Question 1

Privacy Policy of Centauro Rent a Car Spain (CENTAURO RENT A CAR, S.L.U.)

Accepted Answer

Privacy Policy of Centauro Rent a Car Spain (CENTAURO RENT A CAR, S.L.U.)
-------------------------------------------------------------------------

### A. Data Controller

We inform that the personal data you provide us in the framework of our contractual relationship will be processed by CENTAURO RENT A CAR, S.L.U., with registered office at Avda. País Valencià 9, Bloque A Local 4, 03509, Finestrat (Alicante), (hereinafter “**Centauro**”), and will serve the functions depicted below.

Unless expressly stated otherwise when collected, all personal data needed and collected make up essential elements for the management, maintenance, and control of our contractual relationship. By choosing not to facilitate such data, you will make it impossible to process your request or provide the contracted service. Personal data will be collected exclusively for the purposes indicated in this Privacy Policy.

You confirm and guarantee the veracity and accuracy of the data provided, and that these are adjusted to your current situation. Therefore, you agree to communicate any changes to such data in accordance with the procedure established in section **E. Stakeholder Rights.**

### B. Purpose of Data Processing

Herewith, we inform that your data will be processed by Centauro to serve the following functions:

**i.    Based on the contractual relationship:**

a.    To process your request for registration as a customer so we can manage the commercial relationship between us and your needs.

b.    To manage, maintain and ensure compliance with the contractual or pre-contractual relationship that binds us (including invoicing, where appropriate, the difference between the fuel that the vehicle had when it was delivered and the fuel that it had when it was returned).

**ii.    Based on a legal obligation:**

a.    To communicate information to public authorities, regulatory and governmental bodies, wherever mandated by law, local regulations, or in compliance with regulatory obligations.

b. To geolocate the leased vehicle in the event of justified request from public authorities.

**iii.    Based on the legitimate interest of Centauro:**

a.    To perform commercial and advertising communications and actions, by any means, including through electronic communications or the equivalent, related to products or services similar to those contracted with Centauro.

b.    To conduct satisfaction surveys related to the products and services you contracted, and profiling based on the personal data available to Centauro to know the products and services best suited to your profile, maximising their performance and therefore making the best offers of products and services based on your interests. We will consult the information we have to manage the services we offer you or the products you contract.

c.    To record your voice, image, telephone and video conversation when we expressly indicate it. The legitimate interests of Centauro are to maintain the quality of service, and use the recordings, if necessary, to protect your legal position in the event of any potential dispute.

d.    To communicate your data to insurance companies with which you or Centauro maintain a policy in force and assist you on the road in the event of casualty or accident.

e.    To communicate your data to companies of Centauro and its group (Mutua Madrileña), especially MUTUA MADRILEÑA AUTOMOVILISTA, S.S.P.F.; AUTOCLUB MUTUA MADRILEÑA, S.L.U.; MUTUAMAD MOBILITY, S.L.U.; SILDOSCAN SPAIN, S.L.; CENTAURO RENT A CAR, S.L.U.; NORDIC BUS, S.L.U.; CENTAURO RENT A CAR ITALY, S.r.L.; CENTAURO RENT A CAR, L.D.A.; NORDICWHEELS, L.D.A.; CENTAURO RENT A CAR GREECE, SINGLE MEMBER S.A.; and others. Such communication will serve to provide vehicle rental services on site without a driver requested by the customer, complementary services, and allow us to centralise our administrative and computer processes.

f. To record the geolocation data of the vehicle in Centauro's premises at the time of collection and at the time of return, in order to guarantee the control of compliance with the deadlines and location of the vehicle by the company.

g. To geolocate the leased vehicle in the event of reasonable grounds of theft or misappropriation (including the no return of the vehicle on the due date).

h. Geolocate the rented vehicle in order to detect, by means of automatic alerts, the departure from the territory authorised by contract, either because such departure is prohibited or because the external cover has not been contracted. In this case, Centauro may adopt the measures foreseen in its conditions for breach of contract.

i. Manage and, where appropriate, take legal action, both extrajudicial and judicial, to protect our rights and interests (including the management of collections, claims and any contractual disputes), which may involve the communication of data to courts and tribunals, law enforcement agencies or other public bodies, lawyers, solicitors, experts and other professional advisors.

**iv.    Based on the explicit consent granted by you:**

a.    If you authorise it, Centauro may put together a profile of your consumption habits through external information, and communicate your data to advertising partners, allowing for exclusive offers of products or services to be made tailored to your needs.

b.    If you have expressly authorized it, Centauro may verify your identity through a facial recognition system provided by a verified supplier, using the photograph sent, as well as your driving license, your identity card or any other equivalent document such as your passport, in order to verify that them match. Your data will be processed with confidentially, and after the implementation of all necessary security measures to ensure its proper processing through the use of this technology. If you do not consent to such processing, you can skip the digital processing and physically complete the verification of your identity, manually and not automatically, at Centauro Rent a Car's office.

c. To geolocate the rented vehicle, upon request of the interested party after contacting the Centauro support team, in case the vehicle needs roadside assistance or similar support.

d. To collect driving data for the purpose of analysing the same in order to carry out studies on the impact of driving these vehicles.

### C. Recipients

In the terms described in section **B. Purpose of Data Processing**, Centauro may communicate your personal data to the following entities:

i.    Public authorities, governmental or jurisdictional regulators or bodies, wherever mandated by law, local regulations or in compliance with regulatory obligations, and to meet information requirements related to traffic infractions.

ii.    Insurance Entities with the purposes described in letter d) of item iii) Legitimate Interest included in **section B. Purpose of Data Processing.**

iii.    Third party entities and companies of the Centauro Group, for the purposes described in letter e) of item iii) Legitimate Interest, included in **section B**. **Purpose of Data Processing**

iv. Your data may be communicated to courts and tribunals, law enforcement agencies or other public bodies, lawyers, solicitors, experts and other professional advisors for legal assistance and defence in judicial or extrajudicial proceedings.

In accordance with the provisions of point iii. above, Centauro has the collaboration of some third-party service providers who have access to your personal data and who process the aforementioned data in the name and on behalf of Centauro as a consequence of providing the services.

Centauro follows strict service provider selection criteria in order to comply with its data protection obligations. It undertakes to sign the corresponding data processing contract with them, which impose, among other things, the following obligations: the application of appropriate technical and organizational measures; the processing of personal data for the agreed purposes, in strict compliance with Centauro’s documented instructions; and the deletion or return of the data to Centauro as soon as they complete their services.

In particular, Centauro may hire third-party services from–including but not limited to–companies in the following industries: logistics, identity validation services, legal advice, training, medical, maintenance, shipping, technology, and computer services.

### D. Origin of the Data

Regardless of the personal data provided by you, Centauro may process personal data from public files, market files, and government bodies, in accordance with the purposes and legitimising bases described in section “**B. Purpose of Data Processing**” above.

In line with the above, Centauro will process personal data provided by the aforementioned third parties corresponding to the following categories:

i.   Identification data.  
ii.  Postal or electronic mail addresses.

iii. Geolaction data of the vehicle.

iv. Driving behaviour data.

No specially protected personal data is obtained from third parties.

The data obtained in points iii and iv will only be processed in the cases indicated in the previous sections.

With regard to the data you provide directly during the booking process, Centauro may request, among others, your driving license, your identity card or any other equivalent document such as a passport and a photo of you, in order to verify your identity.

### E. Interested party rights

The consents provided in the cases established in this act may be revoked by you at any time, at your simple request. We inform that in accordance with the current legislation you are entitled to exercise your rights of access, rectification, cancellation and objection, as well as the right of withdrawal, limitation of data processing, and the right to portability of your data, proving your identity at the following address: CENTAURO RENT A CAR, S.L.U., Avda País Valencia 9 Bloque A, Local 4, 03509 Finestrat (Alicante), or by Email to dpo@centauro.net.

If you feel that CENTAURO RENT A CAR, S.L.U. has not respected any of the aforementioned rights, you have the right to lodge a complaint with the Spanish Data Protection Agency.

### F. Data Retention.

| Purpose | Retention Period |
|---|---|
| Creation and management of your account. | During the duration of the business relationship and 5 years after its termination. |
| Management of your reservation and/or rental agreement for: i. confirming, modifying, or canceling your reservation; ii. communicating with you regarding your reservation/rental (e.g., to provide information about your reservation/rental, to send you a reminder before your check-in/check-out, to answer your questions or suggestions); iii. managing your rental; iv. managing payment and invoices; v. managing and claiming amounts owed (including additional costs such as traffic violation fines or compensation for vehicle damage); vi. managing potential claims; vii. contracting and managing vehicle coverage; viii. returning items or objects you may have left behind in the vehicle and/or rental offices. | During the duration of the business relationship and 5 years after its termination. |
| Monitoring of connected vehicles. | Data is retained for a period of 12 months. In case of damage or property crimes, investigation of damage and accidents caused to the vehicle, personal data may be retained until the cases are resolved (including until the filing or resolution of any legal or judicial proceedings). Geolocation data will only be retained for the time necessary for the purposes indicated in the preceding sections, proceeding to anonymize or delete it once they are fulfilled. Data related to user driving behavior will be anonymized immediately and, in any case, before any processing of them after their collection. |
| Management of commercial documents (customer invoices, purchase orders, certain electronically executed contracts). | 10 years from the end of the fiscal year or from the delivery or service. |
| Credit card fraud prevention. | 13 months from the effective payment. |
| Verify that you are not registered on a sanctions list. | During the duration of the business relationship and 5 years after its termination. |
| Improvement of our products and services according to your preferences shown in satisfaction surveys. | During the duration of the business relationship and 5 years after its termination. |
| Promotional and marketing activities: i. sending email notifications for promotions/special offers; ii. managing your loyalty program; iii. sending emails about a reservation you have not completed or a summary of a reservation inquiry; iv. organizing contests and promotional sweepstakes; v. managing and updating our customer/potential customer database. | During the duration of the business relationship and 5 years after its termination. |
| Payment of fines: transferring to the competent Authority through the appropriate procedure the identity of the main driver appearing in the rental agreement. | For the time necessary to identify the driver (or the potential driver) responsible for the infraction that results in the fine. |
| Management and maintenance of a list of customers with contractual risks based on: i. payment incidents that have resulted in legal proceedings; ii. repeated vehicle accidents or damage or offenses against our employees; iii. use of our vehicles in breach of the general vehicle rental conditions. | 5 years from the date of creation or modification of the last rental and depending on the nature of the incident. |
| Video surveillance in our facilities. | Up to one month from the time of recording. If there are indications of crime or alterations in our goods or property or of the people present in the facilities, they may be kept for the time necessary for the resolution of the corresponding claims or legal actions. |
| Analysis of navigation data on our website and mobile applications. | [Centauro's Cookie Policy](/en/cookies-policy/) |

Without prejudice to the foregoing, your data will be kept duly blocked, while liabilities may arise from the execution of our contractual relationship, as well as for compliance with other legal obligations incumbent upon Centauro (with a maximum duration of 5 years).

In this regard, Centauro guarantees that it will not process the data unless it is necessary for the formulation, exercise or defence of claims or when it is required 1  to provide the same to the Public Administration, Judges and Courts during the statute of limitations period for their rights or legal obligations.

Once the maximum blocking period has elapsed, your personal data will be deleted at the moment in which all necessary actions have been carried out to manage and conclude any obligation that may remain outstanding between the parties, carrying out in that period, all necessary administrative procedures.

### G. Security and confidentially

We are committed to the security of your information. In order to prevent unauthorized access or unauthorized disclosure of personal data, we have undertaken appropriate technical and physical measures and management processes to safeguard and secure the information we collect from you.

Question 2

Privacy Policy Centauro Rent a Car Portugal (CENTAURO RENT A CAR, L.D.A.)

Accepted Answer

Privacy Policy Centauro Rent a Car Portugal (Centauro Rent a Car, L.D.A.)
-------------------------------------------------------------------------

### A. Data controller.

We inform you that the personal data that you provide us as part of our contractual relationship will be processed by CENTAURO RENT A CAR, L.D.A., with registered office at Rua Fradesso Silveira, 6, Floor 1 A/B, 1300-609 Lisbon, Parish of Alcântara, Municipality and District of Lisbon, Portugal, (hereinafter "**Centauro**"), for the purposes indicated below.

Unless expressly stated otherwise at the time of collection, all personal data collected are essential for the fulfillment, management, maintenance and control of our contractual relationship. If you do not provide the data, it will be impossible to process your request or provide the contracted service. Personal data will be collected exclusively for the purposes indicated at the time of collection or in this Privacy Policy.

The user confirms and guarantees the integrity and accuracy of the data provided, and that these are current. The user will also notify any change in the data, by following the procedure established in **section E. Personal rights.**

### B. Purpose and legal grounds of data processing

We inform you that Centauro will process your data for the following purposes, and in accordance with the following legal grounds:

**i.    Enforcement of the contractual relationship:**

a.    Process your application to register as a client to manage the contractual relationship and your needs as a Centauro client.

b.    Manage, maintain and guarantee the fulfillment of the contractual or pre-contractual relationship between the parties (including invoicing, where appropriate, the difference between the fuel that the vehicle had when it was delivered and the fuel that it had when it was returned).

**ii.    Fulfillment of a legal obligation:**

a. Provide information to public or regulatory authorities, or to governmental or jurisdictional bodies, if required under the law, local regulations or statutory obligations.

b. To geolocate the leased vehicle in the event of justified request from public authorities.

**iii.    Centauro’s legitimate interest:**

a.    Carrying out commercial and/or advertising activities or communications Centauro, by any means, including through electronic communications, related to similar products or services previously purchased from Centauro.

b.    Conducting satisfaction inquiries on products and/or services purchased by the user, and carrying out an evaluation based on personal data available to Centauro to determine the products and services that best fit your profile, to maximize their performance and provide the best offers of products and services that may be of your interest. Look up the data we possess for the management of the services we provide to you or the products you have purchased.

c.    Record your voice or your image and save phone and/or video conversations, when expressly indicated. The legitimate interests of Centauro are to maintain the quality of the service and use the recordings if necessary to protect its legal position in respect of any potential conflict.

d.    Communicate your data (as long as they are not of a special category) to insurance companies with which the user or Centauro have a valid policy for roadside assistance for traffic incidents or accidents.

e.    Communicate your data to the companies of Centauro and its group (Grupo Mutua Madrileña), in particular to MUTUA MADRILEÑA AUTOMOVILISTA, S.S.P.F.; AUTOCLUB MUTUA MADRILEÑA, S.L.U.; MUTUAMAD MOBILITY, S.L.U.; SILDOSCAN SPAIN, S.L.; CENTAURO RENT A CAR, S.L.U.; NORDIC BUS, S.L.U.; CENTAURO RENT A CAR ITALY, S.r.L.; CENTAURO RENT A CAR, L.D.A.; NORDICWHEELS, L.D.A.; CENTAURO RENT A CAR GREECE, SINGLE MEMBER S.A. and others, to locally provide the services of self-drive vehicle rental as requested by the client and other complementary services, as well as to centralize the administrative and computer processes.

f.    Communicate and/or respond to notifications from any authority, whether public or private, regarding court proceedings of the administrative jurisdiction for traffic offenses, or driver identification procedures for non-payment of toll fees.

g. To record the geolocation data of the vehicle in Centauro's premises at the time of collection and at the time of return, in order to guarantee the control of compliance with the deadlines and location of the vehicle by the company.

h. To geolocate the leased vehicle in the event of reasonable grounds of theft or misappropriation (including the no return of the vehicle on the due date).

i. Geolocate the rented vehicle in order to detect, by means of automatic alerts, the departure from the territory authorised by contract, either because such departure is prohibited or because the external cover has not been contracted. In this case, Centauro may take the measures provided for in its terms and conditions for breach of contract.

j. Manage and, where appropriate, take legal action, both extrajudicial and judicial, to protect our rights and interests (including the management of collections, claims and any contractual disputes), which may involve the communication of data to courts and tribunals, law enforcement agencies or other public bodies, lawyers, solicitors, experts and other professional advisors.

**iv.    User’s consent:**

a.    If the user so authorizes, Centauro will communicate the user’s data to its advertising partners to provide and advertise special offers of products and services tailored to the user’s interests and needs.

b.    If you have expressly authorized it, Centauro may verify your identity through a facial recognition system provided by a verified supplier, using the photograph sent, as well as your driving license, your identity card or any other equivalent document such as your passport, in order to verify that them match. Your data will be processed with confidentially, and after the implementation of all necessary security measures to ensure its proper processing through the use of this technology. If you do not consent to such processing, you can skip the digital processing and physically complete the verification of your identity, manually and not automatically, at Centauro Rent a Car's office.

c. To geolocate the rented vehicle, upon request of the interested party after contacting the Centauro support team, in case the vehicle needs roadside assistance or similar support.

d. To collect driving data for the purpose of analysing the same in order to carry out studies on the impact of driving these vehicles.

### C. Recipients

Under the terms described in section B. Purposes of data processing, Centauro may communicate your personal data to the following entities:

i.    Public or regulatory authorities, as well as governmental or judicial bodies, where so required by law, local regulation or statutory obligations, as well as to comply with the data requirements related to traffic offenses.

ii.    Insurance companies, for the purposes described in section d) of item iii) Legitimate interest, included in section B. Purposes of data processing.

iii.    Third parties and companies of the Centauro Group, for the purposes described in section e) of item iii) Legitimate interest, included in section B. Purposes of data processing

iv.    Highway concessionaires and/or police authorities, for the purposes described in section f) of item iii) Legitimate interest, included in **section B. Purposes of data processing**

v. Your data may be communicated to courts and tribunals, law enforcement agencies or other public bodies, lawyers, solicitors, experts and other professional advisors for legal assistance and defence in judicial or extrajudicial proceedings.

Under item iii. above, third party service providers with access to your personal data work with Centauro processing said data on behalf of Centauro as a consequence of the provision of a service.

Centauro follows rigorous criteria for the selection of its service providers in order to comply with its data protection obligations. Centauro will subscribe with them the corresponding data processing contract, according to which they will have, among others, the following obligations: implement adequate technical and organizational measures; treat personal data for the agreed purposes and only in accordance with Centauro’s documented instructions; and delete or return the data to Centauro once the provision of services has been completed.

In particular, Centauro may hire third-party services from–including but not limited to–companies in the following industries: logistics, identity validation services, legal advice, training, medical, maintenance, shipping, technology, and computer services.

### D. Origin of the data

Irrespective of the personal data you have provided, Centauro may process personal data obtained from common records, market records and/or public bodies, in accordance with the purposes and legal grounds described in section **"B. Purposes of data processing»** above.

In accordance with the foregoing, Centauro will process personal data provided by the aforementioned third parties, in the following categories:

i.    Identification data.

ii.    Postal or electronic addresses.

iii. Geolocation data of the vehicle.

iv. Driving behaviour data.

Personal data is not obtained from special categories of third parties.

The data obtained in points iii and iv will only be processed in the cases indicated in the previous sections.

With regard to the data you provide directly during the booking process, Centauro may request, among others, your driving license, your identity card or any other equivalent document such as a passport and a photo of you, in order to verify your identity.

### E. Interested party rights

The authorizations granted for the purposes of specific personal data processing operations carried out by Centauro may be withdrawn by the user at any time, at the user’s request. We inform you that, according to current applicable law, the user may exercise their rights of access, rectification, cancellation and opposition, as well as the right of elimination and limitation of data processing and data transfers, once their identity has been verified, by writing to the following address: CENTAURO RENT A CAR, L.D.A., with registered office at Rua Fradesso Silveira, 6, Floor 1 A/B, 1300-609 Lisbon, Parish of Alcântara, Municipality and District of Lisbon, Portugal, (+351) 211 303 540, or at the following e-mail address **dpo@centauro.net**.

If the user considers that CENTAURO RENT A CAR, L.D.A.. has infringed any of the rights mentioned above, the user may submit a claim to the National Data Protection Commission (address: Rua de São Bento, 148, R/C, 1200-821 Lisbon; email: geral@cnpd.pt; website: www.cnpd.pt.

### F. Data Retention.

| Purpose | Retention Period |
|---|---|
| Creation and management of your account. | During the duration of the business relationship and 5 years after its termination. |
| Management of your reservation and/or rental agreement for: i. confirming, modifying, or canceling your reservation; ii. communicating with you regarding your reservation/rental (e.g., to provide information about your reservation/rental, to send you a reminder before your check-in/check-out, to answer your questions or suggestions); iii. managing your rental; iv. managing payment and invoices; v. managing and claiming amounts owed (including additional costs such as traffic violation fines or compensation for vehicle damage); vi. managing potential claims; vii. contracting and managing vehicle coverage; viii. returning items or objects you may have left behind in the vehicle and/or rental offices. | During the duration of the business relationship and 5 years after its termination. |
| Monitoring of connected vehicles. | Data is retained for a period of 12 months. In case of damage or property crimes, investigation of damage and accidents caused to the vehicle, personal data may be retained until the cases are resolved (including until the filing or resolution of any legal or judicial proceedings). Geolocation data will only be retained for the time necessary for the purposes indicated in the preceding sections, proceeding to anonymize or delete it once they are fulfilled. Data related to user driving behavior will be anonymized immediately and, in any case, before any processing of them after their collection. |
| Management of commercial documents (customer invoices, purchase orders, certain electronically executed contracts). | 10 years from the end of the fiscal year or from the delivery or service. |
| Credit card fraud prevention. | 13 months from the effective payment. |
| Verify that you are not registered on a sanctions list. | During the duration of the business relationship and 5 years after its termination. |
| Improvement of our products and services according to your preferences shown in satisfaction surveys. | During the duration of the business relationship and 5 years after its termination. |
| Promotional and marketing activities: i. sending email notifications for promotions/special offers; ii. managing your loyalty program; iii. sending emails about a reservation you have not completed or a summary of a reservation inquiry; iv. organizing contests and promotional sweepstakes; v. managing and updating our customer/potential customer database. | During the duration of the business relationship and 5 years after its termination. |
| Payment of fines: transferring to the competent Authority through the appropriate procedure the identity of the main driver appearing in the rental agreement. | For the time necessary to identify the driver (or the potential driver) responsible for the infraction that results in the fine. |
| Management and maintenance of a list of customers with contractual risks based on: i. payment incidents that have resulted in legal proceedings; ii. repeated vehicle accidents or damage or offenses against our employees; iii. use of our vehicles in breach of the general vehicle rental conditions. | 5 years from the date of creation or modification of the last rental and depending on the nature of the incident. |
| Video surveillance in our facilities. | Up to one month from the time of recording. If there are indications of crime or alterations in our goods or property or of the people present in the facilities, they may be kept for the time necessary for the resolution of the corresponding claims or legal actions. |
| Analysis of navigation data on our website and mobile applications. | [Centauro's Cookie Policy](/en/cookies-policy/) |

Without prejudice to the foregoing, your data will be kept duly blocked, while liabilities may arise from the execution of our contractual relationship, as well as for compliance with other legal obligations incumbent upon Centauro (with a maximum duration of 5 years).

In this regard, Centauro guarantees that it will not process the data unless it is necessary for the formulation, exercise or defence of claims or when it is required 1  to provide the same to the Public Administration, Judges and Courts during the statute of limitations period for their rights or legal obligations.

Once the maximum blocking period has elapsed, your personal data will be deleted at the moment in which all necessary actions have been carried out to manage and conclude any obligation that may remain outstanding between the parties, carrying out in that period, all necessary administrative procedures.

### G. Security and confidentially

We are committed to the security of your information. In order to prevent unauthorized access or unauthorized disclosure of personal data, we have undertaken appropriate technical and physical measures and management processes to safeguard and secure the information we collect from you.

Question 3

Privacy Policy Centauro Rent a Car Italia (CENTAURO RENT A CAR ITALY, S.r.L.)

Accepted Answer

Privacy Policy Centauro Rent a Car Italia (CENTAURO RENT A CAR ITALY, S.r.L.)
-----------------------------------------------------------------------------

### A. Holder of data processing

We inform you that the personal data communicated by the client, in the context of the mutual commercial relationship, will be treated by CENTAURO RENT A CAR ITALY, S.r.L., with registered office in Trento (TN), 37, Via Benedetto Giovanelli, (hereinafter referred to as "**Centauro**") as the data controller in the manner described below.

Unless otherwise specified at the time of collection, all personal data collected is necessary for the management of the business relationship. The provision of personal data is mandatory for this purpose. By choosing not to provide such data, it will be impossible for Centauro to process the various requests or provide the service object of the contract. Personal data will be processed exclusively for the purposes indicated in this privacy statement.

The customer confirms and guarantees the truthfulness and accuracy of the data provided and that these conform to their current situation. Therefore, the customer agrees to communicate any changes to these data, according to the procedure set out in section **E. Rights of the parties concerned**.

### B. Purposes of data processing

With this document, we inform the customer that his personal data will be processed by Centauro for the pursuit of the following purposes.

**I.  Based on the contractual relationship:**

a.  Elaborate the customer's request, so as to manage the business relationship and meet their needs.

b.  Manage the fulfilment of the mutually binding contractual or pre-contractual obligations between the client and Centauro (including invoicing, where appropriate, the difference between the fuel that the vehicle had when it was delivered and the fuel that it had when it was returned).

c.    Provide, on-site, rental services for vehicles without a driver and additional services.

**II.     On the basis of a legal obligation**

a. Communicate information to public authorities, regulatory bodies and government agencies, where required by law, local regulations or in compliance with regulatory obligations.

b. To geolocate the leased vehicle in the event of justified request from public authorities.

**III.     Based on the legitimate interest of Centauro**

a. To carry out promotional initiatives and advertising communications, by any means, including through electronic communications or equivalent, relating to products or services similar to those covered by Centauro’s contract.

b. To conduct surveys on the level of customer satisfaction related to products and services.

c. To record the customer's voice and image, by telephone and videoconference, when expressly stated. Centauro's legitimate interests are the maintenance of the quality of service and the use of registrations, if necessary, to protect the client's legal position in the event of any disputes.

d. To record the geolocation data of the vehicle in Centauro's premises at the time of collection and at the time of return, in order to guarantee the control of compliance with the deadlines and location of the vehicle by the company.

e. To geolocate the leased vehicle in the event of reasonable grounds of theft or misappropriation (including the no return of the vehicle on the due date).

f. Geolocate the rented vehicle in order to detect, by means of automatic alerts, the departure from the territory authorised by contract, either because such departure is prohibited or because the external cover has not been contracted. In this case, Centauro will be able to take the measures foreseen in its conditions for breach of contract.

g. Manage and, where appropriate, take legal action, both extrajudicial and judicial, to protect our rights and interests (including the management of collections, claims and any contractual disputes), which may involve the communication of data to courts and tribunals, law enforcement agencies or other public bodies, lawyers, solicitors, experts and other professional advisors.

**IV.    Based on explicit consent given by the customer**

a. Prior the consent of the client, Centauro can create a profile of the customer's consumption habits, through external information and communicate the customer‘s data to advertising partners, allowing them to send exclusive offers of products or services tailored to their needs.

b.    If you have expressly authorized it, Centauro may verify your identity through a facial recognition system provided by a verified supplier, using the photograph sent, as well as your driving license, your identity card or any other equivalent document such as your passport, in order to verify that them match. Your data will be processed with confidentially, and after the implementation of all necessary security measures to ensure its proper processing through the use of this technology. If you do not consent to such processing, you can skip the digital processing and physically complete the verification of your identity, manually and not automatically, at Centauro Rent a Car's office.

c. To geolocate the rented vehicle, upon request of the interested party after contacting the Centauro support team, in case the vehicle needs roadside assistance or similar support.

d. To collect driving data for the purpose of analysing the same in order to carry out studies on the impact of driving these vehicles.

### C. Recipients

In the terms described in section **B. The purpose of data processing**, Centauro will be able to communicate the customer's personal data to the following bodies:

a. Public authorities, regulatory bodies and governmental and jurisdictional bodies, where required by law, by local regulations and in compliance with regulatory obligations, as well as to meet communication requirements relating to traffic offenses;

b. Insurance companies, for roadside assistance in the event of car accidents or traffic accidents.

c. Centauro and its group companies ( Grupo Mutua Madrileña) and, in particular, MUTUA MADRILEÑA AUTOMOVILISTA, S.S.P.F.; AUTOCLUB MUTUA MADRILEÑA, S.L.U.; MUTUAMAD MOBILITY, S.L.U.; SILDOSCAN SPAIN, S.L.; CENTAURO RENT A CAR, S.L.U.; NORDIC BUS, S.L.U.; CENTAURO RENT A CAR ITALY, S.r.L.; CENTAURO RENT A CAR, L.D.A.; NORDICWHEELS, L.D.A.; CENTAURO RENT A CAR GREECE, SINGLE MEMBER S.A. and others, for the correct execution of rental services and centralization of computerized administrative procedures, as well as third-party companies that operate in collaboration with Centauro.

d. Your data may be communicated to courts and tribunals, law enforcement agencies or other public bodies, lawyers, solicitors, experts and other professional advisors for legal assistance and defence in judicial or extrajudicial proceedings.

In accordance with the provisions of point III) mentioned above, Centauro collaborates with some service providers, who have access to the customer's personal data and who process the aforementioned data in the name and on behalf of Centauro, as a consequence of the provision of services.

Centauro uses a strict selection criteria for service providers. To comply with its data protection obligations, it agrees to appoint such persons as data controllers with the signing of a specific contract, which imposes, amongst other things, the following obligations: the application of adequate technical and organizational measures; the processing of personal data exclusively for the purposes agreed, in strict compliance with Centauro’s documented instructions and the cancellation or return of data to Centauro as soon as the provision of services is completed on their behalf.

In particular, Centauro may hire third-party services from–including but not limited to–companies in the following industries: logistics, identity validation services, legal advice, training, medical, maintenance, shipping, technology, and computer services.

### D. Origin of the data

Regardless of the personal data provided by the client, Centauro may process personal data collected from public archives, market archives and governmental bodies, in accordance with the purposes and the basis of legitimacy described in section **"B. Purpose of data processing"**, mentioned above.

In line with what is described above, the personal data provided by the aforesaid third parties in contact with Centauro fall into the following categories:

I.     identification data;  
II.     postal addresses or email addresses.

iii. Geolocation data of the vehicle.

iv. Driving behaviour data.

No personal data belonging to the particular categories (i.e. sensitive) will be obtained from third parties.

The data obtained in points iii and iv will only be processed in the cases indicated in the previous sections.

With regard to the data you provide directly during the booking process, Centauro may request, among others, your driving license, your identity card or any other equivalent document such as a passport and a photo of you, in order to verify your identity.

### E. Interested party rights

The consent given, in the cases established in this document, can be revoked at any time, at the request of the customer. We inform that, in accordance with current legislation, the customer has the right to exercise the rights of access, rectification, cancellation and opposition, as well as the right of withdrawal, limitation of data processing and the right to portability, demonstrating their identity to the following address: CENTAURO RENT A CAR ITALY, S.r.L. Trento, 37, Via Benedetto Giovanelli or to the following email address: **dpo@centauro.net**.

If the customer considers that the CENTAURO RENT A CAR ITALY, S.r.L. has not respected any of the rights mentioned above, it has the right to file a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

### F. Data Retention.

| Purpose | Retention Period |
|---|---|
| Creation and management of your account. | During the duration of the business relationship and 5 years after its termination. |
| Management of your reservation and/or rental agreement for: i. confirming, modifying, or canceling your reservation; ii. communicating with you regarding your reservation/rental (e.g., to provide information about your reservation/rental, to send you a reminder before your check-in/check-out, to answer your questions or suggestions); iii. managing your rental; iv. managing payment and invoices; v. managing and claiming amounts owed (including additional costs such as traffic violation fines or compensation for vehicle damage); vi. managing potential claims; vii. contracting and managing vehicle coverage; viii. returning items or objects you may have left behind in the vehicle and/or rental offices. | During the duration of the business relationship and 5 years after its termination. |
| Monitoring of connected vehicles. | Data is retained for a period of 12 months. In case of damage or property crimes, investigation of damage and accidents caused to the vehicle, personal data may be retained until the cases are resolved (including until the filing or resolution of any legal or judicial proceedings). Geolocation data will only be retained for the time necessary for the purposes indicated in the preceding sections, proceeding to anonymize or delete it once they are fulfilled. Data related to user driving behavior will be anonymized immediately and, in any case, before any processing of them after their collection. |
| Management of commercial documents (customer invoices, purchase orders, certain electronically executed contracts). | 10 years from the end of the fiscal year or from the delivery or service. |
| Credit card fraud prevention. | 13 months from the effective payment. |
| Verify that you are not registered on a sanctions list. | During the duration of the business relationship and 5 years after its termination. |
| Improvement of our products and services according to your preferences shown in satisfaction surveys. | During the duration of the business relationship and 5 years after its termination. |
| Promotional and marketing activities: i. sending email notifications for promotions/special offers; ii. managing your loyalty program; iii. sending emails about a reservation you have not completed or a summary of a reservation inquiry; iv. organizing contests and promotional sweepstakes; v. managing and updating our customer/potential customer database. | During the duration of the business relationship and 5 years after its termination. |
| Payment of fines: transferring to the competent Authority through the appropriate procedure the identity of the main driver appearing in the rental agreement. | For the time necessary to identify the driver (or the potential driver) responsible for the infraction that results in the fine. |
| Management and maintenance of a list of customers with contractual risks based on: i. payment incidents that have resulted in legal proceedings; ii. repeated vehicle accidents or damage or offenses against our employees; iii. use of our vehicles in breach of the general vehicle rental conditions. | 5 years from the date of creation or modification of the last rental and depending on the nature of the incident. |
| Video surveillance in our facilities. | Up to one month from the time of recording. If there are indications of crime or alterations in our goods or property or of the people present in the facilities, they may be kept for the time necessary for the resolution of the corresponding claims or legal actions. |
| Analysis of navigation data on our website and mobile applications. | [Centauro's Cookie Policy](/en/cookies-policy/) |

Without prejudice to the foregoing, your data will be kept duly blocked, while liabilities may arise from the execution of our contractual relationship, as well as for compliance with other legal obligations incumbent upon Centauro (with a maximum duration of 5 years).

In this regard, Centauro guarantees that it will not process the data unless it is necessary for the formulation, exercise or defence of claims or when it is required 1  to provide the same to the Public Administration, Judges and Courts during the statute of limitations period for their rights or legal obligations.

Once the maximum blocking period has elapsed, your personal data will be deleted at the moment in which all necessary actions have been carried out to manage and conclude any obligation that may remain outstanding between the parties, carrying out in that period, all necessary administrative procedures.

### G. Security and confidentially

We are committed to the security of your information. In order to prevent unauthorized access or unauthorized disclosure of personal data, we have undertaken appropriate technical and physical measures and management processes to safeguard and secure the information we collect from you.

Question 4

Privacy Policy of Centauro Rent a Car Greece (CENTAURO RENT A CAR GREECE SINGLE MEMBER S.A.)

Accepted Answer

Privacy Policy of Centauro Rent a Car Greece (CENTAURO RENT A CAR GREECE SINGLE MEMBER S.A.)
--------------------------------------------------------------------------------------------

### A. Data Controller

We inform that the personal data you provide us in the framework of our contractual relationship will be processed by CENTAURO RENT A CAR GREECE SINGLE MEMBER S.A., with registered office at 396, Mesogeion Avenue, 15341 Agia Paraskevi, Attica, (hereinafter “Centauro”), and will serve the functions depicted below.

Unless expressly stated otherwise when collected, all personal data needed and collected make up essential elements for the management, maintenance, and control of our contractual relationship. By choosing not to facilitate such data, you will make it impossible to process your request or provide the contracted service. Personal data will be collected exclusively for the purposes indicated in this Privacy Policy.

You confirm and guarantee the veracity and accuracy of the data provided, and that these are adjusted to your current situation. Therefore, you agree to communicate any changes to such data in accordance with the procedure established in section **E. Stakeholder Rights.**

### B. Purpose of Data Processing

Herewith, we inform that your data will be processed by Centauro to serve the following functions:

**i.    Based on the contractual relationship:**

a.    To process your request for registration as a customer so we can manage the commercial relationship between us and your needs.  
b.    To manage, maintain and ensure compliance with the contractual or pre-contractual relationship that binds us (including invoicing, where appropriate, the difference between the fuel that the vehicle had when it was delivered and the fuel that it had when it was returned).

**ii.    Based on a legal obligation:**

a.    To communicate information to pu

b. To geolocate the leased vehicle in the event of justified request from public authorities.

**iii.    Based on the legitimate interest of Centauro:**

a.    To perform commercial and advertising communications and actions, by any means, including through electronic communications or the equivalent, related to products or services similar to those contracted with Centauro.

b.    To conduct satisfaction surveys related to the products and services you contracted, and profiling based on the personal data available to Centauro to know the products and services best suited to your profile, maximising their performance and therefore making the best offers of products and services based on your interests. We will consult the information we have to manage the services we offer you or the products you contract.

c.    To record your voice, image, telephone and video conversation when we expressly indicate it. The legitimate interests of Centauro are to maintain the quality of service, and use the recordings, if necessary, to protect your legal position in the event of any potential dispute.

d.    To communicate your data to insurance companies with which you or Centauro maintain a policy in force and assist you on the road in the event of casualty or accident.

e.    To communicate your data to companies of Centauro and its Group (Grupo Mutua Madrileña), especially MUTUA MADRILEÑA AUTOMOVILISTA, S.S.P.F.; AUTOCLUB MUTUA MADRILEÑA, S.L.U.; MUTUAMAD MOBILITY, S.L.U.; SILDOSCAN SPAIN, S.L.; CENTAURO RENT A CAR, S.L.U.; NORDIC BUS, S.L.U.; CENTAURO RENT A CAR ITALY, S.r.L.; CENTAURO RENT A CAR, L.D.A.; NORDICWHEELS, L.D.A.; CENTAURO RENT A CAR GREECE, SINGLE MEMBER S.A.; and others. Such communication will serve to provide vehicle rental services on site without a driver requested by the customer, complementary services, and allow us to centralise our administrative and computer processes.

f. To record the geolocation data of the vehicle in Centauro's premises at the time of collection and at the time of return, in order to guarantee the control of compliance with the deadlines and location of the vehicle by the company.

g. To geolocate the leased vehicle in the event of reasonable grounds of theft or misappropriation (including the no return of the vehicle on the due date).

h. Geolocate the rented vehicle in order to detect, by means of automatic alerts, the departure from the territory authorised by contract, either because such departure is prohibited or because the external cover has not been contracted. In this case, Centauro may adopt the measures foreseen in its conditions for breach of contract.

i. Manage and, where appropriate, take legal action, both extrajudicial and judicial, to protect our rights and interests (including the management of collections, claims and any contractual disputes), which may involve the communication of data to courts and tribunals, law enforcement agencies or other public bodies, lawyers, solicitors, experts and other professional advisors.

**iv.    Based on the explicit consent granted by you:**

a.    If you authorise it, Centauro may put together a profile of your consumption habits through external information, and communicate your data to advertising partners, allowing for exclusive offers of products or services to be made tailored to your needs.

b.    If you have expressly authorized it, Centauro may verify your identity through a facial recognition system provided by a verified supplier, using the photograph sent, as well as your driving license, your identity card or any other equivalent document such as your passport, in order to verify that them match. Your data will be processed with confidentially, and after the implementation of all necessary security measures to ensure its proper processing through the use of this technology. If you do not consent to such processing, you can skip the digital processing and physically complete the verification of your identity, manually and not automatically, at Centauro Rent a Car's office.

c. To geolocate the rented vehicle, upon request of the interested party after contacting the Centauro support team, in case the vehicle needs roadside assistance or similar support.

d. To collect driving data for the purpose of analysing the same in order to carry out studies on the impact of driving these vehicles.

### C. Recipients

In the terms described in **section B. Purpose of Data Processing**, Centauro may communicate your personal data to the following entities:

i.    Public authorities, governmental or jurisdictional regulators or bodies, wherever mandated by law, local regulations or in compliance with regulatory obligations, and to meet information requirements related to traffic infractions.

ii.  Insurance Entities with the purposes described in letter d) of item iii) Legitimate Interest included in **section B. Purpose of Data Processing.**

iii.  Third party entities and companies of the Centauro Group, for the purposes described in letter e) of item iii) Legitimate Interest, included in **section B. Purpose of Data Processing**

iv. Your data may be communicated to courts and tribunals, law enforcement agencies or other public bodies, lawyers, solicitors, experts and other professional advisors for legal assistance and defence in judicial or extrajudicial proceedings.

In accordance with the provisions of point iii. above, Centauro has the collaboration of some third-party service providers who have access to your personal data and who process the aforementioned data in the name and on behalf of Centauro as a consequence of providing the services.

Centauro follows strict service provider selection criteria in order to comply with its data protection obligations. It undertakes to sign the corresponding data processing contract with them, which impose, among other things, the following obligations: the application of appropriate technical and organizational measures; the processing of personal data for the agreed purposes, in strict compliance with Centauro’s documented instructions; and the deletion or return of the data to Centauro as soon as they complete their services.

In particular, Centauro may hire third-party services from–including but not limited to–companies in the following industries: logistics, identity validation services, legal advice, training, medical, maintenance, shipping, technology, and computer services.

### D. Origin of the data

Regardless of the personal data provided by you, Centauro may process personal data from public files, market files, and government bodies, in accordance with the purposes and legitimising bases described in **section “B. Purpose of Data Processing”** above.

In line with the above, Centauro will process personal data provided by the aforementioned third parties corresponding to the following categories:

i.    Identification data.

ii.   Postal or electronic mail addresses.

iii. Geolocation data of the vehicle.

iv. Driving behaviour data.

No specially protected personal data is obtained from third parties.

The data obtained in points iii and iv will only be processed in the cases indicated in the previous sections.

With regard to the data you provide directly during the booking process, Centauro may request, among others, your driving license, your identity card or any other equivalent document such as a passport and a photo of you, in order to verify your identity.

### E. Interested party rights

The consents provided in the cases established in this act may be revoked by you at any time, at your simple request. We inform that in accordance with the current legislation you are entitled to exercise your rights of access, rectification, cancellation and objection, as well as the right of withdrawal, limitation of data processing, and the right to portability of your data, proving your identity at the following address: CENTAURO RENT A CAR GREECE SINGLE MEMBER S.A., 396, Mesogeion Avenue, 15341 Agia Paraskevi, Attica, or by Email to dpo@centauro.net.

If you feel that CENTAURO RENT A CAR GREECE SINGLE MEMBER S.A. has not respected any of the aforementioned rights, you have the right to lodge a complaint with the Hellenic Data Protection Authority.

### F. Data Retention.

| Purpose | Retention Period |
|---|---|
| Creation and management of your account. | During the duration of the business relationship and 5 years after its termination. |
| Management of your reservation and/or rental agreement for: i. confirming, modifying, or canceling your reservation; ii. communicating with you regarding your reservation/rental (e.g., to provide information about your reservation/rental, to send you a reminder before your check-in/check-out, to answer your questions or suggestions); iii. managing your rental; iv. managing payment and invoices; v. managing and claiming amounts owed (including additional costs such as traffic violation fines or compensation for vehicle damage); vi. managing potential claims; vii. contracting and managing vehicle coverage; viii. returning items or objects you may have left behind in the vehicle and/or rental offices. | During the duration of the business relationship and 5 years after its termination. |
| Monitoring of connected vehicles. | Data is retained for a period of 12 months. In case of damage or property crimes, investigation of damage and accidents caused to the vehicle, personal data may be retained until the cases are resolved (including until the filing or resolution of any legal or judicial proceedings). Geolocation data will only be retained for the time necessary for the purposes indicated in the preceding sections, proceeding to anonymize or delete it once they are fulfilled. Data related to user driving behavior will be anonymized immediately and, in any case, before any processing of them after their collection. |
| Management of commercial documents (customer invoices, purchase orders, certain electronically executed contracts). | 10 years from the end of the fiscal year or from the delivery or service. |
| Credit card fraud prevention. | 13 months from the effective payment. |
| Verify that you are not registered on a sanctions list. | During the duration of the business relationship and 5 years after its termination. |
| Improvement of our products and services according to your preferences shown in satisfaction surveys. | During the duration of the business relationship and 5 years after its termination. |
| Promotional and marketing activities: i. sending email notifications for promotions/special offers; ii. managing your loyalty program; iii. sending emails about a reservation you have not completed or a summary of a reservation inquiry; iv. organizing contests and promotional sweepstakes; v. managing and updating our customer/potential customer database. | During the duration of the business relationship and 5 years after its termination. |
| Payment of fines: transferring to the competent Authority through the appropriate procedure the identity of the main driver appearing in the rental agreement. | For the time necessary to identify the driver (or the potential driver) responsible for the infraction that results in the fine. |
| Management and maintenance of a list of customers with contractual risks based on: i. payment incidents that have resulted in legal proceedings; ii. repeated vehicle accidents or damage or offenses against our employees; iii. use of our vehicles in breach of the general vehicle rental conditions. | 5 years from the date of creation or modification of the last rental and depending on the nature of the incident. |
| Video surveillance in our facilities. | Up to one month from the time of recording. If there are indications of crime or alterations in our goods or property or of the people present in the facilities, they may be kept for the time necessary for the resolution of the corresponding claims or legal actions. |
| Analysis of navigation data on our website and mobile applications. | [Centauro's Cookie Policy](/en/cookies-policy/) |

Without prejudice to the foregoing, your data will be kept duly blocked, while liabilities may arise from the execution of our contractual relationship, as well as for compliance with other legal obligations incumbent upon Centauro (with a maximum duration of 5 years).

In this regard, Centauro guarantees that it will not process the data unless it is necessary for the formulation, exercise or defence of claims or when it is required 1  to provide the same to the Public Administration, Judges and Courts during the statute of limitations period for their rights or legal obligations.

Once the maximum blocking period has elapsed, your personal data will be deleted at the moment in which all necessary actions have been carried out to manage and conclude any obligation that may remain outstanding between the parties, carrying out in that period, all necessary administrative procedures.

### G. Security and confidentially

We are committed to the security of your information. In order to prevent unauthorized access or unauthorized disclosure of personal data, we have undertaken appropriate technical and physical measures and management processes to safeguard and secure the information we collect from you.

Question 5

Website Privacy Policy

Accepted Answer

Website Privacy Policy
----------------------

### Basic information on data protection

**Data processor:** Centauro Rent a Car, S.L.U. (hereinafter, “Centauro”).

**Address:** Avda. País Valencià Bloque A, Local 4, 03509 Finestrat (Alicante).

**E-mail:** dpo@centauro.net

**Main purpose of the processing:** your data will be used to manage your browsing the Centauro Website and, where appropriate, to establish, maintain and manage the commercial, contractual or pre-contractual relationship with you, attending your queries or requests and sending promotional and commercial information.

**Legal grounds:** depending on the cases, the data will be processed on the basis of consent, the execution of the contract between you and Centauro, legitimate interests held by Centauro or the adoption of pre-contractual measures.

**Potential recipients of the data:**

\-    Third parties to which Centauro must transfer data, such as public authorities.

\-    Third entities and companies of the Centauro Group.

**Data protection rights:** you can revoke at any time your consent to Centauro’s data processing activities, and exercise, if you wish, your rights of access, rectification, deletion, limitation or objection to data processing, data portability, and your right not to be subject to automated decisions. You can do so by sending a request to Centauro Rent a Car, S.L.U. at Ave. País Valencià Bloque A, Local 4, 03509 Finestrat (Alicante) or to the following email address: dpo@centauro.net proving your identity.

**Origin of the data:** Centauro may collect personal data from joint or sector-wide data files and/or files held by public institutions.

### 1.    About Centauro

This document governs the privacy policy of the website owned by Centauro (hereinafter, the “Website”).

Please find below the particulars of the company:

Company name: CENTAURO RENT A CAR, S.L.U. (hereinafter, “Centauro”).  
Address: Avda. País Valencià Bloque A, Local 4, 03509 Finestrat (Alicante)  
E-mail: dpo@centauro.net

#### 1.1. How this Privacy Policy is applied

This Privacy Policy regulates the data processing carried out by Centauro in relation to users who access or contact Centauro through the Website - https://www.centauro.net/ - This includes processing personal data of (i) customers and/or potential customers, (ii) suppliers and/or potential suppliers, (iii) employees and/or candidates and (iv) any other user who may access or transfer data through the Website.

Therefore, this Privacy Policy contains the information concerning the processing of personal data related to the mentioned categories of interested parties.

For more information on the processing of data of customers purchasing Centauro products and/or services, read the Customer Privacy Policy at https://www.centauro.net/en/privacy-policy/

Find more information relating to processing of job candidates data, please read the Job candidate data protection informative clause at https://www.centauro.net/en/clause-information-candidates-employment/

### 2.    Personal data processed by Centauro, purposes and legal grounds

You are hereby informed that all the data that Centauro requests (or may request) are necessary for the purposes described in this privacy policy; failure to provide them would result in our inability to contact you or manage your application to Centauro. Likewise, Centauro reserves the right not to respond or deal with requests that do not include the requested information.

You guarantee the accuracy of the personal data provided to Centauro.  Centauro may periodically ask you to review and update your personal data.

On the Website you can find useful information about the services offered by Centauro. In this sense, Centauro will only request and process the data necessary to deal the query, provide the contracted service or engage in and maintain a commercial, contractual and/or pre-contractual relationship with you.

Find below the different purposes for which your personal data may be processed and the legal grounds for such processing:

i.    Legal grounds for the execution of the services contract between you and Centauro, or application of pre-contractual measures:

a.    To manage vehicle bookings made by Centauro customers through the Website, which includes managing the inquiries received from, and monitoring the relationship with, the latter.

b.    To manage the relationship with all the Centauro Website users, attending to their requests and following up on the relationship maintained.

c.    If you submit your information via the “Employment” section of the Website, to formalize the registration in the corresponding job openings subscription form and, where appropriate, subsequent monitoring of the submitted application.

d.    To respond to your inquiries and requests submitted through the different website sections.

ii.    Legal grounds arising from legitimate interest:

a.    To carry out any of Centauro’s commercial and/or advertising activities or communications, by any means, including electronic communications, relating to products or services similar to those previously purchased from Centauro.

b.    To conduct satisfaction surveys concerning the products and/or services you purchase, and to prepare profiles based on the personal data Centauro holds, to determine the products and services that can best fit your profile, so you can maximize their performance and, by doing so, provide you the best offers on products and services that may be of interest to you. We will retrieve the data we possess as a result of our management of the services we provide to you, or the products you have purchased.

c.    To transfer your data to companies of Centauro and its group (Grupo Mutua Madrileña), in particular, to the Centauro companies and its group (Grupo Mutua Madrileña), particularly, MUTUA MADRILEÑA AUTOMOVILISTA, S.S.P.F.; AUTOCLUB MUTUA MADRILEÑA, S.L.U.; MUTUAMAD MOBILITY, S.L.U.; SILDOSCAN SPAIN, S.L.; CENTAURO RENT A CAR, S.L.U.; NORDIC BUS, S.L.U.; CENTAURO RENT A CAR ITALY, S.r.L.; CENTAURO RENT A CAR, L.D.A.; NORDICWHEELS, L.D.A.; CENTAURO RENT A CAR GREECE, SINGLE MEMBER S.A. , among others, to provide on-site self-drive car rental services as requested by customers, and complementary services, as well as to centralize the administrative and computing procedures.

d.      To take legal actions in defense of the interests of Centauro.

e.      To manage your data as a user of the Website.

f.    To provide maintenance and support to Website users.

g.    To improve your browsing experience.

h.    To maintain our network and information security.

iii.    Legal grounds arising from express consent:

a.    With your prior authorization, to manage the subscription and/or unsubscribe you from the Centauro Newsletter.

b.    If you authorize it, to keep you informed by any means, including electronic, about the products and services marketed by Centauro other than those requested by you.

c.    If you authorize it, preparing profiles based on external sources that help us determine which products and services best fit your profile, so you can maximize their performance and, thus, provide you the best offers of products and services that may be of interest to you.

d.    If you authorize it, transfer your data to Centauro’s advertising partners, to send you special offers for products or services tailored to your needs.

#### 2.1. Data processing relating to mere Website browsing

Browsing through the Website may involve processing of personal data. Find more information about personal data processing  through mere Website browsing in the Cookies Policy, at https://www.centauro.net/en/cookies-policy/

### 3.    Third parties to whom your data may be transferred

The personal data you provide to Centauro may be transferred to the following categories of recipients:

\-    Third parties to which Centauro is legally required to transfer data, like public authorities, to comply with requirements from said authorities and applicable regulations, where appropriate.

\-    Third entities and companies of the Centauro Group, for the purposes described in letter d) of point ii) Legal grounds, as found in section 2. Personal data processed by Centauro, purposes and legal grounds.

\-    Third companies, including Centauro’s advertising partners, for the purposes described in letter c) of point iii) Legal grounds arising from express consent, as found in section 2. Personal data processed by Centauro, purposes and legal grounds.

Notwithstanding the data transfers mentioned above, Centauro cooperated with third party service providers that have access to your personal data and process the mentioned data in the name and on behalf of Centauro as a result of their provision of services.

Centauro pursues strict criteria for the selection of service providers that comply with their data protection obligations, and commits to sign with them the corresponding data processing agreements, by virtue of which it shall impose, among others, the following obligations: to apply technical and organizations measures; to process personal data for the agreed purposes and only within Centauro’s written instructions; and to delete or return data to Centauro after completing the provision of services.

Specifically, Centauro may hire third party providers, including without limitation, in the following sectors: logistics, legal advice, training services, medical services, maintenance services, transportation services, technology services and computer-related services.

### 4.    Data security

Centauro implements appropriate policies, as well as technical and organizational measures, to safeguard and protect your personal data against illegal or unauthorized access, loss or accidental destruction, damage or use, and illegal or unauthorized disclosure.

We will also take all reasonable precautions to ensure that our staff and employees with access to your personal data have received the appropriate training.

In any case, the user is hereby informed that any data transfer over the Internet is not completely secure and, as such, is made at their own risk. Although we will do our best to protect your personal data, Centauro cannot guarantee the security of personal data transmitted through our Website.

### 5.    Origin of the data

Regardless of the personal data you provide, Centauro may process personal data from joint or sector-wide data files and/or files held by public institutions in accordance with the purposes and legal grounds described in section 2. Personal data processed by Centauro, purposes and legal grounds.

As described above, Centauro will process personal data provided by the mentioned third parties in the following categories:

i.   Identification data.

ii.  Postal or electronic addresses.

We also inform you that no specially protected personal data is collected from third parties.

### 6.    Retention of data

The retention period of your data will be determined based on the duration of your relationship with Centauro and the legally established periods. In this sense, the criteria used by Centauro to determine the retention periods applicable to your data have been established in accordance with current applicable laws, regulations and guidelines, and the operational requirements of Centauro relating to adequate management of existing relationships with different categories of stakeholders.

In this sense, your data will be kept as long as you maintain any commercial or contractual relationship with Centauro.

Upon termination of said relationship, your personal data will be deleted once all the necessary actions have been carried out to manage and terminate any obligation that may remain between the parties, conducting all necessary administrative procedures within that period, except if you have authorized us to send you commercial communications, in which case your data will be kept until you revoke such authorization.

Notwithstanding the foregoing, your data will be kept duly blocked, as long as responsibilities may be derived from the execution of our contractual or pre-contractual relationship, as well as for the fulfillment of Centauro’s other legal obligations.

In this regard, Centauro guarantees that it will not process the data unless it is necessary for the filing, exercise or defense of claims or in order to comply with requests to hand the data to Public Administrations, Judges and Courts during the prescription period of their rights or legal obligations.

Based on all of the above, you are hereby informed that, at most, data will be retained for the duration of the relationship with Centauro and 5 years after its termination, after which they will remain duly blocked for 5 years and subsequently deleted.

### 7.    Your data protection rights

You may exercise, if you wish, your rights of access, rectification, deletion, limitation or objection to data processing, data portability, and your right not to be subject to automated decisions. You can do so by sending a request to Centauro Rent a Car, S.L.U. at Ave. País Valencià Bloque A, Local 4, 03509 Finestrat (Alicante) or to the following email address: dpo@centauro.net proving your identity.

Likewise, you are hereby informed that you may revoke the consents granted at any time, by contacting Centauro at the address or email indicated above.

If you need more information about your data protection rights or to submit a claim, please contact the Spanish Data Protection Agency, at Calle Jorge Juan, 6, 28001, Madrid, to apply for protection.

### 8.    Contact Centauro

Should you have doubts or questions for Centauro related to the processing of your personal data, please write to Centauro Rent a Car, S.L.U. at Avda. País Valencia Bloque A, Local 4, 03509 Finestrat (Alicante), or to the following email address: dpo@centauro.net.

Privacy policies