Privacy notice

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and applicable Italian data protection law, Mazzella Rent informs its customers and drivers how their personal data is processed in connection with vehicle bookings and rentals.

1. Data controller

The data controller is Mazzella Rent, VAT number —, registered office at Via Iasolino 40, 80077 Ischia (NA), IT, email info@mazzellarent.it. Where appointed, the Data Protection Officer (DPO) can be reached at the same contact details.

2. Personal data processed

The controller processes the following categories of personal data:

• identification and contact data (name, surname, date and place of birth, address, email, phone number, tax code or VAT number);
• identity document and driving licence data (number, categories, issue and expiry dates, issuing authority) and copies thereof;
• booking and contract data (dates, handover and return locations, vehicle, extras, signatures, handover and return reports including photos of the vehicle);
• payment data (amounts, method, outcome and transaction references; full card details are processed exclusively by the payment service provider);
• vehicle location data, where the vehicle is fitted with a satellite tracker;
• data on accidents, damage, traffic fines and tolls relating to the rental period;
• technical data collected during online booking (IP address, user agent, date and time of consents).

3. Purposes and legal bases

• handling the booking, entering into and performing the rental agreement, customer support: performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR);
• verifying identity and driving eligibility, keeping a copy of the licence and ID document, notifications to public security authorities required by law: legal obligation (Art. 6(1)(c) GDPR) and performance of the contract;
• accounting and tax obligations, invoicing: legal obligation (Art. 6(1)(c) GDPR);
• transferring traffic fines to the driver and handling tolls and accidents: legal obligation and performance of the contract;
• vehicle geolocation for anti-theft, recovery and roadside assistance purposes: legitimate interest of the controller in protecting its assets (Art. 6(1)(f) GDPR), with prior notice to the driver;
• establishing, exercising or defending legal claims and debt collection: legitimate interest (Art. 6(1)(f) GDPR);
• sending marketing communications and offers: consent of the data subject (Art. 6(1)(a) GDPR), which can be withdrawn at any time without affecting the rental.

4. Mandatory or optional provision of data

Providing the data needed for the booking, the contract and legal obligations is mandatory: without it the rental cannot be concluded. Consent to marketing communications is optional.

5. Processing methods and retention

Data is processed electronically and on paper by authorised staff, with technical and organisational measures appropriate to ensure confidentiality, integrity and availability. Data is kept only for as long as necessary for the purposes above, in particular:

• contracts, invoices and accounting records: 10 years from the end of the relationship, as required by Italian civil and tax law (Art. 2220 Civil Code);
• copies of driving licence and ID document: for the rental period and thereafter for as long as needed to handle fines, accidents and disputes, in any case not beyond the applicable limitation periods;
• location data: for as long as needed for security purposes and in any case no longer than 12 months, unless needed for legal defence;
• data processed for marketing: until consent is withdrawn and in any case no longer than 24 months from the last contact;
• records of consents collected: for as long as the related processing continues and thereafter for the limitation periods.

6. Recipients

Data may be disclosed, to the extent necessary, to:

• insurance companies, assessors and loss adjusters for handling accidents and damage;
• police, local authorities and other enforcement bodies for transferring traffic fines and legal obligations;
• IT and hosting providers, including the RentHub management platform, acting as data processors (Art. 28 GDPR);
• payment service providers, banks and credit institutions;
• satellite tracking, roadside assistance and repair providers;
• tax and legal advisers and debt collection agencies;
• judicial and administrative authorities, where required by law.

7. Transfers outside the EU

Data is mainly processed within the European Economic Area. Where some providers (for example payment, email or cloud services) process data outside the EEA, transfers only take place to countries covered by a European Commission adequacy decision or on the basis of the Standard Contractual Clauses approved by the Commission, with any additional safeguards required.

8. Your rights

You may exercise at any time the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest and objection to marketing. Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. No automated decision-making, including profiling, producing legal effects is carried out.

9. Complaints to the supervisory authority

If you believe the processing infringes data protection law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State where you live or work.

10. Contact

To exercise your rights or for any question about data processing, write to Mazzella Rent at info@mazzellarent.it or at the registered office in Via Iasolino 40, 80077 Ischia (NA), IT. The controller will reply within one month of receiving the request.