Privacy policy

Privacy Policy

Version dated 09/19/2024

Preamble

The General Data Protection Regulation (GDPR) came into effect on May 25, 2018, and complements existing legislation on the protection of personal data.

For your information, personal data refers to any information relating to an identified or identifiable natural person, directly or indirectly, by reference to an identification number or one or more factors specific to that person (name, first name, address, email, phone number, contract number, credit card number, etc.).

The processing of personal data refers to any operation performed on such data (collection, storage, transmission, deletion, etc.), whether on paper or electronic format. The data controller is the person who determines the purposes of each processing operation and the means to achieve these purposes.

For DOMIBAM RENTALS, SAS, the protection of your data is a priority. Therefore, in the interest of transparency, this Privacy Policy aims to explain why your personal data is collected and processed by DOMIBAM RENTALS, SAS, as the data controller, how it is processed, what rights you have over your data, and how you can exercise those rights.

DOMIBAM RENTALS, SAS reserves the right to modify this Privacy Policy at any time. Any modifications will take effect immediately.

Consequently, we invite you to regularly review our Policy, which is accessible from all pages of the Website, to stay informed of the latest applicable version. For significant changes, a notification will be made on the Website. We also encourage you to check the date indicated on this Policy to know when it was last updated.

Why does DOMIBAM RENTALS, SAS need to collect your data?

The data that DOMIBAM RENTALS, SAS collects is necessary to meet the following purposes:

• Responding to requests received via the online contact form

• Contract management (managing vehicle reservations, invoices, and payments)

• Conducting customer satisfaction surveys and studies, including rental statistics

• Managing complaints

• Carrying out commercial and marketing prospecting actions (sending advertising messages via email and SMS)

• Supplier selection

• Managing accidents

• Handling traffic violations and other criminal code infractions

In general, DOMIBAM RENTALS, SAS does not process your data for purposes incompatible with those for which they were collected, except with your prior consent.

What data does DOMIBAM RENTALS, SAS collect?

DOMIBAM RENTALS, SAS collects various types of personal data about you:

The personal data you provide directly:

• When you fill out a contact form,

• When you submit a reservation request,

• When you wish to subscribe to a rental contract,

• When you contact customer service with a question or to file a complaint,

• More generally, when you interact with DOMIBAM RENTALS, SAS in any other way.

Providing your personal data is voluntary. However, some information, identified by an asterisk, is essential for DOMIBAM RENTALS, SAS to process your request. Without this information, DOMIBAM RENTALS, SAS will not be able to process your request.

The personal data provided by third parties:

In the context of business partnerships:

• Tour operators (turnkey travel organizers)

• Brokers (comparison websites)

• Insurers (insurance companies)

• Hotel partners (Hotels, Guesthouses, etc.)

• Automotive franchises with which we have partnerships

The personal data we automatically collect:

We automatically collect certain information about you when you access DOMIBAM RENTALS, SAS's website, including information about your browsing behavior. DOMIBAM RENTALS, SAS uses cookies and other tracking technologies to collect information about you when you interact with the website.

For more information about cookies and how to disable them, please see the Cookie Policy.

What is the legal basis for processing your data?

DOMIBAM RENTALS, SAS collects your personal data for the purposes described in Section 1 of this Policy. In any case, DOMIBAM RENTALS, SAS only collects and processes your data when such collection and processing are based on a legal foundation.

Execution of contractual relationships with DOMIBAM RENTALS, SAS

Your data is necessary for the execution of the contract you have entered into or wish to enter into. On this contractual legal basis, any refusal to provide your personal data will prevent the conclusion and execution of the contract.

Compliance with a legal obligation to which DOMIBAM RENTALS, SAS is subject

Some of your data is processed by DOMIBAM RENTALS, SAS to comply with its legal obligations, including:

• Fulfilling legal obligations, such as applicable accounting rules, managing customer and supplier accounts,

• Identifying individuals committing infractions while driving rental vehicles (Art. L.121-6 of the French Highway Code),

• Declaring automotive accidents,

• Managing access, rectification, and opposition rights,

• Managing a list of opposition to telephone marketing.

Your consent

Subject to obtaining your prior consent, DOMIBAM RENTALS, SAS may process your data to:

• Send you commercial offers about its products and services,

• Offer you partner promotions,

• Set cookies under the conditions described in the Cookie Policy.

You may withdraw your consent at any time, following the procedures described in Section 5.2 of this Policy, without affecting the legality of the processing based on consent carried out before its withdrawal.

DOMIBAM RENTALS, SAS's legitimate interests

DOMIBAM RENTALS, SAS may process your personal data in pursuit of its legitimate interests, notably for managing business relationships, including:

• Responding to your requests sent via the online form,

• Selecting suppliers.

How long is your data retained?

Your data is retained by DOMIBAM RENTALS, SAS for the time necessary to achieve the purposes specified in Section 1, plus the applicable statutory limitation periods.

In terms of cookies:

DOMIBAM RENTALS, SAS may retain data for 13 months.

In terms of commercial management and prospecting:

DOMIBAM RENTALS, SAS may retain data for 3 years from the last contact with DOMIBAM RENTALS, SAS and you (Simplified Standard No. 48).

In terms of bank data retention:

DOMIBAM RENTALS, SAS may retain bank data for a maximum of 13 months after the contract's end, in intermediate archives, for evidence purposes. The data can only be used in the event of a transaction dispute.

In terms of customer satisfaction surveys and studies, including rental statistics:

DOMIBAM RENTALS, SAS may retain data for 2 years to monitor indicator trends.

In terms of managing traffic violations:

DOMIBAM RENTALS, SAS may retain data for a maximum of 45 days after receiving the traffic ticket notice. After this period, the data can be archived for a maximum period corresponding to the limitation of traffic violations, i.e., twelve months.

In terms of invoicing:

DOMIBAM RENTALS, SAS may retain data for 10 years (Art. L123-22 para. 2 of the Commercial Code, Simplified Standard No. 48).

In terms of accounting:

DOMIBAM RENTALS, SAS may retain data for 10 years (Art. L123-22 para. 2 of the Commercial Code, Simplified Standard No. 48).

For more information about how long your data is retained, you can contact DOMIBAM RENTALS, SAS's DPO at: dpo@gbh.fr.

What are your rights and how can you exercise them?

Your Rights Concerning Your Data

Right to Access Your Data

You can obtain confirmation from DOMIBAM RENTALS, SAS whether or not your data is being processed and, if it is, access to all the data and information held by DOMIBAM RENTALS, SAS.

Right to Rectify Your Data

You can request that DOMIBAM RENTALS, SAS correct, as soon as possible, any inaccurate or incorrect data concerning you. You can also request that your data be completed, if necessary.

Right to Erasure of Your Data

Except for legal exceptions, you can request that DOMIBAM RENTALS, SAS erase your data as soon as possible, especially if you believe that the processing carried out by DOMIBAM RENTALS, SAS on your data is no longer necessary for the purposes for which it was collected.

Right to Data Portability

You have the ability to retrieve some of your data in an open and machine-readable format, or request that DOMIBAM RENTALS, SAS transfer it to another entity. This right only applies to data you have actively and consciously provided to DOMIBAM RENTALS, SAS (e.g., data entered into an online form) or data generated during the use of a service or device in connection with the conclusion or management of your contract, and which is processed automatically, based on your consent or the execution of a contract.

Right to Object

In the case of your data being processed for marketing purposes, you can object to it at any time (See Section 5.2 of this Policy). Likewise, you can object to the dissemination of targeted advertising (Cookies).

Right to Restrict Processing of Your Data

You can request that DOMIBAM RENTALS, SAS retain your data without using it in the following cases:

You dispute the accuracy of the data used by DOMIBAM RENTALS, SAS,

You object to your data being processed,

The use is unlawful, but you oppose its deletion,

You need the data for the establishment, exercise, or defense of legal claims.

Right to Withdraw Consent to Data Processing

When the processing of your personal data is based on your consent (e.g., sending you commercial electronic offers), you can withdraw your consent at any time (See Section 5.2 of this Policy). Likewise, to withdraw your consent to cookies, you can do so in the ways specified in the Cookie Policy.

Right to Set Post-Mortem Directives

You have the option to define directives regarding the retention, deletion, and communication of your data after your death. These directives specify how you want your data rights to be exercised after your death. You can send us these directives by addressing a letter, with the subject line "Post-Mortem Directives," to the following address: dpo@gbh.fr. You can modify or revoke your directives at any time.

Right to File a Complaint with the CNIL

If you believe that your rights are not being respected or that your data protection is not ensured in accordance with the GDPR, you can file a complaint with a competent supervisory authority (in France, the CNIL) at any time, directly on the CNIL website or by postal mail to: CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.

Exercising Your Rights

You can exercise your rights regarding your personal data by accessing the following URL:

https://privacyportal-de.onetrust.com/webform/4fe2eaf0-48b2-46ba-a637-860caa064c34/707de958-6fb7-43da-bae4-8d2f614278e0?Site=Jumbocar%20Republique%20Dominicaine&Source=www.jumbocar-dominicanrepublic.com

You can also send your request by email or postal mail to: dpo@gbh.fr or DOMIBAM RENTALS, SAS - Calle Segunda, Km 10 ½ Autopista Duarte, Los Guayabos, Santo Domingo, D.N., República Dominicana, specifying "For the attention of the DPO."

The request must specify the reason for the request (e.g., exercising the right of access, objection, etc.) and the company concerned by the request. The request must include the address where the response should be sent.

DOMIBAM RENTALS, SAS will respond to your request within one (1) month of receiving it. However, this period may be extended by two (2) months due to the complexity and number of requests.

If you believe, after contacting DOMIBAM RENTALS, SAS, that your rights to data protection are not being respected, you can file a complaint with the CNIL.

Marketing and Targeted Advertising

If you have agreed to receive commercial offers from DOMIBAM RENTALS, SAS, you can change your mind at any time by clicking on the unsubscribe link.

For general questions about this data protection policy or requests regarding the management of your personal data by DOMIBAM RENTALS, SAS, you can send your request by email or postal mail as indicated above.

With Whom Does DOMIBAM RENTALS, SAS Share Your Data?

DOMIBAM RENTALS, SAS may share your data with the following entities when necessary to fulfill one of the purposes listed in Section 1 of this Policy:

For managing commercial activities, your data may be shared with:

Authorized personnel of DOMIBAM RENTALS, SAS (sales, accounting, and management),

Control services (auditors, internal procedure services).

For managing marketing campaigns, your data may be shared with communication providers operating on behalf of DOMIBAM RENTALS, SAS.

For managing insurance and claims, your data may be shared with insurance companies.

In the case of criminal offenses, DOMIBAM RENTALS, SAS may share your information with competent authorities.

Your personal data may also be accessible to DOMIBAM RENTALS, SAS's subcontractors for outsourced services (e.g., IT providers, software publishers, etc.). DOMIBAM RENTALS, SAS does not share your data with business partners.

Are Your Data Transferred Outside the EU?

Your data is stored on secure servers located in France. If your data is transferred outside the EU, notably via our subcontractors, we will ensure that they process your data in strict compliance with applicable data protection regulations.

How Does DOMIBAM RENTALS, SAS Secure the Processing of Your Data?

DOMIBAM RENTALS, SAS implements technical, physical, and organizational measures to ensure the security and confidentiality of your data during collection, processing, and transfer.

The infrastructures of DOMIBAM RENTALS, SAS are protected against malware (viruses, spyware, etc.); securing your device is your responsibility.

In the event we employ service providers to process part of your data, we commit to ensuring that they offer sufficient guarantees to protect the personal data entrusted to them and to signing confidentiality clauses in compliance with Article 28 of the GDPR.

In Case of a Personal Data Breach, i.e. in case of a security incident, whether intentional or not, and which compromises the integrity, confidentiality, or availability of your personal data, DOMIBAM RENTALS, SAS is committed to fulfilling the following obligations:

Hypothesis 1: No Risk: à Internal documentation in the "violations log."

Hypothesis 2: High Risk: à Internal documentation in the "violations log" + Notification to the CNIL within a maximum of 72 hours.

Hypothesis 3: High Risk: à Internal documentation in the "violations log" + Notification to the CNIL within 72 hours + We will inform you as soon as possible.

The "violations log" contains the following elements:

The nature of the violation;

The categories and approximate number of individuals concerned;

The categories and approximate number of files concerned;

The probable consequences of the violation;

Measures taken to remedy the violation and, if applicable, to mitigate its negative effects;

If applicable, the justification for not notifying the CNIL or informing the individuals concerned.

In accordance with applicable regulations, we are not required to notify you of a breach in the following cases:

Your personal data is protected by measures making it unintelligible to anyone not authorized to access it;

Measures have been taken to ensure the risk is no longer likely to materialize;

Notification would require disproportionate efforts, especially if we have no means of contacting you to inform you.

Mandatory Fields

Fields marked with an asterisk in our forms are mandatory. The consequence of not responding is simply that your request will not be processed. The obligation to provide the requested data is contractual, as it is necessary for the execution of the contract to which you are a party or pre-contractual measures carried out at your request, such as requests for information or quotes for our products and services.

Default Cookie Policy

We are committed to incorporating the protection of personal data from the design stage of a project, service, or any other tool related to the handling of personal data, notably through data minimization, limitation of the purposes for which data is collected, integrity and confidentiality of data, and limiting data retention periods.

Accountability

In order to comply with the principle of Accountability, our company:

Adopts internal procedures to ensure compliance with regulations (IT charter, personal data protection charter);

Maintains a documentary record of all processing activities carried out under its responsibility or that of its subcontractor (register of processing activities, confidentiality agreements for employees and contractors, company security policy, procedures for handling access, rectification, and opposition requests, etc.);

Conducts impact assessments (PIA) for processing operations that present particular risks to the rights and freedoms of individuals.

The objective is to provide extensive documentation to demonstrate compliance with data protection rules at all times.