Privacy Policy

1. About Us

   1.1 Welcome to the privacy policy of “CARisma Rental” (trade name “CARisma Rental”). We respect your privacy and are committed to protecting your personal data. This privacy policy informs you about how we look after your personal data as a customer and provides information regarding your privacy rights and how the law protects you. Our company is responsible for the collection, management, and processing of your personal data.

1.2 You possess all rights under the provisions of EU Regulation 2016/679 (GDPR) and relevant European and national legislation. We will process your personal data only when the law allows us to.

We will use your personal data in the following circumstances:

• When we have your explicit consent to do so.

• When we need to perform the contract we are about to enter into or have already entered into with you.

• When it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• When we need to comply with a legal or regulatory obligation.

• When required for reasons of public interest.

2. Purposes for Processing Your Personal Data

   We process personal data that you provide to us voluntarily and after receiving your prior explicit consent, when processing is necessary for the execution of our contract, or to take steps at your request before entering into a contract, such as when you activate the online check-in service or any other similar service we provide. Specifically, our purposes are defined as: the rental of cars to third parties with or without a driver, the sale of cars to third parties (wholesale or retail), and the rental of trucks and light commercial vehicles with or without a driver.

3. Categories of Information We Collect

   We reserve the right to collect, process, store, and transfer different kinds of personal data about you, which we have grouped as follows:

• Identity Data: Includes first and last name (Business Name for Sole Proprietorships), father’s name, mother’s name, date of birth, ID card (Number, issue/expiry date, and place of issue), or Passport (Number, issue/expiry date, and place of issue), Residence Permit, and valid Driver’s License (Number, issue/expiry date, and place of issue).

• Contact Data: Includes residential address, email, fax, and telephone numbers.

• Financial Data: Includes Tax ID (AFM), bank account, payment card details, VAT exemption status, Business Activity (for Sole Proprietorships), Tax Office (DOY), Headquarters (for Sole Proprietorships), Credit Check details, and Legalization documents.

We do not collect sensitive Personal Data in any of our activities or countries of presence, except for information regarding your health, which we receive with your consent in case of an injury in a road accident, solely for the purpose of transmitting it to the insurance company where our vehicle is insured.

4. How We Collect Your Information

   We collect personal data about you in digital or hard copy format whenever you use our services, whether provided at our customer service points (branches) or other physical locations where our company lawfully operates (e.g., airports, hotels, service stations, etc.).

We also collect your information when you use our call centers or mobile applications, when you use our company’s email, and when you use our websites and digital applications (e.g., online check-in). In the above cases, and specifically when you create or manage your profile, we collect the necessary information for that purpose. You bear the sole responsibility for the accuracy and correctness of the information and documents you transmit to our company.

Additionally, for information regarding our company’s cookies policy, you may refer to our website.

We collect personal data with your consent in various ways, including but not limited to telephone calls, customer service contacts, websites, and other sources as defined above. We collect personal data from customers or drivers during the booking process for short-term or long-term rental or car sale, such as name, address, telephone, driver’s license, credit card details, Tax ID, etc.

We also collect your personal data when you create a profile on our website as follows:

• Personal Data Collected: Full Name, Email, Telephone Number.

• Access: You gain access by creating a password of your choice. You have the option to renew your password or reset it in case of loss. The password is strictly personal. Its creation and any changes are made exclusively through your email and under your personal responsibility. Access to your booking management profile by third parties is strictly prohibited. We advise you not to grant access to third parties and to contact us if you face any problem. Our company bears no responsibility if you provide access to third parties, authorized or not. Accordingly, we have no obligation to provide information to third parties regarding your booking management via your profile. Access is available 24/7 (except during maintenance or technical issues). You retain the right to update your contact details at any time.

• Reasons for profile creation: i) management of your booking, ii) maintaining a history of your bookings, iii) facilitating future bookings.

• Retention: i) You have the right to delete your profile at any time. Data provided for contractual fulfillment will be retained as per paragraph 5. ii) Data will be automatically deleted from your profile five years after your last booking. iii) The right to profile portability is not provided.

5. How Long We Retain Your Personal Data

   We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use, the purposes of processing, and applicable legal requirements.

• Tax data is retained for ten (10) years from the year of issuance for audit purposes.

• Data related to legal claims is retained from the time the claim arises and for up to twenty (20) years, or until the claims are legally barred.

6. Personal Data Security

   We have taken all appropriate organizational and technical measures for the security of your personal data and their protection against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and any other form of unlawful processing.

    

    

7. Who Are the Recipients of Your Data

   Our company guarantees that it will not transfer, disclose, or grant your Data to third parties (other than those mentioned herein) for any purpose unless required by law or judicial authorities. Access is granted to strictly necessary personnel bound by confidentiality and partner businesses compliant with GDPR.

   Indicative recipients:

    

    

• Partner insurance companies.

• Franchisees and brand partners.

• Car rental companies (within or outside Europe) part of the global booking system. Data may be transferred to countries outside the EU, provided they have an adequate legal framework for data protection.

• Auditing firms.

• Roadside assistance providers.

• Car leasing partners.

• Legal service providers (lawyers, law firms) to protect the company’s interests.

8. Ensuring Compliance by Processors & Sub-processors

   Data processors on our behalf have contractually agreed:

• To maintain confidentiality and not send data to third parties without permission.

• To take appropriate security measures and comply with GDPR.

• To ensure that any sub-processors they employ have the same obligations and rights.

9. Your Rights

   You have the right to:

• Request access to your personal data.

• Request correction of inaccurate or incomplete data.

• Request erasure of your data (subject to paragraph 5).

• Object to processing if you feel your fundamental rights are violated.

• Request restriction of processing in specific cases.

• Request the transfer of your data to you or a third party (Data Portability).

• Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

If you wish to exercise any of these rights, please contact us.

10. How You Can Exercise Your Rights

    For any clarification or request, you can send an e-mail to: info@carisma-rental.gr or a letter to: “CARisma Rental”, 75 Piraeus Str., Moschato – 18346, Greece.

You also have the right to lodge a complaint with your national supervisory authority. In Greece, this is the Hellenic Data Protection Authority (www.dpa.gr). We would appreciate the opportunity to address your concerns first.

11. Fees

    You will not have to pay a fee to access your personal data. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

12. What We May Need From You

    We may request specific information to confirm your identity and ensure your right to access the data. This is a security measure to prevent unauthorized disclosure.

13. Response Time Limit

    We try to respond to all legitimate requests within one month. If the request is complex, it may take longer, in which case we will notify you.

14. Updates to This Policy

    We reserve the right to change this policy. Material changes will be published on our website. These changes take effect from the day of publication. We encourage you to read this Policy periodically.