keep certain types of personal information in common scenarios below:

Category of personal information

Examples

How long we will keep this personal information

Customer and member records for administration and management

Records relating to the administration and management of customers and members. These records would include information used for the management of our relationship with customers including customer profiles, transactional history, customer preferences, personal information and satisfaction survey forms.

We will keep this personal information for at least 6 years after they cease to be an active customer.

Customer and member relations

Records related to customer (and member) issues, business dealings and the actions taken by ABG, its business units or subsidiaries including general customer relations as well as complaints. This includes Call reports, Change of Address Forms, E-Mail Correspondence and Dispute Resolutions, Notification of Customer Dispute, Supporting Documentation, ABG Response to Customer Dispute, Lost and Found documentation, i.e., register of items, contact with customer, etc.

We will keep this personal information whilst the complaint or incident is under investigation or until the issue is resolved and for between 6 and 10 years after this period depending on the applicable jurisdiction.

For incidents involving minors this information is kept for between 6 and 10 years after the age of majority i.e. 18 years of age plus 6-10 years.

Customer cardholder transaction information

Cardholder Data including primary account number (PAN). PAN is the 15- or 16-digit number on the front of credit and debit cards.

Please note we do not store: (a) Personal Identification Numbers (PIN); (b) encrypted PIN blocks; (c) full contents of any track from the magnetic stripe on the back of the card; and (d) Card verification codes. This is additional data that may be transmitted or processed as part of a payment transaction, but will not be stored at any time by ABG.

The Primary Account Number or PAN will be retained for no longer than 15 months from the date of return of your rental vehicle.

We will either keep this personal information:

• for at least 15 months starting on the date of the last transaction; or
• if you are an Avis Preferred or Fastbreak customer or member of another of our loyalty schemes we will keep this personal information for as long as you have a profile with us.

Marketing data

These records would include information used for direct marketing by email, post or via push notifications through the ABG App to customers/potential customers including name, address, email address, customer profiles, customer preferences, and opt-in status.

We will keep this personal information for at least 3 years from the date the customer provides these details.

Avis loyalty program information

Customer information associated with an Avis loyalty scheme account.

We will keep this personal information for the duration of the loyalty scheme membership and for at least 6 years after the expiry of the membership, which is 6 years from the end of the year in which the customer’s membership expired.

For other categories of personal information, the criteria we use to determine the retention period is as follows:

• the length of time that you are a member of Avis Preferred or any other loyalty scheme that we operate or a member of any corporate programme;
• when your most recent rental occurred;
• whether there are contractual or legal obligations that exist that require us to retain the data for a period of time;
• whether there is an ongoing legal claim that relates to any rental you have made with us, or that is otherwise related to your relationship with us;
• whether any applicable law, statute, or regulation allows for a specific retention period; and
• whether the personal information is considered to be a special category of personal information, in which case a shorter retention period generally would be applied.

These criteria may also mean we adjust the period of time we retain the categories of personal information detailed in the table above.

For more information about the retention of Personal Connected Car Data, please see the Connected Cars section.

F

HOW WE PROTECT PERSONAL INFORMATION

The security of personal information is important to us. We take reasonable steps aimed to ensure personal information is protected from unauthorized use, access, disclosure, alteration, destruction or loss. Firewalls and encryption are used to protect your more sensitive personal information. You are responsible for keeping your account safe. Do not share your passcode, membership and pin numbers with anyone. Please be mindful that hackers and scammers may impersonate us or our website. For more information about phishing, please visit https://www.ncsc.gov.uk/collection/phishing-scams . If you suspect unauthorized use or security breach of your personal information related to us, you must notify our customer service as soon as possible! To the extent permissible by applicable law, we are not responsible or liable for any loss or damage if your account passcode, membership numbers, and pin numbers are stolen or used inappropriately.

We do not ask for financial or payment information, such as credit card number, passcode, account number or pin number, in an e-mail, text or any other communication that we send to you. We will only take payment details by phone, through our website or in person at one of our rental locations. Please always check that any website on which you are asked for financial or payment information in relation to our rentals or services is operated by ABG or its affiliates. If you do receive a suspicious request, do not provide your information and report it by contacting one of our customer service representatives as set out in the Contact Us section.

G

YOUR RIGHTS AND CHOICES

You may have – in accordance with data protection laws applicable in the European Economic Area and the United Kingdom – the following rights when it comes to our handling of your personal information:

• Right of access – you may have the right to request a copy of the personal information we have about you and to request supporting information explaining how the personal information is used;
• Right of rectification – you may have the right to request that we rectify inaccurate personal information about you;
• Right of erasure – you may have the right to request that we erase personal information about you;
• Right to restrict processing – in some situations, you may have the right to request that we do not use the personal information you have provided (for example, if you believe it to be inaccurate);
• Right to data portability – you may have the right to receive your personal information in a structured, commonly used and machine-readable format and to transmit such information to another controller;
• Right to withdraw consent – where we process your personal information based on consent (including direct marketing consents), you have the right to withdraw consent at any time. However, this will not affect the lawfulness of the processing based on consent before its withdrawal. Furthermore, even in case of a withdrawal we may continue to use your personal information as permitted or required by law;
• Right to object – where we are processing your personal information based on a legitimate interest (or those of a third party) you may challenge this. However, we may be entitled to continue processing your personal information based on our legitimate interests or where this is relevant to legal claims. You also have the right to object where we are processing your personal information for direct marketing purposes.

In addition, if specifically provided for under your local law, you will have a right to define post-mortem guidelines – meaning you may define guidelines regarding the storage, erasure, and disclosure of your personal information after your death.

To exercise any of these rights, please click here.

You can also get in touch with our Data Protection Officer at the address set out in the Data Controllers and Contact Details by Country section if you should have any concerns about how we process your personal information.

You are also free to lodge a complaint with the supervisory authority, should you feel that we process your personal information in a way that is against applicable law.

If you are included on the Do Not Rent list, you will be notified by a letter to your address, which will include why we have determined that you should be included on the DNR list and details of how you can challenge this decision in addition, you can exercise your privacy rights in respect of your personal information which is processed for this purpose as described above.

MARKETING

If you want to opt-out of receiving promotional and marketing emails, text messages, post and other forms of communications from ABG or our promotional partners in relation to which you might receive in accordance with the Marketing section, you can opt-out by using one of the following mechanisms:

• Log into your account and update your profile.
• Click "unsubscribe" at the bottom of an email we sent you.
• Go to our Contact Us section to email the customer service representative.
• To stop receving promotional push notifications via our ABG App adjust the settings on your mobile device.

If you do opt-out of receiving promotional and marketing messages, we can still contact you regarding our business relationship with you, such as account status and activity updates, survey requests in respect of products and services we have provided to you after you rent from us, reservation confirmations or respond to your inquiries or complaints, and similar communications.

Want to close your account, stop doing business with ABG, or otherwise opt-out of ABG collecting, using or disclosing your personal information? We will be sorry to see you go. Please contact our customer service representatives in accordance with the Contact Us section.