DATA PROTECTION POLICY

Data Controller: In compliance with the provisions of the European General Data Protection Regulation 2016/679 and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, lessees are hereby informed that the data controller is the lessor company, specifically SICILY BY CAR SPAIN, S.L., Procença, 290 PR 1, 08008 Barcelona, ​​Spain, Tax ID B55475982, and the contact details are those included in this contract.

You are hereby informed that, for greater assurance of compliance with data protection regulations, a Data Protection Officer has been appointed. Their contact information is as follows: GDPR Officer, email: dpo@sbciberia.com

Purpose: The purposes for which we will process your data are the provision and management of the vehicle rental service and the execution of this contract, the sending of commercial communications, the management of traffic violations and vehicle insurance, as well as the monitoring (location) of the vehicle fleet and the sending of advertising about the company's products and services.

Legal Basis: The legal basis for the processing described is the contractual relationship, when it involves the provision of the contracted service, compliance with legal obligations in cases of traffic violations and/or police requests, as well as the legitimate interest in the processing related to sending advertising or locating the vehicle. For all other processing activities, the legal basis will be the customer's consent.

Retention: Personal data will be retained for as long as necessary to fulfill the purpose for which it was collected. If the data is used for several purposes that require us to retain it for different periods, we will apply the longest retention period. Our data retention periods are based on business needs, so personal data that is no longer necessary will either be restricted to compliance with strictly legal obligations or will be securely destroyed.

• Purposes related to the performance of a contract: Regarding the use of information for managing any contractual obligation we have with the client, we will retain this data for the duration of the contract and for the following ten years, in order to address any subsequent inquiries or claims.

• Purposes related to compliance with legal and regulatory obligations: certain information must be kept for the periods required by the specific applicable regulations (tax, commercial, anti-money laundering, etc.).

• Marketing purposes: with regard to the use of your information for marketing purposes, we will retain this information for that purpose for two years following the date on which we last obtained your authorization to send you marketing communications, unless you request that we exclude you from them by revoking the consent previously given.

Communications: The company will not transfer data to third parties unless there is a legal obligation to do so, it is necessary for the provision of the contracted service, or to share your data with partner brokers in order to facilitate the management of the booking or the provision of additional services related to the vehicle rental. During the vehicle delivery process, your name may be displayed on the public screens at the delivery locations to manage the corresponding appointments. In any case, we limit access to your data only to those individuals who need it to perform their duties.

Your Rights: You may exercise your rights of access, rectification, erasure, restriction of processing, objection, or, where applicable, data portability by sending a request to the Data Controller, along with a copy of your identity document, to the email address dpo@sbciberia.com, specifying the right you wish to exercise.

Finally, we inform you that you may file a complaint with the Spanish Data Protection Agency and other competent public bodies regarding any issue arising from the processing of your personal data.

Sicily by Car reserves the right to modify its Privacy Policy at its own discretion, or due to changes in the doctrine of the Spanish Data Protection Agency, legislation, or case law. Any changes to the Privacy Policy will be published at least ten days before they take effect on the company's website.