The website www.gabautorent.ro provides car rental services in Bucharest and for the airports in the Bucharest area (Otopeni and Băneasa). If you do not agree with any of the provisions below regarding the processing of your personal data submitted through this website, please do not use our contact or booking forms.
1. Scope
This Privacy Policy applies to all personal data collected through the website www.gabautorent.ro, in accordance with Regulation (EU) 2016/679 (“GDPR”).
The controller of your personal data is LIMADRIA DBG TRANS S.R.L., the owner of the GAB Auto Rent brand, a Romanian legal entity (hereinafter “GAB Auto Rent”, “we” or “the controller”).
For the purposes of this Policy, “personal data” means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, for example by name, e-mail address, telephone number, location data (such as an IP address) or other specific identifiers.
We undertake to process the personal data submitted through this website in accordance with the following principles:
- lawful, fair and transparent processing;
- collection for specified, explicit and legitimate purposes, with no further processing incompatible with those purposes;
- data that is adequate, relevant and limited to what is necessary;
- accurate and, where applicable, up-to-date data;
- keeping data in a form which permits identification of data subjects only for as long as necessary;
- appropriate security of the data and respect for your rights under the GDPR.
2. Purposes of processing your personal data
We process the personal data submitted through www.gabautorent.ro only where applicable law allows us to do so and only for legitimate purposes, such as:
- preparing and sending car rental quotes, at your request (through the forms on the website or through the messages you send);
- handling booking requests and preparing car rental agreements;
- communicating with you regarding clarifications about your booking, changes, confirmations or cancellations;
- providing additional information about our car rental services (prices, rental conditions, pick-up/drop-off, etc.);
- complying with legal obligations (accounting, tax or other legal requirements applicable to our activity);
- defending our rights and legitimate interests in any disputes or inspections by the authorities.
The main legal bases for the processing are:
– performance of a contract or taking steps at your request prior to entering into a contract;
– compliance with the controller’s legal obligations;
– our legitimate interests relating to the proper running of our business and the defence of our rights, to the extent that these are not overridden by your fundamental rights and freedoms.
We will not use the personal data you submit through this website for purposes other than those described above, unless we obtain your explicit consent or another clear legal basis exists.
3. Categories of personal data collected and processed
Through the website www.gabautorent.ro, we may collect the following categories of data:
A. Data you provide directly through the forms:
- first name and surname;
- e-mail address;
- telephone number;
- the message submitted through the form (booking details, period, preferences, questions, etc.);
- any other information you choose to share with us voluntarily.
B. Data collected automatically when you visit the website:
- IP address;
- information about your approximate location (country/city) inferred from the IP address, where applicable;
- browser type, device type and operating system;
- pages visited and actions taken on the website (for example, submitting a form).
This information is used mainly for the security of the website and for aggregated statistics on the use of our services (for example, to better understand how the website is used and to improve it).
Through this website, we do not intentionally collect:
- bank card data or other payment details (payment for our services is made when you collect the car, in accordance with the policies published on the website);
- data from the content of your device (photographs, contacts, files, etc.);
- direct login data for your social media accounts;
- images/photographs of you, unless you send them to us voluntarily through other channels (e-mail, messaging apps, etc.).
We do not intend to collect, through this website, special categories of personal data (for example data concerning health, religious or political beliefs, etc.). Please do not include such information in the message fields or in correspondence sent through the website.
4. Processing and storage of your personal data
We will process the personal data submitted through this website only in accordance with this Privacy Policy and with applicable law.
The data will be processed mainly by electronic means (IT systems, e-mail applications, booking management applications). Where necessary, we may inform you specifically, at the time of collection, about the possible consequences of refusing to provide certain data (for example, our inability to prepare a quote or to complete a booking).
5. Disclosure of your data to third parties
The personal data you submit through this website will not be sold or rented to third parties.
We may, however, disclose the data to the following categories of recipients, strictly for the purposes set out in section 2:
- IT and hosting service providers, who help us operate, maintain and secure the website;
- maintenance and technical support service providers;
- external advisers (accountants, auditors, lawyers), where necessary;
- other companies or partners involved in providing the car rental services, where this is necessary in order to manage the booking and only to the extent justified.
All these third parties act either as processors (processing the data on our behalf, under data processing agreements) or as independent controllers (for example, authorities or self-employed professionals), in which case they have their own privacy policies.
We may also disclose your personal data where the law requires or permits us to do so (for example, to tax authorities, consumer protection authorities, the police or the courts).
6. Transfer of your personal data outside the European Union
In principle, it is our intention that the personal data collected through www.gabautorent.ro be processed and stored within the European Union (EU) / European Economic Area (EEA).
If, exceptionally, a transfer of data outside the EU/EEA were to be necessary (for example, through the use of IT services from providers with servers outside the EU), we will ensure that the conditions imposed by the GDPR are met, by means of:
- an adequacy decision of the European Commission for the country concerned; or
- the use of standard contractual clauses and/or other appropriate data protection safeguards.
Your data may also be disclosed to authorities in other countries, to the extent required by law (for example, in the context of legal proceedings or cooperation between authorities).
7. Questions and complaints
If you have questions, concerns or complaints regarding the processing of your personal data or this Privacy Policy, you can contact us at:
E-mail: contact@gabautorent.ro
We will make every effort to respond to requests in good time and to resolve them amicably.
If you are resident in the European Union and consider that your data protection rights have been infringed, you also have the right to lodge a complaint with the national supervisory authority for personal data processing (ANSPDCP) or with the competent authority in your country of residence.
8. Security and retention of data
GAB Auto Rent applies reasonable technical and organisational security measures to protect personal data against:
- unauthorised access;
- accidental loss, destruction or alteration;
- unauthorised disclosure.
These measures may include, without being limited to: access controls, complex passwords, regular system updates, backups, firewall and anti-malware solutions, as well as internal policies on access to data.
We will retain your personal data:
- for the period necessary to prepare and send the requested quote;
- for the duration of the car rental agreement, where applicable;
- thereafter, for the period required by legal obligations (in particular accounting and tax obligations) or for as long as is necessary to defend our rights in any dispute.
Once the relevant retention periods have expired, the data will be erased or anonymised, to the extent that this is possible.
9. Your rights in relation to your personal data
In accordance with applicable law (including the GDPR), you have the following rights in relation to your personal data processed through this website:
a) Right of access and rectification
You have the right:
- to obtain confirmation as to whether or not we process personal data concerning you;
- to request a copy of the personal data we hold about you;
- to request the rectification of inaccurate data or the completion of incomplete data.
b) Right to erasure (“right to be forgotten”)
In certain situations provided for by law, you may request the erasure of your personal data (for example, where it is no longer necessary for the purposes for which it was collected, or if you have withdrawn your consent, where consent was the basis of the processing).
c) Right to restriction of processing
You have the right to request that we restrict the processing of your data in the following cases:
- you contest the accuracy of the data – for the period during which we verify its accuracy;
- the processing is unlawful, but you do not want the data erased, only its use restricted;
- we no longer need the data for the original purpose, but you require it for the establishment, exercise or defence of legal claims;
- you have objected to the processing, pending verification of whether our legitimate interests override your rights.
d) Right to data portability
To the extent that the processing is based on consent or on the performance of a contract and is carried out by automated means, you may request:
- to receive the data in a structured, commonly used and machine-readable format;
- the direct transmission of the data to another controller, where this is technically feasible.
e) Right to object
You have the right to object, on grounds relating to your particular situation, to processing based on the controller’s legitimate interest. In that case, we will stop the processing, except where we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.
If, in the future, we use your data for commercial or marketing communications (for example, newsletters), you will be able to withdraw your consent at any time, and we will immediately stop processing for that purpose.
f) Right to lodge a complaint
If you consider that the way in which we process your personal data does not comply with data protection law, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing or with another competent supervisory authority.
To exercise any of the rights above, or for further clarification regarding your personal data, you can contact us at the e-mail address:
contact@gabautorent.ro
We will respond to your requests within the time limits and under the conditions provided by the applicable legislation.
