Data Privacy Policy

Data protection is a key concern for ALD Automotive SIA and to ALD SA to which ALD Automotive SIA belongs. We have been placing this matter as a priority for long and we have implemented strong principles in that respect, especially in regards of the General Data Protection Regulation (the “GDPR”).

Indeed, The European Regulation (EU) 2016/679 on the protection of individuals regarding the processing of personal data and on the free movement of such data has been applicable since May 25, 2018 (hereinafter the "GDPR").

The RGPD raises awareness of all actors in the European Union and more, on a multitude of issues related to the management, use and retention of personal data.

In this order, ALD Automotive SIA Data Privacy Policy aims to explain how we collect, store, use and disclose your personal information whenever you use our products and services, our websites or interact with ALD Automotive SIA. 

This Policy is intended to explain our privacy practices.

1. General principles

   ALD Automotive understands your concerns regarding the confidentiality of your personal information. Below we describe how we acquire and use that information and outline your rights. Please read this carefully, so that the process is as fair, transparent and secure as possible.

   The following principles are central to how we process your personal information:

   • Transparency and fairness: When we collect and process your personal information, we inform you as to who collects and receives these data, and the reasons for this. When required by law, we always seek your prior consent (e.g. before collecting any sensitive information or sending any direct marketing material). We never use your personal information for purposes that are incompatible with the purposes outlined here.
     
     
   • Legitimacy: ALD Automotive does not collect or process personal information without a lawful reason. We use your personal information only for appropriate business purposes (e.g. to provide services, manage relationships with customers, manage customer vehicle fleets, and perform accurate invoicing, or for marketing activities, profiling to better serve customers, to conduct satisfaction surveys or draft reports and comply with our legal obligations).
     
     
   • Minimization: We only collect the personal information strictly necessary for data processing, as set out in this document. We collect sensitive information only where relevant. We take all reasonable measures to ensure that your personal data on record is accurate, complete and up to date.
     
     
   • Privacy: We endeavor to ensure privacy when implementing personal data processing. To this end we also carry out privacy impact assessments to ensure that our safeguards are appropriate and that your information is protected.
     
     

2. About us

   Company name: ALD Automotive Eesti AS
   Registration country: Estonia
   Registration number: 11094435
   Legal office: Sõpruse pst. 145, Tallinn, 13417, Eesti
   Contact details: e-mail to info.ee@aldautomotive.com; phone +372 630 8960
   
   This Privacy Policy only relates to processing undertaken by or on behalf of ALD. Whilst our websites may contain links to other third party websites, we do not accept any responsibility or liability for those third parties' policies in relation to any personal data or their collection or processing of any personal data.

3. How we use your personal data and which personal data is used

   
   
   1. The personal data that we collect and process will vary, depending on the relationship we have with you, as we only collect what we need to provide our services. We collect personal data relating to seven groups of individuals:
      
      

      • Ultimate beneficial owners, Top executives and Legal representatives of our customers (legal entities), as detailed at paragraph 3.2. of this Privacy Policy;

      • Customer personnel responsible for managing the customer relationship, as detailed at paragraph 3.3. of this Privacy Policy; and

      • Nominated drivers, as detailed at paragraph 3.4. of this Privacy Policy; and

      • Consumers (privates individuals) as detailed at paragraph 3.5. of this Privacy Policy; and

      • Top executives and Legal representatives of our suppliers (legal entities), and their contact persons as detailed at paragraph 3.6. of this Privacy Policy; and

      • Our employees (as detailed in a separate document shared internally); and

      • Job candidates (CV and motivation letter - 1 month retention period shall apply, however until the expiry of the limitation period of a claim for compensation for damage (if limitation period is longer) in respect of the candidate’s personal information gathered during recruitment process in respect of refused candidates, unless the candidate gives his/her consent to include his/her personal data into ALD Automotive candidates’ data base for future recruitment. The retention period starts the next day after recruitment process ends.
        
        

   2. Customer owners, Top executives and Legal representatives
      

      Personal data we may collect from you

      We collect the following personal data relating to the ultimate beneficial owners, Top executives and legal representatives of each of our customers:

      • Name, Surname
      • Place of residence
      • Date of birth
      • Personal identity number
      • Identity document information

      Purposes for processing personal data

      We collect this data in order that we can undertake credit references and screening checks to ensure our customers' creditworthiness and good standing, as set out below:

      • Anti-sanctions or politically exposed persons searches (We conduct anti-sanctions and politically exposed persons searches against commercial and publically available databases to comply with Anti-Money Laundering and Financing Terrorism requirements, including Know Your Customer (KYC) requirements).

      • Fraud prevention checks (We may conduct fraud prevention checks against databases held by fraud prevention agencies).
        
        

      Lawful bases

      We may also use your personal data to analyse our processes and procedures to identify and implement ways to improve and streamline our services.

      We will rely on the following lawful bases in relation to this processing: Contract Performance, Legal Obligation, Legitimate Interests (establishing your credit worthiness and prevention of fraud) and, in limited instances, Legal Claims.
      
      

   3. Customer contacts
      

      Personal data we may collect from you

      We collect the following personal data relating to customer personnel responsible for managing the customer relationship with us:

      • Name, Surname; and
      • Work contact details.
        
        

      Purposes for processing personal data

      We collect this information for the purposes of correspondence in relation to the provision of our services to you. We may also use this information to analyse our processes and procedures to identify and implement ways to improve and streamline our services.

      Lawful bases

      We will rely on the following lawful bases in relation to this processing: Contract Performance, Legitimate Interests (communicating with you in the course of providing our services) and, in limited instances, Legal Claims.
      
      

   4. Izvirzītie autovadītāji
      

      Personal data we may collect from you

      We collect the following personal data relating to our customer's nominated drivers (whether from the customer, the nominated drivers themselves or from any third party):

      • Name, Surname;
      • Work contact details (e-mail address, phone number);
      • Date of birth;
      • Your driving licence details;
      • Administrative offences, convictions or penalties (limited to information received in order to manage traffic accidents, insurance claims and reinvoicing services);
      • Information about accidents (limited to information received in order to manage traffic accidents and insurance claims);
      • Employer details;
      • Survey responses relating to your feedback on our service (should you choose to provide it);
      • Additionally, where telematics services are used, we may also process GPS derived location data and vehicle behavioural data, e.g., revving, idling, speeding.

      How and why we process your (nominated driver’s) personal data

      A summary is set out below of the purposes of processing of your personal data, the third parties it may be shared with, and the lawful bases we may rely on in order to process it:

      • Correspondence relating to the Vehicle or use of the Vehicle

        Lawful bases: Legitimate Interests (communicating with you in the course of providing our services) and, in limited instances, Legal Claims;

        Personal data may be shared for this purpose with your employer (our customer), the Vehicle manufacturer and/or any relevant dealer.

      • Driver feedback

        Lawful basis: legitimate interests (driving continuous improvement in our service)

        Personal data may be shared for this purpose with your employer (our customer) and any relevant dealer.

      • Managing Vehicle tax, registration and MOT

        Lawful bases: Legal Obligation, Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and, in limited instances, Legal Claims;

        Personal data may be shared for this purpose with your employer (our customer).

      • Handling traffic or parking infractions (e.g. fines)

        Lawful bases: Legal Obligation, Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and Legal Claims;

        Personal data may be shared for this purpose with relevant public or private bodies responsible for managing parking arrangements, your employer (our customer) to communicate to you, and/or fines management services, in the event that a fine has been levied.

      • Providing services in response to an accident or Vehicle damage/loss

        Lawful bases: In relation to health information or information relating to any activity that amounts, or may amount, to a administrative offence, we will rely on your explicit consent, as obtained by your employer. Otherwise, we will rely on Legal Obligation, Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and Legal Claims;

        Personal data may be shared for this purpose with law enforcement agencies, insurers or impacted parties, in the event of an accident or a potential claim. This may include the processing of special categories of personal data (health information), Criminal Conduct Data and/or information about any damage caused to the vehicle.

      • Delivery and collection of Vehicles

        Lawful bases: Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and, in limited instances, Legal Claims;

        Personal data may be shared for this purpose with your employer (our customer), delivery and collection agents, dealers and replacement Vehicle providers.

      • Recovery of the Vehicle in the event that the Vehicle is not returned when appropriate

        Lawful bases: Legal Obligation, Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and Legal Claims;

        Personal data may be shared for this purpose with recoveries agents, law enforcement agencies, legal advisors, your employer (our customer) and debt/tracing agencies.

      • (Where applicable) providing Vehicle maintenance, repairs or replacement

        Lawful bases: Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and, in limited instances, Legal Claims.

        In cases where your employer (our customer) has requested this optional service, we may share personal data for this purpose with repairs service providers, dealers, manufacturers, replacement Vehicle providers or your employer (our customer). This may include information about any damage caused to the vehicle.

      • (Where applicable) In relation to connected Vehicle services

        In the event that you ask us to activate any manufacturer provided connected vehicle service, your personal data may be shared with both us and the vehicle manufacturer. You remain responsible for the deletion of any personal data from any of the vehicle systems and for terminating your access to any manufacturer provided connected vehicle service prior to returning the vehicle to us. Please also note that we will not receive diagnostic information from such services in all cases, so it remains the Nominated Driver's responsibility to tell us if there is anything wrong with one of our vehicles.
        
        

   5. Consumers (private individuals)
      

      Personal data we may collect from you

      We collect the following personal data relating to customers (consumers):

      • Name, Surname

      • Place of residence

      • Date of birth

      • Personal identity number

      • Identity document information

      • Employer and position 

      • Income amount and source of income

      • Your driving licence details

      • Administrative offences, convictions or penalties (limited to information received in order to manage traffic accidents, insurance claims and reinvoicing services)

      • Information about accidents (limited to information received in order to manage traffic accidents and insurance claims)

      • Survey responses relating to your feedback on our service (should you choose to provide it)

      • Additionally, where telematics services are used, we may also process GPS derived location data and vehicle behavioural data, e.g., revving, idling, speeding.

      How and why we process your (nominated driver’s) personal data

      A summary is set out below of the purposes of processing of your personal data, the third parties it may be shared with, and the lawful bases we may rely on in order to process it:

      • Solvency check, anti-sanctions or politically exposed persons searches, as well as fraud prevention checks

        We collect this data in order that we can undertake credit references and screening checks to ensure our customers' creditworthiness and good standing.

        Lawful bases: Contract Performance, Legal Obligation, Legitimate Interests (establishing your credit worthiness and prevention of fraud) and, in limited instances, Legal Claims. 

      • Correspondence relating to the Vehicle or use of the Vehicle

        Lawful bases: Legitimate Interests (communicating with you in the course of providing our services) and, in limited instances, Legal Claims;

        Personal data may be shared for this purpose with the Vehicle manufacturer and/or any relevant dealer.

      • Customer feedback

        Lawful basis: legitimate interests (driving continuous improvement in our service).

      • Managing Vehicle tax, registration and MOT

        Lawful bases: Legal Obligation, Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and, in limited instances, Legal Claims;

      • Handling traffic or parking infractions (e.g. fines)

        Lawful bases: Legal Obligation, Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and Legal Claims;

        Personal data may be shared for this purpose with relevant public or private bodies responsible for managing parking arrangements and/or fines management services, in the event that a fine has been levied.

      • Providing services in response to an accident or Vehicle damage/loss

        Lawful bases: In relation to health information or information relating to any activity that amounts, or may amount, to a administrative offence, we will rely on Legal Obligation, Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and Legal Claims;

        Personal data may be shared for this purpose with law enforcement agencies, insurers or impacted parties, in the event of an accident or a potential claim. This may include the processing of special categories of personal data (health information), Administrative Conduct Data and/or information about any damage caused to the vehicle.

      • Delivery and collection of Vehicles

        Lawful bases: Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and, in limited instances, Legal Claims;

        Personal data may be shared for this purpose with our delivery and collection agents, dealers and replacement Vehicle providers.

      • Recovery of the Vehicle in the event that the Vehicle is not returned when appropriate

        Lawful bases: Legal Obligation, Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and Legal Claims;

        Personal data may be shared for this purpose with recoveries agents, law enforcement agencies, legal advisors and debt/tracing agencies.

      • (Where applicable) providing Vehicle maintenance, repairs or replacement

        Lawful bases: Legitimate Interests (to enable us to perform our obligations as the registered owner of the vehicle and in the course of providing our services) and, in limited instances, Legal Claims.

        In cases where you have requested this optional service, we may share personal data for this purpose with repairs service providers, dealers, manufacturers or replacement Vehicle providers. This may include information about any damage caused to the vehicle.

      • (Where applicable) In relation to connected Vehicle services

        In the event that you ask us to activate any manufacturer provided connected vehicle service, your personal data may be shared with both us and the vehicle manufacturer. You remain responsible for the deletion of any personal data from any of the vehicle systems and for terminating your access to any manufacturer provided connected vehicle service prior to returning the vehicle to us. Please also note that we will not receive diagnostic information from such services in all cases, so it remains your responsibility to tell us if there is anything wrong with one of our vehicles.

   6. Suppliers’ Top executives, Legal representatives and contact persons
      
      Personal data we may collect about Suppliers’ Top executives and Legal representatives
      
      • Name, Surname
      • Date of birth
      • Personal identity number
      
      

      Purposes for processing personal data

      We collect this data in order that we can undertake credit references and screening checks to ensure our suppliers’ good standing, as set out below:

      • Anti-sanctions or politically exposed persons searches (We conduct anti-sanctions and politically exposed persons searches against commercial and publically available databases to comply with Anti-Money Laundering and Financing Terrorism requirements, including Know Your Customer (KYC) requirements).

      •  Fraud prevention checks (We may conduct fraud prevention checks against databases held by fraud prevention agencies).

      Lawful bases

      We may also use your personal data to analyse our processes and procedures to identify and implement ways to improve and streamline our services.

      We will rely on the following lawful bases in relation to this processing: Contract Performance, Legal Obligation, Legitimate Interests (prevention of fraud) and, in limited instances, Legal Claims.

      Personal data we may collect about Suppliers’ contact persons

      We collect the following personal data relating to our suppliers’ personnel responsible for managing the supplier relationship with us:

      • Name, Surname; and
      • Work contact details.

      Purposes for processing personal data

      We collect this information for the purposes of correspondence in relation to the cooperation with our supplier. We may also use this information to analyse our processes and procedures to identify and implement ways to improve and streamline our services.

      Lawful bases

      We will rely on the following lawful bases in relation to this processing: Contract Performance, Legitimate Interests (communicating with you in the course of cooperation with our supplier) and, in limited instances, Legal Claims.

4. Processing of Special Categories of Personal Data and Criminal Conduct Data

   Some types of personal data are considered to be sensitive and are accorded greater protection under data protection legislation. These include:
   

   • "Special Categories of Personal Data" which include personal data that reveals racial or ethnic origin, political opinion, religious or philosophical beliefs, trade-union membership, and the processing of genetic data, biometric data in order to uniquely identify a person or data concerning health, sex life and sexual orientation. Data concerning health covers Personal Data relating to the physical or mental health of an individual which reveals information about the individual's health status; and

   • "Criminal Conduct Data" which is Personal Data relating to criminal convictions or offences or related security measures.

   As a general rule, we do not process Special Categories of Personal Data or Criminal Conduct Data. However, in order to perform our obligations as the registered owner of the vehicle and provide our services effectively, we might be required to process sensitive information about drivers in the following limited circumstances:

   • Health/medical information: We may process health information in the course of providing services in response to an accident or Vehicle damage/loss. This is due to the fact that we may receive accident reports in our capacity as the registered owner of the vehicle and these reports sometimes contain a small amount of health/medical information. We are not in control of the content of these reports, which will in some cases also be used for insurance purposes.

     This health information may be shared with law enforcement agencies, insurers or impacted parties, in the event of an accident or a potential legal claim.

      

   • Criminal Conduct Data: As the vehicle is considered to be a source of increased danger and causing a traffic accident may lead to criminal charges to a driver or the vehicle might be involved criminal activities, we may receive requests and information relating to criminal offences and possible offences of drivers from law enforcement agencies or courts, which may arise in correspondence that is incidental to our role as the registered owner of the vehicle.

     Personal data may be shared for this purpose with law enforcement agencies or courts to advise that a Vehicle leased to you may be involved.

   We do not process above mentioned information by any other means or for any other purpose.
   
   

5. How long do we keep your personal information?

   Personal data is kept by ALD Automotive SIA, in an active base, for the time necessary to achieve the objective pursued at the time of their collection.

   The retention period is therefore initially set by ALD Automotive SIA according to the operational needs necessary for the execution of each individual rental contract and taking into consideration any recommendations of the local Data protection authority.

   However, certain longer retention periods may result from legislative and regulatory texts. Some laws also require that documents/information containing personal data be retained for a specific period of time for evidentiary purposes or in anticipation of possible litigation until the action in question is time-barred. For example, a general limitation period for bringing civil claims is ten years.  ALD is therefore obliged to keep certain personal data beyond the execution of the lease contracts, even though it no longer has any use for them, in the form of so-called intermediate archives.

   In case of litigation, we may keep your personal information until the end of such legal action, including any potential periods for appeal. We will then either delete or archive it according to the law in force.

   At the end of these periods, the personal data is:

   • deleted; or
   • archived; or
   • anonymized.
     
     

6. Who ALD Automotive SIA may share your personal data with.

   ALD understand that you do not want us to provide your personal information directly to third parties for their own marketing purposes without your consent. However, ALD occasionally need to use partners or processors to provide you with the requested services and a better experience, for the purposes described above. We therefore limit our sharing of your personal information on a need-to-know basis as follows:
   

   • with internal business departments such as sales, customer care/quality department, marketing, IT services, support and maintenance. Inside the ALD Automotive Group, we may share your personal data with other ALD Automotive entities, who may only use your personal information in compliance with this Policy.  

   • with our service providers, such as data hosting service providers, call centers, data administrators, vehicle manufacturer/dealer, maintenance and breakdown service providers, vehicle recovery tracing agents, vehicle delivery and collection agents, third parties who provide maintenance and servicing of any vehicles you hire as part of the service located in Estonia or within the European Economic Area and instructed to only use your personal information in accordance with our instructions.

   • with unaffiliated partners, such as banks, our insurers and professional advisers etc.

   • where needed to affect the sale or transfer of business assets, in connection with a bankruptcy proceeding, to enforce our rights, protect our property, or protect the rights, property or safety of others, or as needed support external auditing, compliance and corporate governance functions. 

   • when required to do so by law, such as in response to a subpoena, including to police, law enforcement agencies and courts in the countries where we operate.

   • with a person to whom we assign our rights under your Agreement.

7. Export of personal data outside of the EEA

   In general, all of the ALD databases are located inside the European Union. However, ALD may transfer your personal data from the Europe to countries within or outside the European Economic Area. The countries outside of the EEA may not provide the same level of protection as is available in the EEA. If we transfer your personal data outside the EEA, we will ensure that adequate levels of protection are in place in relation to the processing of your personal data.

   However, certain countries outside the EEA have been approved by the European Commission as providing essentially equivalent protections to EEA data protection laws and therefore no additional safeguards are required to export personal data to these jurisdictions. These countries are listed online at:

   https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en 

8. Your rights

   In order to protect data subjects concerned by the processing of personal data, the GDPR has implemented rights. The rights in question are as follows:
   
   

   Data subject Right	Description of the right	GDPR Article
   Right of access	You can obtain information relating to the processing of your personal data, and a copy of such personal data. If you make such a request, we will provide you with all the information on the purposes of the processing, categories of data processed, categories of recipients, data retention term, your rights to rectify, delete or restrict the data accessed if applicable.	Article 15
   Right to rectification	When you consider that your personal data are inaccurate or incomplete, you can require that such personal data be modified accordingly	Article 16
   Right to erasure (right to be forgotten)	You can require the deletion of your personal data, to the extent permitted by the law	Article 17
   Right to restriction of processing	You can request a restriction on the use of your personal information	Article 18
   Right to data portability	Where legally applicable, you have the right to have the personal data you have provided to us be returned to you in an intelligible format.	Article 20
   Right to data portability Right to object	You can object to the processing of your personal data, on grounds relating to your particular situation. You have the right to object to the processing of your personal data for direct marketing purposes, which includes profiling related to such type of marketing.	Article 21

   
   Please note that at any time you have the right to address a complaint to the competent local supervisory authority, but we kindly as you refer your complaint to us at first.
   
   

9. Security and data storage

   Security and data storage.

   No data transmission over the Internet or through a website can be guaranteed to be secure from intrusion. However, in order to ensure fair and transparent processing, we will, taking into account our processing activities, adopt appropriate procedures for the processing of personal data, which shall include implementing technical and organisational measures which take into account the harm that may be suffered, and correct inaccuracies identified in personal data processed, so that risk of errors are minimised and your Personal data is processed in a fair and secure manner.

   All information you provide to us is stored on our secure servers. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site or application, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

   We will treat all of your information in strict confidence and will endeavour to take all reasonable steps to keep your personal data secure once it has been transferred to our systems. We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction of your personal data, and data stored on our website and associated databases.

   All information you provide to us is stored on our, or our suppliers,' secure servers and accessed and used subject to our security policies and standards. We ask that you:

   • Refrain from sharing any password providing access to any part of our website with any other person; and
   • Comply with any other security procedures that we may notify you of from time to time.
     
     

10. Cookies Policy & Websites

    ALD Automotive SIA may collect data via cookies to improve the user's browsing experience. Cookies are used, among other tracers, to store preferences and settings in order to save time, enable login, combat fraud, analyze the performance of the website and the services provided by the renter, and compile visit statistics.

    For more details you can consult our Cookie policy.

11. Updates of this Privacy Policy 

    We may modify this Privacy Policy periodically to be compliant with any new regulations, so please review it regularly. If we change this Privacy Policy, we shall notify you by means of providing a notice on our website homepage. This Notice was last amended on 8 October 2021.
    
    

12. How to contact us

    If you have any queries relating to this Notice or use of your personal data, please contact us at info.ee@aldautomotive.com.