Confidentiality Policy(GDPR)

The personal data controller is:

In this policy, the terms „we”, „the company” and „AIC Rent a Car” refer to the controller identified above.

For questions regarding the processing of personal data, requests regarding GDPR rights or requests concerning the data submitted through the website forms, you can contact us at gdpr@aic-rentacar.ro.

Depending on the requested service, we may process the following categories of data:

Identification and contact details

• First and last name.
• Email address and phone number, including the international prefix.
• Country of residence or other country information provided through our forms, when requested.

Details required for booking and rental

• The requested vehicle, the rental period, and the pickup and drop-off information.
• Information about the price, rental duration, additional services, and the selected payment method.
• Confirmation of the eligibility conditions stated in the form, such as the minimum age and the length of time the driver's license has been held.
• Information and communications necessary for managing the reservation, changes, cancellations, and the contract.

Professional documents and information

• Copy or image of the identity card or passport, when the document is requested for the rental.
• Copy or image of the driving license, including the front and back.
• International driving permit, when required.
• The issuing country of the driving license.
• In the case of a legal entity: the company name, the tax identification number (CUI/CIF), and the trade registry registration number, if requested.
• The additional information you choose to send us in the comments field.

Technical and site usage data

• Technical data generated by accessing the site, such as IP address, browser type, device, and information about page usage, to the extent that they are collected by the server or by the activated services.
• Cookie preferences and consents expressed in the privacy interface.
• Technical information related to the operation of the site, security, and prevention of abusive use.

Depending on the situation, personal data may be used for:

• Receiving and managing quote requests and bookings.
• Checking vehicle availability and communicating the booking confirmation.
• Verifying the documents and conditions required to conclude the rental agreement.
• Drafting, performing, and administering the agreement, including managing the pick-up and return of the vehicle.
• Management of payments, guarantees, invoices, and any financial obligations related to the rental.
• Communication with you regarding the reservation, missing documents, changes, cancellations, and requested services.
• Management of requests, complaints, incidents, and any disputes.
• Ensuring the security of the site, preventing fraud, and protecting the company's property and rights, within the limits of the law.
• Fulfillment of legal, tax, and accounting obligations and of legal requests from competent authorities.
• Administration and improvement of the site, services, and user experience, in accordance with the law.
• Audience measurement, advertising campaign analysis, and ad personalization, if such tools are used and there is the necessary legal basis.
• Sending commercial offers and marketing information, when consent or another applicable legal basis exists.
• Organizing contests, promotions, or campaigns, if you participate in them.

We do not automatically use all data for all purposes. Their use depends on your relationship with us, the service requested, the preferences expressed, and the applicable legal obligations.

In accordance with Regulation (EU) 2016/679 — GDPR, data processing is carried out on the basis of one or more legal grounds applicable to each activity:

The forms on the website allow us to receive reservation requests and, when necessary for the rental, the related documents. The data requested may vary depending on the type of reservation and the documents required.

Documents required for rental

After the offer is submitted and when documents are requested for preparing the contract, the upload page allows you to submit the relevant documents, such as:

• Identity card or passport.
• Driving licence — front and back.
• International driving permit, where required.
• Other information or documents reasonably requested for managing the rental.

The upload form accepts files in JPG, JPEG, PNG, HEIC, PDF, DOC, and DOCX formats and allows uploading multiple files, within the limit indicated by the form.

Documents must be submitted only through the channels indicated by the company and only when they have been requested. Do not submit documents belonging to other people without authorization.

Booking confirmation

Submitting the form does not, by itself, constitute a definitive confirmation of vehicle availability. The booking becomes firm after availability is confirmed by an AIC Rent a Car representative and after the requirements communicated for that booking have been met, including the submission of the requested documents, where applicable.

Payments and financial information

Forms may require selecting a payment method, for example card payment, cash, or bank transfer, depending on the available options. Selecting the payment method does not mean that all card details are collected by the site.

If online payment is available through an external processor, the data required for the transaction is processed by the payment provider in accordance with its own terms and policies. We do not include the name of a specific processor in this policy unless it is confirmed to be actually used.

You can access the document upload page here: Upload your documents.

Some vehicles may be equipped with GPS devices or monitoring systems. To the extent that these systems process data associated with an identifiable person, the resulting information may constitute personal data.

Depending on the equipment used, the contract, and applicable legislation, the information may be used to:

• Protect the vehicle and prevent theft or unauthorized use.
• Locate the vehicle in situations justified by security, incidents, or recovery.
• Manage incidents and verify compliance with contractual obligations, where there is a legal basis.
• Checking the condition and functioning of the monitoring systems, to the extent that this is necessary.

Access to GPS data must be limited to authorized persons and justified purposes. The data must not be used for unjustified monitoring of the client's private life.

The retention period and the conditions of access to GPS data depend on the specific purpose, the system used, and the applicable legal obligations. Any use of this data after the end of the rental must have a legal basis and be limited to what is necessary, for example to investigate an incident or to defend rights.

The data may be disclosed only to the extent necessary for the legitimate purpose of the processing and under the conditions of the applicable legislation.

• To hosting, maintenance, and technical support providers for the website and IT systems.
• To email and communications service providers used to manage requests.
• To payment processors, if they are used for transactions related to the services.
• To GPS or car security service providers, to the extent that the data is necessary for the operation of the service and the justified purpose.
• To analytics, audience measurement, and advertising service providers, if such tools are enabled and the processing is permitted.
• To partners involved in the provision of services, when the transmission of data is necessary and justified.
• To accountants, legal consultants, auditors or other professionals, when necessary and permitted by law.
• To public authorities, courts or competent bodies, when there is a legal obligation or a valid request.

Suppliers who process data on our behalf must be subject to appropriate contractual obligations, including confidentiality and security obligations, when these requirements are applicable.

We do not sell customers' personal data. We do not disclose data to third parties for their own purposes without an appropriate legal basis.

Transfers outside the European Economic Area

Some technical or digital service providers may process data in other countries or may allow access from other jurisdictions. If personal data is transferred outside the European Economic Area, this must be done in accordance with the GDPR, based on an applicable legal mechanism and the necessary safeguards. The exact information depends on the providers actually used by the company.

According to the information published in the existing privacy policy, data hosting and storage are stated to be carried out in Romania. This statement should be maintained only to the extent that it reflects the actual configuration of the server, backups, and the external providers used.

We use appropriate technical and organizational measures to protect data against unauthorized access, loss, modification, disclosure, or accidental destruction, taking into account the nature of the data and the risks of processing.

These measures may include, as applicable:

• Limiting access to data to those who need it for their duties.
• Protecting accounts and IT systems through appropriate security measures.
• Updating and maintaining the systems in use.
• Using appropriate channels and tools for transmitting documents.
• Backups and recovery procedures, depending on the infrastructure used.
• Evaluating suppliers and establishing contractual confidentiality and security obligations.

No electronic transmission or storage system can guarantee absolute security. If a data security breach occurs, it will be handled in accordance with applicable legal obligations, including, if necessary, notifying the supervisory authority and informing the data subjects.

We keep personal data only for as long as is necessary for the purposes for which it was collected or for as long as we are obliged or entitled to keep it under applicable legislation.

• Requests and bookings: for the period necessary to manage the request and the contractual relationship, as well as afterwards, if necessary for legal obligations or the defense of rights.
• Contracts, invoices and accounting documents: for the periods provided by applicable legislation.
• Identification documents and driving license: for as long as necessary for the justified checks and obligations of the rental, in compliance with the principle of data minimization.
• Marketing communications: until consent is withdrawn or until there is no longer a legal basis for communication, as applicable.
• Technical data and cookies: in accordance with the retention periods specific to the tools used and the preferences expressed.
• GPS data: for the duration necessary for legitimate security purposes, incident management, and compliance with applicable obligations.
• Complaints and disputes: for as long as necessary to resolve them and to comply with the relevant legal deadlines.

We do not set a single retention period for all categories of data. When the data is no longer necessary, it will be deleted, anonymized, or archived under the conditions permitted by law.

You can request information about the retention period applicable to your data by writing to gdpr@aic-rentacar.ro.

Under the conditions and within the limits provided by the GDPR, you have the following rights regarding your personal data:

How you can exercise your rights

Send your request to gdpr@aic-rentacar.ro. To protect your data, we may request additional reasonable information to verify your identity, when necessary.

We will respond within the timeframe provided by the GDPR. Typically, the timeframe is one month from receipt of the request and may be extended under the conditions of the law, in which case you will be informed.

The site may use cookies and similar technologies for the operation of the pages, to store certain preferences, for security, to analyze traffic, or to measure advertising campaigns.

Non-essential cookies should not be activated before obtaining consent when applicable legislation requires it. Refusing optional cookies should not prevent access to the site's essential functions.

The identity of the providers, the exact categories of cookies, their duration, and any data transfers depend on the tools active on the site and their configuration. This information must be presented in an up-to-date manner in the cookie interface and policy.

You can also view and modify the available options through the cookie banner or cookie management interface, when it is available on the site.

Minors' data

Rental services are subject to the eligibility conditions communicated by the company, including age and driver's license requirements. We do not intentionally collect data from minors for purposes that are not compatible with the services offered. If you have reason to believe that a minor's data has been provided to us without a legal basis, please contact us.

Policy modification

We may update this policy when the services, forms, technologies used, or legal requirements change. The version published on the site is the one that should be consulted for current information. If a change requires additional notification of data subjects, we will proceed in accordance with applicable legal requirements.

Supervisory authority

If you believe that the processing of your data violates applicable legislation, you can contact us first for clarification or you can file a complaint with the competent data protection authority.

In Romania, the national authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP). Official information is available at www.dataprotection.ro.