Privacy & Cookies

                                                                                                                                                   PRIVACY POLICY

                                                                                                                                                  www.autonom.ro 

1. Who are we?

AUTONOM SERVICES S.A. (hereinafter referred to as “Autonom” or “Controller”), attaches great importance to your personal data, constantly taking the necessary steps to ensure that the data processing carried out by it complies with the legal requirements in this area. To this end, we have developed this Privacy Policy, by which we undertake to respect the confidentiality of your personal data and by which we explain to you what categories of personal data Autonom processes, how that data is used, and for what purposes it is processed.

This Policy relates only to the personal data that we process through our website www.autonom.ro  (hereinafter referred to as the "Site" or "Platform"), in the context of your interaction with it by renting the vehicles presented on the site, by filling out the forms available on the site, when you are simply browsing the site or when you are communicating with the Controller (e.g. via inbound or outbound telephone calls, by signing up to the newsletter as to receive messages of the marketing sort, etc.). We want to assure you that we have taken all necessary measures to ensure the confidentiality of your data, which is processed only by the Controller's staff and collaborators who have been previously trained and authorized to process personal data and who respect firm confidentiality commitments.

Your data is processed by AUTONOM SERVICES S.A. in a safe manner. In this regard, the Controller has implemented various technical and organizational measures fit to protect personal data against incidents such as: destruction, loss, modifications be they accidental or illegal, use, leaks or unauthorized access, especially when data processing implies sending of data via a network and against any other form of illegal processing.

To get to ‘know’ us virtually, we provide you our identification data.

The Controller that processes your personal data when you browse or interact with the online platform www.autonom.ro is AUTONOM SERVICES S.A., with headquarters in Piatra Neamț, str. Fermelor No. 4, Neamț County, with UIC 18433260, registered in the National Trade Register Office under no. J2006000280271.

For any questions/ queries pertaining to the protection of personal data, you are invited to send a request to the person in charge with data protection designated at Autonom, at the postal address aforementioned or at the e-mail address [email protected]. Data subjects sending such requests to Autonom via e-mail/ mail are requested to mention in the subject line of the email/ mailing envelope information such as "data protection", "GDPR" or "personal data", in order to ensure that requests will be treated with priority.

As a data subject, you will receive a response within a maximum of 30 days from the communication of the document to Autonom. An extension of this deadline can only operate in exceptional situations. In these cases, we assure you that you will be duly informed of this deadline.

2. Definitions

• „Personal data” means any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or to one of more factors specific to the physical, physiological, mental, economic, cultural or social identity of that natural person.

! For the purposes of this policy, personal data that will be subject to processing may relate to: name, surname, telephone number, e-mail address, etc., as described below.

• „Personal data processing” means any operation or set of operations which is performed on personal data, regardless of whether it is done by automated means or not, such as: collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

! For the purposes of this policy, data processing refers to those processing operations carried out at the time of your navigation on the website www.autonom.ro or your interaction with it by renting the vehicles provided by Autonom, by completing the forms available on the Platform or by subscribing to the Controller’s newsletter, or by accepting cookies other than those absolutely necessary (essential).

•  „Controller” means the person which, alone or jointly with others, determines the purposes and means of the processing of personal data.

! For the sake of clarity, for the purposes of this Privacy Policy, the Personal Data Controller is represented by AUTONOM SERVICES S.A.

• „Data subject” represents the person whose personal data is being processed.

! For the purposes of this Policy, the data subject is the Internet user who browses on or interacts with www.autonom.ro Site. This includes the situations in which a car is rented from Autonom.

• „Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

! The data processing carried out through the Platform and based on the legal basis of the consent is exclusively for the purpose of subscribing to the newsletter, i.e. accepting cookies other than the necessary (essential) ones, as highlighted in the cookie pop-up.

• „Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

• „Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

3. What types of personal data do we process?

Your browsing and interaction with the Site involves the processing of two categories of personal data, namely:

        a.personal data that you disclose to the Controller on a voluntary basis (e.g. via the contact form, in the case of a newsletter subscription, when renting a vehicle through the site or when soliciting a rental offer, etc.), which are collected on an individual basis;

        b.data that you provide involuntarily, simply by browsing our website.

The users are properly informed regarding the processing of data when they provide their data to the Controller via the forms present on the site, as such Autonom fulfills its legal obligation of informing the users.

Autonom collects, on the basis of the voluntary provision of the data subject, the following personal data:

A. When soliciting a personalized offer for the rental of vehicles

• Name and surname;

• Phone number;

• E-mail address;

• Any other data provided by filling the form in order to obtain a personalized rental offer (in the section intitled ‘Other observations’).

B. When soliciting the rental of a vehicle

• Name and surname;

• E-mail address;

• Phone number;

• Any other data provided by filling the form in order to obtain a personalized rental offer (in the section intitled ‘Other observations’).

C. When completing the contact form

• Name and surname;

• E-mail address;

• Phone number;

• Any other data provided by filling the form in order to obtain a personalized rental offer (in the section intitled ‘Other observations’).

D. When conversing via inbound and/or outbound phone calls

• Your voice;

• Phone number;

• Any other personal data that the data subject provides during a phone call, which may include:

  • Name and surname;

  • E-mail address etc.

E. When obtaining additional information via e-mail or Whatsapp

• E-mail address;

• Name and surname (which may indirectly result from the e-mail address if its composition is as such: [email protected]);

• Phone number;

• Any other sort of data that you provide the Controller with.

F. When subscribing to the newsletter

In order to subscribe to our newsletter, you must give your consent for the purpose of receiving messages of commercial or marketing nature from Autonom. In such cases, the following personal data will be processed:

• E-mail address;

• Name and surname (which may indirectly result from the e-mail address if its composition is as such: [email protected]).

G. When applying for a job, in the ‘Career’ section

• Name and surname;

• Phone number;

• E-mail address;

• Information present in the CV (e.g. age, studies, professional experience, image, etc.)

• Information present on the personal LinkedIn page, if you choose to provide the Controller with it;

• Any other information that you provide the Controller with when completing the box entitled ‘Message’.

The Controller also processes marketing and communication data only on the basis of prior consent of the users, as well as technical data and browsing actions by means of cookies and similar technologies. You can access our Cookie Policy, available at the footer of the Platform.

! N.B. Autonom has entered into data processing agreements with its service providers (e.g. online administration systems, online legal services etc.), however it is not held liable for the data processing done by these providers in their own name. Whenever they process data as independent controllers, the data subject will be informed properly regarding the processing that presupposes a transfer of data in-between Autonom and any society that furnishes services towards the Processor.

Your personal data may be disclosed by Autonom for processing or to designated data processors, including contractual partners, financial authorities and institutions, courts or competent bodies, at their request and for the purpose of providing the services offered by the Controller.

Autonom may store your personal data even after registering a request for deletion of such data, if the storage is for one of the following purposes, provided for in Article 17 of the GDPR, respectively:

       a.for the performance of a contract;

       b.for compliance with a legal obligation which requires processing by Union or Member State law to which the Controller is subject;

       c.for exercising the right of freedom of expression and information;

       d.for protecting the vital interests of the data subject;

       e.for the performance of a task carried out in the public interest;

       f.for archiving purposes in the public interest, scientific or historical research purposes;

       g.for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child;

       h.for the establishment, exercise or defence of legal claims.

4. For what purpose and on what legal grounds do we process personal data?

Autonom processes your personal data for the following purposes and on the following legal grounds:

       a. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6, para. (1), let. b) of Regulation (EU) no. 679/ 2016 of the European Parliament and of the Council of 27 april 2016), for the purpose of ensuring the data subject's access to the services made available through the www.autonom.ro Platform and the conclusion of the distance car rental contract. If you do not provide us with the data necessary for entering into a rental contract of vehicles from Autonom, we inform you that the Controller will not be able to proceed with the conclusion of this contract.

This basis of processing is also used in the case of submitting your application in order to conclude an individual employment contract with Autonom.

       b. the data subject has given consent to the processing of his or her personal data (art. 6, para. (1), let. a) of Regulation (EU) no. 679/ 2016 of the European Parliament and of the Council of 27 april 2016), in the case of the transmission of commercial and marketing communications or the acceptance of cookies that are not necessary; 

       c. processing is necessary for the purposes of the legitimate interests pursued by the Controller (art. 6, para. (1), let. f) of Regulation (EU) no. 679/ 2016 of the European Parliament and of the Council of 27 april 2016), in order to be able to provide accurate information and to solve problems of any nature related to the content of the website www.autonom.ro or the services offered by the Controller, as well as for actions involving interaction with the online platform;

       d. the processing is necessary for the fulfillment a legal obligation (e.g. tax obligation) incumbent on the Controller – art. 6, para. (1), let. c) of the Regulation (EU) no. 679/2016 of The European Parliament and Council of 27 April 2016). In the event that you will not provide us your data necessary for invoicing, we inform you that Autonom will not be able to proceed with the conclusion of the vehicle rental contract and will not be able to honor your request.

Your personal data will be processed so that the Controller can:

       a. improve the website and the services provided through it;

       b. determine the usefulness/popularity of the web content presented on the Site;

       c. send technical, support or administrative notifications;

       d. honor requests and resolve complaints received from users;

       e. facilitate user access to the services offered by Autonom;

       f. communicate information of interest to users of the site;

       g. protect the Controller's rights;

5. The duration of processing personal data

Personal data processed at the level of the Controller through the website www.autonom.ro are retained for a reasonable period of time in relation to the purpose of data processing, in accordance with the legal provisions on data archiving. The Controller respects the data archiving deadlines required by law.

In regards to the data obtained through inbound and outbound phone calls, these will not be kept by the Controller. Phone calls are not registered. Notwithstanding, the data obtained during phone calls that is necessary, for example, for billing and honoring contractual obligations or to solve any disagreement may be held in storage for the duration of 30 days. They will be kept in conformity with the legal imperatives relevant to the archiving of data.

Data processed as a result of your subscription to the newsletter will be processed by the Controller only until you withdraw your consent for processing in accordance with the Newsletter Subscription Policy.

6. Transfer of personal data

Your data is processed on the territory of the European Union through secure internal servers. However, by means of plugins specific to social networks (e.g. Facebook, LinkedIn, Instagram, etc.), as third-party recipients of the data, it is possible that your data processed in this context may also be transferred outside the European Union/European Economic Area and stored on servers in third countries. In this regard, the Controller has implemented a number of necessary and appropriate measures to ensure that the data is processed accordingly.

The Controller undertakes that the data collected will only be processed in accordance with the stated purposes and will not make public, sell, rent, license, transfer, etc. unauthorized databases containing information on the data subjects to any third party not involved in the fulfilment of the stated purposes, unless the transfer/access/viewing etc. is requested by the competent authorities in cases provided for by the regulations in force at the time of the event.

It is possible that your data will be disclosed to other companies that provide services to us and act as our authorized persons, such as suppliers providing website maintenance, IT, legal etc. services. Furthermore, we may transfer your data to the following: entities executing activities of debt collection or vehicle collection, providers of roadside assistance services etc.

These entities are selected with great care to ensure that they comply with specific personal data protection requirements. They have a limited ability to use your information for purposes other than providing services to us.

In addition to the disclosures described in this Privacy Policy, we may disclose information to third parties to whom you consent or request that we make such a disclosure.

7. Links, hyperlinks, third-party sites

The www.autonom.ro website may contain links to third party sites that may collect your personal data, including through cookies or other technologies.

If you link to a third-party website, this Privacy Policy will not apply to your use of that website.

8. What are your rights as a data subject?

Any natural person browsing our website, as a data subject, has the following rights in relation to Autonom, as a Personal Data Controller:

• Right of access means the right of the data subject to obtain confirmation from the Controller as to whether or not the Controller is processing personal data relating to him or her and, where that is the case, access to the personal data and to information of how the data is processed.

•  Right to rectification refers to the rectification, without undue delay, of inaccurate personal data processed or to their completion if they are incomplete. They can be amended by sending an e-mail to: [email protected].

• Right to erasure („right to be forgotten”) means the right of the data subject to obtain from the controller the erasure of personal data concerning him or her, without undue delay, where one of the following grounds applies: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing, objects to the processing and there are no overriding legitimate legal grounds for the processing, the personal data have been unlawfully processed, the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject, the personal data have been collected in relation to the offer of information society services.

• Right to restriction of processing may be exercised if the data subject requests the restriction of the processing of his/her personal data, in which case they will be used strictly for the exercise of the data subject's other legal rights, including responding to any requests/complaints from the data subject.

• Right to data portability means the right to receive personal data in a structured, commonly used and machine-readable and the right to transmit those data to another, where the processing is based on consent or on a contract and is carried out by automated means, where technically feasible.

• Right to object concerns the right of the data subject to object to the processing of personal data where the processing is necessary for the performance of a task carried out in the public interest or in the legitimate interest of the Controller.

• Right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. However, it will not be possible to exercise this right if the decision is necessary for the conclusion or performance of a contract between the data subject and the Controller, is authorised by the law applicable to the Controller, provided that the rights, freedoms and interests of the data subject are adequately protected or is based on the consent of the data subject obtained in compliance with applicable law.

• Right to address the National Supervisory Authority for Personal Data Processing. If the data subject considers that the above-mentioned rights have been infringed, he/she has the possibility to address the ANSPDCP by lodging a complaint.

The contact details of the ANSPDCP are as follows:

Address: Bucharest, 1st District, G-ral. Gheorghe Magheru Blvd. no. 28-30;

Telephone: 0.318.059.211/0.318.059.212; 

Fax: 0.318.059.602; 

E-mail: [email protected];

Website: www.dataprotection.ro. 

In order to exercise the rights set out above, the data subject shall contact AUTONOM SERVICES S.A. by sending a request to the postal address: Piatra Neamț, str. Fermelor No. 4, Neamț County / e-mail address [email protected]

9. Final provisions

If Autonom deems it necessary to change the privacy rules, the Controller will publish those changes to inform data subjects about the information it collects and how it uses it.

The provisions of the Privacy Policy are complemented by the provisions of the Cookie Policy and the Newsletter Subscription Policy, respectively, present on the website www.autonom.ro.

AUTONOM SERVICES S.A.