Reviewed date: 30/12/2022

Introduction

UFODRIVE is committed to respecting your privacy as well as protecting your personal information, which means:

• We will be transparent about what information we are collecting and for which purpose.
• We will use this information solely for the purposes described in this document.
• We put in place all reasonable measures to protect your information and keep it safe and secure.
• We will respect your data protection rights and in particular allow you to inspect the processing, correction or ask for removal of your personal data.

We encourage you to read this policy carefully and to contact us with any questions or concerns about our privacy practices.

Who are we?

UFODrive SA, registered in Luxembourg, is the legal entity responsible for processing the personal data in the meaning of the General Data Protection Regulation (EU) 2016/679 (GDPR).

What information do we collect and how do we use it?

When using the term “personal data” in our Privacy Notice, we mean information that relates to you and allows us to identify you, either directly or in combination with other information that we may hold.

Personal data that you provide voluntarily

To allow the execution of the rental contracts we will collect the following data when you register to our service or reserve a car using our App or the booking website:

• Name
• Home address
• Email address
• Mobile phone number
• An electronic copy of an identification document (id, passport, etc.)
• An electronic copy of your driver licence
• Credit card details

Your personal data are collected, processed, and used only to the extent this is necessary to enable the execution of the rental agreement and its associated service (UFOBook, UFOSign, UFOFind, UFOReturn and UFOJourney). We may also use your data to manage your club membership.

Furthermore, your personal data can be used for market research or marketing purpose (including social media targeting to display adverts and posts to specific audiences on platforms such as Facebook and Google) only after we collect explicit consent from you using our App or email, consent you are free to withdraw at any time.

However, where we email or text you about a similar product or service that you bought from us in the past, we process your personal data in our legitimate interests in carrying out our business, provided those interests are not outweighed by your rights and interests.

We also use a video-surveillance system for security purposes and automated operations management. To learn more about our system, please see our Video-surveillance Privacy Notice.

Personal data that we collect automatically

Whenever you interact with our App or our booking website your activity is logged to allow our support team to help you should you encounter any issue in using them.  Thus, we automatically collect certain information from your device, such as the IP address, the operating system of your device, the pages visited, and the requests made and the day and time of connection. You also collect your account password.

Furthermore, GPS trackers are installed in all our cars and used solely to prevent any criminal acts on the vehicles, enhance your customer experience and enable the execution of UFOReturn and UFOJourney services.

Cookies and other technologies

Our website uses cookies. During your first visit, a banner appears at the bottom of the screen informing you of the use of cookies when browsing the website. It is up to you to make a choice between accepting or refusing the use of optional cookies depending on the purpose pursued by each cookie. Some cookies do not collect any personal data but simply allow a better browsing experience. To learn more about the types of cookies and similar technologies we use, why and how you can control these technologies, please see our Cookie Policy[OH1] .

How do we secure personal data?

Your personal data are secured using the following measures:

• Our employees have access to personal data on a need-to-know basis only, which means only to the information essential to perform their duties.
• We select only contractors and service providers with high standards in terms of data protection.
• We apply technology security best practices: HTTPS encrypted connections, firewalls, OAuth 2.0, etc.

Where do we store and process personal data?

All personal data except the credit card details are securely stored on our servers hosted on Amazon Web Services in the European Union.

The credit card details are not stored on our servers but securely collected and stored by Stripe a specialized payment service which saves and manages credit card details safely.

How long do we keep your personal data for?

Your personal data is stored only for as long as is necessary for the purpose for which we obtained them. The retention period will depend upon several factors, such as the duration of the contract concluded with you, or legal requirements imposed to us.

The logs collected during interactions with the App or the booking website are destroyed after six (6) months.

The GPS data is stored for 3 months from the end of the rental contract. Video recordings are kept for a maximum of 7 days unless we are required to keep them for a longer period.

If you have not used the service for two (2) consecutive years, we will send you an email to ask if you want to keep your account active. If we receive no answer after two reminders we will delete your account and associated personal data (including identification and driver licence documents).

Whenever we process your personal data on the basis of your consent, you have the right to withdraw your consent to marketing at any time by contacting us as indicated below or by clicking the unsubscribe link in the email communication we send you (e.g., UFODRIVE events, product updates, etc.). Please, note that the withdrawal of your consent does not affect the lawfulness of the personal data processing based on consent prior to its withdrawal.

‍

Your rights in relation to personal data

As a natural person, you have a number of rights regarding your personal data including:

§  the right of access: You can request access to the data concerning you at any time as well as a copy of the data;

§  the right to rectification: You can request at any time that inaccurate or incomplete data be rectified;

§  the right to request the erasure of data: You can request that your data be deleted when, for example, the data is no longer necessary for the purposes for which it was collected or processed;

§  the right to restriction of processing: You can request that we restrict the processing of data if, for example, you question the accuracy of the data concerning you or if you object to the processing of data concerning you;

§  the right to data portability: You have the right to have your data transferred to another data controller in a structured, commonly used and machine-readable format, if the processing is carried out by automated means or if it is based on prior consent;

§  the right to object to data processing: You can object to the processing of your data and can withdraw your consent if the processing is based on consent, for example if the data is used for commercial prospecting purposes.

These rights can be enforced within the limits defined by articles 15 to 23 of the RGPD.

For more information or if you wish to exercise your rights, please contact our Data Protection Officer (DPO) at dpo@ufodrive.com

Requests will be dealt with by the DPO and will be responded to within 1 month at the latest, starting from the moment of your identity confirmation. We may extend the time limit by a further 2 months if the request is complex or if we have received a high number of requests.

We may request additional information to help us confirm your identity and to ensure that you respect your right to access the personal data (or to exercise any other of your rights). This is a security measure to ensure the non-disclosure of your personal data to an unauthorised person.

You will in general not have to pay a fee to exercise any of your individual rights mentioned in this Privacy Policy. However, we may charge a reasonable fee if your request to exercise your individual rights is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you are not satisfied with our response, you also have the right to lodge a complaint at any time with the National Commission for Data Protection (CNPD), the Luxembourg supervisory authority for data protection issues, or, as the case may be, any other competent supervisory authority depending on the place of your habitual residence, on the place where you used our services or on the place where you believe infringement may have happened.

Links

Our website contains links other websites, but this Privacy Notice applies only to personal data collected via the UFODRIVE website and to how UFODRIVE processes personal data. It does not apply to specific member or correspondent firms practicing under the UFODRIVE name. We are not responsible for the privacy practices of other websites.

Revisions to privacy policy

We reserve the right to update and revise this Privacy Policy at any time and from time to time, as it deems necessary or appropriate. You may determine if this Privacy Policy has been revised since your last visit by referring to the "Effective Date" at the top of this page.