Security and data protection

1. Data protection information

Sunny Cars GmbH appreciates your interest in our company and our services/products.

The following data protection information aims to inform you about which personal data we collect, process and, if applicable, share with our partners when you visit our website and for the services and offers accessible via the website, to what extent and for what purpose.

Insofar as this website refers to external pages of other providers (links), you are leaving our website via these links. The operators of these linked sites are solely responsible for compliance with data protection regulations.

2. Data protection principles of Sunny Cars GmbH

The protection of your privacy and the security of all business data are very important to us, and we take this into account in our business processes. Data protection and information security are part of our corporate policy.

We attach great importance to protecting your personal data and process it exclusively in accordance with the laws and regulations of the Federal Republic of Germany and overriding European legal requirements, including the EU General Data Protection Regulation (GDPR) and other applicable national laws. Your personal data will be processed to the extent described below for the purposes explained. This means that we only use your personal data if this is expressly permitted by data protection laws or if you have given us your express prior consent.

3. Data security

Sunny Cars takes technical and organizational security measures to protect your data that we manage against manipulation, loss, destruction, or access by unauthorized persons or unauthorized disclosure. This includes ensuring that only authorized persons have access to your personal data, and only to the extent necessary for the purposes stated. Our security measures are regularly reviewed and constantly improved in line with technological developments.

Our employees are obliged to maintain confidentiality and receive regular training on data protection and security issues.

4. Definitions

The EU General Data Protection Regulation uses certain terms that are defined in Article 4, e.g., personal data, processing, pseudonymization, controller, processor, recipient, third party, consent.

personal data

means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

processing

means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

profiling

means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

pseudonymisation

means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

controller

means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

processor

means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

recipient

means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

third party

means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

consent

of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

5. Name and contact details of the controller

The controller within the meaning of the GDPR is:

Sunny Cars GmbH Paul-Gerhardt-Allee 42 81245 Munich Germany

Phone: +49 89 - 82 99 33 900 (central contact) Fax: +49 (0) 89 - 82 99 33 66 Email: info@sunnycars.de Website: www.sunnycars.de (http://www.sunnycars.de/)

For questions regarding data protection and to assert your rights as a data subject, please contact our data protection team. Email: datenschutz@sunnycars.de

This privacy information applies to additional domains operated by the controller: www.sunnycars.jobs (http://www.sunnycars.jobs/) www.sunnycars.com (http://www.sunnycars.com/)

6. Name and contact details of the data protection officer

The data protection officer of the controller is:

Dr. Eddie Kohfeldt Paul-Gerhardt-Allee 42 81245 Munich Germany Email: DPO@sunnycars.de

7. General information on the processing of personal data

7.1 Scope of processing

We process personal data to provide a website with various content and functions and to offer, provide, and bill our business services and products.

7.2 Purposes of the processing

The purposes of the processing of personal data are based on the business operations of Sunny Cars GmbH and all associated ancillary businesses.

7.3 Legal basis for the processing

Personal data is processed based on the currently applicable legal principles.

• The legal basis for the processing of personal data necessary for the performance of a contract to which the data subject is party is Article 6(1)(b) GDPR. This also applies to processing operations that are necessary for the performance of pre-contractual measures. • If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights, and freedoms of the data subject do not outweigh the former interest, Article 6(1)(f) GDPR is the legal basis for the processing. • Insofar as we obtain the consent of the data subject for the processing of personal data, Article 6 (1)(a) GDPR or Article 9 (2)(a) GDPR (for special categories of personal data) is the legal basis. • If the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Article 6 (1)(c) GDPR is the legal basis. • If data is transferred to third countries, this is done either based on an adequacy decision of the European Union (Article 45 GDPR), based on suitable guarantees (Article 46 GDPR) or based on Article 49 (1)(b) if this is necessary for the fulfillment of the contract.

7.4 Legal or contractual provisions for the provision of personal data

The provision of personal data by you may be required by law or contract, or may be necessary for the conclusion of a contract.

You may be obliged to provide us with personal data for the conclusion of contracts. Failure to provide personal data would mean that the contract cannot be concluded with you.

7.5 Disclosure of personal data

We only pass on your personal data to third parties if

• this is necessary for the initiation or execution of an existing contractual relationship with you; • it is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of you (the data subject), which require protection of personal data; • we are legally obliged to do so; • this is necessary to enforce our claims and rights; • we receive requests from official bodies (e.g., supervisory authorities or law enforcement authorities, if the disclosure is necessary to prevent threats to public safety and order and to prosecute criminal offenses); • you have given us your consent to do so.

In the context of such a transfer, the personal data may only be used by the recipients for the respective purpose.

7.6 Integration of external service providers

We are not specialists in everything. That is why we use service providers to support us in some areas of our business activities, e.g.

• Data centers and cloud providers for the secure operation of our services • IT developers for the further development of our applications • IT service provider for the maintenance of our infrastructure • IT service provider for business applications (ERP, CRM, AI applications) • Service providers for specific applications used on our website • Agencies and print shops for sending emails or printed information

We have concluded the contracts for order processing required by law. These specifically define what the service provider may do with which data. In particular, the use of the data for the service provider's own purposes and disclosure to third parties are excluded. In these contracts, service providers are obliged to comply with the applicable data protection regulations.

7.7 Data erasure and storage duration

Personal data will be deleted or blocked as soon as the storage purpose no longer applies. By way of derogation, data may be stored for longer if this has been provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject (e.g., obligations to provide evidence, retention periods) or if consent has been given.

Data erasure or blocking takes place when a storage period prescribed by the aforementioned standards expires unless there is a justified need for further storage of the data.

8. Details on the processing of personal data

8.1. Provision of the website and creation of log files

8.1.1 Description and scope of data processing

When you visit our website, data is collected from the web server for the transfer of data (information from the computer system of the requesting computer) and sometimes stored in log files on the web server. These files give information on the end device and browser used, the time of access, the referrer, and the quantity of data transferred, for example.

The following data is collected in this way:

• Document requested (URL) • Quantity of data requested • Status of the request (success/error) • Information on the browser type and version used • User’s IP address • User’s operating system • Referring URL, known as the referrer (optional) • Date and time of access • Websites from which the user’s system reaches our website • Websites by the user’s system via our website

The data is stored in our system’s log files. This data is not stored together with the user’s other personal data.

8.1.2 Legal basis for data processing

The legal basis for the temporary storage of the data and log files is Article 6(1)(f) GDPR. Our legitimate interests in processing lie in providing a functional and appealing website and in ensuring the security of our systems.

8.1.3 Purpose of data processing

It is necessary for the system to store the IP address temporarily to enable the website to be sent to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session.

We store data in log files to ensure the functionality of the website. We also use the data to optimize the website and to ensure the security of our IT systems. We do not analyze the data for marketing purposes as part of this.

8.1.4 Duration of storage

The data will be erased as soon as it is no longer required to achieve the purpose of its collection. When data is collected to operate a website, this is the case when the relevant session ends.

When data is stored in log files, this is the case after ninety days at the latest. Extended storage is possible. In this case, users’ IP addresses will be erased or distorted so that assignment to the requesting client is no longer possible.

8.1.5 Right to object and right to rectification

Recording data to operate the website and storing the data in log files is essential for running the website. Therefore, the user does not have any right to object.

8.2 Use of cookies and similar technologies

We use cookies on our website to make visiting our website attractive and to enable the use of certain functions. Cookies allow user interactions and other useful functions when using websites. Cookies do not damage your computer and do not contain viruses.

Cookies are small text files that are stored on the user's device when a website is accessed. For example, this enables the website to anonymously identify the browser when it is accessed again.

8.2.1 Description and scope of data processing

We use both temporary cookies, which are automatically deleted when you close your browser, and what are known as "persistent" (permanent) cookies, which expire at a future time set for your convenience. Cookies can be provided by us or by third-party providers.

The data collected in this way is pseudonymized. It is therefore not possible to assign the data directly to the user accessing the website. The data is not stored together with other personal data of the user.

When you visit our website, an integrated application (consent tool) provides you with full information on the cookies used and the option of preventing the use of cookies by opting out or consenting to their use by opting in.

It is important to distinguish between essential cookies, which are necessary for the operation of the website, and do not require consent, and cookies that require consent, e.g., for statistics, analysis, and marketing.

Details and setting options for the cookies used and other technologies can be found in our Consent Tool.

8.2.2 Legal basis for data processing

The legal basis for the processing of personal data using

• essential cookies is Article (6)(1)(f) GDPR in conjunction with §25 (2)(2) TDDDG or Article (6)(1)(c) (compliance with legal obligations). Our legitimate interests consist of providing a functional and user-friendly website with various functions. • cookies that are necessary for the functionality of the website in relation to (pre-)contractual measures (e.g., when using a shopping cart function) is Article (6)(1)(b) GDPR. • analysis and marketing cookies is based on the existence of the user's consent in accordance with Article 6 (1)(a) GDPR (consent) in conjunction with §25(1) TDDDG.

8.2.3 Purpose of data processing

The purpose of using essential cookies is to ensure the functionality of our websites in terms of display and navigation, and to enable access to protected areas of the website. Visitor consent is not required here. The website cannot function properly without this type of cookie.

Functional, analytical, and marketing cookies are used to improve the quality and content of our website and to provide you with personalized content and offers. The cookies enable us to find out how the website is used to constantly optimize our offer. These cookies are only activated if you give us your consent to do so.

8.2.4 Duration of storage

Cookies are stored on the user's computer and transmitted by it to our website. "Session cookies" are automatically deleted at the end of each visit. Other cookies remain stored on your end device until a defined storage period has expired or you delete them.

The storage times of individual cookies can be found in the details of the consent tool.

8.2.5 Possibility of objection and removal

You have full control over the use of cookies. If you deactivate cookies for our website, you may no longer be able to use all functions of the website to their full extent.

Global cookie settings

You can deactivate or restrict the transmission of cookies in your Internet browser. Cookies that have already been saved can be deleted at any time. Many third-party applications that use cookies offer deactivation functions in which deactivation cookies are set. Do not delete these opt-out cookies, otherwise the deactivation will not be active. If you have deleted all your cookies in the browser, you must set the respective deactivation cookie again the next time you visit our site.

Differentiated cookie settings

In our Consent Tool, you can obtain further information on the functions and providers of the cookies and technologies we use on our website, view your current settings, and configure the use of cookies.

8.3 Contact forms and email contact

8.3.1 Description and scope of data processing

Communication via contact form

There are contact forms on our website that can be used to contact us electronically. The data entered in the forms is transmitted to us securely. The data is processed exclusively for the purpose of handling your inquiry.

Mandatory fields required for processing are marked with * in the forms.

Option 1: General inquiry, complaint

To process a general inquiry or complaint, we require the following information:

• Personal details • Contact details • Booking details • Your experiences, the reason for the complaint • Reimbursement details, if applicable • Content of the message (your message to us) • If applicable, various documents related to the vehicle rental, e.g.:    • Local rental agreement (main rental agreement)    • Credit card billing    • Pictures

Option 2: Damage report

To process a claim, we require the following information:

• Personal details • Contact details • Booking details • Reimbursement details, if applicable • Damage description • Various documents:    • Local rental agreement (main rental agreement)    • Damage report of the lessor    • Police report    • Final invoice from the local rental car partner    • Proof of paymen

The following data is also stored when messages are sent via the contact forms:

• Web server log file

Communication by email

Alternatively, it is possible to contact us via the email address provided. In this case, the user's personal data transmitted with the email will be stored.

• Email address • Content of the message • Signature showing:    • First and last name    • Address    • Phone number    • Company, if applicable

The following data is also stored when the message is sent:

• Date and time the email was sent • Message ID and transmitting mail server

The data will be processed exclusively for the purpose of handling your request. This processing includes the classification of incoming emails by an AI system to forward your request to the specialized department for the request.

Please note: Communication via email can have security gaps. For example, emails could be intercepted and viewed by unauthorized persons on their way through the Internet. If we receive an email from you, we assume that we are authorized to reply by email. Otherwise, we must expressly refer you to another form of communication.

8.3.2 Legal basis for data processing

The legal basis for the processing of data transmitted while using the contact forms or the sending of an email may be Article 6(1)(b) GDPR or Article 6(1)(f) GDPR, depending on the content. Classification by an AI system is carried out based on Article 6(1)(f) GDPR. Our legitimate interests consist of a personalized, fast, and high-quality processing of the request by our customer service.

8.3.3 Purpose of data processing

The processing of the transmitted personal data allows us to process the request.

The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

8.3.4 Duration of storage

The data entered in the various contact forms or sent by email will be deleted depending on the fulfillment of the purpose, unless there are legal grounds (retention periods, verifiability) to the contrary.

8.3.5 Right to object and right to rectification

You have the option to object to the processing and storage of your personal data at any time. Depending on the legal basis of the processing for the various contact options, the data will be deleted or blocked if no further use of the data is necessary to clarify the request and there are no legal grounds (retention periods, verifiability) to the contrary.

8.4 Contact by phone

8.4.1 Description and scope of data processing

A service phone number is provided on our website, which can be used to contact our Customer Service team by phone. Here you can make general inquiries, raise complaints, report damage, or request a quote for a rental car reservation.

The date and time, and the call partner are always saved.

Depending on the type of request, the information is transferred to our customer database.

Option 1: General inquiry, complaint

To process a general inquiry or complaint, we require the following information:

• Personal details • Contact details • Booking details • Your experiences, the reason for the complaint • Reimbursement details, if applicable • Content of the message to us • If applicable, various documents related to the vehicle rental, e.g.:    • Local rental agreement (main rental agreement)    • Credit card statement    • Images

Option 2: Damage report

To process a claim, we require the following information:

• Personal details • Contact details • Booking details • Reimbursement details, if applicable • Damage description • Various documents:    • Local rental agreement (main rental agreement)    • Damage report of the lessor    • Police report    • Final invoice from the local rental car partner    • Proof of payment

Option 3: Rental car offer

To send you a rental car offer, we need:

• Rental location • Pick-up date and time • Delivery date and time • Desired vehicle category • If applicable for sending the offer:    • First and last name    • Email address

Option 4: Car rental reservation

To be able to make a rental car reservation, we need:

• Rental location • Pick-up date and time • Delivery date and time • Desired vehicle category • To complete the booking:    • First and last name    • Email address    • Phone number    • Date of birth, if applicable

Option 5: Sending documents via Call BOT

For our automated call answering system (Call BOT) to send your rental car documents and/or invoice, we need:

• Booking number

Phone call recording

We occasionally record phone conversations for quality assurance and training purposes. If this happens, the consent of the person concerned is always obtained before the actual conversation begins. If this consent is not given, the content of the conversation will not be recorded.

The evaluation of an interview only takes place between the team leader/trainer and the employee who conducted the interview.

8.4.2 Legal basis for data processing

The processing of data to obtain a quote, to book a rental car, to send rental car documents, or to process damage reports and complaints serves to initiate or fulfill the contract in accordance with Article 6 (1)(b) GDPR.

Depending on the content of the conversation, the legal basis for the processing of data as part of a "general inquiry" may be Article 6 (1)(b) or Article 6 (1)(f) GDPR. Insofar as Article 6 (1)(f) f GDPR is the legal basis, our legitimate interest in processing the data lies in comprehensive personal customer service.

Your personal data from recorded phone conversations is processed based on your consent. The legal basis is Article 6 (1)(a) GDPR.

8.4.3 Purpose of data processing

The processing of the transmitted personal data allows us to process the request.

The recording of phone conversations serves the purpose of improving our service quality and ensuring the quality of customer and prospective customer support.

8.4.4 Duration of storage

Depending on the options specified, the data stored will be deleted after the purpose has ceased to exist, unless there are legal grounds (retention periods, verifiability) to the contrary.

Recordings of phone conversations are deleted after the end of the training activity if this is before the end of 4 weeks. If an evaluation does not take place within four weeks, the recordings are automatically deleted after this time.

If consent is withdrawn, the recordings will be deleted immediately.

8.4.5 Right to object and right to rectification

You have the option to object to the processing and storage of your personal data at any time. Depending on the legal basis of the processing, the data will be deleted or blocked if no further use of the data is necessary and there are no legal grounds (retention periods, verifiability) to the contrary.

You can revoke your consent to the recording of phone conversations at any time.

8.5 Subscription to our newsletter

8.5.1 Description and scope of data processing

On our website, you have the option to subscribe to a free email newsletter. The data obtained during registration will be transmitted to us and processed.

Mandatory field for registration:

• Email address

The following data is also stored at the time of registration:

• Subscriber ID • IP address of the user • Source of the registration • Date and time of registration • Date and time of the double opt-in consent • Registration text (consent text) • Status of the subscription

When unsubscribing

• Date of unsubscription

Newsletter tracking

Tracking pixels are integrated into our email newsletters. This enables us to statistically evaluate the success or failure of our advertising measures. With the help of the tracking pixel, we can recognize whether and when an email was opened and which links in the email were clicked.

The following usage data is stored:

• Date of last sending • Time of opening the email • Last click on a link • Conversion • IP address

The data is used exclusively for sending and statistically analyzing the newsletter. The newsletter is sent by a service provider who is obliged to comply with the specified data security measures.

As part of the registration process, your consent to the processing of the data is obtained via the double opt-in procedure, and reference is made to this privacy policy

8.5.2 Legal basis for data processing

The legal basis for the processing of data after you register for the newsletter is Article 6(1)(a) GDPR (consent).

The legal basis for the processing of additional data is Article 5(2) GDPR (verifiability of the active and explicit consent of the recipients).

The legal basis for the processing of tracking-related data is Article 6(1)(a) GDPR in conjunction with § 25 TDDDG.

8.5.3 Purpose of data processing

The purpose of processing the user's email address is to deliver the newsletter. The other data stored as part of the registration process is used to verify the consent given and to prevent misuse of the services or the email address used.

The personal data collected via tracking pixels is statistically evaluated to optimize the newsletter sending process and to adapt the content of future newsletters even better to your interests.

8.5.4 Duration of storage

Once consent has been withdrawn, the data will be deleted unless it needs to be retained for verification purposes. Email addresses are stored as blocked data in the system in a block list that cannot be viewed by us for verification purposes.

8.5.5 Right to object and right to rectification

You can unsubscribe from the newsletter at any time. For this purpose, there is a corresponding link in every newsletter.

8.6 Comment function in the Sunny Blog

8.6.1 Description and scope of data processing

We operate a public blog on our website with articles on various topics. Readers can leave comments on individual blog posts.

The following data is collected as part of a commentary:

Mandatory information

• Pseudonym (specified user name) • Email address

Further data

• Comment content • Date and time of the comment • IP address of the user

For publication

• User name • Comment content • Date and time of the comment

Email addresses are used to contact the commenter and are not published.

Sunny Cars reserves the right to delete comments based on their content. There is no right to publish a comment that has been entered.

8.6.2 Legal basis for data processing

The legal basis for the processing of the data processed while commenting and publishing the comment is Article 6(1)(a) GDPR.

The IP address, as well as the date and time, are stored based on Article 6(1)(f) GDPR. Our legitimate interests lie in providing the comment function and preventing misuse of the service.

8.6.3 Purpose of data processing

The purpose is to give readers an opportunity to comment on posts in our blog.

8.6.4 Duration of storage

Data will be deleted or blocked as soon as the purpose of the storage, specifically the display of the comment, no longer applies or the consent to the publication of the comment is withdrawn.

The IP address collected in the context of a comment is generally deleted after a period of 60 days unless it needs to be retained for verification purposes.

8.6.5 Right to object and right to rectification

Consent to the publication of the comment can be withdrawn at any time, and the deletion of the comment can be requested. To do so, please send an email to datenschutz@sunnycars.de.

Sunny Cars reserves the right to request additional information to uniquely identify the requester before executing a deletion request.

8.7 Use of the chat function

8.7.1 Description and scope of data processing

On our website, we offer the option of contacting us via chat. Users are connected directly to our customer service team and can discuss their concerns in writing in real time.

The following data is collected when you use the chat:

• Content of chat communication • IP address • Date and time of the chat communication

Further optional data:

• Email address • First and/or last name

Email addresses are used to contact the chat user by email. We can use the name to personalize the communication.

8.7.2 Legal basis for data processing

The legal basis for the processing of personal data entered and processed in the chat is Article 6(1)(a) GDPR

The IP address and the date and time are stored based on Article 6(1)(f) GDPR. Our legitimate interests lie in providing the comment function and preventing misuse of the service.

8.7.3 Purpose of data processing

The purpose is to provide our customers with a chat service to answer their queries.

8.7.4 Duration of storage

Chat data will be deleted after 60 days or if consent is withdrawn by the user, provided that there are no legal grounds to prevent deletion (retention periods, verifiability).

The IP address collected as part of the communication is deleted after a period of 60 days unless it needs to be retained for verification purposes.

8.7.5 Right to object and right to rectification

Consent can be withdrawn at any time, and the deletion of data from communications can be requested. To do so, please send an email to datenschutz@sunnycars.de.

Sunny Cars reserves the right to request additional information to uniquely identify the requester before executing a deletion request.

8.8 Use of the booking and reservation system

8.8.1 Description and scope of data processing

Sunny Cars operates an online booking and reservation system for the brokerage of rental car reservations.

Your personal data is collected and processed if you provide it yourself, e.g., when booking a hire car. This can be done directly by you on our website or by a Sunny Cars partner (travel office, agency) with the data you provide there. For standard bookings, we send your name, the vehicle class, the time of collection and return, and, if applicable, the flight number to the local fleet providers. Your data is transmitted securely using SSL encryption.

The data collected when a booking is made is stored as inventory data in a customer account in our customer database and used for the rental car reservation, services, and to manage the customer relationship.

The following personal data is collected as part of the booking process:

Rental car reservation

• Rental location • Place of vehicle pick-up/return • Time of collection and return • Vehicle class

Personal information of the booker (self-driver) or the other main driver

• Booker:    • Salutation, title if applicable    • First and last name    • Age (if self-driver)    • Mobile phone number    • Address (street, house number, zip code, town, country)    • Email address    • Payment method, payment data, if online payment is used after the booking process • Other main driver (if option selected):    • Salutation    • First and last name    • Age    • Mobile phone number

Optionally, the following data can be entered:

• Flight data (flight number)

The following data is also stored at the time of ordering via the booking portal:

• Booking number, customer number • Price of rental car • Optional: Intermediary agency • Date and time of booking • IP address of the user

With booked services online check-in, fast lane, young car, and no deposit:

If you select this extended service offering, we will also collect and process the following data that you provide during the preliminary online registration process:

• Date of birth • Place of birth • Driver's license data:    • Driver's license number    • Country of issue    • Date of issue    • Issued by • ID document data:    • ID document number    • Country of issue    • Date of issue    • Issued by    • Valid until • Mobile number (e.g., for delivery of the rental car to the hotel) • Lodging in the destination area

When using these services, all the data that you usually provide to the local fleet provider is encrypted and transmitted to them in advance.

We would like to point out that the data may be transferred to insecure third countries where an adequate level of data protection cannot be guaranteed. Our local partners have made a commitment to us to use the data only for the agreed purpose.

8.8.2 Legal basis for data processing

The processing of your data serves the fulfillment of a contract to which you are a party or the implementation of pre-contractual measures. The legal basis for the processing of the data is Article 6(1)(b) GDPR.

The transfer of data to a third country that does not have the necessary data protection standards for such transfers is based on Article 49 (1)(b) GDPR—exceptions for particular cases, i.e., the transmission is necessary for the fulfillment of a contract between the data subject and the controller or for the implementation of pre-contractual measures at the request of the data subject.

If your data is used for direct advertising, the legal basis is Article 6(1)(f) GDPR. The starting point for the balancing decision to be made for the sending of direct advertising is recital 47 GDPR, which, among other things, states "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

We carry out statistical evaluations and analyses based on Article 6(1)(f) GDPR. Our legitimate interest lies in optimizing our marketing measures and our range of services.

The legal basis for legally required data transmission and longer-term storage for evidence and retention purposes, as required by law, is Article 6(1)(c) GDPR.

8.8.3 Purpose of data processing

The primary purpose of processing the data provided by you is to fulfill a contract with you or to carry out pre-contractual measures to reserve you a rental car and provide it at the place of acceptance.

Further purposes are compliance with legal requirements and the improvement of our services through statistical analysis and optimization of our marketing measures.

Online check-in / Fastlane / Young car:

The purpose of processing the additional data provided by you is the fulfillment of a contract concluded with you for the use of our extended service offers.

No deposit:

The purpose of processing the additional data collected is to provide a rental car without you having to leave a deposit with the vehicle fleet provider on site.

8.8.4 Duration of storage

Existing customer data is stored for the duration of the contractual relationship. If the personal data is no longer required to achieve the purpose for which it was collected, it will be deleted. Even after the conclusion of the contractual relationship, it may be necessary to store personal data of the contractual partner to comply with contractual or legal obligations (e.g., retention and verification obligations).

Online check-in / Fast lane / Young car / No deposit:

The registration data is stored for 365 days after the vehicle is returned and then deleted. The user may agree to permanent storage by registering for a My Sunny account. In this case, the data will be stored until revoked.

8.8.5 Right to object and right to rectification

During the period in which you are listed as an existing customer, you have the right to have data deleted that is not subject to a statutory retention period.

If the data is required to fulfill a contract or to carry out pre-contractual measures, premature deletion of the data in the customer account is only possible insofar as contractual or legal obligations do not prevent deletion.

You can object to the sending of direct advertising at any time based on Article 21(1) GDPR.

8.9 Creation and use of a My Sunny account

8.9.1 Description and scope of data processing

On our website, we offer users the opportunity to register for a My Sunny Account by providing personal data. Registration can be done directly on the Sunny Cars website via "My Sunny Login" or during the booking process.

The data entered on our website for registration is transmitted to us securely and stored.

The following data is collected as part of the registration process:

Mandatory fields:

• Email address • Password • Salutation (gender) • First and last name • Cell phone number • Date of birth

Optional fields:

• Address (street and house number, zip code, and town) • Country • Company information:    • Company name    • Sales tax identification number

As part of the registration process, the user's consent to the processing of this data is obtained via the double opt-in procedure.

In your My Sunny account, you can edit your profile, make a new booking, edit current bookings, and view your previous bookings and recent searches.

8.9.2 Legal basis for data processing

The legal basis for the processing of the data is the user's consent in accordance with Article 6(1)(a) GDPR. For personal data of current bookings, the legal basis is Article 6(1)(b) GDPR.

8.9.3 Purpose of data processing

The My Sunny account enables the user to book a rental car more quickly and easily and to process current bookings online. A further purpose is the provision of certain services requested by the customer and additional services, such as the online check-n service.

8.9.4 Duration of storage

The data stored in the My Sunny account will be deleted if the registration is canceled by the user, provided that there are no legal grounds to prevent deletion (retention periods, verifiability).

8.9.5 Right to object and right to rectification

As a user, you have the option at any time to change or delete the data stored about you in the My Sunny account yourself, or to have it changed or deleted.

To delete yourself, log in to your profile, go to "Edit profile" and then select "Delete account".

8.10 Use of My Sunny Ride

8.10.1 Description and scope of data processing

When you book a rental car with Sunny Cars, you can receive additional services in connection with your booking via My Sunny Ride.

Services:

• Display of car rental booking, including pick-up and drop-off location, booking details • Information about the destination including a map display with Points of Interest (POI), filter option by category (e.g., sights, restaurants, beaches, etc.) • Saving of the selected POI favorites, possible navigation via the proprietary map program of the smartphone (e.g., Google Maps), and search for a parking space • Smart Delay Service in the event of flight delays • 1 GB data volume through eSim

The services are available from the time the voucher is sent until the return date of the rental car.

My Sunny Ride can be accessed via a link or with a QR code on smartphones, tablets, laptops, and desktops. The access data (link, QR code) is indicated on the rental car voucher.

My Sunny Ride offers the above-mentioned functions within the website accessed. Installation on the end device is the most convenient way of access, but it is not mandatory. You can also log in via the link/QR code from the voucher/email.

The processing includes the categories of data mentioned below:

Personal data:

• Name • Address (holiday address if applicable) • Age, if applicable, if necessary for any services

Contact details:

• Telephone number • Email address

Car rental booking data:

• Driver name • Pick-up place/date/time • Drop-off place/date/time • Vehicle class • Reservation number • If applicable, also the person who booked (if not booked by the driver), in case of booking via a travel agent, also provide this information.

Language data:

• Selected language • Contents of telephone conversations

Personalized data: For data protection reasons, personalized data is not stored on Sunny Cars servers but locally on the respective customer device (e.g., smartphone/tablet).

• Points of Interest favorites list

Data stored in the app:

• Reservation number • Validation token

The processing covers the following categories of data subjects:

• Sunny Cars customers with a car rental reservation/active rental • Fellow travelers, if applicable

8.10.2 Legal basis for data processing

The processing of your data serves the fulfilment of a contract to which you are a party or the implementation of pre-contractual measures. The legal basis for the processing of the data is Article 6 (1)(b) GDPR.

The storage of the contents of the telephone calls takes place exclusively with your consent in accordance with Article 6 (1)(a) GDPR.

The legal basis for the processing of technically necessary cookies is Article 6 (1)(f) GDPR (legitimate interest). If you accept the use of further cookies, your consent according to Article 6 (1)(a) GDPR is the legal basis.

8.10.3 Purpose of data processing

The purpose of the data processing is to offer an optional customer-oriented mobility service around your booking by providing additional services.

8.10.4 Duration of storage

Booking-relevant data:

• as described in the Data Protection Information on using the booking and reservation system

Language data:

• Cookies for storing the language selection expire 30 days after the return date of the rental vehicle.

Personalized data:

• Sunny Cars has no influence on the storage time of the personalized data. The deletion of this data stored on the user's terminal device is the responsibility of the user.

Data stored in the application:

• When you delete the application on your end device, the data stored in it will be deleted. The reservation number and the validation token will continue to be stored by Sunny Cars for 30 days (to enable you to log in again) and then deleted.

8.10.5 Right to object and right to rectification

You can stop using My Sunny Ride at any time. Your data will then be deleted as described under "Duration of storage".

You can adjust the use of cookies via the Consent Management Tool in the app. You can generally object to the setting of cookies via your browser settings. However, switching off all cookies may mean that some functions no longer run correctly.

8.10.6 Name and contact details of the controller

The controller within the meaning of the General Data Protection Regulation is:

Sunny Cars GmbH Paul-Gerhardt-Allee 42 81245 Munich Germany Email: info@sunnycars.de

If you have any questions regarding data protection and to assert your rights as a data subject, please contact our data protection team (datenschutz@sunnycars.de).

Contact Data Protection Officer: Email: DPO@sunnycars.de

8.11 Use of payment services

In addition to the option of payment by bank transfer and direct debit, we offer you the use of payment services on our website for processing online payments. For certain payment methods, you will be redirected to the website of the respective payment service provider as part of the payment process.

The task of the payment service providers is to request the relevant payment system, e.g., credit card or other online payment systems, to authorize the transaction and to send this authorization to your bank for approval. If the bank grants authorization, the payment service provider will be notified by the relevant payment system and will execute the payment to Sunny Cars' bank.

8.11.1 Description and scope of data processing

Payment data corresponding to the selected means of payment and other data required to process the transaction will be transmitted to service providers such as credit card institutions or payment providers for billing purposes or collected directly by them and processed there.

The following personal data is processed when you use our payment services:

• Name and contact details (address, email address, telephone number) • Payment information (credit card information, bank details) • Transaction data (payment purpose, transaction number, date, payment amount, time) • Device information (IP address, device type) • Geolocation data, if applicable

Banks and payment service providers process personal data required for payments and transactions as their own controllers.

Payment and transaction data is transmitted exclusively via an encrypted SSL or TLS connection.

8.11.2 Legal basis for data processing

The processing of your data serves the fulfillment of a contract (Article 6(1)(b) GDPR), the fulfillment of legal obligations (Article 6(1)(c) GDPR), and the protection of our legitimate interests (Article 6(1)(f) GDPR). Our legitimate interests are the prevention of fraud and the safeguarding of network and information security.

8.11.3 Purpose of data processing

The purpose of the processing is to process payments and transactions for an order/booking, to comply with legal obligations, to prevent and combat fraud, and to optimize our payment services.

8.11.4 Data transfer to third parties

We only pass on your personal data to third parties to the extent that this is necessary to fulfill the purposes.

8.11.5 Duration of storage

The data is subject to the statutory retention periods and is then deleted.

8.11.6 Possibility of objection and removal

A revocation for the processing of personal data used for payment does not affect personal data that must be processed, used, or transmitted for contractual payment processing.

8.11.7 Payment methods

Credit card

If you use a credit card for the payment process, the payment will be made via the payment service provider B+S Card Service GmbH, Lyoner Str. 9, 60528 Frankfurt. B+S Card Service accepts payments on behalf of Sunny Cars and transfers the amounts paid by you to us. For this service, B+S Card Service processes your personal data as the data controller.

Sunny Cars does not store any credit card information that you provide to B+S Card Service via the Sunny Cars website.

PayPal

If you use PayPal for the payment process, you will be redirected to the website of the provider. The European provider of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

The data required for payment is subsequently processed by PayPal. The personal data transmitted to PayPal is generally data that is related to the respective order and is necessary for payment processing.

You can find comprehensive information about the handling of your personal data when using the service in the PayPal Privacy Policy (https://www.paypal.com/de/legalhub/paypal/privacy-full?locale.x=en_de).

8.12 Use of third-party extensions

We use third-party extensions on our website, e.g., analysis tools, marketing tools, social media, etc.). Personal data (e.g., IP numbers, information from pseudonymized cookies, geodata, etc.) may be passed on to the third-party providers or transmitted automatically. The type, scope, purpose, and duration of this processing of personal data may vary from case to case. Further information on the individual services can be found in the Usercentrics Consent Management tool under "Services".

The legal basis for the processing of personal data in the case of legitimate interest is Article 6(1)(f) GDPR in conjunction with §25(2) TDDDG. If the user has given consent in accordance with Article 7(1) GDPR, the legal basis for the processing of the data is Article 6(1)(a) GDPR in conjunction with §25 TDDDG, in the case of fulfillment of a legal obligation Article 6(1)(c)(c) GDPR.

Further details and legal bases for the services described below can be found in the Usercentrics Consent Management Tool under “Services”. There you can revoke your consent for all third-party extensions requiring consent at any time with effect for the future.

8.12.1 Consent management

Usercentrics Consent Management

We use the consent management service Usercentrics (https://usercentrics.com/de/), provided by Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany.

The purpose of use is to obtain and manage consent in accordance with Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR for the use of certain cookies and other technologies, and thus for the use of the tools integrated into our website.

By integrating JavaScript code, users are allowed to give their consent for certain cookies and/or other technologies when they access the website via a banner. This means that only those cookies requiring consent are placed on the user's device for which consent has been given.

Log data is processed to be able to provide the legally required proof of your consent and revocation. For this purpose, data is transmitted to Usercentrics' servers and processed there.

The processing is necessary for compliance with a legal obligation (Article 6(1)(c) GDPR).

We have concluded an order processing agreement with Usercentrics in which the company is obliged to protect the personal data of visitors to our website and not to pass it on to third parties. The processing takes place in the European Union.

Your personal data will be deleted after 3 years.

Further information on data protection at Usercentrics can be found at https://usercentrics.com/de/datenschutzerklaerung

Google Tag Manager

Google Tag Manager provides a technical basis for integrating various web applications, including tracking and analysis services, into our online offering and managing them via a standardized user interface. Google Tag Manager does not carry out any independent data analyses and does not store any information on user end devices or read it out. When a user visits our website, the current tag configuration is sent to the user's browser.

Further information on Google Tag Manager can be found at https://www.google.com/intl/de/tagmanager/faq.html and in Google's privacy policy: https://policies.google.com/privacy?hl=de

8.12.2 Analyse und Marketing

Google

We use various services on our website that are provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, California, 94043 USA. The provider, contractual partner, and controller for the European area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

The legal basis for the processing of your data is your consent pursuant to Article 6(1)(a) GDPR in conjunction with §25(1) TDDDG. Details can be found in the Google Consent Mode section.

We have concluded an order processing contract with the provider, which ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties: https://business.safety.google/adsprocessorterms.

If data is transferred to the USA, legal certainty is ensured through certification by Google Inc. for the EU-US Data Privacy Framework, which establishes an appropriate level of protection at Google.

In addition, Google implements the provisions of the EU standard contractual clauses (Article 46(2)(c) and (d) GDPR) and offers additional guarantees to comply with European data protection law.

Google Consent Mode

We use Google Consent Mode V2 for the Google services Google Tag Manager, Google Analytics, and Google Ads (Google Ads Conversion Tracking and Remarketing). The legal basis is the Digital Markets Act (Regulation 2022/1925) of the EU.

Legally valid consent must be obtained from end users for the following purposes:

• Use of cookies or other local storage data where required by law; • Collection, transfer, and use of personal data of target groups for ad personalization.

This requests basic consent not only to data storage, but also to whether the data can be used by Google for personalized marketing purposes, e.g., in the case of remarketing.

Consent management (consent/objection) is carried out via the "Usercentrics" consent management system used on our website.

Google Analytics

This website uses the functions of the web analysis service Google Analytics with server-side tracking. With server-side tracking, user data is not transmitted directly to Google but is first pseudonymized on Pollin's own server in the EU. The IP address is replaced by a separate ID number, which is sent to Google Analytics instead of the user's IP address. This means that only data records that Google cannot assign to individual users are transmitted.

Usage data can be various events. Events make it possible to measure specific interactions or events on a website or in an app (e.g., loading a page, clicking a link, completing a purchase).

No precise location data is provided in Google Analytics. In the case of access originating from the EU, IP address data is only used to derive location data and then deleted immediately. It is not logged, is not accessible, and is not used for other applications.

Google Dynamic Remarketing

This website uses Google's remarketing function. This function is used to present interest-based advertisements to visitors to our website as part of the Google advertising network. With remarketing, our ads are also displayed on other websites on the Internet. Google uses cookies so that our ads can also be shown to you on other websites based on your previous visits to our website. You have the option of deactivating the use of cookies by Google by visiting the page for deactivating Google advertising (https://www.google.com/policies/technologies/ads/).

Google Ads Conversion Tracking

Our websites use the functions of Google Analytics in conjunction with the cross-device functions of Google Ads.

This function makes it possible to link the advertising target groups created with Google Analytics with the cross-device functions of Google Ads. In this way, interest-based, personalized advertising messages that have been adapted to you depending on your previous usage and surfing behavior on one device (e.g., cell phone) can also be displayed on another of your devices (e.g., tablet or PC). Cross-device remarketing, including extended data collection, is only activated if you have given your consent to the linking of browsers and your Google account.

If you have given your consent, Google will link your web and app browsing history to your Google account for this purpose. In this way, the same personalized advertising messages can be displayed on every device on which you sign in with your Google account. To support this function, Google Analytics collects Google-authenticated user IDs that are temporarily linked to our Google Analytics data to define and create target groups for cross-device interest-based advertising.

You can permanently object to cross-device remarketing/targeting by deactivating personalized advertising in your Google account; follow this link to do so: Settings for advertising (https://www.google.com/settings/ads/onweb/). Further information and the data protection provisions can be found in Google's privacy policy under: "Technologies" (https://www.google.com/policies/technologies/ads/).

Further information on usage-based online advertising and online data protection can be found at http://www.youronlinechoices.com/.

Meta Pixel and Facebook Custom Audience

If we receive your consent to do so, we use the analytics tool "Meta Pixel" (formerly Facebook Pixel) from the company "Meta" (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) on our website.

Meta Pixel is used to measure the effectiveness of our Facebook advertising and to optimize target group-specific data from visitors to our website - see https://www.datenschutzexperte.de/blog/datenschutz-im-internet/meta-pixel-dsgvo-ist-das-tracking-per-meta-pixel-datenschutzkonform/.

The personal data collected by Meta cannot be viewed by us. Cookies are also set as part of the use of the Meta Pixel code. If you have a Facebook account and are logged in, these cookies make it possible to assign your visit to our website to your Facebook user account.

We also use Facebook's remarketing function "Custom Audiences". This provides Facebook with the information that you have accessed a specific web page on our website. Subsequently, interest-based advertisements ("Facebook ads") may be displayed when using Facebook or other websites that also use this process.

The purpose of data processing is the display of interest-based advertising offers. Your consent serves as the legal basis in accordance with Article 6(1)(a) and §25 TDDDG.

Further details, e.g., on the types of data transferred or the storage period, can be found in our data protection information for the use of cookies and similar technologies (https://www.pollin.de/datenschutz-cookie#infos) - Marketing section.

Information about Meta's data protection and the processing of your personal data by the provider can be found in the privacy policy (https://www.facebook.com/privacy/policy) in the Meta Privacy Center.

The following objection and control options exist:

• Here you can edit your cookie settings for Facebook if you are logged in to Facebook: https://www.facebook.com/ads/preferences/ • You can find the option to deactivate the "Custom Audiences" function at https://www.facebook.com/settings/?tab=ads#

Transfer to third countries:

The service provider of Meta Pixel (formerly Facebook Pixel) is Meta Platforms Ireland Limited. However, personal data may also be transferred to the parent company Meta Platforms Inc. This company is based in the USA. The possible transfer of data to the USA is permitted by an adequacy decision of the EU Commission and the certification of Meta Platforms Inc. for the EU-US Data Privacy Framework.

Microsoft Advertising

On our pages, we use the conversion tracking of Microsoft Corporation, provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin, Ireland 18, D18 P521. If you consent to the use of the service, a cookie will be set on your computer if you have reached our website via a Microsoft Bing ad. In this way, Microsoft Bing and we can recognize that someone has clicked on an ad, has been redirected to our website, and has reached a previously determined target page (conversion page). We only learn the total number of users who clicked on a Bing ad and were then redirected to the conversion page. No personal information about the identity of the user is disclosed.

We have concluded an order processing contract with Microsoft which stipulates that the data will be processed in accordance with instructions.

The legal basis for the processing of your data is your consent pursuant to Article 6(1)(a) GDPR in conjunction with §25(1) TDDDG.

Further information on data protection and the cookies used by Microsoft and Bing Ads can be found on the Microsoft website at https://privacy.microsoft.com/de-de/privacystatement

Transfer to third countries:

Microsoft Corporation is based in the USA. The transfer of data to the USA is permitted by an adequacy decision of the EU Commission and Microsoft's certification for the EU-US Data Privacy Framework. In addition, Microsoft Ireland Operations Limited has concluded EU standard contractual clauses with Microsoft Corporation for the transfer of personal data to the USA.

AWIN Affiliate Marketing

This website uses the remarketing function of AWIN AG, Eichhornstraße 3, D-10785 Berlin.

AWIN operates an affiliate network and serves as an interface between merchants (merchants) and sales partners (affiliates).

Affiliate marketing is a form of sales that enables website operators to display advertising, which is usually remunerated via click or sales commissions, on third-party websites, i.e., those of sales partners. The merchant provides an advertising banner or other means of Internet advertising via the affiliate network, which is integrated by an affiliate on their own website. The function is used to present interest-based advertisements to website visitors within the AWIN or Webgains advertising network.

If you give your consent, a tracking cookie is stored in the browser of the website visitor, which makes it possible to recognize the visitor when they visit a website of a company belonging to the advertising networks.

The tracking cookies do not store any personal information such as your name, address or email address, but only the ID of the referring partner and the serial number of the visitor to a website, and the advertising material clicked on (banner, text link, etc.). When a transaction is concluded, the partner ID is used to allocate the commission to be paid to the referring partner.

The purpose of storing this data is to process commission payments between a merchant and the affiliate, which are processed via the advertising networks.

The legal basis for the processing of your data is your consent pursuant to Article 6(1)(a) GDPR in conjunction with §25(1) TDDDG.

Further information on data protection at AWIN is available via the following link: https://www.awin.com/de/rechtliches/privacy-policy-DACH.

Criteo

This website uses the Criteo service for advertising purposes. The provider is CRITEO SA, 32 rue blanche, 75009 Paris, France.

This allows us to target our advertising to visitors who are interested in our products on partner websites, apps, and emails. The advertising is either based on information about the visit to the respective websites, which is stored in cookies or via advertising IDs on the user's computer, or based on data transmitted by an advertiser or publisher in an optional and pseudonymized manner, e.g., your CRM identifiers and/or hashed or encrypted email addresses. Criteo stores a pseudonym and product profiles for each user.

For more details on the services of Criteo and the tracking technologies used, please refer to Criteo's privacy policy (https://www.criteo.com/de/privacy/). Here you can also use the opt-out option to reject interest-based advertising.

Users/customers can request data deletion directly from us, and we will send a list to Criteo with the hashed email addresses.

Hotjar

We use Hotjar (http://www.hotjar.com/) on our website to better understand the needs of our users and to optimize the offer on this website. Hotjar's technology gives us a better understanding of our users' experiences (e.g., how much time users spend on which pages, which links they click on, what they like and dislike, etc.), and this helps us to tailor our offering to our users' feedback. Hotjar works with cookies and other technologies to collect information about the behavior of our users and their devices, in particular the IP address of the device (only collected and stored in anonymized form), screen size, device type (Unique Device Identifiers), information about the browser used, location (country only), preferred language for displaying our website. Hotjar stores this information in a pseudonymized user profile. The information is neither used by Hotjar nor by us to identify individual users or merged with other data about individual users. Further information can be found in Hotjar's privacy policy (https://www.hotjar.com/legal/policies/privacy).

You can object to the storage of a user profile and information about your visit to our website by Hotjar and the setting of Hotjar tracking cookies on other websites by clicking on this opt-out link: https://www.hotjar.com/legal/compliance/opt-out.

Further information on usage-based online advertising and online data protection can be found at http://www.youronlinechoices.com/.

Mouseflow

We use Mouseflow, a web analytics tool from Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark, to improve the user-friendliness of our website. In addition to mouse clicks, mouse and scroll movements as well as keyboard interactions of randomly selected website visitors can be recorded. The purpose of randomly reproducing individual visits to this website as so-called session replays and evaluating them in the form of so-called heat maps is to derive potential improvements for our website. The information is not personal and is not passed on.

Further information on data protection at Mouseflow can be found at https://mouseflow.com/de/privacy.

The legal basis for the use of Mouseflow and the associated use of cookies and other technologies is your consent. You can revoke your consent at any time with effect for the future.

Further details on this application can be found under “Services” in our Consent Management Tool.

User survey with Mopinion

We use the online tool “Mopinion” from the provider Mopinion B.V, Pannekoekstraat 104, 3011 LL, Rotterdam, Netherlands, to collect and record customer feedback.

If you participate in a survey, we collect the answers to the questions shown in the form. We process your feedback for internal analysis of user satisfaction in order to optimise our website and make it more user-friendly.

It is not possible for us to identify individual persons based on their feedback. Please note that you should not provide any personal data or other information about yourself (e.g., name, email address, other contact details, etc.) in your feedback.

Participation in the survey is voluntary. The legal basis for the use of Mopinion and the associated use of cookies to ensure the technical functionality of the survey is your consent. You can revoke your consent at any time with effect for the future.

Further details on this application can be found at "Services" in our Consent Management Tool.

8.12.3 Use of other third-party applications

Cloudflare

We use the Cloudflare Content Delivery Network (CDN), a service of Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA, provided by Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany, to increase the security and delivery speed of our website. This corresponds to our legitimate interest (Article 6(1)(f) GDPR).

A CDN is a network of globally distributed servers that can deliver optimized content to the website user. Cloudflare uses cookies for this purpose, and personal data may be processed by Cloudflare in server log files. Cloudflare acts as a processor for us. Your personal data will be stored by Cloudflare for as long as is necessary for the purposes described.

Further information on objection and removal options vis-à-vis Cloudflare can be found at: Cloudflare DPA.

Cloudflare is certified for the Data Privacy Framework and has implemented compliance measures for international data transfers. These apply to all global activities where Cloudflare processes personal data of natural persons in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs) (https://www.cloudflare.com/cloudflare_customer_SCCs-German.pdf).

Further information about data protection and compliance with the GDPR by Cloudflare can be found here: https://www.cloudflare.com/de-de/trust-hub/privacy-and-data-protection/.

Use of script libraries (web fonts)

We use script libraries such as Google Webfonts (https://www.google.com/webfonts) or Font Awesome (https://fontawesome.com) on this website to display our content correctly and to make it graphically appealing across all browsers. Web fonts are transferred to the cache of your browser to avoid multiple loading. This is also our legitimate interest in data processing in accordance with Article 6(1)(f) GDPR.

Calling script libraries normally triggers a connection to the operator of the library. As far as can be seen, at least the IP address is transmitted.

We have installed the fonts required for our website locally on the sunnycars.de domain. This prevents your IP address from being transmitted to Google or Font Awesome.

Integration of videos

On some of our pages, we embed videos via third-party providers. For technical reasons, the integration of the videos results in the provider's servers being accessed. For the associated use of data from your browser or end device, please refer to the respective data protection notices of the providers responsible for processing.

The legal basis for the transmission of the technically required data to the video portals is Article 6(1)(f) GDPR; cookies are only set if you consent to this in accordance with Article 6(1)(a) GDPR.

YouTube

YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit one of our websites equipped with a YouTube plugin, a connection to the YouTube servers is established. This tells the YouTube server which pages you have visited. If you are logged in to your YouTube account, you allow YouTube to assign your surfing behavior to you personally. You can prevent this by logging out of your YouTube account.

When a YouTube video is started, the provider uses cookies that collect information about user behavior. If the storage of cookies for the Google Ad program is deactivated, no such cookies will be set. Further information on the handling of user data by YouTube can be found in the Google/YouTube privacy policy (https://www.google.de/intl/de/policies/privacy).

8.12.4 Further information on tools and technologies

Further information about the technologies described and other technologies and third-party providers used on our website, depending on the consent status, can be found in section "8.2 Use of cookies and similar technologies" and under "Services" in the Usercentrics Consent Tool.

8.13 Use of Sunny Cars social media offers

The links to social media integrated on our website are not integrated via plugins. When you visit our website, no connection to the provider's servers is established, and no personal data is transferred to the provider. The integrated graphics with the provider's logo only contain an HTTP link to our pages at the respective provider

8.13.1 General information

In addition to our own website, we use various company-specific social media platforms to communicate and interact with our customers and interested parties.

8.13.1.1 Description and scope of data processing

If you use social networks, Sunny Cars has no influence on data collection and its further use by the providers. To what extent, where, and for how long the data is stored, to what extent the networks comply with existing deletion obligations, which evaluations and links are made with the data, and to whom the data is passed on is not conclusively and clearly stated by the providers and is therefore not recognizable to us.

When visiting the pages, content data (e.g., posts, comments), and usage data, including the IP address, are collected and processed. Usage data is used to provide us, as the operator of the pages, with summarized, anonymized statistics on the use of and user actions on the pages (e.g., number of visitors, length of stay, click behavior).

Sunny Cars has no access to the personal usage data that is processed in this context. We also have no influence on the collection and processing of this and other data by the providers for their own purposes.

Freely accessible comments or contributions that you publish on our social media offerings are processed to respond to your request. For this purpose, your public profile and your post will be saved so that we can contact you.

8.13.1.2 Purpose of data processing

The purpose of data processing is the presentation of the company, communication, and interaction with our customers and interested parties. A further purpose is the creation of usage statistics to further develop and optimize the content of the offers.

8.13.1.3 Legal basis for data processing

The legal basis for the processing of the pseudonymized data that is processed for us during your visit to our social media profiles is Article 6(1)(f) GDPR, legitimate interest.

Our legitimate interests lie in the aforementioned purposes. No overriding conflicting interests of the users can be identified, as they have voluntarily agreed to the terms of use and data protection provisions of the social media offerings.

8.13.1.4 Duration of storage

The length of time the operators of the social media offerings store the data for their own purposes, and to what extent existing deletion obligations are complied with, are not fully specified by the platform providers.

8.13.1.5 Possibility of objection and removal

For us as the operator, there is no way to stop the platform provider from compiling usage statistics.

Users can make settings for personalization and cookie use through basic data protection settings in their account settings or by means of the consent banners offered by the social media platforms, and thus influence the scope of data processing. For more information on your rights in this regard and setting options to protect your privacy, please refer to the data protection notices of the respective networks.

8.13.2 Details on the individual social media profiles

8.13.2.1 Facebook / Instagram

Sunny Cars and the provider of the social media platforms Facebook and Instagram, Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for the processing of personal data about the use of our profiles. We have concluded a contract with Meta Platforms Ireland Ltd. in accordance with Article 26 GDPR regarding the joint responsibility for the processing of Insights data (data for statistical analysis). ("Page Controller Addendum, Page Insights Addendum regarding the controller": https://www.facebook.com/legal/terms/page_controller_addendum).

Meta agrees to assume primary responsibility under the GDPR for the processing of Insights data and to fulfill all obligations under the GDPR regarding the processing of Insights data. Further information on data protection can be found in the Facebook Privacy Policy (https://www.facebook.com/privacy/policy) and the Instagram Privacy Policy (https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect).

Data subjects can assert their rights against Meta or Sunny Cars in the same way.

Facebook provides more information on "Page Insights data" at the following link: https://www.facebook.com/legal/terms/information_about_page_insights_data

The legal basis for the processing is our legitimate interest in the analysis of usage data to optimize our corporate presence on Facebook and Instagram platforms (Article 6(1)(f) GDPR).

8.13.2.2 LinkedIn

Sunny Cars and the provider of the social media platform LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, are jointly responsible for the processing of personal data about the use of our profile. We have concluded a contract with LinkedIn Ireland in accordance with Article 26 GDPR regarding the joint responsibility for the processing of Page Insights data (data for statistical evaluation) (Page Insights Joint Controller Addendum: https://www.linkedin.com/legal/l/page-joint-controller-addendum)

LinkedIn agrees to assume primary responsibility under the GDPR for the processing of Page Insights data and to fulfill all obligations under the GDPR regarding the processing of this data. Further information on data protection can be found in the LinkedIn Privacy Policy (https://www.linkedin.com/legal/privacy-policy).

Data subjects can assert their rights against LinkedIn or Sunny Cars in the same way.

LinkedIn provides more information on the Page Insights analysis data at the following link: https://www.linkedin.com/help/linkedin/answer/a547077/viewing-company-page-analytics?lang=en

The legal basis for the processing is our legitimate interest in analyzing usage data to improve our corporate presence on LinkedIn (Article 6(1)(f) GDPR).

8.13.2.3 XING

Sunny Cars and the provider of the social media platform Xing, New Work SE, Am Strandkai 1, 20457 Hamburg, Germany, are jointly responsible for the processing of personal data about the use of our profile. We have concluded a contract with New Work SE in accordance with Article 26 GDPR with regard to the joint responsibility for the processing of data used for statistical evaluation (Annex 1 to the agreement on shared responsibility under data protection law: https://www.xing.com/terms/onlyfy-one)

Xing agrees to assume primary responsibility under the GDPR for the processing of this data and to fulfill all obligations under the GDPR regarding the processing of this data. Further information on data protection can be found in the Xing Privacy Policy (https://privacy.xing.com/en).

Data subjects can assert their rights against Xing or Sunny Cars in the same way.

The legal basis for the processing is our legitimate interest in the analysis of usage data to optimize our company presence on XING (Article 6(1)(f) GDPR).

8.13.2.4 Pinterest

Sunny Cars has a social media profile on Pinterest. When a user visits our Pinterest page, the personal data is processed by the data controller, Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Sunny Cars has no influence on the type and scope of processing.

Sunny Cars and Pinterest are jointly responsible for the processing of personal data relating to the use of our profile. We have concluded a contract with Pinterest Europe in accordance with Article 26 GDPR regarding the joint responsibility for the processing of data used for statistical analysis (Pinterest Advertising Services Agreement Exhibit B: https://business.pinterest.com/en-us/pinterest-advertising-services-agreement/germany/).

Pinterest Europe agrees to assume primary responsibility under the GDPR for the processing of this data and to fulfill all obligations under the GDPR regarding the processing of this data. This applies to the security of processing, personal data breaches, and the assertion and implementation of data subjects' rights. To exercise your rights, please contact Pinterest's Data Protection Officer (https://help.pinterest.com/de/data-protection-officer-contact-form). Irrespective of this, data subjects can assert their rights against Sunny Cars in the same way.

For more information on how Pinterest Europe processes personal data, including the legal basis on which Pinterest Europe relies and the ways in which data subjects' rights can be exercised against Pinterest Europe, please refer to Pinterest Europe's Privacy Policy (https://policy.pinterest.com/en/privacy-policy).

The legal basis for the processing is our legitimate interest in the analysis of usage data to optimize our corporate presence on Pinterest (Article 6(1)(f) GDPR).

8.13.2.5 YouTube

Sunny Cars operates a channel on the social media platform YouTube. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland, is responsible for the data processing of persons living in the EU/EEA. The technical platform is provided by YouTube LLC, headquartered at 901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

We would like to point out that your use of the YouTube channel offered by Sunny Cars and its functions is under your own responsibility. Sunny Cars has no influence on the type and scope of the data processed by Google, the type of processing and use, or the transfer of this data to third parties.

Before you can use this offer, you will be redirected to the YouTube Consent Banner, where you can make settings for personalization and cookie use. In addition, Google offers specific data protection settings for YouTube in the Google Product Privacy Guide (https://policies.google.com/technologies/product-privacy?hl=en&gl=en).

Google processes personal data (e.g., personal information, IP address, user behavior, comments) in accordance with the Data Usage Guidelines (https://policies.google.com/privacy?hl=en&gl=en#infocollect) and uses it for its own business purposes. Further information on the handling of personal data by Google can be found in the provider's Privacy Policy (https://policies.google.com/privacy?hl=en&gl=en).

As the channel operator, Sunny Cars has access to statistical data on the use of the YouTube channel, e.g., reports on the use of the channel and the videos, number of visitors to the channel, number of subscribers, reach of the video, and interactions of users (likes, comments, shared content) as well as information about individual persons who actively interact with our page.

The legal basis for the processing is our legitimate interest in the interaction with users and the analysis of usage data to optimize our corporate presence on YouTube (Article 6(1)(f) GDPR).

8.14 Internal Reporting Office

As part of our compliance management system, we have set up a whistleblower hotline. You have the possibility to use this hotline to provide information on facts that we have a legitimate interest in knowing about.

We have commissioned the law firm Heuking Kühn Lüer Wojtek as an outsourced internal reporting office (hereinafter: "Reporting Office") to receive and review such information.

Entries to the Reporting Office can be made by web form, by telephone, by email, by post, or in person.

Reports to the Reporting Office can be made anonymously.

The use of the Reporting Office is voluntary.

When you submit a report to the Reporting Office, it collects the information you provide. This includes your personal data, if you disclose it, and usually the names and other personal data of the persons you name in your report. For more information on how the Reporting Office handles your personal data, please refer to the Reporting Office's privacy policy (https://whistlefox.heuking.de/UserContent/Legal/Datenschutzinformation_en.pdf).

8.14.1 Categories of personal data we process

We receive a report from the Reporting Office when they have checked the report, which may contain the following personal data:

• Names and other personal data of the person providing the information only if the person providing the information does not wish to remain anonymous and agrees to their disclosure to us; • Names and other personal data resulting from the report of the persons named in the report.

During further clarification of the reported facts and further processing, additional personal data may be collected and processed by us.

8.14.2 Purposes of data processing, legal basis

The processing of the data transmitted to us by the Reporting Office serves to process and manage reports of compliance violations, violations of legal regulations, and violations in connection with our business operations by employees, customers, suppliers, and other third parties.

The legal basis for the processing of your personal data as a whistleblower is compliance with the legal obligation of the Whistleblower Protection Act (Article 6(1)(1)(c) GDPR), provided that you disclose your identity and share personal information. You can also choose not to share your personal information.

Insofar as facts are concerned that are subject to the Whistleblower Protection Act (HinSchG/Wet bescherming klokkenluiders), Section 10 HinschG and/or Article 1c Wet bescherming klokkenluiders is the legal basis for the processing of the personal data of you as the whistleblower and of the person(s) affected by the whistleblowing.

Outside the scope of the HinschG, the legal basis for processing the personal data of you and the persons affected by the report is our legitimate interest in the detection and prevention of legal violations and misconduct (Article 6(1)(1)(f) GDPR). We have a legitimate interest in detecting and preventing breaches of the law and misconduct if we are legally obliged to do so in certain areas. In addition, such violations can not only cause considerable economic damage, but also lead to a considerable loss of reputation.

If the data subject is one of our employees, the legal basis for processing during the handling or further investigation of the reported facts is Article 6(1)(1)(b) GDPR or Section 26(1)(2) BDSG (processing for the detection of criminal offences) and, if applicable, our legitimate interest described above (Article 6(1)(1)(f) GDPR).

8.14.3 Disclosure to third parties

The confidential treatment of all reports and data by the Reporting Centre is guaranteed at all times and in every processing step as described in Article 1a of the Whistleblowers Protection Act. This applies in particular to the personal data of the reporting person and the person(s) affected by the report. Access to incoming reports and information about the processing of the report or follow-up measures is only granted to individual, previously defined, authorized persons who are obliged to maintain confidentiality.

We may pass on the content of the report and the results of further clarification of the reported facts to courts, authorities, and other public bodies. This may be the case if we are legally obliged to disclose the data or if this is necessary for the assertion, exercise, or defense of legal claims.

We may also use the support of law firms or auditing companies in the context of clarification measures and in the assertion, exercise, or defense of legal claims.

In addition, we may involve (technical) service providers in the clarification and processing of the reported facts, who work for us as processors within the meaning of Article 28 GDPR and based on corresponding agreements bound by instructions. These service providers may also become aware of the content of the report, but are obliged to treat the data concerned confidentially.

In exceptional situations, personal data of the whistleblower and the person concerned may come to the attention of authorities, courts, or third parties despite the duty of confidentiality. This is the case if the disclosure of this information is absolutely necessary for us, for example as part of an official investigation (e.g., as part of an investigation procedure) or if this is necessary for the assertion, exercise, or defense of legal claims. In addition, the reported information must also be disclosed by us to the persons affected by the report.

8.14.4 Duration of the data storage

The personal data will be stored for as long as is necessary to clarify the report and any subsequent measures, or for as long as there is a justified interest on our part, or as long as this is prescribed by law. In this case, the duration is 5 years as we need the information in case of any legal procedures. Afterwards, the data will be deleted in accordance with the legal requirements.

8.15 Processing of business contacts

8.15.1 Description and scope of data processing

In addition to business contact information that we receive through active contact, e.g., via contact forms, email, and telephone, employees and managing directors of our company may receive business cards or participant lists from external events, e.g., conferences, trade fairs, if the participant list has been shared by the organizer. In addition, business contact information is collected and processed when registering business partners (e.g., agencies or tour operators, vehicle rental companies) and service providers.

This personal business contact data is transferred by us to a contact database/CRM system.

• Title • First and last name • Company • Function • Company address • Email address • Internet address • Phone number • Cell phone number • Fax number

In addition, the time and reason for the transfer of contact information and, if applicable, other business-related information is processed, e.g.:

• Industry • Appointment dates • Contact history • Customer number, customer type • Data on business partners • Sales-related data, e.g., turnover • Essential communication content • Date of birth, if applicable

The following data are required for partner registration/account creation in the B2B booking tool:

• Username/Email address • Password

The data is processed exclusively within the scope of our business relationship. The data will not be passed on to third parties unless you give us your consent to do so.

8.15.2 Legal basis for data processing

The legal basis for the processing of data processed while collecting and storing business contact data is Article 6(1)(f) GDPR for members and employees of companies or organizations. We have a legitimate interest in appropriate and effective communication for the stated purposes.

If the contact is based on pre-contractual measures or is necessary for the execution of a contract with the data subject, the processing is based on Article 6(1)(b) GDPR.

The sending of information, which is generally classified as direct advertising, is carried out based on Article 6(1)(f) GDPR in conjunction with Recital 47.

If the data subject has given consent, Article 6(1)(a) GDPR is the legal basis for the processing.

8.15.3 Purpose of data processing

Management and provision of the possibility to contact persons, companies, employees of companies, or public bodies. The processing of business contact data may serve one or more of the following purposes:

• Efficient management of contacts • Contact maintenance • Exchange of information/sending of information material • Cooperation/business collaboration • Statistical analysis of business cooperation • Potential future cooperation/business collaboration • Quotation preparation and contract processing • Optimization of our services • Accounting • Project management • Sending birthday greetings

8.15.4 Duration of storage

After four years at the end of the respective calendar year, a check is carried out to determine whether further storage of the personal data in the contact management system is necessary. If it is not necessary, the data will be deleted. The review is carried out depending on the respective purpose.

The data will not be deleted after four years if there are legal grounds (retention periods, verifiability) that prevent deletion. This data will be blocked for further processing.

8.15.5 Right to object and right to rectification

You have the option to object to the processing and storage of your personal business contact data. You can object to the processing by email, post, or fax.

If you have given your consent to the processing of personal business contact data, you have the option of withdrawing your consent to processing.

In both cases, the processing will be ceased and all personal data stored during contact management will be deleted, unless there are legal grounds (retention periods, accountability) to the contrary. In the latter case, the data will be blocked.

In the event of deletion or blocking, an existing conversation cannot be continued, or future contact cannot be made.

Information on your further rights can be found in this Data Protection Information.

8.16 Application

8.16.1 Description and scope of data processing

This data protection notice informs you about how we handle personal data that you submit to us during your application.

Our application portal - the preferred way to apply to us

On the careers page (https://www.sunnycars.jobs/), we offer the option of sending your application directly to the careers department via a secure connection with an upload option for files. The transmission of your application documents is encrypted in accordance with currently recognized state-of-the-art technology. In addition to applying for our vacancies, you can also send an unsolicited application to Sunny Cars via this page.

Please always apply via our application portal (https://www.sunnycars.jobs/offene-stellen/), as when applying by email, your data will be transmitted to us in encrypted form but not content-encrypted, i.e., in an insecure way.

We process the following data when you contact us/during the application:

Personal and contact details:

• First and last name* • Email address* • Phone number

Data on future employment:

• Your message/questions to Sunny Cars • Notice period • Salary expectations

Further information:

• Channel through which you became aware of us

Complete application documents (as PDF files):

• Letter of application • Curriculum vitae • Certificates (references, job references, proof of qualifications, certificates)

Further options

If there is no other option, you can also send us your application documents by post. In the case of a postal application, we will scan your application documents for further processing.

Video interview

If your application is a good fit, we ask for voluntary participation in a video interview via the Cammio portal. This allows us to get a better picture of you, and you get to know us in an initial video. Alternatively, you can have an interview with us via MS Teams or by phone. If the first impression is good, the next step is to arrange a personal meeting. 

Forwarding of application data

In the company, access to your data is only granted to those persons who require it for the proper course of the application process.

Your application data will be reviewed by the careers department after receipt of your application. Suitable applications are then forwarded internally to the specialist responsible for the respective open position.

If you are not eligible for the position currently being advertised, you have the option of forwarding your application to the relevant specialist managers of Sunny Cars for other positions that come into consideration or to store it for a longer period. We will obtain your explicit consent for this in advance.

Your data will not be passed on to third parties unless you give us your consent to do so.

8.16.2 Legal basis for data processing

The legal basis for the processing of the data is Article 6(1)(b) GDPR and Article 88 GDPR in conjunction with §26 BDSG (DE).

If you have given us your consent (e.g., video interview, longer-term storage), the legal basis is Article 6(1)(a) GDPR in conjunction with §26(2) BDSG (DE).

Consent to longer-term storage is given based on Article 6(1)(a) GDPR.

Should the data be required for legal prosecution after completion of the application process, data processing may be carried out based on Article 6(1)(f) GDPR. Our legitimate interest lies in the assertion of or defense against claims.

8.16.3 Purpose of data processing

The purpose of data processing is to carry out the selection procedure to fill an advertised position or to check an unsolicited application for the possibility of employment.

8.16.4 Duration of storage

If we have not agreed on a longer period based on your consent, your application documents will be deleted a maximum of six months after completion of the application process. This applies equally to written and electronic applications.

If you consent to longer-term storage in our applicant pool, the data will be deleted after a maximum of two years.

If you are accepted for a position as part of the application process, the data from the applicant data system will be transferred to our personnel information system.

8.16.5 Right to object and right to rectification

It is always possible to withdraw an application. In this case, all related data will be deleted by us immediately, unless a storage period prescribed by law prevents this.

If you have given us your consent and wish to revoke it, please inform us via our contact page (https://www.sunnycars.jobs/kontakt/) by email or post to Sunny Cars GmbH / Abt. Personal, Paul-Gerhardt-Allee 42, 81245 Munich, Germany.

Further information on your rights and data protection when using our website can be found at "8.1 Provision of the website and creation of log files"

8.17 Use of CarCheck

8.17.1 Description and scope of data processing

Sunny Cars offers a web-based photo app (CarCheck) as an optional service that customers can use in connection with a car rental booking.

The photo app can be used to take photos/videos of the vehicle and the fuel and mileage levels when picking up and returning the vehicle, or of any damage during the rental period or an accident involving the rental car. Photos taken are sent to Sunny Cars and used if necessary.

This provides the customer and Sunny Cars with evidence for processing complaints in the event of damage, defects, other faults or accusations. The advantage for Sunny Cars customers is that it avoids costs, debits and speeds up refunds (e.g. excess).

Processed data:

• Booking number • First and last name of the driver • Email • Photo and/or video material of the hire car • Location, date and time the photos/videos were taken

8.17.2 Legal basis for data processing

Your data is processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR, provided that you have given your consent to use the app.

The processing for the purpose of checking and verifying the fuel level and mileage, as well as further processing in the event of a specific complaint or damage claim, is carried out for the purpose of fulfilling the contract in accordance with Art. 6 (1) lit. b GDPR .

8.17.3 Purpose of data processing

The data is processed for the purpose of handling complaints or insurance claims relating to the rental car booking, as well as to verify the fuel level and mileage in the event of discrepancies.

8.17.4 Duration of storage

The data stored by Sunny Cars will be deleted once the purpose has been fulfilled, unless there are legal reasons (retention periods, verifiability) that prevent this. In the event of legal disputes or outstanding claims in connection with the rental agreement, the data will be stored until final clarification and at the latest until the expiry of the statutory limitation periods.

If the rental agreement ends without any complaints, the data will be deleted six months after the end of the contract, unless there are legal retention obligations that prevent this.

8.17.5 Right to object and right to erasure

You have the right to object to the processing and storage of your personal data at any time. Depending on the legal basis for processing, the data will be deleted or blocked if no further use is necessary and there are no legal reasons (retention periods, verifiability) that prevent this.

It may then no longer be possible to use the data as evidence at a later date.

Further information on data protection at Sunny Cars can be found in this information on data protection and data security.

9. Your rights as a data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

Right to information

You can request confirmation as to whether your personal data and more specifically which of your personal data we are processing.

Right to rectification

You have a right to rectification and/or completion if your processed personal data is incorrect or incomplete.

Right to erasure ("right to be forgotten")

You can request that your personal data be deleted immediately, and the controller is obliged to delete this data immediately, if certain grounds apply.

Right to restriction of processing

Under certain circumstances, you may request the restriction of the processing of your personal data (e.g., blocking of use or temporary removal from the website if it was published there).

Right to notification

If it has been determined that you have the right to rectification, erasure or restriction of processing, the controller is obliged to notify all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of processing and to inform them to act accordingly.

Right to data portability

You have the right to receive your personal data, which you have provided to the controller, in a structured, commonly used, and machine-readable format. You also have the right to have it transmitted directly to another controller where this is technically feasible and does not adversely affect the rights and freedoms of others.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data if the processing is based on legitimate interests.

=> This includes the objection to direct advertising, for example.

Right to revoke the declaration of consent under data protection law

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent provided before its withdrawal.

Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority.

How to exercise your rights

You can exercise these rights by contacting us by email at datenschutz@sunnycars.de or by post to the controller.

If necessary, we may request additional information required to confirm your identity, e.g., a photocopy of an identity card.

Your requests will be processed immediately, usually within one month of receipt of the request. If circumstances require it, the processing time may be extended by a further two months.

10. Changes to the data protection information

We reserve the right to adapt this data protection notice when introducing or changing new services so that it always complies with current legal requirements. The current version will apply when you visit our website again.

Munich, January 2026