Politica sulla privacy

LEGISLATIVE FRAMEWORK:

The privacy and data protection management model of TopCar RAC S.L. is based on the following legal framework:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
• Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights.
• The guidelines of the Article 29 Working Party.
• Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (L.S.S.I.C.E.).

 

DATA CONTROLLER:

• Identity: TopCar RAC S.L., is the owner of the website: https://top-car-hire.com/
• N.I.F.: B38045498.
• Telephone: 828 913 118
• Postal Address: C/ Los Peregrinos, 29, Urbanización Industrial El Goro 35200 Telde - Gran Canaria - Las Palmas, Spain.
• E-mail: rgpd@topcar.es.

 

PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA:

TOPCAR RAC S.L informs users that the purpose of processing the collected data includes:

• PROCESSING INFORMATION REQUESTS AND/OR QUERIES:
  • Purpose of Processing: To attend to and respond to queries submitted by website users.
  • Lawfulness of Processing: Consent given by the data subjects via the forms provided for such purposes.
  • Type of personal data: Identifying, contact and/or professional data, as well as any possible information contained in the submitted query, the processing of which is necessary to provide you with a response.
  • Source of personal data: Provided directly by the website user, either by completing the contact forms or by submitting them via email or similar means.
  • Category of data subjects: Website users who submit queries through the forms and possible affected and/or interested parties who directly provide their personal data.
  • Retention periods: The time necessary to fulfil the purpose described in each processing activity and to determine any possible liabilities that may arise from said purpose.

 

• NEWSLETTER AND SIMILAR INFORMATION SUBSCRIPTIONS
  • Purpose of Processing: To send periodic newsletters by e-mail upon request of the data subject, regarding existing services or promotions.
  • Lawfulness of Processing: Consent given by the data subjects via the forms provided for such purposes.
  • Type of personal data: Identifying, professional, and contact data necessary to send you the newsletter.
  • Source of personal data: They are provided directly by the website user in the newsletter subscription forms included on the website.
  • Category of data subjects: Website users who subscribe to the newsletters.
  • Retention periods: The time necessary to fulfil the purpose described in each processing activity. You will always find a direct means to manage your consent and unsubscribe within our mailings.

 

• COMMERCIAL COMMUNICATIONS
  • Purpose of Processing: To allow the entity to send general and commercial information to the person requesting it.
  • Lawfulness of Processing: Consent given by the data subjects via the forms provided for such purposes.
  • Type of personal data: Identifying, professional, and contact data necessary for sending information.
  • Source of personal data: They are provided directly by the website user in the forms included on the website.
  • Category of data subjects: Website users.
  • Retention periods: The time necessary to fulfil the purpose described in each processing activity. In any case, for as long as the consent has not been withdrawn by the user.

 

• JOB APPLICATIONS
  • Purpose of Processing: To allow management of job applications and personnel selection processes.
  • Lawfulness of Processing: Consent given by the data subjects.
  • Type of personal data: Identifying, professional, and contact data necessary for sending information.
  • Source of personal data: They are provided directly by the website user in the forms included on the website.
  • Category of data subjects: Job applicants.
  • Retention periods: The time necessary to fulfil the purpose described in each processing activity. In any case, it may not exceed one year from when consent for its processing was given.

 

• RENTER REGISTRATION
  • Purpose of Processing: To manage the vehicle rental and to comply with Spanish state security regulations.
  • Lawfulness of Processing: Performance of a contract to which the data subject is a party (Art. 6 b) GDPR) and legal obligation applicable to the data controller (Art. 6 c) GDPR).
  • Type of personal data: Identifying, professional, and contact data necessary for sending information.
  • Source of personal data: They are provided directly by the website user in the forms included on the website.
  • Category of data subjects: Job applicants.
  • Retention periods: The data will be retained for the legal periods necessary to comply with the entity's legal obligations.
  • The data will be transferred to the State Security Forces and Corps: Royal Decree 933/2021, of 26 October.
  • You can consult the original text of the aforementioned Royal Decree and the mandatory data according to RD 933/2021, Annex II, point 2, via the following link: https://www.boe.es/diario_boe/txt.php?lang=en&id=BOE-A-2021-17461

 

• TOPCAR RAC S.L. WHISTLEBLOWING CHANNEL
  • Purpose of Processing: Processing of received communications and, where appropriate, investigating the reported events.
  • Lawfulness of Processing: Legal obligation applicable to the data controller (Art. 6 c) GDPR). Organic Law 10/1995, of 23 November, on the Criminal Code, Law 2/2023, of 20 February, regulating the protection of persons who report on regulatory infringements and the fight against corruption. 6.1 a) User consent in the case of images and audio.
  • Type of personal data: Identifying, professional, and contact data that has been provided by the user.
  • Source of personal data: They are provided directly by the user in the channel itself.
  • Category of data subjects: Natural or legal persons who use the whistleblowing channel.
  • Retention periods: Data will be retained for the time necessary to fulfil the purpose for which it was collected and to determine any possible liabilities that may arise from said purpose and the processing of the data. The data included in the Whistleblowing Channel will be retained in accordance with Organic Law 3/2018, on Data Protection and Guarantee of Digital Rights, Organic Law 10/1995, of 23 November, on the Criminal Code, and Law 2/2023, of 20 February, regulating the protection of persons who report on regulatory infringements and the fight against corruption.

 

• MARKETING SERVICES
  • Purpose of Processing: Optimisation of advertisements according to their target audience (techniques such as hashing are used to allow your personal data to be matched with an existing customer database and thus prevent it from being used for any other purpose).
  • Lawfulness of Processing: Legitimate interest of the Data Controller, as the owner and responsible party for its website, to enable the analysis and optimisation of the user experience.
  • Type of personal data: Limited personal data and email address (in any case, this is always hashed, complying with all security guarantees).
  • Source of personal data: Personal data provided by customers directly while browsing the website, by filling in subscription, contact or booking forms, and even retrieved from the TopCar S.L. system, if the customer logs in and has previously had a contract with the data controller.
  • Category of data subjects: Website users.
  • Retention periods: Data will be retained for the time necessary to fulfil the purpose for which they were collected.

 

RECIPIENTS TO WHOM YOUR DATA WILL BE DISCLOSED:

As a general rule, TOPCAR RAC S.L informs users that their personal data will not be transferred to third-party organisations, except where such a data transfer is supported by a legal obligation or when the provision of a service implies the need for a contractual relationship with a data processor.

Based on the above, the Data Controller may use authorised subcontractors acting on behalf and in the name of TopCar RAC S.L., as processors and contractually bound by the instructions established in said contracts, solely for the lawful purposes described and for the period of time strictly necessary to do so.

Likewise, to the extent strictly necessary to fulfil the purposes stated, personal data may be shared with other companies or entities belonging to or associated with us, for processing under their responsibility and always for the same purposes informed in this Policy.

Furthermore, in the event of a legal obligation or requirement to do so, we may disclose your data to the competent public authorities in accordance with said legal obligation or requirement.

International data transfers are not envisaged. If this should occur for any reason in the future, and the data processors or recipients are located or process your data outside the European Economic Area (EEA), an international transfer of your data will be taking place in accordance with data protection regulations.

As a general rule, we will seek to avoid carrying out international data transfers, ensuring that data is processed within the European Economic Area.

However, in those cases where it is essential to carry out such transfers, the appropriate organisational, technical, and contractual measures will be implemented to ensure the protection and confidentiality of the personal information.

Such measures may include, but are not limited to, the formalisation with the sub-processor or third-party recipient of the Standard Contractual Clauses approved by the European Commission, the preparation of impact assessments regarding the international transfer to evaluate risks and adopt mitigation mechanisms, the encryption of data both in transit and at rest, the pseudonymisation of the transferred information, as well as the possibility for the data subject to take direct action for damages against the sub-processor or third-party recipient, among others.

 

YOUR RIGHTS WHEN YOU PROVIDE US WITH YOUR DATA:

In accordance with the provisions of the applicable regulations, TOPCAR RAC S.L informs the client that they have the following rights derived from the applicable regulations:

• Right of Access: Allows the data subject to obtain information as to whether or not TOPCAR RAC S.L is processing personal data concerning them and, if so, the right to obtain information about their personal data undergoing processing.
• Right to Rectification: Allows for the correction of errors and the modification of data that proves to be inaccurate or incomplete.
• Right to Erasure (Right to be Forgotten): Allows data to be deleted and to no longer be processed by TOPCAR RAC S.L, unless there is a legal obligation to retain it and/or other legitimate grounds for its processing by TOPCAR RAC S.L do not prevail; for example, when the personal data is no longer necessary in relation to the purposes for which it was collected, the client may request that we erase that data without undue delay.
• Right to Restriction of Processing: Under the conditions established by law, this allows the processing of data to be halted, so that TOPCAR RAC S.L will avoid processing it in the future, and will only retain it for the exercise or defence of legal claims.
• Right to Object: In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. TOPCAR RAC S.L will cease to process the data, except for compelling legitimate grounds, or the exercise or defence of possible claims.
• Right to Data Portability: Allows the data subject to receive the personal data concerning them, which they have provided to TOPCAR RAC S.L, and to transmit it directly to another controller in a structured, commonly used, and machine-readable format. To exercise this right, the client must provide a valid e-mail address.

 

HOW TO EXERCISE YOUR RIGHTS:

You may submit a request to exercise your rights to TOPCAR RAC S.L or directly to the Data Protection Officer specified below.

Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

In certain circumstances, data subjects may request the restriction of the processing of their data, may object to the processing of their data, and may exercise the right to data portability.

To exercise these rights, you may send a written communication to the following addresses: Postal address: C/ Los Peregrinos, 29, Urbanización Industrial El Goro 35200 Telde - Gran Canaria - Las Palmas, Spain, or to the e-mail address: rgpd@topcar.es. In both cases, you must provide: your name and surname, and you must prove your identity with a copy of your DNI (National ID) or passport, indicating the right you are requesting, the reasons alleged, and any corresponding supporting documents.

Likewise, all data subjects shall have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos). The exercise of these rights is free of charge.

 

TopCar RAC S.L. Data Protection Officer

The Data Protection Officer is responsible for protecting the fundamental right to the protection of personal data at TopCar RAC S.L and is in charge of compliance with data protection regulations.

Privacy management is coordinated by the Data Protection Officer and is carried out in accordance with the principles relating to the processing of data set out in Article 5 of the GDPR, which establishes that data shall be:

• Processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency").
• Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation").
• Accurate and, where necessary, kept up to date ("accuracy").Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ("storage limitation").
• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ("integrity and confidentiality").

Please note that if you consider that TopCar RAC S.L has not processed your personal data in accordance with the regulations and/or you wish to submit a request to exercise your data protection rights, such as access, rectification of data, erasure, restriction, objection to processing, as well as the right to data portability, you may do so by contacting TopCar RAC S.L Data Protection Officer (DPO) by written communication to the following addresses: postal address: Calle Vitoria N.º 13, 2º izquierda, 09004, Burgos, Spain, or to the e-mail address: dpd@auditoriaycertificacion.com. In both cases, you must provide: your full name and surname, and you must prove your identity with a copy of your DNI (National ID) or passport, indicating the right you are requesting, the reasons alleged, and any corresponding supporting documents.

Likewise, all data subjects shall have the right to lodge a complaint with the Spanish Data Protection Agency. The exercise of these rights is free of charge, by written communication to the following postal address: Calle Jorge Juan N.º 6, 28001, Madrid, Spain.

You may also be interested in our:

• Cookie Policy

Important note: In the event of any discrepancies or disputes arising from the interpretation of these policies, only the Spanish version shall be legally binding and prevail.