Privacy policy

Information on CARTRUST SA

 

CARTRUST SA, a public limited company whose registered office is located at 7 Route de Trèves, L-2632 Findel, registered with the Trade and Companies Register of Luxembourg under number B 125 189, operating under the business name CARTRUST SA (hereinafter “CARTRUST SA” or “we“), is a specialized service provider in long-term operational and financial leasing, and in corporate fleet management services.

As part of its activities and services, CARTRUST SA processes, among others, the personal data of its clients and its clients’ (drivers’) employees. CARTRUST SA acts as a “Data Controller” as part of such processing activities, and is responsible for the protection of your personal data. As such, CARTRUST SA must comply with the existing legislation on data protection, including, since 25 May 2018, the European General Data Protection Regulations 2016/679 (the “regulations” or GDPR’) and the national laws in force implementing Directive 95/46 of the EU on personal data processing.

Data collection activities

Cartrust SA collects all data sources within the framework of commercial activities such as professional car rental, car rental for private individuals, vehicle sales or fleet management, etc.

We process your personal data if you are:

  • clients (professional persons or private individuals);
  • drivers of vehicles, i.e. clients’ employees or anyone else authorised by the clients to benefit from a contract between the client and CARTRUST SA
  • contact persons of clients
  • Fleet Managers
  • buyers of used vehicles
  • visitors/users of the website
  • prospects
  • Corporate Directors
  • etc.

How do we collect your personal data?

  • We collect your personal data directly from you, when we interact with you, when you complete an online form (application form, accident report form, etc.).
  • We may receive personal data from your employer with which CARTRUST SA has entered into an agreement (contact information, vehicle category, etc.).
  • We may receive personal information about you from our suppliers offering services in the context of the execution of any contract (e.g. provider of fuel cards).
  • We may receive your personal data from the authorities (e.g. in the context of fines).
  • We may collect information about your computer or device, including your IP address, operating system or browser type. Such information is collected to ensure the sound management and functioning of our website. Cookies are used to collect such information.

 

 

What types of personal data do we collect?

  • Identification and contact data, e.g. surname, first name, address, telephone/mobile number or email address; etc.
  • Professional information, e.g. your position, your department or your business contact; etc.
  • Financial information, e.g. information on your contract, etc.
  • Personal characteristics including your gender, date of birth, nationality, language, etc.
  • Data about you as a driver including your driver’s licence number/duplicate or the employee’s driver code;

 

For what purposes do we use your personal data?

CARTRUST SA processes your personal data for the following purposes:

  • To undertake client checks, in order to process and carry out assessments of clients prior to entering into a contract or the sale of a used vehicle.
  • To meet legal obligations and protect the rights and assets of CARTRUST SA: we use personal data to respond to legitimate requests of the supervisory and tax authorities, in order to detect and prevent money laundering, to conduct a preliminary check of a counterpart, etc.
  • To create and administer customer accounts.
  • To communicate with you: you can contact us via different means (via our website, by phone, email, etc.) to ask questions, request information, share comments, etc. We will use your information to communicate with you or to answer your questions.
  • To provide you with vehicle related services included in the contract: * delivering a vehicle, * vehicle insurance, * management of fuel cards, * replacement vehicle,
  • * vehicle return management
  • * roadside assistance,
  • * accident and repair management,
  • * repair, maintenance and tyres,
  • * ordering a vehicle,

– To make fleet reports related to the use of vehicles (fuel consumption, accident history, etc.) for clients

– For billing and accounting purposes (invoicing, receipt of payments, etc.).

– To manage conflicts (recovery of unpaid amounts, legal files, etc.)

– To manage fines and administrative sanctions related to the use of a vehicle, such as parking, as well as any other offence.

– For administrative reports, including audits, internal control, data analysis. – To store business and professional files for legal, administrative and auditing purposes. We also use the information to meet legal, insurance and processing requirements.

– We can also invite you to participate in events

 

On what legal basis do we process your personal data?

CARTRUST SA processes your personal data according to the following legal basis, and as appropriate:

  • The execution of the contract you have entered into with CARTRUST SA or the preparation of a contract that you intend to enter into with CARTRUST SA;
  • Compliance with our legal obligations (e.g.: anti-money laundering legislation, provisions of the law of 25 July 2015 establishing the creation of the automated control and sanction system, etc.);
  • Legitimate interests of CARTRUST SA or a third party, insofar as these rights outweigh your fundamental rights and freedoms, such as, where appropriate, for purposes of detecting and preventing money laundering, conducting a pre-audit of a counterpart, providing you with useful information, etc.

 

With whom do we share your personal data?

To offer our services, we sometimes need to call on partners or processing entities for the purposes outlined above. We limit sharing your personal data to the following categories of recipients:

  • internal services such as the Sales Department, Customer Service Department, Marketing Department, Accounting Department
  • our client (your employer);
  • our service providers including: data hosting providers, IT providers, third parties performing developments, maintenance, mechanical repairs, tyre changes, damage assessment, damage repairs, assistance, etc.
  • authorities when required by law, such as in response to a court order, including law enforcement agencies and courts, or to requests from tax authorities, etc.
  • when necessary to sell or transfer business assets, as part of a bankruptcy, to claim our rights, to protect your property or rights, or the safety of others, or, if needed, to support the functions of external audit, compliance and corporate governance.

 

How is your personal data collected?

CARTRUST SA aims to ensure that your personal data is:

  • protected against any accidental or intentional destruction/loss
  • used properly
  • inaccessible to unauthorised persons.

 

How long will we keep your personal data?

Generally, we keep your personal information as long as necessary as set out in this Personal data protection policy, or in accordance with the laws in force.

 

Sensitive data

We sometimes have to deal with sensitive data, primarily judicial data, such as fines, violations of road traffic regulations, criminal data regarding claims (police report, etc.).

We process such data exclusively for the following purposes:

  • For the management of claims and litigations related thereto (recovery of amounts under claims incurred during the rental period, etc.). If necessary, such data can be provided to the client (employer), to insurers and brokers involved in the management of the claim, to professional experts designated by us or by them (lawyers, forensic experts in charge of the file), to any subcontractors involved in the management of claims, as well as to authorities and courts.
  • For the management of fines and administrative penalties as well as offences related to the use of the rented vehicle.

CARTRUST SA may be required to:

  • process data on traffic fines, administrative sanctions and violations of road traffic regulations, including the location of the offence, the date and time, the offence itself, the amount to be paid;
  • provide personal data to the competent authorities for identification purposes (via fax/email); and, where appropriate,
  • provide data on the fine or administrative penalty to the client (usually the driver’s employer) for management and billing purposes of the fine or sanction.

 

How do we ensure the security and integrity of your personal data?

We protect your data, through measures of technical and organisational safety, against accidental or illegal destruction, loss or accidental alteration, unauthorised disclosure or access, and against all other forms of unlawful processing.

How can you check and indicate your preferences on the use of your personal data?

You can exercise a number of rights against CARTRUST SA regarding the processing of your personal data, insofar as you actually have these rights under existing legislation on data protection, such as the RGPD.

To exercise the rights set forth in this section at any time, please contact the data protection addressee of CARTRUST SA, who will process your request.

Objection. You have the right to object to the processing of your personal data on the basis of a legitimate CARTRUST SA interest.

Withdrawal. If you have already provided your consent to process your personal data, you may withdraw your consent at any time. However, it does not affect the legality of processing based on consent prior to withdrawal.

Access You may request access to personal data we store about you, or to claim a copy. You may also request information on the purposes of the processing, the categories of data, the categories of recipients, the terms of data retention, etc.

Portability. You have the right to obtain a copy of any personal data that we hold about you in our files in a compatible format in order for you to be able to exercise your data portability right.

Limitation.

You have the right to ask to restrict the processing of your personal data in the following cases:

  • for a period that allows CARTRUST SA to verify the accuracy of your personal data, in the event that you challenge the accuracy of such data;
  • if the processing is illegal and you wish to restrict the use of, rather than delete, your personal data;
  • if you would like CARTRUST SA to keep your personal data as you need it to defend yourself in the context of legal proceedings;
  • if you objected to the processing, but we have to check whether the legitimate reasons for such processing have precedence over your own rights.

 

Rectification. You also have the right to rectify inaccurate personal data and supplement incomplete personal data.

Deletion. You have the right to request the deletion of your personal data in the following cases:

  • if your personal data is no longer required considering the purposes for which it was collected or processed;
  • if you have withdrawn your consent and there is no other legal basis for the processing;
  • if you objected to the data processing and CARTRUST SA has no pressing legitimate ground to process your data;
  • if the personal data was unlawfully processed;
  • if the personal data must be deleted to comply with a legal obligation to which CARTRUST SA is subject.

 

Complaint. You also have the right to file a complaint with the competent supervisory authority in the event of doubts as to the processing conditions of your personal data by CARTRUST SA (National Commission for Data Protection, “Commission Nationale pour la Protection des Données” 1 Avenue du Rock’n Roll, L-4361 Esch-sur-Alzette, Luxembourg, www.cnpd.lu).

 

Who should you contact if you have any questions or concerns regarding the processing of your personal data?

CARTRUST SA has appointed a Data Protection Officer. The Data Protection Officer can be contacted via info@cartrust.lu.

The Data Protection Addressee is the clients’ first point of contact for any issues relating to personal data protection or the exercise of their rights.

In this regard, any questions, complaints or comments regarding this Personal data protection policy or our data processing principles should be sent by e-mail to the following e-mail address: info@cartrust.lu .

To avoid any ambiguity, this person is not empowered as a Data Protection Officer within the meaning of the GDPR.

 

The CARTRUST SA Data Protection Officer will act as a second point of contact for any questions regarding (presumed) non-compliance to regulations and/or data protection laws in force.