CarToRent CarToRent Europe

Legal

Privacy policy

The following privacy policy is provided by the data controller, NextHub Digital AG, to describe how the site https://cartorent-europe.com (hereinafter also the "Site") is managed, with specific reference to the processing of personal data provided by Users/Data Subjects.

This notice sets out the methods, purposes and limits of data processing and is provided, pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter "GDPR"), the Swiss Federal Act on Data Protection (nFADP) and the United Kingdom General Data Protection Regulation (UK GDPR), to those who access the NextHub Digital AG website. Switzerland is recognised by the European Commission as a country with an adequate level of data protection (Decision 2000/518/EC and subsequent updates).

This information refers exclusively to https://cartorent-europe.com and not to other websites or sections/pages/spaces owned by third parties that the user may consult through specific links.

Users are invited to read this Policy carefully before providing any personal information and/or completing any form on the Site.

1. Identity and contact details of the data controller

The data controller is NextHub Digital AG, with registered office at Via Giovan Battista Pioda 8, 6900 Lugano, company identification number CHE-332.633.398.

Pursuant to Article 27 of the GDPR, NextHub Digital AG has appointed a representative in the European Union to ensure compliance with local regulations.

Data Protection Representatives (Pursuant to Article 27 of the GDPR)

Dott. Gabriel Mercas
Via Mantova, 250 - 25018 Montichiari (BS) Italy
email: gabriel@pgstudiolegale.it — pec: dott.madalin.mercas@pec.it

The up-to-date list of Data Processors, pursuant to Art. 28 of the GDPR, the Swiss Federal Act on Data Protection (nFADP) and the UK GDPR, can be requested by sending a written request to the Data Controller using the contact details given in Art. 8 of this Policy.

2. Data collected

The personal data collected by the Data Controller while the site is used consists of:

  1. Data provided by Users: when Users register for the services offered on the website https://cartorent-europe.com, they voluntarily provide the following personal data: full name, email, phone number and postcode. The Data Controller may process this data for the service purposes referred to in Article 3, point 1, of this Policy.
  2. Browsing data: the IT/electronic systems and software procedures used to operate the Site acquire, during their normal operation, some personal data. The transmission of this data is implicit in the use of web communication protocols or is functional to managing and optimising data transmission and the email system. This data collection, carried out exclusively for statistical purposes or to monitor the correct functioning of the Site, is not intended to identify the User in any way. Web contact data is not kept after processing, except where computer crimes against the Site are detected.
  3. Data for marketing and telemarketing purposes: with your prior consent, you may receive communications by email, text message or phone call.

3. Purpose and legal basis of processing — registration on the Site

The data provided is used to allow registration on the Site and access to its services. Legal basis: performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR).

The personal data provided by Users is collected and processed by NextHub Digital AG for the following purposes:

  1. Registration on the Site https://cartorent-europe.com
    The data provided by the User will be processed in order to provide the services offered by the Site and will allow the User to use the Services. The processing of personal data is based on Article 6(2) of the GDPR, i.e. it is necessary for the fulfilment of contractual and pre-contractual obligations.
    Providing personal data for the processing purposes indicated above is optional but necessary, as failure to provide such data will make it impossible for the user to use the services offered by the site.

  2. Direct marketing
    With the User's express and voluntary consent, the data provided may be used for commercial purposes. Communications may be made using the contact details provided by the User during registration (email, SMS or voice calls). When the Company sends promotional communications about third-party products, services or events, it does not share your data with those third parties without your explicit consent. Consent to the use of personal data for this purpose is entirely optional and refusal will in no way affect your participation in the initiative. Furthermore, once consent has been given, the User may revoke it at any time by sending a request to the email address indicated in Section 8 of this policy.
    Legal basis: user consent (Article 6(1)(a) GDPR). The user may revoke consent at any time by sending an email to privacy@nexthubdigital.com or, in the case of emails, via the automatic opt-out link included in each message.

  3. Disclosure to third parties, independent data controllers, for their commercial purposes
    The data collected may be disclosed to third parties located in Switzerland, the European Union and the United Kingdom for marketing and profiling purposes only with the user's explicit consent (Article 6(1)(a) GDPR and UK GDPR).
    With the express, free and informed consent of users, the personal data provided during registration may be used by third parties to send commercial and promotional communications about their products and services. These third parties will process your data as independent data controllers and may send promotional communications using the contact details provided by users during registration (email, SMS or phone calls, with or without an operator). Consent to the use of your personal data for this purpose is entirely optional, and refusal will in no way affect the possibility of registering and using the services offered on the site. Furthermore, once consent has been given, users may revoke it at any time by sending a request to the email address indicated in section 8 of this policy.

    Use of trademarks, disclosure of data to manufacturers and specific consent

    All names, trademarks, logos and trade names mentioned on this site are the exclusive property of their respective owners. They are used solely for descriptive, informative and comparative purposes and do not imply any sponsorship, affiliation or endorsement by the brands mentioned.

    In addition, in certain cases and provided that the User gives prior, free, express and informed consent by ticking the corresponding boxes ("checkboxes") in the Site's forms, the personal data provided may be disclosed directly to car manufacturers or other companies owning the aforementioned brands, so that these entities can contact the User and send commercial information, quotes, offers or proposals relating to the vehicle or service of interest.

    In the absence of such specific consent expressed by ticking the corresponding box, no data will be disclosed directly to these companies.

    Legal basis: user consent (Article 6(1)(a) GDPR).
    The up-to-date list of external companies to which data may be disclosed is available on request. To obtain an up-to-date copy, write to privacy@nexthubdigital.com.

    The third-party companies to which, with the User's free and optional consent, the Data Controller may disclose personal data fall into the following categories:

    1. Car and motor vehicle manufacturers
    2. Car dealerships (dealers and resellers)
    3. Automotive-related products (accessories, spare parts, tyres, etc.)
    4. Car insurance
    5. Car financing and leasing
    6. Car rental and shared mobility (car sharing, long-term rental, etc.)
    7. Maintenance and repairs (garages, body shops, inspection centres)
    8. Electric mobility services (electric cars, charging stations, batteries, etc.)
    9. Fleet management and business solutions
    10. Automotive technology and connectivity (GPS, infotainment, driver-assistance software)
    11. Car washing and detailing services
    12. Sale of motorcycles and alternative vehicles (scooters, e-bikes, campers, etc.)

    These categories also include third-party companies that have expressly requested to be designated as Partners of the Data Controller.

  4. Profiling and automation
    The data provided may be used to analyse the user's preferences, habits and behaviour using automated tools and advanced algorithms. This analysis allows the Data Controller to personalise promotional communications, tailoring content, offers and messages to the user's specific interests.

    Purpose of profiling:

    The profiling activity has the following objectives:

    • Improve the user experience by offering personalised content and promotions.
    • Provide targeted offers based on previous interactions with the Site and the Services.
    • Analyse purchasing behaviour and propensity towards certain products or services.
    • Segment users into interest categories to run more effective marketing campaigns.
    • Optimise customer relationships by offering more relevant support and services.

    Legal basis for processing

    The processing of data for profiling is based on the user's explicit consent, pursuant to Article 6(1)(a) GDPR. Users have the right to refuse or withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

    Users have the right to object at any time to profiling and to the use of their data for direct marketing purposes, pursuant to Article 21 of the GDPR and the UK GDPR. To exercise this right, you can write to privacy@nexthubdigital.com or use the unsubscribe link in email and/or SMS communications.

4. Processing methods

The data collected for the purposes referred to in Article 3 above will be processed using electronic or IT tools and paper media and, in any case, using methods strictly related to those purposes, in order to guarantee the security and confidentiality of the data.

These methods will be relevant and not excessive in relation to the type of services provided.

5. Scope of disclosure and dissemination of data

Users' personal data may be disclosed to employees and/or collaborators of the Data Controller responsible for managing the Site. These persons, formally designated by the Data Controller as "data processors", will process Users' data exclusively for the purposes indicated in this privacy policy and in accordance with applicable law.

If the Data Controller uses external providers for certain types of services, such as technology services, User data may also be disclosed to these providers, who will process it as data processors.

With Users' express consent, Sponsors and third parties belonging to the categories indicated in Article 3.3 may process Users' personal data as independent Data Controllers.

Except in the cases mentioned above, User data will under no circumstances be transferred by the Data Controller.

6. Data retention period

The data collected will be processed for the time strictly necessary to achieve the specific purposes for which the User has given consent and, in any case, in compliance with the terms established by current legislation.

  • Data will be processed until consent is revoked and, in any case, will be kept for the time strictly necessary to protect the legitimate interests of NextHub Digital AG in compliance with the limitation periods applicable in Switzerland, the European Union and the United Kingdom (approximately 5-10 years, unless the law provides otherwise).
  • For the purposes set out in articles 3.2 and 3.3, data will be kept for a maximum of 24 months.
  • In the event of a dispute, data may be kept for longer periods to protect legal rights.

The data will subsequently be anonymised or deleted, unless supervisory authorities, law enforcement or the judiciary request otherwise.

If the User states that they no longer wish to receive information or offers, the retention period will end and NextHub Digital AG will take appropriate technical and organisational measures to exclude any further contact with the User.

7. Place of data processing and transfer of data to third countries

Data processing related to this Site's web services takes place at the Data Controller's offices in Switzerland (Lugano) and is handled exclusively by authorised personnel and by the Data Controllers.

The personal data collected may be transferred to and processed by entities located in the European Union, the United Kingdom and Switzerland for purposes related to the provision of services, marketing and the management of contractual relationships with partners and suppliers.

Data transfers between Switzerland and the United Kingdom are based on the UK-Switzerland Data Bridge, recognised by the UK ICO since 12 October 2023. For all other transfers outside the EEA, the European Commission's Standard Contractual Clauses (SCCs) or other safeguards compliant with the GDPR and the UK GDPR apply.

For transfers to countries without an adequacy decision from the European Commission or the UK ICO (for example, the United States), such transfers will be made on the basis of the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreements (IDTAs) and, where necessary, additional technical and organisational measures will be implemented to ensure an adequate level of protection, as required by the EDPB (European Data Protection Board) guidelines.

Such transfers will be made in accordance with Article 45 et seq. of the GDPR, which governs the international transfer of personal data, with reference to the following legal bases:

  • European Commission adequacy decisions for Switzerland and the United Kingdom.
  • Standard contractual clauses (SCCs) for data transfers between Switzerland, the EU and the United Kingdom.
  • Other security measures compliant with the GDPR and the UK GDPR.

For further information, the User may contact the Data Controller using the contact details indicated in Article 8 of this Policy.

If you would like more information about the security measures we take or to request a copy of the security measures we implement, you can contact us by email.

8. Rights of the data subject

The user may exercise the following rights:

  • Access, rectification and erasure of personal data.
  • Restriction of and objection to processing.
  • Withdrawal of consent (without affecting the lawfulness of prior processing).
  • Data portability in a readable format.
  • Complaint to the Italian Data Protection Authority.

The user may exercise these rights by contacting:

In accordance with the Applicable Regulations, the Data Controller informs Users that they have the right to obtain:

  1. the indication of the origin of the personal data;
  2. the indication of the purposes and methods of processing;
  3. the indication of the logic applied in the case of processing carried out with the aid of electronic instruments;
  4. the indication of the identification details of the controller and the administrators;
  5. the indication of the subjects or categories of subjects to whom the personal data may be disclosed or who may become aware of it as data controllers or data processors.

In addition, Users have the right to obtain:

  1. access to, updating, rectification or, where of interest, integration of the data;
  2. the erasure, anonymisation or blocking of data processed unlawfully, including data whose retention is not necessary in relation to the purposes for which it was collected or subsequently processed;
  3. certification that the operations referred to in letters a) and b) have been brought to the attention, including as regards their content, of those to whom the data has been disclosed or disseminated, unless this proves impossible or involves a manifestly disproportionate effort compared with the right protected.

Users also have:

  1. the right to withdraw consent at any time, if processing is based on consent;
  2. the right to data portability (the right to receive all personal data concerning them in a structured, commonly used and machine-readable format), the right to restrict the processing of personal data and the right to erasure (the "right to be forgotten");
  3. the right to object: (i) in whole or in part, on legitimate grounds, to the processing of personal data concerning them, even if relevant to the purpose of collection; (ii) in whole or in part, to the processing of personal data concerning them for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communications; (iii) where personal data is processed for direct marketing purposes, at any time, to the processing of data concerning them for such purposes, including profiling to the extent that it is related to such direct marketing;
  4. if they consider that the processing of their personal data infringes the Regulation, the right to lodge a complaint with a supervisory authority (in the Member State where they habitually reside, work or where the alleged infringement occurred). The Controller is not responsible for updating the links contained in this Policy. Therefore, if a link does not work or is out of date, Users acknowledge and accept that they must always consult the document or section of the websites linked through that link.

Users have the right to lodge a complaint with the competent supervisory authority in the Member State in which they reside or in the country where the alleged infringement occurred. The main reference authorities are:

9. Updates and changes to the privacy policy

NextHub Digital AG reserves the right to modify this Privacy Policy at any time. Any changes will be published on the Site, in the "Privacy Policy" section, highlighting the changes. Users are therefore advised to review this page periodically.

Any legal dispute will be submitted to the jurisdiction of the Courts of Lugano, without prejudice to the right of data subjects to apply to the competent judicial authority in their country of residence, in accordance with applicable law (GDPR, nFADP, UK GDPR).

We use cookies to improve your experience and analyse how the site is used. Learn more