Dear clients,
Please read the following Privacy Policy prior to registering your user account on XDRIVE application. By registering and using our services via XDRIVE application, you confirm that you have read and understood the conditions under which we process your Personal data and that you have accepted this Privacy Policy.
I. General Information on Collector of Personal data
XPERTIZE LTD with its registered seat in London, 85 Great Portland Street, United Kingdom, registration number: 15584873 (hereinafter: “the Controler”) respects and protects Personal data of all its clients whose Personal data is processing.II. Basic terms
“Personal data” is any data relating to a natural person whose identity is determined or determinable, directly or indirectly, in particular on the basis of an identity marker, such as name and identification number, location data, identifiers in electronic communication networks or one, i.e., more features of his/her physical, physiological, genetic, mental, economic, cultural and social identity (hereinafter: “Personal data”);„Person to whom the data refer“ is a natural person whose Personal data is processed (hereinafter: „the User“ or „You“);
„Personal data processing“ is any action or set of actions performed automatically or non-automated with Personal data or their sets, such as collecting, recording, sorting, grouping, i.e. structuring, storing, matching or changing, revealing, viewing, using, disclosing by transmission, i.e. delivering, duplicating, disseminating or otherwise making available, comparison, restriction, deletion or destruction (hereinafter: „Processing“);
„Controller“ is a natural or legal person, i.e. an authority that independently or together with others determines the purpose and method of Processing;
„Recipient“ is a natural or legal person, i.e. a government body to which Personal data has been disclosed, regardless of whether it is a third party or not, unless it is a government body that, in accordance with the law, receives Personal data as part of research of a specific case and process this data in accordance with the rules on the protection of Personal data related to the purpose of Processing;
„Consent“ of the person to whom the data refer, is any voluntary, specific, informed and unequivocal expression of the will of that person, by which that person, by statement or clear affirmative action, gives consent to the processing of Personal data relating to him/her;
„Commissioner for Information of Public Importance and Personal data Protection“ is an independent and autonomous authority established on the basis of the Law, which is responsible for supervising the implementation of the Law and performing other tasks prescribed by law (hereinafter: „the Commissioner“);
„XDRIVE application“ is an Android and IOS application that enables its users to aquire rent-a-car services which are provided by XPERTIZE LTD (hereinafter: “XDRIVE application”);
“Service” is rent-a-car service provided by XPERTIZE LTD to the users of the XDRIVE application (hereinafter: “Rent-a-car service”).
III. Personal data that the Controller is Processing
Personal data that the Controller is Processing are as follows:- Name and surname;
- ID card number and driver’s license number;
- Passport number and date of issuance;
- e-mail address;
- Phone number;
- Your photo and photo/copy of your ID card/passport and driver’s license;
- Credit card number and its expiration date;
- Geolocation data.
Personal data is collected directly from you.
Without providing any of the above listed Personal data, except geolocation data, will unable any potential user to register his/her account on XDRIVE application and thus use Rent-a-car service, i.e. providing the required Personal data is necessary for conclusion and performance of the Rent-a-car contract.
IV. Тhe Purpose of the Intended Processing and the Legal Basis for the Processing
The Personal data is being processed for the following purposes:- Creation of your user account on the XDRIVE application;
- Concluding and performing the Rent-a-car service contract via XDRIVE application;
- Your identification as the true user of the XDRIVE application and to prevent any potential abuses in using the XDRIVE application (e.g. preventing others from creating an account on the Аnygo application using your data etc.);
- Processing the payment for provided services;
- Fulfillment of Controller’s legal obligation in accordance with Article 110, paragraph 2 of the Law on tourism;
- Protection of our legitimate interests – protection of our property, i.e. cars in case they are stollen.
To create your user account on the XDRIVE application, you will be requested to enter your name and surname,your e-mail address and phone number. The rest of Personal data listed under Article IV of this Privacy policy, except geolocation data, is collected through photographs/copies of your ID card/passport and your driver’s license which must be provided through the process of registration on XDRIVE application.
Personal data including name and surname, ID card number and driver’s license number, gender, date of birth, address of residence, passport number and date of issuance, citizenship, phone number and your e-mail address is necessary for creating your user account on the XDRIVE application and, at the same time, is necessary for concluding and performing the Rent-a-car contract via this application. In addition, Personal data processed based on your consent as well, given prior to providing this data in the process of registering a user account on the XDRIVE application.
In accordance with the Article 107 paragraph 1 point 14 of the Law on tourism, the Controller is obliged to keep records of provided rent-a-car services. In accordance with the Article 110 paragraph 2 of the same law, this record must contain name and surname and contact data of the service user. Therefore, collecting this Personal data is necessary in fulfilling Collector’s legal obligations stipulated under the Law on tourism.
Your photo, unique identity number of citizens and place of birth, are processed to confirm your identity in the process of registering your user account on the XDRIVE application. The purpose of this is to prevent any potential abuses in using the XDRIVE application (e.g. preventing others from creating an account on the Аnygo application using your data etc.). Processing of this data is done based on your consent that is provided via XDRIVE application prior the beginning the process of registration.
Credit card number and its expiration date is necessary for concluding and performing the Rent-a-car service contract via XDRIVE application, i.e. for charging the User for the provided services.
Each of our cars that can be rented is equipped with a GPS tracking device, and therefore we might collect data on the car’s location while the rent-a-car service is being provided. This is necessary for protection of our legitimate interests – protection of our property (e.g. in case the car is stolen). Processing of this data is done based on your consent that is provided via XDRIVE application prior the beginning the process of registration.
V. Recipients of Personal data
We may disclose Personal data, if necessary, to our employees, insurance service providers, to the ministry in charge of tourism affairs as well as to any other state and/or public body based on its written request (e.g. courts, public prosecutor’s office, police etc.).In addition, we hire other companies to perform tasks on our behalf and for our account – IT services responsible for maintenance of our web site and XDRIVE application and financial institutions in charge of processing of payment by credit cards for provided Rent-a-car service. These recipients may receive only Personal data necessary for performance of their service and may not process them in any other purpose or disclose them to any third party.
VI. Personal data Retention Period
We will retain your Personal data for as long as it is reasonably necessary for the purposes for which it was Processed in accordance with this Privacy policy. In some circumstances we may need to store your Personal data for longer periods of time, for instance where we are required to do so in accordance with legal, regulatory, tax or accounting requirements or if we reasonably believe there is a prospect of litigation or any other court procceding.VII. Your rights in connection with the Processing of Personal data
You have the following rights:Requesting Information on whether the Collector is processing his/her Personal data and to request access to that data.
At your request we will provide you with information whether XPERTIZE LTD is processing your Personal data and provide you with access to such data. In addition, you may request, and we shall provide you with the information regarding: (i) the purpose of such processing, (ii) the type of Personal data that is being processed, (iii) the recipients or types of recipients of such data, (iv) expected period of retention of Personal data, i.e. on the criteria for determining that period, (v) your right to request the correction or deletion of your Personal data, the right to limit processing and the right to object to processing, (vi) the right to submit a complaint to the Commissioner, (vii) available information about the source of the Personal data, in case that Personal data was not collected from the person to whom it relates, (viii) existence of an automated decision-making procedure, including profiling and information about the logic used, as well as about the importance and expected consequences of that processing for the person to whom the data refer.
At your request, we are obliged to provide you with a copy of your Personal data. If the request is clearly unfounded or excessive, and especially if the same request is repeated frequently, we may:
- charge the necessary administrative costs of providing information, i.e. acting upon the request;
- refuse to act on the request.
Correction of Personal data
You have the right to have inaccurate Personal data corrected without undue delay. Depending on the purpose of the Processing, you have the right to supplement your incomplete Personal data, which includes providing an additional statement.
Deletion of Personal data
You have the right to request deletion of your Personal data.
We are obliged to delete Personal data without undue delay if:
- it is no longer necessary to achieve the purpose for which it was collected or otherwise processed;
- you have revoked the consent on the basis of which the Processing was carried out and there is no other legal basis for the Processing;
- you have submitted an objection to the Processing:
- - In accordance with Article 37, paragraph 1 of the Law, and there is no other legal basis for Processing that prevails over your legitimate interest, right or freedom;
- - In accordance with Article 37, paragraph 2 of the Law.
- - Personal data was illegally processed.
Personal data must be deleted to fulfill our legal obligations.
Personal data was collected in connection with the use of information society services in accordance with Article 16, paragraph 1 of the Law.
Restriction of Personal data processing
You have the right to have the processing of your Personal data restricted if one of the following cases is met:
- You have contested the accuracy of the Personal data, within the time limit that allows us to check the accuracy of the Personal data;
- The processing is illegal, and you oppose the deletion of Personal data and instead of deletion you request restriction of its Processing;
- We no longer need Personal data to achieve the purpose of Processing, but the you have requested them in order to submit, implement or defend a legal claim;
- You have submitted an objection to the Processing in accordance with Article 37, paragraph 1 of the Law, and an assessment is underway as to whether the legal basis for Processing by us outweighs your interests.
We are obliged to inform all recipients to whom Personal data has been disclosed about any correction or deletion of Personal data or restriction of the Processing unless this is impossible or requires an excessive expenditure of time and resources. In addition, at your request, we are obliged to you about all these recipients.
Data portability
You have the right to receive your Personal data that you previously provided to us in a structured, commonly used and electronically readable form and you have the right to transfer this data to another controller without our interference, if the following conditions are met together:
- Processing is based on consent in accordance with Article 12. paragraph 1. point 1) or Article 17. paragraph 2. point 1) of the Law or based on a contract, in accordance with Article 12. paragraph 1. point 2) of the Law;
- Processing is done automatically.
The right of data portability also includes your right to have us directly transfer your Personal data directly to another controller if this is technically feasible.
Submitting an objection
If you consider that it is justified in relation to the special situation in which you are in, you have the right to submit us an objection to the processing of your Personal data at any time, which is carried out in accordance with Article 12, paragraph 1 point 5) and 6) of the Law, including profiling based on those provisions. In that case, we are obliged to stop Processing your Personal data, unless there are legal reasons for the Processing that prevail over your interests, rights or freedoms or are related to the submission, exercise, or defense of legal demands.
You have the right to object at any time to the Processing of your Personal data that is processed for the purposes of direct advertising, including profiling, to the extent that it is related to direct advertising.
If you objecs to the Processing for the purposes of direct advertising, the Personal data can no longer be processed for such purposes.
Automated individual decision-making and profiling
You have the right not to be applied to you a decision made solely based on automated processing, including profiling, if that decision produces legal consequences for or that decision significantly affects your position. On the other hand, this will not apply if the decision is:
- necessary for the conclusion or performance of a contract between you and XPERTIZE LTD;
- based on the law, if that law prescribes appropriate measures to protect your rights, freedoms and legitimate interests;
- based on your consent.
Being informed of Personal data breach
We are obliged to inform you if a breach of Personal data can cause a high risk to your rights and freedoms, except if:
- We have taken appropriate technical, organizational and personnel protection measures in relation to your Personal data that has been breached, especially if we have prevented the intelligibility of your Personal data to all persons who are not authorized to access this data by means of crypto-protection or other measures;
- We have subsequently taken measures to ensure that the breach of your Personal data with a high risk for your rights and freedoms can no longer produce consequences for you;
- Informing you would represent a disproportionate expenditure of time and resources. In that case, we are obliged to ensure informing you to through public notification or in another effective way.
In case you want to exercise any of your rights, please send us an email with a request to the email address: contact@xpertize.pro.
VIII. Transfer of Personal data
Personal data necessary for processing the payment by credit cards for provided Rent-a-car service, is being disclosed to the company hired for performing such tasks – Stripe Payments Europe Limited with its registered seat in Dublin, Ireland. Ireland represents a country that possess adequate level of protection of personal data.IX. Consent revocation
You have the right to revoke your consent for Personal data Processing at any time. Revocation of consent does not affect the admissibility of Processing that was carried out based on consent before the revocation.You can submit us your revocation at any time by sending us an e-mail to: contact@xpertize.pro