AvantCar (hereinafter referred to as AvantCar or data controller) is aware of the importance of your privacy, which is why we are committed to protect the confidentiality of personal data of our customers.
We assure you that your personal data, captured on our webpages or through doing business with you, will be collected, processed, protected and stored in compliance with the applicable legislation (the General Data Protection Regulation - GDPR) and national laws of the Republic of Slovenia (the respective applicable law on personal data protection, the Electronic Commerce Market Act and Personal Data Protection Act) and in accordance with the provisions of the present Privacy Statement (hereinafter referred to as the Statement).
The controller of your data is AvantCar d.o.o., Dunajska cesta 140, 1000 Ljubljana, email address firstname.lastname@example.org, and phone number 01 589 08 50.
Since your privacy is particularly important to us we have appointed a person fully empowered to protect personal data whom you can contact when you have any questions concerning the processing of your personal data processing. This person can be reached at the email address email@example.com.
Strict confidentiality shall apply to all the topics and contents dealt with by the person fully empowered to protect personal data.
Personal Data Collection
You can visit AvantCar’s website without any identification or submission of personal data. However, on some webpages, applications or reservation systems you are required to enter your personal data, e.g. email address, name, home or office address, phone number and other data so that we can carry out your order or request.
Personal data is any piece of information which identifies you as an identified or identifiable data subject. A data subject is identifiable when it is possible to identify him or her directly or indirectly, in particular by stating identifiers such as name, ID number, location data, online identifier or by stating one or more factors which are characteristic of a data subject’s physical, physiological genetic, mental, economic, cultural or social identity.
You can either submit your personal data to us or they are collected in the following cases:
use of rent-a-car services,
use of the car-sharing system and Avant2Go application,
use of the FMG system (“Fleet Management”),
use of customer support centre,
use of online contact forms and other communication with us,
participation in our online surveys and marketing campaigns,
your application for subscription to e-news,
if you send us a job application.
Following are the data we collect according to individual programs of the AvantCar Company:
data on the customer: name and family name, personal registration No., to wit, date of birth, tax ID number – optional, home address, phone number, email address – optional, your office within a legal entity – optional;
data on the to-date services – purchases;
driving licence – scanned (validity date, driving licence number);
credit card (holder’s name, credit card number, validity date, CVC Code).
data on the customer: name and family name, personal registration No., to wit, date of birth, tax ID number, home address, phone number, email address, employed/unemployed;
data on the to-date services, history of purchases, financial transactions carried out, method of payment (credit card, personal payment, package), cash in hand (bank balance);
driving licence (validity date, driving licence number);
credit card: holder’s name, the last 4 digits of the credit card, validity date;
location data: GPS location of the vehicle at the time of its being rented, events in relation to the vehicle rental (vehicle locking / unlocking time, vehicle’s location when rented, vehicle’s location when dropped off, journey time, mileage).
data on the customer’s driver (company): name and family name, phone number, email address;
data on the to-date services;
driving licence – scanned (validity date, driving licence number).
The accuracy and truthfulness of the personal data and contact information are the exclusive responsibility of data subjects. The obtained contact information is used either to contact a user when necessary or when a user wishes to contact us. Furthermore, your contact information (email address, phone number, postal address) can be processed based on our legitimate interest for the basic adapted communication with you trying to present you appropriate services and/or products which you may find interesting on account of your past interactions with us.
You can unsubscribe, free of charge, from this type of communication by sending a respective message to our email address firstname.lastname@example.org. AvantCar will attend to your request be complied with without delay.
Further information about your rights in relation to direct marketing is available in the section entitled Your Rights.
Certain AvantCar’s webpages, services, products and activities require a password to be accessed. Users are directly responsible to keep their passwords confidential.
Purpose and Legal Grounds for Personal Data Processing
Personal data and contact information shall be used solely for the purposes for which they have been submitted in compliance with your consent. On each separate occasion we will inform you beforehand of personal data collection and of the purpose thereof. Should we collect and use your personal data for any other purposes than those for which you have submitted them to us we will contact you in order to obtain your consent.
Use of services within the programs Rent-a-car, Avant2Go, Fleet Management
The purpose of personal data collection within the Rent-a-Car, Avant2Go and Fleet Management programs is to ensure the data collector’s services, user assistance and direct marketing of a service (keeping you updated about new packages, user experience-significant communication).
The legal grounds for data collection within the above-mentioned programs are:
sub-clause (b) of the first paragraph of Article 6 of the GDPR: data processing is required for the purposes of carrying out matters relating to the contract;
in case of GPS tracking (Avant2Go): the basis for processing is our legitimate interest: sub-clause (f) of the first paragraph of Article 6
in case of direct marketing: consent of a data subject or our legitimate interest (when ads are sent to our customers who have been informed beforehand of the possibility)
Use of Online Contact Forms, Customer Support Centre and Other Communication with Us
After you have either filled in our online contact form or have sent to our contact information (address, email address, phone number), posted on our webpage, a question or demand or you have called us with respect to our services and/or products, namely, when you need support for the use of services and/or products, your personal data will be processed solely for the purposes of preparing an answer to your question, carrying out a concluded contract, eventually preparing and entering into a contract and answering your question.
Solely the data you have submitted voluntarily are collected for this purpose. All the data collected on our webpages or communicated to us in some other way are collected for the purposes of ensuring our services, managing our operation and for internal administration. The legal grounds for processing these data are our legitimate interests and/or entering into a contractual relationship with you.
Subscribing to Electronic News
On our webpage or by answering the email you have received, you can also subscribe to topical news and information about special offers and novelties concerning our services. For this purpose of direct marketing we can inform you on the novelties in our offer by email. You will receive such email from time to time and when necessary.
These data are processed on the basis of your express consent in which case the consent to receive electronic ads can be withdrawn: send us a respective message to our email address email@example.com. Further information about your rights in relation to direct marketing is available in the section entitled Your Rights.
Sending Us a Job Application
If you use our contact information to send us a spontaneous job application, the data thus submitted (e.g. a motivation letter and CV, papers documenting that the conditions have been met) are controlled by you.
We undertake to process your personal data solely for the following purposes: to carry out the procedures of selecting eventual candidates for the jobs, contact you about having or not having been selected, invite you for a job interview, prepare a possible employment contract draft and defend our claims in case of a dispute resulting from an alleged discrimination while the selection procedure was being conducted. These personal data need to be processed so that we can apply measures prior to concluding a possible contract with you.
Participation in Our Online Surveys and Marketing Campaigns
Your personal data are processed exclusively for the purposes of your participation in our online surveys and marketing campaigns.
Solely the data you have submitted voluntarily are collected for this purpose. All the data collected on our webpages or communicated to us in some other way are collected for the purposes of ensuring our services, managing our operation and for internal administration.
The legal grounds for data collection by reason of the participation in our online surveys and marketing campaigns: sub-clause (a) of the first paragraph of Article 6 of the GDPR – the processing of the data is possible on the basis of an express consent by the data subject.
Care for the Personal Data Security
AvantCar is subject to protection of data which you have submitted to us by using our Rent-a-Car, Avant2Go, Fleet Management programs and webpages, via communication channels or in any other way.
Unauthorised access to the data, their use and disclosure are prevented via numerous security technologies and procedures.
Should the need arise, SSL protocol is used on our webpages in order to increase the security of sensitive data when they are being transferred. AvantCar stores the data in continuously controlled computer systems with limited access at controlled points.
When there is no further need to manage the data, i.e. the purpose of the collected data has been achieved, the data are immediately anonymised or irreversibly and permanently erased.
Should our webpages have a link to other websites that have nothing to do with us, we do not assume any responsibility as to the protection of your data on these websites.
Disclosure of Personal Data to Third Parties
Without their consent, AvantCar will not forward the personal data of its customers to any unauthorised natural or legal person. We reserve the right to access and disclose personal data to ensure compliance with the law, meet legal requirements, and use the data in legal procedures or to protect the rights and property of the AvantCar Company.
When cooperating with other companies (contractual data processors), which carry out special services for AvantCar, AvantCar enables them to access those data which are indispensable for their work. These providers are contractually bound to safeguard the privacy of these data and may use them solely to carry out their work. The above-mentioned contractual data processors safeguard the transferred data, they do not store them and they process them exclusively on our behalf and within the limits of our authorisation. The contractual data processors are entitled to use the transferred data solely within the scope of performing their work.
Within the framework of legislative powers, your personal data can be disclosed to the following data users:
accounting services, law firms and other providers of legal and management consulting services;
providers of files and data carriers erasure services;
providers of informational technology services within the framework of servicing and maintenance;
an administrator or a webmaster;
cloud computing services providers and email services providers;
providers of the customer relationship management systems.
We undertake that neither we nor other users will transfer your personal data to a third country outside the European Union and/or the European Economic Area or to an international organisation without a proper degree of protection.
In some particular instances, your personal data can be transferred to the USA in which case all our contractual data processors in the USA are included in the EU-USA Privacy Shield program.
Personal Data Retention Period
The data controller undertakes to store and use the collected data only until the purpose, for which individual data were obtained and used further, has been achieved. After the retention of data period has expired, your personal data will be either efficiently and permanently erased or anonymised.
The data that are processed on the basis of law are kept for the period laid down by law. The data that are processed so that our contractual relationship with you can be carried out are kept for the period necessary to implement the contract and for the legal statute of limitations concerning any claims resulting from the so concluded contract, with the exception of a dispute in relation to the contractual relationship.
The personal data that are processed on the basis of your consent or legitimate interest, e.g. sending electronic news, are kept until you withdraw your consent in which case we undertake to review the existence of the data processing purpose at regular intervals. The data will only be erased prior to the withdrawal if the purpose they are processed for has been achieved (e.g. if electronic ads are no longer sent) or if it is so provided by law.
The data retention period for the Rent-a-Car, Fleet Management and Avant2Go programs is 5 years following the completion of the business (general legal statute of limitations for claims of damages). If for certain data processed for the purpose of carrying out our contractual relationship there is a different data retention period (e.g. accountancy and tax data) the retention period is 10 years. During this period the processing of data is restricted.
Your spontaneous job application will be kept for up to two years; should we ask you to come for a job interview it will also be kept for the entire time of the employment procedure and 30 days after you have received a notice about you having or not having been selected, to wit, for the time of an eventual court proceedings. If we think your job application may be interesting for another job role and would like to keep it longer, we will inform you thereof beforehand and ask for your consent.
AvantCar’s websites (www.avantcar.si, www.avant2go.com) and mobile applications use the so-called cookies which enable the user to display and use our webpages adapted to their requirements. A cookie is a small text file which is stored by the web server on your computer’s disk. Its main purpose is to store your settings and other data in your computer so that you do not need to enter them again when you next visit our websites.
Contrary to a common belief, cookies do not contain software programs, so they cannot install anything on a computer, consequently they cannot infect your computer with a virus. Cookies do not enable us to access your system or personal data.
AvantCar also collects data on your use of our websites, mobile applications and services. Our website-analysis tools enable us to obtain – from your browser – information about which website you have accessed from, through which browser and key words you have found us, which webpages and data you have visited on our website, what width and height your computer is. By using various tracking technologies we can collect information about which of our webpages you visit and what links you click and whatever else you do on our webpages. In addition, we collect the usual information the browser sends to each visited website, e.g. IP address, type and language of the browser, time of access and website addresses.
Furthermore, our websites use plug-ins for social networks such as Google+, Facebook, Pinterest, Twitter, Linkedin (“plug-ins”). We need your consent to use plug-ins.
When you use a plug-in service the data can be directly transferred from your device to the social network operator. We have no influence on the data collected by a plug-in. If you are logged in a social network, your use of the service can be linked to your account in the social network. If you interact with plug-ins, e.g. by clicking likes, following others or sharing with them, entering a comment, these data can be automatically shown on your social network profile. Even if you are not logged in a social network, it is still possible that plug-ins send your IP address to the social network operators. You are kindly asked to take this in consideration when using our services.
We want to point out explicitly that we have no influence on the scope, nature and purpose of your personal data processing which is carried out by the provider of a social network services, consequently please refer to the privacy policies of the social network services providers.
Freedom of Choice
It is you who control the data you have submitted to us. If you decide not to submit us certain data, you will not be able to access certain websites, namely functions on our websites; moreover, in such cases we will be able neither to answer your demands nor contact you with respect to your job application.
If your personal data are changed (postal code, email address, address, phone number etc.), you are kindly asked to send us respective message to the email address firstname.lastname@example.org.
The data controller assures you a consistent implementation of all your incidental rights in connection with your personal data processing on the basis of applicable legal regulations.
As a data subject you shall have the following rights:
Right to withdrawal of consent: If, as a data subject, you have given your consent to the processing of your personal data (for one or several purposes), you shall have the right to withdraw the consent. The withdrawal of consent has no impact on the legality of data processing having been carried out prior and up to its withdrawal.
You can withdraw, free of charge, your consent at any time by sending a written statement to the data controller’s email address email@example.com. Neither legal consequences nor sanctions ensue from the withdrawal of the consent.
Right to access personal data: As a data subject you shall have the right to get a confirmation from the data controller whether your personal data are processed or not. If they are, you shall have the right to access your personal data (i.e. including copying them) and to be given the information concerning your personal data processing (e.g. the purpose of processing, type of data, users your personal data have been or will be transferred to, anticipated data retention period, technical and organisational measures on data protection, existence of automated decision making, including profiling etc.).
Right to rectification: As a data subject, you shall have the right to be given the possibility to rectify the inaccurate and complement the incomplete personal data. To this end, you shall have the right to submit to us a complementary statement with updated personal data.
Right to erasure (i.e. right to be forgotten): You shall have the right to obtain from the data controller to take steps without undue delay to erase your personal data if one of the reasons given in Article 17 of the General Data Protection Regulation exists (e.g. if the data are no longer required to serve the purpose they have been collected for or processed in some other way; if you have withdrawn your consent and there is no other legal grounds for the data processing; if you contest the data processing and there are no overriding legitimate interests for the data processing; if the data have been processed unlawfully etc.).
Right to restriction of processing: The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
- the accuracy of personal date is contested by the data subject, for a period the controller can verify the accuracy of the personal data;
- the processing is unlawful and the data subject objects to erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has contested to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
Right to data portability: As a data subject you shall have the right to receive the personal data in a commonly used and machine-readable format and have the right to transmit those data to another controller, when the processing is based on consent or on a contract or is carried out by automated means.
Right to object: If data processing is based on our legitimate interests, you shall have the right, according to the reasons concerning your particular position, to object to the processing of your personal data at any time. In such case, we will continue processing your personal data provided that we prove the existence of compelling legitimate grounds for processing them which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where your personal data are processed for direct marketing purposes, you shall have the right to object at any time, free of charge and without giving any reasons, by sending us a message to our email address firstname.lastname@example.org. If you object to your personal data being processed for direct marketing purposes, we will immediately stop processing them for these purposes.
Furthermore, we will, upon your request, provide you in compliance with applicable law other information concerning your personal data which we process.
Right to lodge a complaint: If you believe that infringements of personal data protection legislation have occurred during the processing of your personal data, you shall have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia, Zaloška 59, 1000 Ljubljana, Slovenia, phone number 00 386 (0)1 230 97 30, email address email@example.com.
Privacy Statement Modifications
Privacy Statement was last updated in May 2018. The present Statement can be updated in compliance with respective applicable law, with our modified services and on the basis of users’ feedback. All modifications of the Statement will be posted on the website including the update of the date of the last modification.
In case of substantial modifications we will inform you thereof through a direct message, namely, in a conspicuous position.
Your Questions and Suggestions
Should you have any questions, reservations or suggestions concerning our collecting, using and disclosing your personal data, you are kindly asked to submit them to us via the online contact form or contact the person fully empowered to protect personal data at the email address firstname.lastname@example.org.