Privacy Statement and Data Protection

On behalf of City Rent a Car Beograd D.O.O. from Belgrade, Bulevar Zorana Đinđića 59/23, we undertake to protect the privacy of all our customers.

We collect only the necessary basic data about customers/users and the data required for doing business and informing users, in line with good business practice and with the aim of providing a quality service.

We give customers a choice, including the option to decide whether or not they want to be removed from the mailing lists used for marketing campaigns.

All customer/user data is kept strictly confidential and is available only to employees who need it to do their job. All employees (and business partners) are responsible for respecting the principles of privacy protection.

This privacy statement explains what data we collect, how we store and transfer it and how we use it. If you would like to know which personal data we hold about you, please contact us using the contact details below.

Some of the data we collect may be considered personal, and we protect it in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation).

When we publish changes to this privacy statement, we will include the date of the last change. If we significantly change the statement or the way we use your personal data, we will notify you by clearly publishing a notice before the change takes effect or by sending you a notice directly. We recommend that you review this statement from time to time.

Why we collect data

We process your data only for purposes justified by our services. We process it with respect for your fundamental right to privacy, including the need to protect your personal integrity and private life, and we always take care not to collect more data than we need to deliver the service you want. Unless stated otherwise, we at Carwiz determine the purpose and means of collecting your data, which in legal terms means that we act as the "data controller" of personal data.

We collect data in order to:

• Enable you to use the vehicle reservation service
• Conclude a vehicle rental agreement and issue an invoice
• Respond to your questions, complaints and claims
• Send you information about our offers

What data we collect

Vehicle reservation

If you want to make a vehicle reservation, the personal data we need from you is, for example: first name, last name, address, telephone number and e-mail address.

Vehicle rental agreement

Once you decide to rent one of the vehicles we offer, we need some more of your personal data in order to conclude the rental agreement. This data includes, for example:

• first and last name
• address, city
• personal identification number (JMBG)
• date of birth
• ID card / passport (number and validity)
• driving licence number, issuer and validity
• credit card number
• telephone number
• e-mail address

Question / Complaint / Claim

If you were dissatisfied with something or want to report that something was wrong with the vehicle, we will need the following data from you:

• first and last name
• address
• personal identification number (JMBG)
• telephone number

and any other data you provide to us or that is needed in order to handle your question, complaint or claim.

How we collect data

In general, we collect data in the following ways:

• When you request to use our services
• When you provide it to us explicitly, e.g. by sending an e-mail or making a phone call
• Through use of the website. Carwiz uses cookies, so some personal data may be collected this way. You can find out what cookies are and how we use them at: https://www.carwiz.rs/en/general-releases/cookies/
• Through signing up for our newsletter
• Through consent to direct marketing, which may be given e.g. by e-mail or by signing a consent form in person, e.g. when you visit one of our branches

Wherever possible, we will inform you which data we need before you start using our services.

On our websites we may use cookies or other data collection tools. Details can be found in our cookie policy: https://www.carwiz.rs/en/general-releases/cookies/

Some third-party websites may monitor data traffic from our products and services, such as the number of clicks and the search terms used. We do not provide any of your personal data to these services.

How we protect your data

We have appropriate technical and administrative security measures in place to ensure that our users' data is protected against unauthorised or accidental access, use, alteration or loss. The measures taken are regularly reviewed and continuously adapted to the current state of technology.

We handle your data in accordance with the law. We also require our suppliers and service providers to submit security assessments and to demonstrate their compliance with applicable laws and industry standards.

We regularly review, upgrade and update working procedures, business processes and technical measures in order to improve your privacy and ensure that we comply with our internal rules.

How we share your data

CARWIZ may disclose your personal data to third parties in the following cases:

• To comply with legal obligations, i.e. to provide it to courts or other competent authorities, or to conduct civil, criminal, misdemeanour or other proceedings;
• To protect the rights, safety or property of Carwiz;
• To conclude and/or perform a contract or process transactions with intermediaries and agencies through which you came into contact with CARWIZ;
• To prevent or limit damage that could be caused to CARWIZ;
• In other cases, provided that you have given your consent.

When sharing your personal data with third parties, CARWIZ will in every case prohibit them from using your personal data for any purpose other than the one agreed, and will oblige the third party to keep the personal data confidential.

How long we keep your data

We will keep personal data in a form that permits identification only for as long as is necessary for the purposes for which the data is processed, or for as long as the regulations of our country require the controller to retain personal data. Personal data may be stored for a longer period under certain prescribed conditions, e.g. for statistical purposes or for archiving in the public interest.

Where we process your data with your consent, if you withdraw it we will stop processing your data and will no longer use it for the given purposes, but this may mean you can no longer use some additional benefits connected with it.

Please note that we will not delete your data within the stated time periods if proceedings for the enforced collection of unpaid overdue claims, or any other proceedings, have been initiated. In that case the personal data will be deleted after the final conclusion of those proceedings, i.e. when the claim becomes time-barred under the regulations governing the law of obligations.

Your rights

• Right of access to personal data – you have the right to request and receive, in writing, by telephone or in person, information about the personal data relating to you that we process, provided that your identity has been established and proven beyond doubt.
• Right to rectification or completion of personal data – if your data is inaccurate or incomplete, you have the right to request, in writing or in person, that it be corrected or completed by giving an additional statement, provided that your identity has been established and proven beyond doubt. You are responsible for providing correct personal data and are obliged to notify us of all relevant changes (change of first/last name, address and the like).
• Right to erasure of personal data – if there are no longer reasons for processing your personal data, given the purpose for which it was collected, it will be erased, unless this is contrary to applicable regulations, or the data is processed for statistical purposes where the person to whom it relates can no longer be identified through the personal data, or the data is necessary for establishing, exercising or defending legal claims.
• Right to withdraw consent for marketing purposes – you have the right to withdraw your consent to receive our marketing e-mails at any time.
• Right to object to processing of personal data based on Carwiz's legitimate interest – you have the right to object at any time, stating the reasons relating to your interests, in writing or in person at the address of our company's registered office. In that case we will send you a reply on whether our company's legitimate interests override your interests and whether the personal data must continue to be processed for the establishment or exercise of legal claims, in which case the data will continue to be processed.
• Right to lodge a complaint with a supervisory authority – you have the right to submit a complaint in writing or in person at the address of our registered office, as well as to the Personal Data Protection Agency.
• Right to data portability – you have the right to request, in writing or in person at the company's registered office, that we make the data you provided to us on the basis of consent or a contract available to you in a structured, commonly used and machine-readable format, if we processed that data by automated means.
• Right to restriction of processing – you have the right to request, in writing or in person at our company's registered office, a temporary block on the processing of personal data, provided that you contest the accuracy of the data (so the block is necessary to verify its accuracy), or the processing is unlawful and you oppose erasure of the data, or Carwiz no longer needs the data but you require it for establishing, exercising or defending legal claims, or you have lodged an objection and expect confirmation from Carwiz on whether our legitimate grounds override yours.

Abuse of rights

We may charge you a reasonable fee based on administrative costs, or refuse to act on your request, if your requests are unfounded or excessive, in particular because of their frequent repetition.

Contact details

If you want to know more about personal data protection or wish to exercise any of your rights, you can contact us by e-mail at info@carwiz.rs, by telephone on +381 11 7357 606, or by sending your question or request to the address: Bul. Zorana Djindjića 59/23, Belgrade, Serbia.