Privacy Policy

The controller responsible for the processing of personal data is:

UCanRent GmbH
Ferstelgasse 4/10
1090 Vienna
Austria
FN 681018 y

Geschäftsführer (CEO): Aleksandr Bulatov

E-mail: ab@ucan.rent
Phone: +43 (0) 676 955 55 25
Website: https://ucan.rent

Hereinafter referred to as “UCanRent”, “we” or “us”.

This Privacy Policy applies to our website, our mobile app, reservations, rental agreements, customer profiles, communication with us, and all related services of UCanRent GmbH and its current or future branches, representative offices or organisational units in Austria, Germany, the Czech Republic, Slovakia or other countries.

We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and, where applicable, other national data protection regulations.

Personal data means any information relating to an identified or identifiable natural person.

We may process, in particular, the following personal data:

a) Master data
First and last name, date of birth, nationality, residential address, telephone number, e-mail address.

b) Identity and document data
Passport data, identity card data, driving licence data, country of issue, validity period, document numbers, copies or photos of identity documents and driving licences, insofar as this is necessary for identity verification and contract processing.

c) Contract and booking data
Reservations, rental period, vehicle model, pick-up and return location, additional drivers, additional services, deposit, payment status, rental agreement, handover and return protocols.

d) Payment and billing data
Payment method, invoice data, deposit, transaction data, bank details, card information insofar as provided by the payment service provider, outstanding claims, refunds and damage settlements.

e) Communication data
E-mails, telephone notes, WhatsApp or messenger communication, support requests, complaints, damage reports and other communication with us.

f) Vehicle and usage data
Mileage, fuel level, charging level, handover and return data, vehicle photos, damage documentation, driving data, GPS location data, speed and movement data, insofar as the vehicle is equipped with a GPS or telematics system.

g) Website and app data
IP address, device information, browser type, operating system, app version, log files, technical usage data, language settings, session data, cookie and tracking data, where applicable.

We process personal data in particular for the following purposes:

a) creation and management of customer profiles;
b) processing and confirmation of reservations;
c) conclusion, performance and termination of rental agreements;
d) identity, age and driving licence verification;
e) verification of rental eligibility and prevention of misuse;
f) payment processing, deposit management, invoicing and accounting;
g) handover, return and documentation of the vehicle condition;
h) handling of damages, accidents, breakdowns, fines and contractual breaches;
i) theft protection, tracking, security and protection of our vehicles;
j) assistance in emergencies, breakdowns or accidents;
k) enforcement and defence of legal claims;
l) fulfilment of legal obligations, in particular tax, accounting and trade-law obligations;
m) operation, security and improvement of our website, app and IT systems;
n) customer communication and support;
o) direct advertising and marketing, where legally permitted or where consent has been given;
p) creation, management and deletion of customer and renter profiles, including the storage of the personal data required for this purpose during active use of the profile and for a reasonable period of inactivity.

Depending on the purpose, processing is carried out on the following legal bases:

a) Performance of a contract and pre-contractual measures pursuant to Art. 6(1)(b) GDPR This applies in particular to reservations, customer profiles, rental agreements, identity verification, driving licence verification, vehicle handover, payment processing and return.

b) Legal obligation pursuant to Art. 6(1)(c) GDPR This applies in particular to tax, accounting, corporate-law, trade-law and official retention and documentation obligations.

c) Legitimate interest pursuant to Art. 6(1)(f) GDPR This applies in particular to fraud prevention, theft protection, GPS tracking, vehicle security, damage handling, debt collection, IT security, prevention of misuse and documentation of contractual breaches.

d) Consent pursuant to Art. 6(1)(a) GDPR This applies in particular to voluntary marketing measures, newsletters, certain cookies, tracking technologies or other processing activities for which we expressly obtain consent.

Consent once given may be withdrawn at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

The provision of certain personal data is required for creating a reservation, concluding a rental agreement and handing over a vehicle.

Without the required data, in particular identity data, driving licence data, contact data and payment/deposit information, we cannot confirm a reservation and cannot hand over a vehicle.

The creation of a customer or renter profile requires the processing and storage of certain personal data, in particular master data, contact data, identity data, driving licence data and booking- and contract-related data. Without this data, a complete profile cannot be created and a proper reservation or vehicle handover cannot be carried out.

Our vehicles may be equipped with GPS tracking and telematics systems.

These systems may collect, in particular, the following data:

a) current location of the vehicle;
b) route history and movement data;
c) speed and driving behaviour;
d) mileage;
e) technical vehicle data;
f) times of departure, return or standstill.

Processing is carried out for the following purposes:

a) theft protection and recovery of the vehicle;
b) assistance in breakdowns, accidents and emergencies;
c) protection of high-value vehicles;
d) monitoring compliance with contractual usage restrictions;
e) handling of damages, fines, contractual breaches and cases of misuse;
f) fleet management, maintenance and technical control.

The legal basis is, depending on the individual case, performance of a contract pursuant to Art. 6(1)(b) GDPR and our legitimate interest pursuant to Art. 6(1)(f) GDPR in protecting our vehicles, ensuring the safety of renters and enforcing contractual claims.

Permanent live monitoring of individual renters without a specific reason does not take place. Access to GPS and telematics data is granted only to authorised persons, insofar as this is necessary for the purposes stated above.

During handover and return of the vehicle, photos and protocols may be created in order to document the condition of the vehicle, mileage, fuel level, accessories, damages or other relevant circumstances.

This processing serves the performance of the contract, damage handling, preservation of evidence and enforcement or defence of legal claims.

For payments, deposits, refunds and settlements, we may process payment data and involve payment service providers, banks, card providers or other financial service providers.

The deposit is processed in order to secure possible damages, fines, contractual breaches, late returns, missing fuel, cleaning costs or other outstanding claims.

If traffic violations, parking violations, toll violations or other official matters arise during the rental period, we may transfer personal data of the renter or additional driver to competent authorities, police departments, courts, lawyers, debt collection service providers or other authorised bodies.

This is done to fulfil legal obligations, to perform the contract and to protect our legitimate interests.

Personal data may, where necessary, be transferred to the following recipients:

a) payment service providers, banks and card providers;
b) insurance companies, leasing companies and financing partners;
c) workshops, towing services, roadside assistance providers and experts;
d) IT service providers, hosting providers, app and software providers;
e) GPS/telematics service providers;
f) tax advisors, accountants, lawyers, notaries and auditors;
g) authorities, courts, police and administrative bodies;
h) debt collection service providers and receivables management providers;
i) affiliated branches, representative offices or organisational units of UCanRent GmbH;
j) other service providers, insofar as this is necessary for the provision of our services.

All service providers are contractually obliged, where required, to comply with data protection regulations.

Personal data may be processed or transferred within the European Union and the European Economic Area, in particular in Austria, Germany, the Czech Republic and Slovakia.

A transfer to countries outside the EU/EEA takes place only if there is a suitable legal basis for this, in particular an adequacy decision of the European Commission, appropriate safeguards such as EU Standard Contractual Clauses or express consent.

We store personal data only for as long as this is necessary for the respective purposes or as long as statutory retention obligations exist.

Personal data processed in connection with the creation and management of a customer or renter profile is generally stored for the duration of active use of the profile.

A customer or renter profile is considered inactive if, for a period of 1 year and 3 months, there has been no login, no reservation, no active booking, no outstanding claim, no open damage case, no ongoing insurance case and no other contractually or legally relevant activity.

After a period of inactivity of 1 year and 3 months, the customer or renter profile will generally be automatically deleted or anonymised, provided that no statutory retention obligations, outstanding claims, damage cases, insurance cases, official proceedings, legal claims or other legitimate reasons prevent deletion.

The renter may request the deletion of their customer or renter profile at any time by contacting us using the contact details provided in this Privacy Policy. We will delete the profile and the related personal data, provided that no statutory retention obligations, open contractual relationships, outstanding claims, damage cases, insurance cases, official proceedings, legal claims or other legitimate reasons prevent deletion.

Where complete deletion is not possible due to statutory retention obligations or legitimate interests, the relevant data will be blocked, processing will be restricted, or the data will be retained only for legally permissible purposes.

In general, the following storage periods apply:

a) Customer and profile data: for the duration of active use of the profile; in case of inactivity, generally automatic deletion or anonymisation after 1 year and 3 months, provided that no statutory retention obligations or legitimate reasons prevent this;

b) Contract and booking data: for the duration of the business relationship and beyond in accordance with statutory retention obligations and for the enforcement or defence of possible claims;

c) Invoice and accounting data: in accordance with statutory tax and corporate-law retention obligations;

d) Damage, accident, insurance and claims data: until final clarification and until the expiry of statutory limitation periods for possible claims;

e) GPS and telematics data: only for as long as this is necessary for security, contract control, damage handling, theft protection, misuse prevention or legal enforcement;

f) Communication data: for as long as this is necessary for processing, documentation, customer support, contract handling or legal enforcement;

g) Marketing data: until withdrawal of consent or objection to processing.

Our website and app may use technically necessary cookies, comparable technologies, log files and analytics tools.

Technically necessary cookies and similar technologies serve the secure operation of the website and app, the booking function, profile creation, session management and security.

We use non-essential cookies, analytics, marketing or tracking technologies only if the relevant consent has been given, insofar as such consent is legally required.

Further information on the specific cookies, tools and providers used is provided in a separate cookie notice or consent banner.

If you give us consent or if we are legally entitled to do so, we may use your contact details to send you information about offers, vehicles, promotions or news from UCanRent.

You may object to receiving marketing communications or withdraw consent once given at any time.

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, disclosure or destruction.

These measures include, in particular, access restrictions, password protection, secure IT systems, role-based authorisations and organisational security measures.

Under the GDPR, you have in particular the following rights:

a) right of access to the personal data processed;
b) right to rectification of inaccurate data;
c) right to erasure of personal data;
d) right to restriction of processing;
e) right to data portability;
f) right to object to processing based on legitimate interests;
g) right to withdraw consent once given;
h) right to lodge a complaint with a data protection supervisory authority.

You may contact us at any time using the contact details provided above in order to exercise your rights.

The right to erasure also includes the right to request deletion of the customer or renter profile. Deletion will be carried out provided that no statutory retention obligations, open contractual relationships, outstanding claims, damage cases, insurance cases, official proceedings, legal claims or other legitimate reasons prevent deletion.

You have the right to lodge a complaint with a competent data protection supervisory authority.

For Austria, this is in particular:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria
Website: www.dsb.gv.at

We do not make any solely automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

We reserve the right to amend this Privacy Policy if this becomes necessary due to legal, technical or organisational changes.

The current version will be published on our website and/or in our app.