PRIVACY POLICY

Identity and contact details of the Controller

Our identification information: XTRA AUTO SLU. You can contact us:

• By postal mail: AVDA ELS ARCS, 24 - 46940 MANISES (VALÈNCIA)
• By email: rgpd@grupoxtra.es
• By phone: +(34) 961 666 660
• Website: www.clickrent.es

We inform you that, in accordance with the GDPR, Article 37.1 establishes the obligation to appoint a Data Protection Officer, who you may contact by email or by phone, and to whom you may address all questions, doubts, suggestions, or exercise your rights under this Regulation regarding the processing of your personal data.

Our DPO details: Vicente M. Sancho Rodríguez (Caler Consultores, S.L.) - rgpd@grupoxtra.es.

Categories of personal data

We process the following categories of personal data:

• Identification data – first and last name, ID card or equivalent.
• Administrative data - Company name, address, bank details, and contact persons.
• Contact details – email, phone number, and address.
• Digital data – cookies, IP address, websites and social networks, and other publicly accessible data on the Internet, etc.
• Social network data – public profile data of social network followers and visitors.
• Ethics channel data – data related to the incident or the person reporting it, concerning incidents received through the ethics channel.
• Business data – suppliers, clients, managers, and partners.
• Registered user data – preferences, contact details, payment process.
• Other data necessary for processing - for more information about the category of personal data in the development of our Activity, you can consult our Record of Activities.

How do we collect your data?

We collect information about you from the following sources:

From our website:

• Through the Subscription form.
• Through Online Chat.
• Through the ethics channel.
• Through user registration.
• Through the online rental process both through our website and through partner pages.
• Through Work with Us.
• Sweepstakes via EasyPromo.
• META forms.

From other Internet tools:

• Through our social networks.
• Through email to Clients or Suppliers with whom there has already been a previous business relationship.
• Through email to Future clients or prospects without a business relationship from whom we do not yet have explicit consent.
• Through email to Interested parties from whom we have obtained consent via the different contact forms.

From other sources:

• When communicating or interacting with you by phone, e-mail, or any other means of contact from our company.
• When you visit our facilities.
• Through a business visit.

For more information on the different data collection mechanisms in the development of our activity, you can consult our Record of Activities.

How long do we keep your data? (Retention Period)

The data will be kept as long as there is a business, contractual, or professional relationship with the data subject and subsequently for the years necessary to comply with the corresponding legal obligations in each case. Without prejudice to the above, they will be kept as long as they are necessary for processing and the data subject does not request their deletion.

Regarding accounting and tax documentation, for tax purposes, accounting books and other mandatory record books according to the applicable tax regulations (IRPF, VAT, IS, etc.), as well as the supporting documents that justify the entries recorded in the books (including computer programs and files and any other tax-relevant evidence), must be kept for at least the period during which the Administration has the right to verify and investigate and consequently to settle tax debt, according to Articles 66 to 70 of the General Tax Law, which is 4 years.

Regarding accounting and tax documentation, for commercial purposes, books, correspondence, documentation, and supporting evidence concerning your business, duly organized from the last entry made in the books, unless otherwise provided by general or special provisions, this commercial obligation extends to both mandatory books (income, expenses, investment assets, and provisions), as well as the documentation and evidence supporting the entries recorded in the books (issued and received invoices, receipts, corrective invoices, bank documents, etc.), according to Article 30 of the Commercial Code, which is 6 years.

For more information on data retention in the development of our activity, you can consult our Record of Activities.

Who do we share your data with?

Depending on the purpose of the processing, your personal data may be shared with or processed by different categories of recipients:

• External collaborators or professionals.
• Public administrations (Public administrations that use it in the legitimate exercise of their powers).
• Tax, accounting, and labor advisory
  • Purpose: Accounting, tax management, and compliance with tax and labor obligations.
  • Data shared: Identification data of clients/suppliers/employees, economic data, billing, and payroll.
  • Legal basis: Legal obligation (art. 6.1.c GDPR).
• Insurance companies
  • Purpose: Contracting insurance associated with rented vehicles and claims management.
  • Data shared: Driver’s identification and contact details, driver’s license number, claims history.
  • Legal basis: Contract performance (art. 6.1.b GDPR) and, in some cases, legitimate interest (art. 6.1.f).
• Maintenance, repair, and roadside assistance companies
  • Purpose: Assistance to the driver during the rental (e.g., in case of breakdown).
  • Data shared: Customer’s name, phone number, and location.
  • Legal basis: Contract performance.
• Financial institutions or payment platforms
  • Purpose: Processing payments, charges, and refunds.
  • Data shared: Bank and card details, customer identification data.
  • Legal basis: Contract performance and compliance with legal obligations.
• Fleet control and geolocation companies
  • Purpose: Operational management of the rental, vehicle security, and location in case of theft.
  • Data shared: Vehicle geolocation data associated with the contract.
  • Legal basis: Legitimate interest (security of the rented asset) and contract performance.
• Law enforcement authorities
  • Purpose: In case of judicial requirements, traffic fines, or investigations.
  • Data shared: Driver’s identity, rental contract data, vehicle license plate.
  • Legal basis: Compliance with legal obligation.
• Software or hosting companies (technology providers)
  • Purpose: Technical support, data hosting, billing systems, or CRM management.
  • Data accessed: Remote access to systems where customer data is hosted.
  • Legal basis: Contractual relationship with the provider as data processor (not a transfer per se, but relevant).
• Marketing companies or satisfaction surveys
  • Purpose: Customer loyalty, service improvement.
  • Data shared: Name, email, phone number.
  • Legal basis: Consent or legitimate interest.

In any case, we only share your data to the extent strictly necessary and in the way required to carry out the purposes described in this privacy policy, and only with entities with which we have signed agreements protecting your rights and freedoms in relation to your personal data. These entities and/or professionals, considered Data Processors, will be governed by the provisions of Art. 28 of the GDPR, and this entity ensures that they take all necessary security measures in accordance with said regulations.

We also inform you that your data may be processed by companies belonging to our group for commercial, administrative, statistical, and/or financial purposes. For more detailed information, you can consult the website https://grupoxtra.es.

For more information on third-party data sharing in the development of our activity, you can consult our Record of Activities.

Where do we process your data?

In order to carry out our activity, provide our services, and/or sell our products, we process your personal data in accordance with the conditions established in this privacy policy within the European Union (EU).

For more information on where we process data in the development of our activity, you can consult our Record of Activities.

For what purposes do we process your data?

Your data will be collected for processing operations relevant to the following purposes:

Purposes related to elements of our website:

• Subscription form:
  • Receive our newsletter.
• Work with us:
  • Add your CV to our job pool.
• Work with us:
  • Collect user data to participate in our campaigns.
  • Option to register for the newsletter.
• Through user registration:
  • Store user preferences.
  • Follow-up and management of user-related issues.
• Through the online rental process:
  • Store and manage rental data.
  • Track the rental process.
  • Process rental payment.
• ONLINE CHAT/ONLINE AGENT: Resolve questions or issues related to our products or services. Personal data will not be used for any other purpose.
• OFFLINE CHAT/OFFLINE AGENT: Use the contact details provided through the specific form to resolve the user’s queries.
• Ethics channel:
  • Follow-up and management of the incident.
  • Contact, if applicable, with the person who reported the incident.
  • Use of the provided data to properly resolve the incident.
• Specific processing on social networks (see social networks section).
• In the case of future clients or prospects from whom we do not have explicit consent, this will be requested via email in order to continue communication.

General purposes of our activity:

• Receive contact information or other requests made by you through any of our communication channels.
• Administrative tasks derived from the provision of our services.
• Administrative tasks derived from the sale of our products.

For more information on the purposes of data processing in the development of our activity, you can consult our Record of Activities. You may withdraw your consent at any time free of charge by exercising your rights, submitting your request in writing and duly identified with an appropriate identity document, at our address AVDA ELS ARCS, 24 - 46940 MANISES (VALÈNCIA) or by email at rgpd@grupoxtra.es. For more detailed information on the Exercise of your rights, you can consult our Record of Activities.

Why can we process your data? (Legal Basis)

The use of your data under the conditions described above is permitted by European and Spanish data protection regulations in accordance with the following legal bases:

Art.6. GDPR

• The data subject gave their consent for the processing of their personal data for one or more specific purposes.
• The processing is necessary for the performance of a contract to which the data subject is a party, or for the application, at their request, of pre-contractual measures.
• The processing is necessary for compliance with a legal obligation applicable to the data controller.

Ethics channel. For the ethics channel, processing is based on Law 2/2023 of February 20, Regulating the protection of persons who report regulatory violations and anti-corruption.

For more information on the legal basis for data processing in the development of our activity, you can consult our Record of Activities.

What are your rights?

Data protection regulations allow you to exercise your rights of access, rectification, objection, erasure ("right to be forgotten"), restriction of processing, portability, and not to be subject to automated individual decisions, before the Data Controller.

Any data subject has the Right to be provided, BEFORE their data is collected, with basic information at a first level, in a summarized way, at the same time and through the same medium in which their personal data are collected, and furthermore, to be provided with the rest of the information through a medium more suitable for its presentation and understanding.

The information provided by layers or levels would be as follows:

1st Layer Information

• The identity of the Data Controller.
• What data will be processed.
• For what purpose.
• Where and how the data was obtained.
• The legal basis for processing.
• Whether the data will be communicated, shared, or processed by third parties.
• Reference to the procedure for Exercising Rights.

2nd Layer Information

• Contact details of the controller. Identity and details of the representative (if any). Contact details of the Data Protection Officer (if any).
• Extended description of the purposes of processing. Timeframes or criteria for data retention. Automated decisions, profiling, and applied logic.
• Details of the legal basis for processing, in cases of legal obligation, public interest, or legitimate interest. Obligation or not to provide data and consequences of not doing so.
• Recipients or categories of recipients. Adequacy decisions, safeguards, binding corporate rules, or specific applicable situations.
• How to exercise rights of access, rectification, erasure and data portability, as well as restriction or objection to processing.
• Right to withdraw consent given.

(The following table indicates what your rights are).

These rights are characterized by the following:

• Their exercise is free of charge.
• You may exercise the rights directly or through a legal representative.
• If the request is submitted electronically, the information will be provided by the same means when possible, unless the data subject requests otherwise.
• Before exercising your rights, we must identify you to protect your personal data against fraudulent attempts.
• Your request will be resolved within one month.
• The controller is obliged to inform you about the means to exercise these rights. These means must be accessible, and this right cannot be denied solely on the grounds that you choose another means.
• If the controller does not process the request, they will inform you within one month of the reasons for their inaction and the possibility to file a complaint with a Supervisory Authority.

If you wish to exercise any of the described rights, you can contact us through our Data Protection Officer:

By postal address: XTRA AUTO SLU - Att. Data Protection Officer - AVDA ELS ARCS, 24 - 46940 MANISES (VALÈNCIA)

Or by email at: rgpd@grupoxtra.es

We inform you that, in accordance with the GDPR, Article 37.1 establishes the obligation to designate a Data Protection Officer, who you may contact via the indicated email address, to whom you may address any questions, doubts, or suggestions, or exercise your rights, duly identified with an appropriate identity document, under this Regulation regarding the processing of your personal data.

Supervisory Authority

If you wish to file a complaint regarding the processing of your data by XTRA AUTO SLU, we inform you that you may contact the Spanish Data Protection Agency, C/ Jorge Juan, 6 28001-Madrid. http://www.agpd.es

Cookies

Cookies are files that are downloaded to your computer to collect standard Internet log information and information about browsing habits. This information is used, for example, to track website visitor usage and compile statistical reports on website activity.

You can configure your browser not to accept cookies. However, some first-party cookies are necessary to allow the user session of the website to use our services.

For more information, see the website’s Cookies Policy.

Social networks

XTRA AUTO SLU is present on social networks such as Facebook, WhatsApp, TikTok, and Instagram, with the purpose of processing personal data being those established within the service’s conditions. In the event that registration for certain services is carried out through personal data associated with a user account, it is informed that certain information contained in your account will be shared. XTRA AUTO SLU reminds you that you should be aware of the privacy policies of these platforms or social networks you are registered on in order to avoid sharing unwanted information.

You have privacy and account management settings on social networks to manage privacy preferences, identity, advertising, and other related aspects.

In the event that registration for certain services is carried out through personal data associated with a user account, it is informed that certain information contained in your account will be shared.

The purposes of the data collected on the different social networks are:

• Advertising and commercial prospecting.
• Management of customer databases from campaigns or promotions for the dissemination of our activities and services among our followers.
• Tasks related to e-commerce and order tracking.
• Communication with clients or prospects.
• Conducting sweepstakes and promotions. Data collection and publication of results.

Detailing each of the social networks, on Facebook, when a user becomes a fan of the official Fan Page through the “Like” button, they authorize their personal data to be used exclusively on this Facebook platform for the management of the Fan Page and for bidirectional communications with those followers through chat, posts, comments, messages, or other communication means that the social network allows now or in the future. This processing will be subject to the privacy policies of this social network, which the user can consult at the following link: https://www.facebook.com/policy.php. By becoming a fan, access is gained to the list of members or followers who have joined the Fan Page. It is also informed that when a user becomes a fan, the published news will also appear on their home page and that if the fan user comments on these posts, both their comment and their profile name, and where applicable, the photo they have on it or, depending on their privacy settings, biography, and tagging, will be accessible by other fans. In any case, the user is responsible for the use they make of the social network.

Regarding WhatsApp, when a user adds us as a contact, we will have access to the public data provided by them and their status updates. In addition, we may communicate with them through it. The privacy policy can be consulted at https://www.whatsapp.com/legal/.

Regarding Instagram, when a user follows our profile by clicking the “Follow” button, access will be gained to the profile page of the people who follow it, specifically, the username, photographs (if the user has uploaded one to the profile), and posts made by the user, as well as other information that has been published on the user’s profile such as accounts they follow or their followers. The data of the users who follow our profile on Instagram are used exclusively to manage the information exchanged between both parties. The privacy policy governing this social network can be consulted at the following link: https://help.instagram.com/519522125107875

Regarding TikTok, when a user follows our profile by clicking the “Follow” button, access will be gained to the profile page, username, videos, and posts made by the user, as well as other information published on the user’s profile such as accounts they follow or their followers. The data of the users who follow our profile on TikTok are used exclusively to manage the information exchanged between both parties. The privacy policy governing this social network can be consulted at the following link: https://www.tiktok.com/legal/page/eea/privacy-policy/es

Unsubscription Request

You may exercise the right to cancellation or objection to the processing of your data by contacting AVDA ELS ARCS, 24 - 46940 MANISES (VALÈNCIA) or by sending a message to the email address rgpd@grupoxtra.es, with the subject UNSUBSCRIPTION REQUEST, indicating your details and the email address with which you registered. We will respond to your request indicating its status or if we require further information regarding it.

Minors

The User certifies that they are over 14 years of age and therefore have the necessary legal capacity to provide consent for the processing of their personal data, all in accordance with the provisions of this Privacy Policy.

If you wish to use our services through the website and are 14 years old or younger, we will need the consent of your legal guardian to store your data. If we do not have it, we may block or delete it.

Security

XTRA AUTO SLU adopts organizational and technical measures in order to guarantee the security of personal data and to prevent its alteration, loss, processing, or unauthorized access, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed.

Updates

We keep our privacy policy under review and may change it occasionally (mainly to comply with legal and data protection practices).

Applicable Law and Competent Courts

The terms and conditions governing this website, as well as the relationships that may arise, are protected and subject to Spanish law. To resolve any type of dispute, litigation, or discrepancy that may arise between the user and XTRA AUTO SLU from the use of this website, it is agreed to submit these to the Courts and Tribunals of VALENCIA, Spain.