Privacy Policy

 

  1. INTRODUCTION

Welcome to the Privacy Policy of Prestige Travel Scotland Ltd Trading as Bonnie Motorhome Hire. and its subsidiaries and affiliates that are located in the European Economic Area and United Kingdom. (We refer to these companies as "BM", "we", "us" or "our" in this Privacy Notice).

This Privacy Notice covers the personal information we collect, use and disclose through your use of our websites, mobile applications (each an "App" and collectively, "Apps"), products and services, either online or offline (collectively, "Services").

This Privacy Notice and our processing of your personal information will be subject to applicable data protection laws.

Please note that when you use any of our services, we will collect, use AND DISCLOSE YOUR personal information as described in this PRIVACY NOTICE. If you have questions, comments, or suggestions, you can always contact us via phone, email or social media.

  1. PERSONAL INFORMATION WE COLLECT AND HOW WE COLLECT IT

We collect personal information from you, directly and through third parties, in accordance with this Privacy Notice any time you contact us, interact with us, rent a vehicle (whether through us or a third party), join one of our loyalty programs or use any of our Services.

Please be aware that if you do not provide us with personal information that we need, we may not be able to provide certain Services under our contract with you or comply with our legal obligations. For example, when you rent a vehicle from us, we need your name, address, payment information, and driver’s license, which is personal information. If you refuse to provide us with any of this personal information, we may not be able to rent a vehicle to you. We will let you know when we need personal information from you and the consequences of failing to provide us with that personal information.

  1. HOW WE USE PERSONAL INFORMATION

We use personal information for a number of purposes relating to (i) fulfilling your rental booking with us, (ii) providing other products or Services requested by you, (iii) administrating our relationship with you, (iv) managing incidents such as vehicle damage or theft, and (v) marketing the products and services of ours and our business partners to you.

  1. LEGAL BASIS OF PROCESSING

We rely on one of a number of grounds under applicable data protection law to permit us to process your personal information.  These include as is necessary to perform our contract with you; for the purposes of our legitimate interests; and where we have collected your consent.

  1. HOW WE USE COOKIES AND OTHER SIMILAR TECHNOLOGIES

When you access our websites and Apps, we use cookies and similar technologies to help us understand how you use our websites and Apps and ensure that they function as intended, to optimize user experience, for analytics and to show tailored offers on our website and third party sites.

  1. HOW WE SHARE PERSONAL INFORMATION

The nature of our business and operations requires us to share personal information with our third-party service providers and business partners so that we are able to provide you with your rental booking and other products and services you request (such as insurance and our loyalty reward programs) and customer assistance, as well as to verify your identity and complete fraud checks, support our IT infrastructure, and market products and services that we and our business partners offer or to comply with applicable laws.

  1. HOW LONG WE KEEP PERSONAL INFORMATION

We keep personal information for no longer than is reasonably necessary or required by applicable law. How long we keep personal information depends on the type of personal information and the purpose(s) for which we collected it and the applicable legal requirements.

  1. HOW WE PROTECT PERSONAL INFORMATION

We take reasonable steps aimed to ensure personal information is protected from unauthorized use, access, disclosure, alteration, destruction, or loss.

  1. YOUR RIGHTS AND CHOICES

You may have certain rights and choices that you can make regarding the personal information we have about you.

  1. THIRD PARTY WEBSITES

Our Services may include links to and from the websites of our affiliates and business partners. We do not control how personal information is collected or used on those websites, so please review the privacy policy of any website you visit as a result of following any links to or from the websites of our affiliates and business partners.

  1. CHILDREN’S PRIVACY

Our Services are not for children under the age of 16. We do not knowingly collect personal information from children. If you think we have received personal information from children under the age of 16, please contact us immediately.

  1. CONTACT US

If you have questions, comments, or suggestions, you can always contact us. For your protection, we may need to verify your identity before we assist with your request by verifying that you can provide us with information about you that we have previously collected.

 PERSONAL INFORMATION WE COLLECT AND HOW WE COLLECT IT

RENTING A VEHICLE

When you make a reservation or rent a vehicle with us we collect the following personal information:

  • name;
  • home address;
  • telephone number;
  • gender;
  • tax number (if specifically requested);
  • information from another form of identification documentation such as a passport or national identity card if your driver's license does not include a photo or is not recognizable as you and/or proof of address such as a utility bill.
  • special requests and preferences, including:
    • your preferences regarding optional extras such as damage waivers and other protections if we offer these as an option for your booking;
    • where a delivery or collection service is available, the address where we will drop off or pick-up the vehicle and any optional extras you requested;
  • where a delivery or collection service is available, the address where we will drop off or pick-up the vehicle and any optional extras you requested;
  • where you inform us that you have a medical disability or other health-related requirements that require an adapted vehicle or other driver aid we will use that personal information in order to provide you with the service you requested and where you have given your explicit consent to us using that information;
  • when returning a vehicle following a rental we may ask you for a fuel receipt and we may retain a copy of that receipt. This fuel receipt may include credit card information, date and location of purchase and is required to confirm that the vehicle has been refueled in accordance with our agreement with you in relation to that rental;
  • other personal information that may be required to rent you a vehicle and/or provide you with services; and
  • email address;
  • employer details and business address (if you are a member of a corporate program);
  • date of birth;
  • payment information such as your credit or debit card details (security code is obtained for transaction only – we do not keep it);
  • information from driver's license and/or other government-issued identification, including if you are an additional driver for the specific rental;
  • special discount codes, partner member numbers, association memberships, corporate rewards programs (if you request discounts, special privileges, and points programs);
  • your preferences regarding optional extras such as damage waivers and other protections;
  • where and when you rented the vehicle, where and when you returned the vehicle, insurance preferences, fuel consumption, mileage, accident history and other personal information related to the vehicle and your use of it;
  • some vehicles come equipped with a global positioning system (GPS) or similar type tracking connected car technology device that may also collect information about the vehicle and the location of the vehicle and driving style, this is a requirement from our insurance provider, and we also use this data to manage our fleet, calculating any mileage related charges, ensuring the vehicle is only used in countries that we have allowed, ensuring the vehicle is only used on suitable roads, traffic and motoring offences.
  • in some locations we may be required to collect specific categories of personal data relating to you and your rental so that this can be provided to law enforcement (such as police) where required by applicable law. This may include the personal data set out above as well as additional personal data as required by law (such as gender). 

 

TRAFFIC AND MOTORING OFFENCES

We will collect personal information about any speeding, parking, toll or other traffic-related fines that you incur or any traffic offenses that you commit during your rental where these are provided to us by any law enforcement agency, parking authority or toll authority.

ACCIDENTS, MECHANICAL FAILURES, AND VEHICLE DAMAGE OR THEFT

If you have an accident, or suffer any loss, theft or damage to the vehicle during your rental or suffer any mechanical failure, we will collect information regarding such incident including your report of the incident and any police or other third-party reports including details of those involved, together with the nature of any personal injuries and/or damage to the vehicle and optional extras.

CONTACTING US

When you call us, we may record or monitor the call for quality control, training or similar purposes. We will advise you of this recording or monitoring during the call.

When you contact us by email, text or via social media we will keep a record of your name, contact details and the contents of your messages, queries, feedback or complaints.

We may also offer you the option to create an account with us. This will enable us to retain your verification status so that you can use this verification status for future rentals with us without having to complete the online verification process for each future rental. However, we will still require you to re-verify your driving license and identity at regular intervals and where details require updating – such as where your driving license has expired.

Online verification may also involve the receipt of information from third party fraud check and identity document database check providers.

USING WEBSITE OR APP

When you download, visit and use our websites and/or Apps, BM automatically collects technical information.

We may collect your IP address when you visit our websites. We do not normally link IP addresses to anything personally identifiable. In select circumstances, we may use IP addresses to help us identify you when we feel it is necessary to enforce compliance with our Website Terms and Conditions or to protect our service, site, users or others.

We may also collect your browser type, Internet Service Provider (ISP), referring/exit pages, the files viewed on our site (for example HTML pages, graphics, etc.), operating system, date/time stamp, and/ or clickstream data.

Session Replay

When you visit our website, we will sometimes record personal information about your browsing session on the website, including which pages you visited and any forms on the website that you completed.

Analytics

We use analytic software, such as Adobe Analytics, Google Analytics, and others, to help us to better understand the functionality of our software on our websites and Apps on your device. These software tools record technical information including about your device together with usage information such as how often you use our website or App, which features you use or don't use in the website or App or which pages you visit on the website, aggregated usage, performance data, where the App was downloaded from and information about your visit to the site, including details of some of the URL clickstream to, through and from our website.

GIFT CERTIFICATES AND VOUCHERS

When you purchase a gift certificate or voucher, we collect the name and mailing address of the gift recipient as well as your contact information, billing details and payment details in order to fulfill your order. 

PHOTOS AND VIDEOS

Where indicated by signage at the relevant location, BM rental locations may be equipped with video security surveillance systems as well as cameras that record as our vehicles depart/enter and also within our premises.

We may also receive photos or videos of you when you link your BM account with your social media profile or when we receive a notice of a traffic violation that includes a picture or video.

SOCIAL MEDIA

We may let you share some of our online content on social media websites through hosted sharing links and icons.

We do not track or store a record of each time a third party shares our online content.

If you choose to participate in posting or sharing activities, you should remember that it may be viewed by the public via BM’s website, in RSS feeds, APIs (application program interfaces) and may also be made available to other websites. As a result, your public activities may appear on third-party websites, blogs, or feeds. BM is not responsible for the information that may be shared publicly.

Our websites may include social media features, such as the Facebook Like button. These features may collect your IP address, which page you are visiting on our website, and may set a cookie so that the Like button feature works properly. Any social media feature is governed by the privacy policies of the website providing the feature. We encourage you to read the privacy policies of any website you visit.

We also use social media companies to assist us with advertising and promoting our services.  This will involve information relating to you and your use of our website being disclosed to these companies.  

  1. Legitimate interests (to ensure the security of our fleet and to record that the connected car has left/been returned to us and in relation to the establishment, exercise and defence of legal claims) (GDPR, article 6 (1)(f))

 

    2. Consent (where required by applicable local law).

 

  1. Processing is necessary for the establishment, exercise or defence of legal claims (where required by applicable local law).

GPS data collected when a vehicle is not returned

In the unlikely event that a vehicle is not returned to us following the expiry of your Rental Agreement we will need to try to locate the vehicle in the event of the theft or suspected theft (and, if relevant, notify the police/ relevant authorities and / or our insurers). We will also process GPS data and the details you provided to us when you signed your agreement with us to attempt to locate and recover our vehicle and to record that the vehicle has left/been returned to the rental location.

The GPS location of the vehicle is collected periodically and, in these circumstances, used in connection with our attempts to locate and recover the vehicle.

  1. Legitimate interests under GDPR (including to recover the vehicle in the event of a theft, protection of property and monetary interests, clarification of potential criminal offenses) (GDPR, article 6 (1)(f) and where provided for under applicable local law).
  1. Consent (where required by applicable local law).
  1. Processing is necessary for the establishment, exercise or defence of legal claims (where required by applicable local law).

 

Details and nature of certain identified locations.

Using geo-fence and GPS technology when the vehicle visits certain identified locations we can identify the nature of that location.  These locations include BM rental and operational locations as well as certain identified airports, stations, docks, hotels, workshops and car impounds or roads that may not be suitable for the vehicle.

We use this information to:

  1. protect our fleet against potential theft and/or loss of vehicles;
  2. better manage the availability and distribution of our fleet including by allowing us to generate inventories of which vehicles are at our locations; and
  3. record when a vehicle leaves or is returned to our rental locations including to allow us to manage our check-out and check-in procedures.

 

  1. Legitimate Interests (to ensure the security of our fleet, the efficient distribution of the fleet and to record that the vehicle has left/been returned to us) (points 1 and 2) (GDPR, article 6 (1)(f)).
  1. Performance of the Rental Agreement (point 3) (GDPR, article 6 (1)(b)).
  1. Consent (where required by applicable local law).

 

Information collected by the vehicle and the infotainment system (including details of your contacts, call history, and your music preferences).

If you connect your device to the infotainment system within the vehicle the infotainment system will process your personal information to make the system's functionality available to you (for example, to play and store your music choices and preferences and to allow you to make calls and receive hands-free communications). This information is only collected if you choose to sync your device to the infotainment system.

 

We do not receive this information unless you do not remove your data from the infotainment system when you return the vehicle to us. See below for further details.

Please note that other businesses (such as smartphone or music app providers) may also receive and use your personal information when you use infotainment systems. Please refer to the terms of use and privacy policies of those third party businesses.

  1. Legitimate interests (to provide you with the services available as part of your rental vehicle) (GDPR, article 6 (1)(f)).
  1. Performance of a contract ( GDPR article 6 (1)(b)). 

We may also use Personal Connected Car Data for the purposes of determining whether a customer will be included in the Do Not Rent list of customers who present significant risks to our business and/or personnel and who will be prevented from making a rental with us. We will only use Personal Connected Car Data for this purpose to the extent permitted by applicable law.

We may aggregate or anonymize Personal Connected Car Data to create anonymous and therefore non-personal information. We may use this information for the purposes of improving our products and services, and we may engage a third party analytic provider to assist us with this. Where we process your Personal Connected Car Data in generating such non-personal information , we process this on the basis of our legitimate interests of improving and developing our products and services. The further processing of this non-personal information is no longer subject to the requirements of applicable data protection law.

What other terms apply when you use the vehicles features?

Use of features in vehicles is subject to the terms and conditions posted by the vehicle manufacturer and/or the technology provider, which may include system and service limitations, warranty exclusions, limitations of liability, wireless service provider terms and user responsibilities. Some or all of these features are turned on at all times, even when other services or other media in the vehicle are turned off.

Vehicle manufacturers may also collect vehicle Data from our vehicles pursuant to their privacy policy and share the vehicle Data with us. You can review their privacy policy and other terms and conditions related to vehicle Data on the applicable vehicle manufacturer’s website.

Manufacturer in-built services or other manufacturer provided features and platforms may be included in your rental, and may also collect vehicle Data that is shared directly with the manufacturer. In these circumstances, the manufacturer may also be a data controller of your vehicle Data. Please note, that vehicle Data will first be received by the manufacturer of the vehicle prior to it being received by us. We encourage you to read the privacy notices relating to these services to understand what Personal Connected Data is being collected and the purposes for which it is being collected.

How long do we retain Personal vehicle Data?

We only retain Personal vehicle Data for the amount of time necessary to perform the purposes for which it was collected. This means that some Data may be overwritten very quickly, however, in any event, we will retain Personal Data for no longer than 7 years after the expiry of your rental agreement (unless there has been an insurance claim, accident or damage or there is an applicable legal or regulatory duty which requires us to retain the Data).

If you choose to sync a mobile device to the connected car (using Bluetooth, USB or otherwise) please ensure that you take the necessary steps to remove your information from the system when you return the connected car at the end of your rental period. If you do not do this, your information may be retained in the system.

If you find that a previous customer has forgotten to delete their information please delete it immediately or speak to a member of the team.

THIRD PARTIES

Where you have a booking or other relationship with us we will combine the personal information we receive from you with other information we receive from other sources so we can provide you with a more customized and hassle-free experience. This personal information may include your name, contact information, travel itinerary, booking request and other personal information that is relevant to your booking. These third parties include:

  • Travel agents or a third-party booking service that you used to make your reservation;
  • Hotels;
  • Payment card companies;
  • Advertisers and other partners;
  • Your employer or association if you are using a corporate / association account;
  • Police and other law enforcement agencies or toll authorities if you are involved in an accident during your rental, or suffer any loss, damage or theft of the vehicle, or if you incur any speeding, parking, toll or other traffic-related fines or commit any traffic offences during your rental;
  • Other third-party sources that are lawfully entitled to share personal information with us.
  • Airlines;
  • Membership clubs;
  • Payment processing providers;
  • Social media providers consistent with your personal information sharing settings on such services;
  • Our licensees and our affiliates, in order to create a Wizard account or if you are making a booking in one location served by our affiliates or licensees for rental services in another location served by us;
  • Parking stations or toll authorities if you incur any parking charges or fines during your rental; and

LOCATION INFORMATION

We may collect information about your location, which is personal information, from our websites, your mobile devices, and your visits to our locations. You may opt-out of our collection of information about your location from mobile devices at any time by turning off the transmission of geolocation data or push notifications on your mobile device or disabling cookies through your cookies settings or, where available, your preference settings in respect of our websites.

We also use vehicle Data to collect information about the location of our rental vehicles. As explained above, all Data (including location of the vehicle) that is directly or indirectly linked to you is your personal information. Vehicle Data from our rental vehicles (including location of vehicle) that cannot be directly or indirectly linked to you is not your personal information.

NON-PERSONAL INFORMATION

We may aggregate, anonymize, pseudonymize, de-identify or aggregate personal information to create non-personal information.

We may use non-personal information for any and all purposes, and we may keep it for as long as we have a business need to do so.

HOW WE USE PERSONAL INFORMATION

We use the personal information we collect in order to:

  • provide you with our Services such as renting a vehicle, including performing the vehicle rental, Location Specific Conditions and Rental Agreement, providing any requested optional extras, taking payment, pre-authorisations, and security deposits and providing discounts and offers or other benefits;
  • administer your rental, manage your rental records and to calculate your fees (for example, to automatically record the start of your rental, any exchange or upgrades, and the fuel or mileage usage and charges);
  • provide online digital check-in and biometric verification;
  • provide roadside assistance;
  • better understand how our vehicles are being used;
  • research and develop new features, products, and Services;
  • enable third-party vehicle applications and features;
  • ensure the security of our or another’s premises, property or other assets;
  • prevent and detect fraud or the recurrence of fraud;
  • process medical disability personal information used to adapt vehicle/driver aid;
  • allow you to take the benefits of membership of a loyalty program, including fast-track service at our rental counters, the ability to self-service elements of the rental through our App;
  • help us diagnose problems with our main computers or IT systems;
  • report aggregated information to our business partners;
  • enforce compliance with our Website Terms and Conditions and to protect our Service, site, users or others;
  • to fulfill an order for a gift certificate or voucher including redemption of the gift certificate or voucher;
  • provide customer service functions;
  • complying with health and safety requirements and policies;
  • recover lost, stolen or towed rental vehicles;
  • deal with any traffic, parking, toll or motoring fine or offense in accordance with the terms of your vehicle rental agreement with us;
  • establish, exercise or defend legal claims;
  • comply with applicable law.
  • provide you with additional features, functionalities and optional extras (for example, to provide remote lock/unlock, to remote disable engine/cancel ignition, and to automatically receive the vehicle location, odometer, fuel level and other information in connection with your rental);
  • otherwise perform our contract with you (for example the terms of any optional extra like insurance);
  • diagnose problems, analyze trends, and assess our performances;
  • improve our operations and Services;
  • tailor our Services and features to our customers;
  • maintain our fleet;
  • improve road safety and reduce traffic;
  • defend, protect or enforce our rights or applicable terms of service;
  • assist in the event of an emergency;
  • where you have shared your device location with us and enabled push notifications, for providing certain services such as arrival and return notifications, providing information about vehicle location, available upgrades, etc.;
  • provide you with further benefits to which you are entitled under a loyalty program such as free upgrades and free rentals;
  • for IT system administration;
  • audit the use of our website;
  • analyze trends in the aggregate and administer our website;
  • respond to messages, queries, feedback or complaints;
  • monitor calls and messages for quality control, training, and similar purposes;
  • enforcing our legal rights and manage any dispute and legal claims and take legal or other professional advice;
  • to prevent, detect, or investigate unauthorised use of our vehicles and systems and/or abuse or mistreatment of our staff and personnel and to protect against those risks, and ensure we comply with law and our policies;
  • respond to legally binding requests from law enforcement, regulatory authorities or other third parties;
  • comply with any legal obligation on us (for example, making any required notification of an incident to appropriate authorities or insurers); and

 

MARKETING

We will also use the personal information we collect, to the extent permitted by applicable law and with your consent (where required), in order to:

  • send you marketing where you have given us your consent to receive marketing or we are otherwise permitted by applicable law to do so. This includes marketing promotions, discounts or offers from us or our selected third party partners via multiple channels (including electronically by email, by text, to your postal address or by push notification through our App);
  • analyse your interactions with us, including your rental related searches and behaviour to tailor, personalise and optimise marketing content;
  • tailor the communications we may send to you and/or the promotions we may offer to you as a member of the loyalty program from time to time;
  • where you have shared your device location with us and enabled push notifications, send you push notifications or other communications based on your location (for example, nearby special offers); and
  • administer any contests, sweepstakes or other promotions. Personal information will only be used for these promotional purposes where you have chosen to enter the relevant contest, sweepstake or other promotion or we are otherwise permitted by applicable law to automatically enter you as a result of a rental or other purchase from BM;
  • deliver referral programmes;
  • better understand our customer's preferences and improve and tailor relevant marketing or offers from us and our third party partners;
  • where you have shared your device location with us, to assess and analyse the effectiveness of physical advertising.

 

In addition, where you link your social media and personal device profiles such as Facebook or Twitter with your account with us we will use this information (as permitted by applicable law) in order to:

  • customize offers and deals on our website;
  • send you relevant offers by mobile phone text messages;
  • allow you to publish check-in and check-out information to your linked social media accounts;
  • allow you to view your friends that have linked their profiles upcoming trips.
  • send you relevant e-mail offers with special deals and discounts;
  • update your profile information on our website;
  • allow you to share your upcoming trips with friends; and

BM may share personal information with third parties to help us with our marketing and promotional projects, such as managing our social media pages, running contests, sweepstakes and other promotions, or sending marketing communications.

Don't want to receive promotional and marketing posts, emails and text messages or push notifications from BM and our partners? No problem! You can withdraw your consent to direct marketing or tell us you do not want to receive such marketing at any time.

INSURANCE PRODUCTS

In addition, if you have requested an insurance product from us during your rental, we will process your personal information in order to:

  • enable the insurer to underwrite the relevant insurance product;
  • fulfill the terms of our agreement with you; and
  • process any claim under the insurance and assist the insurer in processing a claim;
  • establish, exercise or defend any associated legal claims.

 

LEGAL BASIS OF PROCESSING

Under applicable law in the European Economic Area and the United Kingdom, there are a number of legal grounds that permit us to use personal information for the purposes stated within this Privacy Notice.

The legal grounds that apply to our use of the personal information are:

  • that you provided your consent to us using your personal information for that purpose (for example, where you have given us your consent to send you electronic marketing) or, in relation to biometric verification, where you have provided your explicit consent;
  • that the processing is necessary for the purposes of our legitimate interests;
  • where processing is necessary for the establishment, exercise or defence of legal claims.
  • that we need to use that personal information in order to fulfill our contract to provide products or Services to you (for example, using your information for vehicle rentals or to join one of our loyalty programs;
  • where we need to comply with a legal obligation (for example, responding to government or law enforcement information requests); and

Our legitimate interests for using the personal information are:

  • to ensure effective administration and management of your relationship with us, including any rentals with us;
  • to operate and administer our services and business;
  • to carry out research, development, and analysis on what services or products our customers want or how they would like to use or improve and develop our Services, products features and to develop new Services, products, and features and tailor Services to our customers;
  • to tell our customers about the various products and Services we can offer;
  • to better tailor and personalize the promotions and benefits that we can offer to our customers and to present promotions to, and market to, our customers;
  • to recover costs of any loss or damage caused to a vehicle;
  • to undertake fraud and security checks and prevent/detect fraud;
  • enforce compliance with the applicable terms or service or Website Terms and Conditions;
  • ensure effective IT system administration and security;
  • to enforce our legal rights and establish, exercise and defend legal claims;
  • respond to legally binding requests from law enforcement, regulatory authorities or other third parties; and
  • to understand how our customers use our services and to manage our vehicle fleet;
  • to operate and administer our loyalty programs;
  • to understand how our customer use our Services and identify any issues in how the Services are used and how we can improve the customers' usage experience;
  • to understand and respond to customer communications , operate our customer service functions and monitor calls and messages for quality control, training, and similar purposes;
  • to prevent, detect, or investigate unauthorized use of our vehicles and systems and/or abuse or mistreatment of our staff and personnel and to protect against those risks and ensure we comply with the law and our policies;
  • to recover lost, stolen or towed vehicles;
  • ensure the security of our or another's premises, property or other assets;
  • defend, protect or enforce our rights or applicable terms of service;
  • report aggregated information to our business partners;
  • complying with health and safety requirements and policies;
  • to manage any dispute, toll, parking fine, motoring fine, offence and accidents and take legal or other professional advice.

 

WHO WE SHARE PERSONAL INFORMATION WITH AND WHY

Categories of third party recipients

Purpose of disclosure

Legal Basis for Processing Personal Information

Independent licensees and network providers

  • Make and confirm your rental reservation;
  • Understand how you use our services and improve our services;
  • Connect with your corporate and commercial accounts;
  • Provide customer assistance;
  • Processing any claims relating to accidents and/or injuries;
  • To protect or defend the rights or well-being of us, our employees, customers or others, including through the Do Not Rent list; or
  • Perform our contract with you;
  • Provide our rewards program and update partner points and rewards;
  • Assist with navigation assistance or itinerary planning;
  • Resolve toll, traffic or parking violations;
  • Providing roadside assistance services;
  • Verify safe driver criteria for qualified drivers.

 

  • Performance of Contract (GDPR, article 6 (1)(b));
  • Legal obligation (GDPR, article 6 (1)(c)); or
  • Legitimate Interests (GDPR, article 6(1)(f));
  • Consent (GDPR, article 6 (1)(a)).

 

Travel agents or a third party booking service used to make a reservation including bookings through airlines and hotels

  • Make and confirm your rental reservation;
  • Understand how you use our services and improve our services;
  • Assist with navigation assistance or itinerary planning;
  • Providing roadside assistance services; or
  • Perform our contract with you;
  • Process payments and refunds;
  • Provide customer assistance;
  • To protect or defend the rights or well-being of us, our employees, customers or others.

 

  • Performance of Contract (GDPR, article 6 (1)(b)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

Your employer or organisation

  • Provide corporate/association program benefits;
  • Verify driver’s licenses or other government identification;
  • Connect with your corporate and commercial accounts; or
  • Understand how you use our services and improve our services;
  • Verify eligibility to use designated account and discount codes;
  • Process billing, payments, and refunds.

 

  • Performance of Contract (GDPR, article 6 (1)(b)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

Brokers

  • Make and confirm your rental reservation;
  • Process payments and refunds;
  • Handle debt collection;
  • Credit risk assessment and management; or
  • Perform our contract with you;
  • Provide customer assistance;
  • Fraud check;
  • Evaluation of the reliability and punctuality of payments.

 

  • Performance of Contract (GDPR, article 6 (1)(b)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

Booking engines

  • Make and confirm your rental reservation;
  • Understand how you use our services and improve our services;
  • Process payments and refunds;
  • Fraud checks;
  • Evaluation of the reliability and punctuality of payments.
  • Perform our contract with you;
  • Verify eligibility to use designated account and discount codes;
  • To protect or defend the rights or well-being of us, our employees, customers or others;
  • Credit risk assessment and management; or

 

  • Performance of Contract (GDPR, article 6 (1)(b)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

Credit card issuers, Payment card companies, Payment processing providers

  • Process payments and refunds;
  • Handle debt collection;
  • Evaluation of the reliability and punctuality of payments.
  • Fraud check;
  • Credit risk assessment and management; or
  • Performance of Contract (GDPR, article 6 (1)(b)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

 

Corporate account manager

  • Provide corporate/association program benefits;
  • If you are renting with a corporate, membership or another similar commercial entity account, we may share personal information with the organisation that manages the account for their own purposes. We recommend you review their privacy policy to learn more about their privacy practices.
  • Understand how you use our services and improve our services;

 

  • Performance of Contract (GDPR, article 6 (1)(b)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

Marketing agent

  • Provide our rewards/loyalty program and update partner points and rewards;
  • Understand how you use our services and improve our services; or
  • Provide corporate/association program benefits;
  • To protect or defend the rights or well-being of us, our employees, customers or others.
  • Performance of Contract (GDPR, article 6 (1)(b)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

IT service providers including IT platform providers and website analytics service providers, data hosters and aggregators and cloud vendors

  • Understand how you use our services and improve our services;
  • Provide maintenance services for our IT systems and infrastructure;
  • Provide analytics services relating to your use of our website to identify any technical or user interface issues and/or improvements in connection with the website
  • Support our IT systems and infrastructure;
  • Provision of data hosting and other data processing services; or

 

  • Legitimate Interests (GDPR, article 6(1)(f)).

Government, regulatory, police and other law enforcement agencies

  • To verify your driver's license and ensure you meet our safe driver criteria;
  • To take action regarding illegal activities, traffic offences or violations of terms of service;
  • As otherwise required or permitted by law.
  • As requested by these agencies if the disclosure is required or permitted by law;
  • If we have a good faith belief that there is an emergency that poses a threat to the safety of you or another person; or

 

  • Legal obligation (GDPR, article 6 (1)(c)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

Parking stations or relevant company or local authority operating parking and toll authorities

  • If you incur any parking charges or fines or toll charges during your rental we will share personal data where required in relation to the relevant parking violation or toll charges; and
  • Resolve toll, traffic or parking violations.

 

  • Legal obligation (GDPR, article 6 (1)(c)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

Emergency services

  • Protect your vital interests in the event of an accident or emergency involving one of our vehicles.
  • Protection of vital interests (GDPR, article 6 (1)(d)).

Insurance companies and claims handlers in respect of any insurance product you purchase in connection with your rental

  • Provide and service the insurance product you have requested; or
  • Manage any claims that may be made under the relevant insurance policy

 

  • Performance of Contract (GDPR, article 6 (1)(b)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

BM Insurance providers

  • Manage any claims that may be relevant under BM insurance policies

 

  • Legitimate Interests (GDPR, article 6(1)(f)).

Marketing, advertising and promotional partners

  • To assist in managing our social media pages and running our advertising projects;
  • Provide you with contests, sweepstakes, and other promotions;
  • To assist in creating more relevant online advertisements for our websites and other websites that display our advertisements.
  • To deliver tailored and dynamic marketing content;
  • Provide you with information about products and services you may like; or

 

  • Legitimate Interests (GDPR, article 6(1)(f)).; or
  • Consent (GDPR, article 6 (1)(a)).

Our Customer Service Centers

  • Provide customer assistance including answering any issues, or concerns or other queries you raise with us;
  • Assist with navigation assistance or itinerary planning;
  • Processing any claims relating to accidents and/or injuries;
  • Assisting with the processing of payments and issuing of invoices;
  • Assisting with queries regarding an individual's inclusion on the Do Not Rent list; or
  • Monitor customer communications for quality and training purposes;
  • Resolve toll, traffic or parking violations;
  • Providing roadside assistance services;
  • Assisting with the resolution of damage incidents of damage to vehicles;
  • To protect or defend the rights or well-being of us, our employees, customers or others.

 

  • Performance of Contract (GDPR, article 6 (1)(b));
  • Legal obligation (GDPR, article 6 (1)(c)).
  • Legitimate Interests (GDPR, article 6(1)(f)).; or

 

BM entities and their employees.

  • Make and confirm your rental reservation;
  • Understand how you use our services and improve our services;
  • Connect with your corporate and commercial accounts;
  • Provide customer assistance;
  • Processing any claims relating to accidents and/or injuries;
  • Assisting with the processing of payments and issuing of invoices;
  • To protect or defend the rights or well-being of us, our employees, customers or others;
  • Assisting with queries regarding an individual's inclusion on the Do Not Rent list;
  • Administrative, management, accounting and reporting purposes.
  • Perform our contract with you;
  • Provide our rewards program and update partner points and rewards;
  • Assist with navigation assistance or itinerary planning;
  • Resolve toll, traffic or parking violations;
  • Providing roadside assistance services;
  • Assisting with the resolution of damage incidents of damage to vehicles;
  • To investigate, detect and prevent fraud, theft or other incidents relating to rentals and our vehicles;
  • Verify safe driver criteria for qualified drivers; or
  • Performance of Contract (GDPR, article 6 (1)(b));
  • Legal obligation (GDPR, article 6 (1)(c)); or
  • Legitimate Interests (GDPR, article 6(1)(f));
  • Consent (GDPR, article 6 (1)(a)).

If data includes criminal data:

  • Preventing or detecting unlawful acts

Third party mapping provider

  • To provide you with location-based services in connection with your rental.
  • Performance of Contract (GDPR, article 6 (1)(b)).

 

Third party contractors and service providers including auditors, legal and other professional advisors, diagnostic service providers, backup and disaster recovery specialists, fraud detection and prevention services, ID and biometric verification providers and debt collection agencies.

  • Provide services requested by you;
  • Detect and protect against fraud, theft or abuse;
  • To collect any overdue payments from you.
  • Manage and protect the BM business and its security;
  • Provide customer assistance; and

 

  • Performance of Contract (GDPR, article 6 (1)(b)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

If you rent a vehicle in Spain, personal data (including rental agreement number and vehicle registration number) will be shared with Spanish airport authorities.

  • Vehicle registration number is shared to enable use of car park exit / entry systems; and
  • Rental Agreement number is shared where required by the airport authority in relation to contractual arrangements with BM.
  • Legitimate Interests (GDPR, article 6(1)(f)).
  • Protecting the BM car fleet including prevention of theft, embezzlement and fraud; and
  • Protecting BM assets from use for illegal purposes.
  • Legal obligation (GDPR, article 6 (1)(c)); or
  • Legitimate Interests (GDPR, article 6(1)(f)).

 

We may also share personal information with third parties in the event of a merger or acquisition, consolidation, change in control, transfer of assets, bankruptcy, reorganization, or liquidation. To the extent that local laws require it, we will provide you notice on our websites or via e-mail of our intent to transfer personal information to a third party for this purpose.

In addition, we will share personal information with organizations if we believe in good faith that the disclosure is necessary in order to meet any applicable legal, regulatory or other enforceable governmental or regulatory request or order, detect, prevent or otherwise address fraud, security or technical issues and to protect against harm to the rights, property or safety of us or our group as required/permitted by applicable law.

We may share non-personal information, including vehcile Data that does not relate to you or your passengers and aggregated/anonymized data, with our third party service providers and partners as reasonably necessary to meet our business needs.

Please note that some of the third parties we share your personal data with act as data controllers such as our independent licensees, travel agents and third party booking services, your employer or organisation, credit card issuers, card providers, payment processors, government, regulatory, police and other law enforcement agencies, parking stations, toll authorities, insurers and other BM entities. This means these organisations will process your personal data for their own purposes. Please review the privacy notice of the relevant third party for further information. For example, where we provide your personal data to our third party provider for the purposes of processing transactions and ancillary services that third party provider will also act as a data controller.

HOW LONG WE KEEP PERSONAL INFORMATION

We have set out how long we will typically keep certain types of personal information in common scenarios below:

Category of personal information

Examples

How long we will keep this personal information

Customer and member records for administration and management

Records relating to the administration and management of customers and members. These records would include information used for the management of our relationship with customers including customer profiles, transactional history, customer preferences, personal information and satisfaction survey forms.

We will keep this personal information for at least 6 years after they cease to be an active customer.

Customer and member relations

Records related to customer (and member) issues, business dealings and the actions taken by BM, its business units or subsidiaries including general customer relations as well as complaints. This includes Call reports, Change of Address Forms, E-Mail Correspondence and Dispute Resolutions, Notification of Customer Dispute, Supporting Documentation, BM Response to Customer Dispute, Lost and Found documentation, i.e., register of items, contact with customer, etc.

We will keep this personal information whilst the complaint or incident is under investigation or until the issue is resolved and for between 6 and 10 years after this period depending on the applicable jurisdiction.

For incidents involving minors this information is kept for between 6 and 10 years after the age of majority i.e. 18 years of age plus 6-10 years.

Customer cardholder transaction information

Cardholder Data including primary account number (PAN). PAN is the 15- or 16-digit number on the front of credit and debit cards.

Please note we do not store: (a) Personal Identification Numbers (PIN); (b) encrypted PIN blocks; (c) full contents of any track from the magnetic stripe on the back of the card; and (d) Card verification codes. This is additional data that may be transmitted or processed as part of a payment transaction, but will not be stored at any time by BM.

The Primary Account Number or PAN will be retained for no longer than 15 months from the date of return of your rental vehicle.

We will either keep this personal information:

  • for at least 15 months starting on the date of the last transaction; or

Marketing data

These records would include information used for direct marketing by email, post to customers/potential customers including name, address, email address, customer profiles, customer preferences, and opt-in status.

We will keep this personal information for at least 3 years from the date the customer provides these details.

HOW WE PROTECT PERSONAL INFORMATION

The security of personal information is important to us. We take reasonable steps aimed to ensure personal information is protected from unauthorized use, access, disclosure, alteration, destruction or loss. Firewalls and encryption are used to protect your more sensitive personal information. You are responsible for keeping your account safe. Do not share your passcode, membership and pin numbers with anyone. Please be mindful that hackers and scammers may impersonate us or our website. For more information about phishing, please visit https://www.ncsc.gov.uk/collection/phishing-scams . If you suspect unauthorized use or security breach of your personal information related to us, you must notify our customer service as soon as possible! To the extent permissible by applicable law, we are not responsible or liable for any loss or damage if your account passcode, membership numbers, and pin numbers are stolen or used inappropriately.

We do not ask for financial or payment information, such as credit card number, passcode, account number or pin number, in an e-mail, text or any other communication that we send to you. We will only take payment details by phone, through our website or in person at one of our rental locations. Please always check that any website on which you are asked for financial or payment information in relation to our rentals or services is operated by BM or its affiliates. If you do receive a suspicious request, do not provide your information and report it by contacting one of our customer service representatives.

YOUR RIGHTS AND CHOICES

You may have – in accordance with data protection laws applicable in the European Economic Area and the United Kingdom – the following rights when it comes to our handling of your personal information:

  • Right of access – you may have the right to request a copy of the personal information we have about you and to request supporting information explaining how the personal information is used;
  • Right of erasure – you may have the right to request that we erase personal information about you;
  • Right to data portability – you may have the right to receive your personal information in a structured, commonly used and machine-readable format and to transmit such information to another controller;
  • Right to object – where we are processing your personal information based on a legitimate interest (or those of a third party) you may challenge this. However, we may be entitled to continue processing your personal information based on our legitimate interests or where this is relevant to legal claims. You also have the right to object where we are processing your personal information for direct marketing purposes.
  • Right of rectification – you may have the right to request that we rectify inaccurate personal information about you;
  • Right to restrict processing – in some situations, you may have the right to request that we do not use the personal information you have provided (for example, if you believe it to be inaccurate);
  • Right to withdraw consent – where we process your personal information based on consent (including direct marketing consents), you have the right to withdraw consent at any time. However, this will not affect the lawfulness of the processing based on consent before its withdrawal. Furthermore, even in case of a withdrawal we may continue to use your personal information as permitted or required by law;

In addition, if specifically provided for under your local law, you will have a right to define post-mortem guidelines – meaning you may define guidelines regarding the storage, erasure, and disclosure of your personal information after your death.

You are also free to lodge a complaint with the supervisory authority, should you feel that we process your personal information in a way that is against applicable law.

If you are included on the Do Not Rent list, you will be notified by a letter to your address, which will include why we have determined that you should be included on the DNR list and details of how you can challenge this decision in addition, you can exercise your privacy rights in respect of your personal information which is processed for this purpose as described above.