In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter GDPR, and Spanish Organic Law 3/2018 of 5 December, on Data Protection and Guarantees of Digital Rights, hereinafter LOPDGDD, OFFUGO MOBILITY, SL (hereinafter OFFUGO), institutes this privacy policy to provide concise, transparent, understandable, and easily accessible information on how it collects, uses, and stores the personal data of those persons who have a relationship with it (hereinafter interested parties).
Widely applicable aspects of personal data processing are set out below:
All interested parties who provide their personal data to OFFUGO will be informed that their personal data will be processed by OFFUGO MOBILITY SL, tax identification code B02769974, and registered address at Carretera de Valldemossa km 7,4. Parc Bit, Edificio 18, Planta 1, Local 13. 07120 Palma (Baleares) and email address gdpr@offugo.es.
OFFUGO usually processes your personal data under one of the following
lawful bases:
The consent of the interested party, as per article 6.1.a) of GDPR.
Compliance with a legal obligation, as per article 6.1.c) of GDPR;
Performance of a contract, as per article 6.1.b) of GDPR;
Satisfying the legitimate interests of the data controller, as per article 6.1.f) of GDPR;
OFFUGO is legally entitled to process personal data pursuant to the provisions of article 6.1.c) of the General Data Protection Regulation, meaning, when processing is necessary for compliance with a legal obligation that is applicable to the data controller.
Similarly, the provisions of article 6.1.b) of GDPR are also applicable when processing is necessary to perform a contract to which the interest party is party or there is activity prior to the signing of a contract.
However, the consent of the interested will be required, in accordance with as per article 6.1.a) of GDPR, when personal data processing is not governed by one of the clauses mentioned above. In this case, interested parties may withdraw their consent at any time.
Finally, OFFUGO, in accordance with article 6.1.f) of GDPR reserves the right to use, when suitably justified, the lawful basis to process based on its legitimate interest, except where such interests are overridden by the interests or fundamental rights and freedoms of the interested party.
For the processing of personal data supplied by users of the website belonging to OFFUGO, the collection and automated processing of personal data is primarily intended for the provision of the vehicle rental service which involves registering the user, the relevant communication with said user, the tracking of the rented vehicle, the completion of the service contract, the verification of the user's identity, and the management of any possible administrative sanctions on the user, as well as providing customer service and conducting marketing activities, where the user's consent has been granted. Additionally, the user shall be shown the terms and conditions concerning personal data protection in the pertinent clause providing information.
User personal data will not be collected on the OFFUGO website without user consent, nor will user personal data be disclosed to third parties except where there exists a legal obligation to do so.
For OFFUGO staff, personal data processing is necessary to maintain employment relations and to comply with regulations in that area.
Generally, the personal data processed by OFFUGO will be directly provided by the interested party. In the event that data comes from sources other than that previously mentioned, the source of the information will be stated in the clause providing information.
The transfer of data to third parties is not envisaged, unless there is a legal obligation to do so or the interested party has given consent.
In the event that, in the processing of personal data, OFFUGO transfers data to third parties, the clause providing information on the processing will state information on the nature of the disclosure and its recipients.
In the event of international data transfers, they will be governed by the provisions of GDPR, LOPDGDD and its implementing provisions, the notices and resolutions of Data Protection Supervisory Authorities, especially the Spanish Data Protection Agency, in the area of their respective competence. The appropriate security measures will be applied to ensure a level of data security that is comparable to those in effect in the European Union.
Personal data will be stored for the length of time necessary to comply with legal obligations or, in the event of processing that requires the consent of the interested party, until the stated purpose has been fulfilled or when the interested party requests it is deleted and has the lawful basis to do so.
This information is available for all data personal data processing in the clause providing information on processing.
Interested parties may exercise any of the following rights provided for by law:
Right of access, meaning, to view and receive a copy of the personal data being processed provided that it is stored on OFFUGO's computer systems.
Right to rectification of personal data when it is inaccurate and it is justified sufficiently on the inaccuracy and on the lawful basis of the new data that is being rectified.
Right to erasure (right to be forgotten), which is the right to erase certain data provided there is no legal obligation preventing it.
Right to object, meaning, the right for your personal data not to be processed for certain purposes.
Right to restrict processing, which means that, upon request from the interested party, their personal data must not be subject to processing as relevant in each case This right can only be requested in some scenarios:
Whilst a challenge as to the accuracy of the data is investigated.
When processing is unlawful but the interested party is opposed to the erasure of their data.
When OFFUGO does not need to process the data but the interested party requires them to be kept in order to present or respond to complaints.
When the interested party has objected to the processing of their personal data in the performance of a legitimate interest, whilst it is verified if the legitimate interest for processing prevails over those of the interested party.
Right to data portability, which involves an advanced from of the right to access under which the copy supplied to the interested party must be provided in structured, commonly used and machine readable formats, which allow them to be provided to another data controller so that they may be added to their computer systems.
Right to not be the subject of automated individual decision-making, including profiling which produces legal effects concerning them or similarly significantly affects them.
Right to file a complaint with the data protection supervisory authority. In this case, the competent authority is the Spanish Data Protection Agency, whose address is C/ Jorge Juan, 6, 28001 -- Madrid and website is: https://www.agpd.es
Interested parties may exercise their rights by writing to Carretera de Valldemossa km7,4. Parc Bit, Edificio 18, Planta 1, Local 13. 07120 Palma de Mallorca (Baleares) or by sending an email to gdpr@offugo.es in which they provide a copy of their identity document, state which of the rights covered in section 2.7 of this privacy policy they wish to exercise, and provide any details they consider relevant for their request to be handled correctly.