Data protection information on using the booking and reservation system

Description and scope of data processing

The processing of personal data for the brokerage of car rental reservations and related services is jointly operated by the companies of the Sunny Cars Group (Sunny Cars GmbH, Sunny Cars International GmbH, Sunny Cars B.V.) (Joint Controllers within the meaning of Art. 26 GDPR).
Sunny Cars GmbH assumes all obligations under the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations. This relates in particular to the exercise of the rights of the data subject and the information obligations pursuant to Art. 13 and 14 GDPR. Irrespective of this, you may assert your rights as a data subject against each of the controllers.

Your personal data is then collected and processed when you provide this voluntarily, e.g. when booking a hire car. You can do this directly on our website or enlist a Sunny Cars partner (travel agent’s, agency) using the data you supplied them with. We only transmit your name, car category, rental period and, if available, your flight number to local fleet providers for standard bookings. Your data is transmitted securely using SSL encryption.

The data collected when you book is stored as inventory data in a customer account in our customer database and used for services and to manage the customer relationship.

The following data is collected in the course of the booking process:

Mandatory fields:

• First name and surname of the driver,
• Age of the driver,
• Address (street, house number, postcode, city, country),
• Email address
• Payment method; payment details
• Telephone number if applicable

The following data is optional:

• Flight details (flight number)
• Time of rental and return

The following data is also stored when you order via the booking portal:

• The user’s IP address
• Booking number and other booking details (travel period, collection and return locations)
• Date and time of the booking
• Customer number
• Optional: Mediating agency

Quick check-in/premium and express service/deposit-free package (see comment below)

If you choose this expanded service offering, we collect and process the following additional data which you provide in the course of this rental car booking:

• Date of birth
• Place of birth
• Driving licence details:
  • Driving licence number
  • Country of issue
  • Date of issue
  • Issued by
• ID details
  • ID card number
  • Country of issue
  • Date of issue
  • Issue by
  • Valid until
• Mobile number (e.g. for delivery of the rental car to a hotel)
• Abode in the destination area

When you use this service all the data which you usually provide to the local fleet provider will be transmitted to the latter beforehand in encrypted form. This allows you to pick up the vehicle immediately when you arrive.

We would like to point out that the data may be transmitted to insecure third countries where an adequate level of data protection cannot be guaranteed. Our local partners have undertaken only to use the data for the agreed purpose.

Legal basis for data processing

The processing of your data facilitates fulfilment of a contract which you are a party to, or execution of precontractual measures. The legal basis for processing the data is Article 6(1)(b) GDPR.

The transmission of the data into a third country which does not have the level of data protection required for such transmissions is based on Article 49(1)(b) - exceptions for particular cases; i.e. the transmission is necessary for the fulfilment of a contract between the data subject and the controller or for the execution of precontractual measures at the application of the data subject.

Where his or her data is used to send direct advertising, the legal basis is Article 6(1)(f). The departure point for the assessment is recital 47 GDPR, which among other things states: “The processing of personal data for the purpose of direct marketing may be regarded as processing serving a legitimate interest.”

Purpose of data processing

The purpose of processing the data provided by you is the fulfilment of a contract with you or the execution of precontractual measures to reserve you a rental car and provide it at the place of acceptance.

Quick check-in/premium and express service:

The purpose of processing the additional information provided by you is the fulfilment of a contract concluded with you to provide a rental car at the place of acceptance in a time-saving manner

No deposit service:

The purpose of processing the additional information is the provision of a rental car without you having to leave a deposit with the vehicle fleet provider.

Duration of storage

Existing customer data will be stored for the duration of the contractual relationship. If the personal data is no longer necessary for the purpose for which it was collected, it will be deleted. Even after completion of the contractual relationship it may be necessary to store the contracting partner’s personal data in order to fulfil contractual or legal obligations (e.g. retention and evidence obligations).

Quick check-in/premium and express service, no deposit service:

The registration data will be retained for 365 days after the vehicle is returned and then deleted. The user has the option of agreeing to permanent storage. Then the data will be stored until this consent is withdrawn.

Right to object and right to rectification

If the data are required for the fulfilment of a contract or the execution of precontractual measures, the data in the customer account may only be deleted early if no contractual or legal obligations prevent this.

In the time when you are managed as an existing customer, you have the right to have the data deleted if it is not subject to a legal retention period.