Privacy Policy

Preamble

We take the protection of personal data, very seriously. We would like to  explain here how we protect your data and what it means for you when you use our personalized services. Of course, we comply with all the legal requirements regarding data protection to ensure maximum protection of your privacy. We comply with the provisions of the General Data Protection Regulation (GDPR) and the New Federal Data Protection Act (BDSG-neu) due to the adaptation of data protection law in line with Regulation (EU) 2016/679 and we comply with the implementation of Directive (EU) 2016/680 (Data Protection Adaptation and Implementation Act EU - DSAnpUG-EU).

This data protection statement applies to DriveNow's website, which can be accessed under the domain https://www.drive-now.com/de/en/ ,and the various subdomains (hereinafter referred to as "our website").

1. Name and address of the person responsible

The responsible party and service provider is DriveNow GmbH & Co KG, Seidlstrasse 26, 80335 Munich, Germany (hereinafter referred to as "DriveNow").

2. Name and address of the data protection officer

Our data protection officer is attorney-at-law Dr. Karsten Kinast, Kinast Rechtsanwaltsgesellschaft mbH, Hohenzollernring 54, 50672 Cologne. You can contact our data protection officer at any time in relation to any matter relating to data protection. The best way to contact us is to send an email to: datenschutz@drive-now.com or to write us at: DriveNow GmbH & Co KG, Seidlstrasse 26, 80335 Munich, Germany.

3. General information on data processing

We only collect and use personal data from our users which is necessary to provide a functional service for our website and for the content of our services.

3.1 Personal data

Personal data is information that can be associated with you as an individual. Examples include your name, address, postal address, telephone number and email address. Non-personal data is information such as the number of users of a website or service.

3.2 Processing of personal data

Processing means any operation or series of operations carried out with or without the aid of automated procedures in relation to personal data, such as the collection, collation, organisation, sorting, storage, adaptation or alteration, reading, retrieval, use, disclosure by transmission, dissemination or any other form of provision, comparison or linking, restriction, erasure or destruction.

Personal data is collected via this website if you provide it to us on your own initiative and consent, e.g. by registering, filling out forms, sending emails or by booking a DriveNow vehicle. We use this data for the purposes indicated in each case or resulting from the enquiry, thus for example the reservation enquiry for handling your reservation requests. Transmission to third parties will only take place if this is expressly permitted by law or if you have agreed to the transmission within the framework of your registration or during an active business relationship. Apart from this, you can principally use the general information on drive-now.com without disclosing your personal data.

3.3 Legal basis for the processing of personal data

The collection and use of the personal data of our users takes place regularly only with the user's consent. Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a GDPR shall apply as the legal basis for the processing of personal data.

An exception applies in those cases in which prior consent cannot be obtained for actual reasons and the processing of the data is permitted by legal regulations. For the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR is the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which we are subject, Art. 6 para. 1 lit. c GDPR is the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh this first interest, Art. 6 para. 1 lit. f GDPR is the legal basis for processing.

3.4 Data erasure and storage time

Your master data is kept for the duration of the contract. After you have initiated the termination of the business relationship, the data will be kept for a maximum of 4 years from your last transaction. If we initiate the termination of the business relationship for security reasons or due to bankruptcy, we will keep your data for a maximum of 5 years after your last transaction. 

3.5 Security, TLS technology

We have taken technical and organisational measures to protect your personal data, in particular against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. These security measures are continually updated in line with technological developments. The transmission of personal data between your computer or mobile device and our server is always encrypted (TLS procedure, Transport Layer Security).

4. Registration

In the following we describe the processing of data within the registration process.

4.1 Registration process

On our website, we offer users the opportunity to register by providing personal data. The data is entered into an input mask, transmitted to us, and saved. Your data is not transferred to any third parties. The following personal data is collected during the registration process:

- Name, address, date of birth, email address, mobile phone number, payment information and a PIN, security response and password of your choice

In addition, the following personal data is collected:

- IP address

- Date and time of registration


Your data, with the exception of your IP address, will be kept for the entire duration as your membership, but for a maximum of 4 or 5 years, depending on how the business relationship as defined in Section 3.4 has been terminated. After expiry of these periods, all personal data will be irretrievably deleted, unless there are legal retention periods. During the retention period, the personal data required for commercial and tax obligations will be completely blocked and will no longer be accessible for further data processing. We always delete your IP address after 6 months.

4.2 Legal basis

The legal basis for the processing of this data, which is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures, is Art. 6 para. 1 lit. b GDPR.

5. PostIdent

In the following we describe data processing within the framework of the PostIdent process.

5.1 Online identification

Using our website you, can carry out the required check of your driving licence via an online identification system provided by Deutsche Post AG. For this you will be directed to a website run by Deutsche Post AG after clicking on the appropriate button and will need to register there. When you register with Deutsche Post AG, we will send the following data to Deutsche Post AG:

- Name, mobile phone number, email address

 

On the Deutsche Post website, you will go through a process to verify the validity of your driver's licence using your computer camera or smartphone. You must photograph your licence via the camera function and then, on the video feature, enable your identification and the comparison with the photograph on the licence. Upon completion, the results of this verification process will be returned to DriveNow. For further information about the processing of data by Deutsche Post AG, please visit: https://www.deutschepost.de/content/dam/dpag/html/ext/postid/Datenschutzhinweise.pdf. 

5.2 Legal basis

The legal basis for the processing of this data, which is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures, is Art. 6 para. 1 lit. b GDPR and your consent to the PostIdent process pursuant to Art. 6 Abs. 1 lit. a GDPR.

6. Google Maps

In the following we describe data processing in the context of the use of Google Maps.

6.1 Google Maps application

This website, as well as the DriveNow application, use Google Maps API applications. This enables us to display interactive maps directly on the website or on our app and enables you to conveniently use the map function. This application is essential for the functionality and complete provision of our content and services. You can view Google's Terms of Use here: https://policies.google.com/terms?hl=en . The additional terms of use for Google Maps/Google Earth can be found here https://www.google.com/intl/en-US_US/help/terms_maps.html. You can find Google's privacy policy here: https://policies.google.com/privacy?hl=en. We use Google Maps to determine the current location of our vehicles and to show you the nearest available vehicle. In addition, we use Google Maps to translate geo-positions into addresses and to show you the estimated walking distance to the selected vehicle. After your approval, we will use Google Maps to show your planned arrival location and the remaining arrival time for handover to a subsequent customer on our app. We do not share this information with Google. This data will only be transmitted to Google anonymously. It cannot, therefore, be traced back to you.

6.2 Legal basis

The legal basis for the processing of this data, which is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures, is Art. 6 para. 1 lit. b GDPR.

7. Cookies

In the following, we describe processing procedures within the framework of using cookies in detail.

7.1 Use of cookies

Cookies are small text files that are stored on your hard drive by a web server. Cookies contain information that can later be read by a web server in the domain that issued the cookie to you. Cookies cannot run programs or deliver viruses to your computer. There is a distinction made between two different types of cookies. Session cookies are deleted as soon as you end the session. Temporary and permanent cookies are stored on the data carrier for a longer period or indefinitely.

7.2 Data in the context of the use of cookies

No personal data is stored in the cookies we use. The cookies we use are also not combined with personal data. In this respect, these cookies cannot be attributed to any particular person. When a cookie is activated, it only receives an identification number. Personal data such as name, IP address, etc. are not assigned to this identification number at any time. Using cookie technology, we only receive anonymous information, such as which pages of our website have been visited, etc.

7.3 Use of session cookies

Most of the cookies we use are so-called session cookies, which are necessary to keep your visit consistent, i.e. to ensure that, for example, no renewed login is required and that your preferences or other information already entered during the reservation request are retained during the session. In addition, we need session cookies to ensure that a specific offer that you have clicked on will be assigned to your request (e.g. for promotional offers). These session cookies are automatically deleted when the session ends. In addition, we use cookies when you visit the website subsequently to detect if you are particularly interested in certain offers, which allows us to display such targeted offers on the site. This assignment is only made using abstract criteria (e.g. "BMW") and not on a personal basis. These cookies have a lifetime of one year and are then automatically deleted.

7.4 Onsite targeting

Our website uses cookie technology to collect data to simplify our website. This tells us how the website is used and enables us to constantly optimise our offering. The following data is processed:

  • Search terms used
  • Frequency of page views
  • Use of website functions

This data is used exclusively for anonymous evaluation of the use of the website and is never merged with the personal data stored by us. Using the information obtained through clickstream analysis, we make our website as attractive as possible in order to best meet our customers' needs.

7.5 Re-marketing/targeting

We use re-marketing/targeting to make internet offerings more relevant to Internet users. This technology enables us to address internet users who have already expressed an interest in our website on the websites of our partners with DriveNow advertising. These advertising materials are displayed on the pages of our partners on the basis of cookies and an analysis of the usage behaviour on the website. The insertion of the advertisement is completely anonymous: no personal data is stored at any time and no user profiles are combined with personal data.

In this context, we use the services of Criteo SA, 32 Rue Blanche, 75009 Paris. This makes it possible for us to show our advertising to visitors who are interested in our products on apps and emails. To decline this interest-based advertising, please visit the following websites:

http://www.networkadvertising.org/choices/

http://www.youronlinechoices.com/

We may exchange information such as technical identifiers from your registration information on our website or from our CRM system with trusted advertising partners. This allows you to link your devices and/or environments and offer you a seamless usage experience with the devices and environments you use.

For more details on these linking capabilities, please refer to the Privacy Policy found on the above platforms.

Criteo's Privacy Policy can be accessed via: https://www.criteo.com/privacy/

7.6 Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses "cookies", text files that are stored on your computer and which enable analysis of your use of the website. The information on your use of this website generated by the cookie (including your IP address) will be transferred to and stored on a Google server in the USA. However, if IP anonymisation is enabled on this website, your IP address will first be abbreviated by Google within the member states of the European Union or other parties to the agreement on the European Economic Area. Only in exceptional cases is the full IP address sent to a Google server in the US and shortened there.

Google will use this information for the purpose of evaluating your use of the website, compiling reports about website activities for website operators and to provide other services related to website and internet use, in particular functions for Google Analytics reports on performance according to demographic characteristics and interests. Google Analytics Demographics and Interest Reporting allows us to use data from Google's interest-based advertising and/or data from third parties about our advertising audience (e.g. age, gender and interests) in conjunction with Google Analytics for targeted and optimised advertising activities, strategies and content of our website.

Google may also transfer this information to third parties as required by law or if said third parties process this data on behalf of Google. In any event, Google will not associate your IP address with other data held by Google.

You can prevent these cookies being stored by selecting the appropriate settings in your browser; however, we wish to point out that doing so may mean you will not be able to enjoy the full functionality of this website. You can also prevent the data generated by cookies about your use of the website (incl. your IP address) being passed to Google and the processing of this data by Google, by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en

This website uses Google Analytics with the extension "anonymizeIp()". As a result, IP addresses are further processed in abbreviated form, so that a connection to a particular individual can be ruled out. If the data collected about you is personal in nature, it will be excluded immediately, and the personal data will be deleted immediately.

We use Google Analytics to analyse and regularly improve the use of our website. We can improve our offering and make it more interesting for you as a user with the statistics gained. For the exceptional cases in which personal data is transferred to the USA, Google has submitted itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

 Third party information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Usage conditions: https://www.google.com/analytics/terms/gb.html, Overview of data protection: https://support.google.com/analytics/answer/6004245?hl=en, as well as the privacy policy: https://policies.google.com/privacy?hl=en.

 This website also uses Google Analytics for a device-independent analysis of visitor flows, which is carried out via a user ID. You can disable cross-device analysis of your usage in your Google Account under "My information", "Personal information"

7.7 adjust.io

This website also uses the analysis technology "adjust.io" from adeven GmbH, Saarbrücker Str. 37a, 10405 Berlin, ("adeven"). adeven uses the IP and Mac addresses of users for the analysis, which, however, are exclusively used anonymously. It is hereby not possible to draw any conclusions about a natural person. The information collected through the use of cookies will only be used to analyse the function and use of websites, whereby anonymous evaluations and charts on the number of visits, number of pages viewed per user etc. will be created. The analyses are used exclusively for the purposes of our own market research as well as for the optimisation and demand-oriented design of the website. By using this website you agree to the processing of anonymised data collected in the manner described above and for the aforementioned purpose. You may object to the collection and storage of data at any time with future effect by sending an email to optout@adjust.io.

7.8 DoubleClick

We use DoubleClick from Google Inc. on our website provided by Trakken Web Services GmbH, Zirkusweg 1, 20359 Hamburg, to present advertisements relevant to you. When you visit a website and view or click an ad served on Google's advertising network sites, a DoubleClick cookie may be placed in your browser. The DoubleClick cookie identifier assigned to your browser is the same one used when you visit websites that use DoubleClick advertising programs. This cookie assigned to your browser contains a pseudonymous identification number (ID) and can check which ads were displayed in your browser and which ads were brought up. The cookies do not contain personal information. In conjunction with our re-marketing measures, we can use this information as a basis for submitting advertisements tailored to your needs. Through re-marketing, information about your surfing behaviour is collected and stored in anonymous form for marketing purposes.

DoubleClick only allows Google and its partners to serve ads based on previous visits to our site or other sites. The information generated by the cookies is transmitted by Google to a server in the USA for analysis and stored there.

Google complies with the data protection provisions of the US Privacy Shield Agreement and is registered with the Privacy Shield Program of the US Department of Commerce, see:

https://www.privacyshield.gov/participant?id=a2zt00000000001L5AAI

The transfer complies with legal regulations or takes place within the scope of order processing. Under no circumstances will Google match its data with other data collected by Google. By using this website, you agree to the processing of data relating to you and collected by Google as described above and to the data processing and the purposes set out above. You may refuse the use of cookies by selecting the appropriate settings on your browser, which may prevent you from using the full functionality of our website.

Information about DoubleClick's privacy policy can be found at:

https://policies.google.com/technologies/ads?hl=en

In addition, you can prevent Google from collecting the data generated by the cookies and relating to your use of the websites and the processing of this data by Google by

downloading and installing the browser plugin available under "Display settings", "Extension for DoubleClick deactivation" at https://support.google.com/adsense/answer/142293?hl=en.

7.9 Prevention of storage of cookies

It is possible to accept or reject cookies. Most web browsers automatically accept cookies. As a rule, it is possible to specify in the browser settings that cookies are to be rejected. If cookies are rejected, it may be that you cannot use some features of this website. If cookies are accepted, you can delete these cookies later on. If you delete cookies, any settings that are controlled by those cookies, including advertising settings, will be deleted and might no longer be recoverable.

7.10 Legal basis

Our legitimate interest lies in the aforementioned data processing processes and the purposes pursued with them. For this purpose, Art. 6 para. 1 lit. f GDPR provides the legal basis.

8. Facebook

This website uses some technologies provided by Facebook, Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). These technologies are explained in more detail below.

8.1 Facebook Connect

If a so-called "Facebook Connect Button" is placed on this website, you can log in to our website with your Facebook user data. In addition, Facebook Connect can automatically include information about your activities on our website in your Facebook profile. In this respect, when you activate the button, you will be given both the opportunity to expressly consent to access your Facebook user data and to publish information and activities in your Facebook profile. The use of further data (e.g. contact via your email address) only takes place with prior express consent. Please note that Facebook receives information about the application or website via Facebook Connect, including what you are doing. To personalise the connection process, Facebook may in some cases receive a limited amount of information prior to authorising the application or website. The purpose and scope of the data collection and the further processing and use of the data by Facebook as well as your rights in this regard and settings options for the protection of your privacy can be found in the privacy policy             at: http://www.facebook.com/policy.php

8.2 Facebook Custom Audience

Within our Internet presence we use the "Facebook pixel" from Facebook Inc. 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). This allows users' behaviour to be tracked after they have seen or clicked on a Facebook ad. This process is used to evaluate the effectiveness of Facebook advertisements for statistical and market research purposes and can help to optimise advertising measures.

The data collected is anonymous to us, so it does not give us any indication of the identity of the users. However, Facebook stores and processes the data so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook data usage guidelines. You can enable Facebook as well as its partners to connect advertising ads to Facebook and including on external websites. A cookie can also be stored on your computer for these purposes. In order to reject the use of cookies on your computer in general, you can set your internet browser so that cookies can no longer be stored on your computer in the future or cookies that have already been stored will be deleted. However, disabling all cookies can result in some functions on our internet pages no longer being executed.

You can disable the use of cookies by Facebook through a program we have developed specifically for this case (web-based opt-out procedure). For this you only need click on the following link https://www.facebook.com/ads/preferences/

8.3 Legal basis

Our legitimate interest lies in the aforementioned data processing processes and the purposes pursued with them. For this purpose, Art. 6 para. 1 lit. f GDPR provides the legal basis.

9. Advertising

In the following we explain the data processing for purposes of advertising.

9.1 Personalised advertising (newsletter)

You have the option to subscribe to a free newsletter on our website. This is done on the basis of your consent. When registering for the newsletter, the data from the input mask is transmitted to us. In the dispatch of the newsletter we will inform you about current products, services and offerings, which correspond to your personal interests.

We collect your email address and your mobile phone number for this purpose. The identification of your email address and your mobile phone number is carried out by the double opt-in procedure. This means that after processing your data you will receive a separate confirmation email and a 4-digit code sent by SMS. You will only receive advertising emails after clicking on the link contained in the email and entering the code contained in the SMS. In addition, we store your IP addresses and the time of registration and confirmation. The purpose of the procedure is to be able to prove your registration and, if necessary, to clarify possible misuses of your personal data.

In order to send you only interest-related information, we must personalise your data. For this purpose, we evaluate the following data:

- Master data (name, address, date of birth)

- Your travel data (time of your last trip, your selected vehicle)

- Your selected product or offer (hourly packages, savings packages)

- Rental frequency (frequency of completed individual rental agreements)


The data will be deleted as soon as it is no longer needed for achieving this purpose of its collection. The user's email address and/or mobile phone number will therefore be stored for this purpose for as long as the subscription to the newsletter is active.

To unsubscribe you can either send us an email to datenschutz@drive-now.com or use the link at the bottom of the newsletter.

You can revoke your consent to the collection of other personal data collected during the registration process at any time.

No data is passed on to third parties in connection with data processing for the dispatch of newsletters. The data will be used exclusively for sending the newsletter.

9.2 Legal basis

The legal basis for the processing of data after registration for the newsletter by the user is, with the user's consent, Art. 6 para. 1 lit. a GDPR.

9.3 Non-personalised advertising (newsletter)

If you purchase offers or services on our website and provide us with your email address, we may subsequently use this for sending you a newsletter (not personalised). In such a case, only direct mail will be sent for goods or services similar to our own.

No data is passed on to third parties in connection with data processing for the dispatch of newsletters (not personalised). The data will be used exclusively for sending the newsletter.

We collect your email address and your mobile phone number for this purpose. The identification of your email address and your mobile phone number is carried out by the double opt-in procedure. This means that after processing your data you will receive a separate confirmation email and a 4-digit code sent by SMS. You will only receive advertising emails after clicking on the link contained in the email and entering the code contained in the SMS. In addition, we store your IP addresses and the time of registration and confirmation. The purpose of the procedure is to be able to prove your registration and, if necessary, to clarify a possible misuse of your personal data.

No data is passed on to third parties in connection with data processing for the dispatch of newsletters. The data will be used exclusively for sending the newsletter.

The data will be deleted as soon as it is no longer needed for achieving this purpose of its collection. The user's email address and mobile phone number will therefore be stored for this purpose for as long as the subscription to the newsletter is active.

To unsubscribe, you can either send us an email to datenschutz@drive-now.com or use the link at the bottom of the newsletter.

You can revoke your consent to the collection of other personal data collected during the registration process at any time.

No data is passed on to third parties in connection with data processing for the dispatch of newsletters. The data will be used exclusively for sending the newsletter.

9.4 Legal basis

The legal basis for the dispatch of the non-personalised newsletter as a result of the provision of services is Article 7 para. 3 UWG (Law on Unfair Competition).

9.5 Personalised advertising by partner companies (newsletter)

On our website you can subscribe to a free newsletter for the purpose of sending advertising by Bayerische Motoren Werke Aktiengesellschaft, Petuelring 130, 80788 Munich (BMW). This is done on the basis of your consent. When registering for the newsletter, the data from the input mask is transmitted to us, which we in turn transmit to BMW. BMW's newsletter provides you with information on current products, services and support for the automotive industry.

We collect your email address and your mobile phone number for this purpose. The identification of your email address and your mobile phone number is carried out by the double opt-in procedure. This means that after processing your data you will receive a separate confirmation email and a 4-digit code sent by SMS. You will only receive advertising emails after clicking on the link contained in the email and entering the code contained in the SMS. You will only receive advertising mails after clicking on the link contained in it. In addition, we store your IP addresses and the time of registration and confirmation. The purpose of the procedure is to be able to prove your registration and, if necessary, to clarify a possible misuse of your personal data.

In order to send you only interest-related information, we must personalise your data. For this purpose, we evaluate the following data:

  • Master data (title, name, address, date of birth, email address and customer ID as well as their opt-in date)

The data will be deleted as soon as it is no longer needed for achieving this purpose of its collection. The user's email address and/or mobile phone number will therefore be stored for this purpose for as long as the subscription to the newsletter is active.

To unsubscribe you can either send us an email to datenschutz@drive-now.com or use the link at the bottom of the newsletter.

You can revoke your consent to the collection of other personal data collected during the registration process at any time.

No data is passed on to third parties in connection with data processing for the dispatch of newsletters. The data will be used exclusively for sending the newsletter.

9.6 Legal basis

The legal basis for the processing of data after registration for the newsletter by the user is, with the user's consent, Art. 6 para. (1)(a) GDPR.

9.7 Customer ID

When you register, you will receive a customer identification number (customer ID) from us, which we use with your consent. Using the Google Maps application and the customer ID we are able to examine your interests automatically. By evaluating personal aspects such as travel data or selected products or offers, we can provide you with our offers and services in a more targeted and specific manner. For example, you will receive offers for new trips from us by email to the email address you provided when you registered and verified using the double opt-in procedure.

For this purpose, we evaluate the following data:

- Master data (name, address, date of birth)

- Your travel data (time of your last trip, your selected vehicle)

- Your selected product or offer (hourly packages, savings packages)

- Rental frequency (frequency of completed individual rental agreements)

 

9.8 Legal basis

The legal basis for this data processing, provided the user's consent is given, is Art. 22 para. 2 lit. c, 6 para. 1 lit. a GDPR.

9.9 Advertising ID

In addition to your customer number, we will assign you an advertising identification number (advertising ID) when you register. Using this advertising ID, we can track your path to our website and our offers and services. This enables us to determine whether you have accessed our website directly or whether you have seen and clicked on an advertisement from us on another website. We are assisted in this data processing by our partner Refined Labs GmbH, Theresienstrasse 4-6, 80333 Munich, whose services we use for this purpose. For this purpose, we merely communicate the advertising ID generated by us to our partner without further personal data. We ask for your consent to access and forward your advertising ID.

9.10 Legal basis

The legal basis for this data processing, provided the user's consent is given, is Art. 6 para. 1 lit a GDPR, supplemented by Art. 6 lit. f GDPR.

10. Market and survey research

In the following we describe data processing procedures in the context of market and survey research.

10.1 Statistical purposes

We process your personal data for market research and polling purposes. Your data will be made anonymous, only used by us for statistical purposes and cannot be traced back to you at any time. You can object to this data processing at any time and without giving reasons with effect for the future. For this purpose, you can use the functions described under Section 2 in the privacy policy.

10.2 Legal basis

This data processing is based on Art. 6 para. 1 lit. f. and serves the improvement of our purposes mentioned here in the privacy policy, in particular a more effective organisation of advertising, regarding our offers and services. We comply with the protection of our customers by conducting market research with anonymised data.

11. Use of service providers for the processing of personal data / processing of data in countries outside the European Economic Area

We use service providers to provide services and to process your data relating to our services and products. The service providers process the data exclusively in accordance with our instructions and have been obliged to comply with the applicable data protection regulations. All contractors have been carefully selected and will only have access to your data to the extent and for the time required to provide the services or to the extent to which you have consented to the processing and use of your data.

Service providers in countries such as the USA or in the countries of the European Economic Area are subject to data protection that does not generally protect personal data to the same extent as is the case in the Member States of the European Union. If your data is processed in a country that does not have a recognised high level of data protection such as the European Union, we use contractual regulations or other recognised instruments to ensure that your personal data is adequately protected.

12. Your rights as an affected person

12.1 Right to information

 You have the right to ask us at any time about the data stored concerning you, as well as its origin, recipients or categories of recipients to whom this data is transmitted and the purpose of storage.

12.2 Right of revocation

If you have given your consent to the use of data, you can revoke this at any time without giving reasons with effect for the future.

12.3 Right of correction

If your data stored with us is incorrect, you can correct it at any time in your customer account or have it corrected by us through our service centre.

12.4 Right of deletion and blocking

You have the right to block and delete your personal data stored by us. As a rule, your personal data will be deleted within a maximum of 2 working days after assertion of this right. Should the deletion contradict legal, contractual, fiscal or commercial-law storage obligations or other reasons based in law, your data can only be blocked, not deleted. Once your data has been deleted, it is no longer possible to provide information.

12.5 Right to data transmission

Should you request the personal data provided to us, we will release or transmit the data to you or another person responsible, if you so desire, in a structured, current and machine-readable format. The latter, however, shall only be the case if this is technically possible.

12.6 Right of objection

You have the right to object at any time and without giving reasons for data processing for the purpose of direct marketing. In addition, it is pointed out that the execution of the framework contract as well as the handling of individual contracts may be restricted or no longer possible due to opposition to all data processing operations.

12.7 Extended rights in relation to data processing for personalised data evaluation

With regard to the data processing of personalised data evaluation, in addition to the aforementioned rights, you also have the right of participation granted to a natural person in the decision-making process, a right of appeal and a right to disclosure of our position.

12.8 Contact for assertion of the rights of the persons affected

For asserting your rights you are entitled to the means mentioned in Section 2 of the privacy policy.

12.9 Right of appeal to the supervisory authority

You have the right to file a complaint with the competent supervisory authority against the processing of your personal data if you feel that your rights under the GDPR have been violated.

14 Data protection information in the General Terms and Conditions

Please also note the data protection information in Section 15 of our General Terms and Conditions, which you can access at https://www.drive-now.com/de/en/gtc . It is there, in particular, that the processing of your personal data is discussed, which we need for the execution of the individual rental contracts. Furthermore, we explain to you which personal data we may have to process for recourse claims. On the basis of our statutory liability as the vehicle and in order to determine that the use of your personal data is contrary to the contract and/or traffic regulations, we may process your personal data. During a trip with our vehicles we operate so-called geofencing, with which we determine your GPS position in order to provide you with valuable information. A motion profile is not created. For the purpose of targeted communication, we process your personal data so that you can also receive push notifications. Finally, we inform you about the processing of your personal data for the purpose of an identity and credit assessment.