Cookies Policy

Cookies are small text files that may be used by websites to make the user experience more
efficient. The law says that we may store cookies on your device if they are strictly necessary for
the operation of this website. For all other types of cookies we need your permission. This website
uses different types of cookies. Some of them are placed by independent services that appear on our
pages. You can at any time change or withdraw your consent from the Cookie Statement on our
website.

Privacy Policy on the Processing of Personal Data

PRIME AZORES is committed to data protection. This Privacy Policy on the Processing of
Personal Data aims to provide an overview of the processing of personal data carried out by PRIME
AZORES and to inform its Customers of the nature, scope and purpose of the collection and
processing of personal data, in compliance with the General Data Protection Regulation –
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
(GDPR).

1. To whom the Privacy Policy on the Processing of Personal Data applies
   This information applies to all Customers and Authorised Drivers who sign a contract with PRIMEAZORES for the hiring of passenger vehicles without a driver and contracts or services related to the same.
2. Person responsible for processing personal data
   The entity responsible for processing the personal data is CIBERAÇORES – TECNOLOGIAS DE INFORMAÇÃO LDA.
3. How is personal data collected and what personal data is processed
   PRIME AZORES processes personal data in accordance with the principles of lawfulness, loyalty and transparency, and the principle of data minimisation, insofar as personal data, in its relationship with the data subject, must be processed lawfully, fairly and transparently, and must be adequate, pertinent and limited to what is strictly necessary, as it is essential to the purposes for which they are processed. Unless otherwise specified, the term “processing” includes collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction – Article 4 of the GDPR.
4. Data processed under the contract
   PRIME AZORES collects, processes and uses the personal data provided by the Customer and Authorised Driver, if applicable, which includes, namely:
   1. General data such as name, date and place of birth, nationality, marital status;
   2. Data contained in the identification documents, such as identity card, passport, residence permit or similar, driving licence;
   3. Tax and bank details such as tax payer and, if applicable, credit card details;
   4. Contact details, such as home address, postcode, telephone numbers, email addresses;
   5. Contract data, such as contract number, contract start and end date, price;
   6. Vehicle data such as brand, model, category, registration, chassis number;
   7. Location data of the vehicle, where applicable, in case the return of the vehicle is not carried out on a voluntary basis;
   8. Information on damage caused by accidents or similar, if applicable;
   9. Any other data related to the commercial relationship established between the parties, which is necessary for compliance with the commercial and/or legal obligations arising therefrom;
5. Personal data made available by third parties
   Additionally, and to the extent strictly necessary to conclude and execute a contract, to carry out pre-contractual diligence, or if consent has been given to this effect, personal data legitimately received through other companies, such as commercial partners (brokers), if applicable, of PRIME AZORES may be collected and processed.
6. Purpose and lawfulness of the processing
   Personal data shall be collected and processed by PRIME AZORES in the context of the conclusion and execution of the contract for the hire of passenger vehicles without a driver and other related services contracted, if applicable, and for compliance with contractual obligations, in accordance with article 6 of the GDPR.
7. Data processing in the pursuit of legitimate interests
   PRIME AZORES will process the personal data provided by the data subject, also when it is necessary to safeguard its legitimate interests, namely, to place on a Black List and communicate with the Regional/National Associations of the sector in case of breach of contract; to proceed with the proper collection of the amounts due in situations of breach of contract, damage, or similar situations; for accounting or tax purposes; to initiate criminal proceedings in case of voluntary nonreturn of the vehicle, if applicable; to determine the location of the vehicle for the purpose of recovery by PRIME AZORES, or subcontracted company for that purpose, if applicable; to initiate the legal means it deems appropriate, in case of breach of contract, directly or through its legal department, even if external to the company; to meet accounts and/or settle commissions with its commercial partners (brokers) or similar, if applicable;
8. Collection and processing of data on the basis of their prior
   In specific situations, the personal data of the data subject may be collected and processed by providing free and express consent, particularly for marketing or advertising activities, under Article 6, paragraph 1 of the GDPR.
9. Sharing of personal data
   1. PRIME AZORES shall not share the holder’s personal data to third parties, unless the Customer or Authorised Driver has given express consent to that effect; if it is obliged to do so in compliance with a legal provision, within the scope of legitimate interests; or if it has subcontracted a service provision.
   2. In certain situations, PRIME AZORES may subcontract the provision of services to third parties, such as, for the purpose of processing documentation, forwarding correspondence, providing financial and/or corporate consultancy, providing legal services, providing tax and/or accounting services, providing computer services. In said situations, data processing shall occur in the name and on behalf of PRIME AZORES, which shall ensure that data processing is carried out under contracted terms, with the necessary safeguards to ensure compliance with applicable legal rules, guaranteeing confidentiality, security, and that they are not used for different purposes.
10. Processing of personal data by authorised third parties
    In the event that the Customer or Authorised Driver has given express consent for marketing purposes, its personal data shall be processed under the precise terms in which consent was given. Within this scope, and if expressly indicated and authorised by the data subject, the processing may also be carried out by PRIME AZORES authorised partners.
11. Data transmission to companies of the same corporate group
    PRIME AZORES may transfer to other companies within its corporate group, where applicable, data regarding rental contracts and other related contracts or services supplied, in order to carry out internal administrative, accounting, fiscal, statistical activities and/or to comply with legal obligations or to defend itself in legal disputes, based on the pursuit of legitimate interests.
12. Transmission of location data for the purpose of vehicle recovery
    In case of breach of contract, namely, in situations of breach of contract If the rented vehicle is not returned voluntarily, PRIME AZORES, whenever it receives information and/or data on the location of the vehicle, may transmit such elements to the service provider responsible for the recovery of the property and, if necessary or due to a legal obligation, to the official authorities.
13. Transmission of data to a third country or international organisation
    The personal data of the Customer or Authorised Driver shall not be transferred outside the European Union or third countries, unless PRIME AZORES is obliged to do so based on orders from official or judicial authorities. In order to comply with legal obligations inherent to the rental contract and related services, as well as to comply with road and safety rules regarding the circulation of the vehicle, the personal data of the Customer or Authorised Driver may be transmitted to the judicial and administrative authorities in a third country outside the European Union that is not included in the list of countries with adequate levels of protection. In these cases, PRIME AZORES ensures that any data transfers within this context shall be carried out through additional security requirements for that information and in strict compliance with the regulations in force.
14. Retention of personal data
    PRIME AZORES processes and keeps personal data for the time necessary to comply with its contractual and legal obligations. If there is no legitimate interest for keeping the information, PRIME AZORES shall delete the data after the expiry of the period established for the conservation of personal data.
15. Data subject rights
    With regard to the processing of personal data, the data subject has the following rights:
    1. Transparency of information, communications and rules for exercising the rights of data subjects – the data controller shall take appropriate measures to provide the data subject with the information referred to in Articles 13 and 14 of the GDPR and any communication provided for in Articles 15 to 22 and 34 of the GDPR, regarding the processing, in a transparent, intelligible and easily accessible form. Information shall be provided in writing, or by other means, including by electronic means, as well as verbally, provided that the identity of the data subject is duly proven by other means – Article 12 of the GDPR.
    2. Information and access to personal data – where personal data is collected from the data subject, the data controller, will provide the following information – the identity and contact details of the data controller and, where applicable, its representative; the purposes of the processing for which the data is intended and the legal basis for the processing – Article 13 of the GDPR.
    3. Information to be provided when the personal data are not collected from the data subject – in this case the data controller shall provide the data subject in particular with the following information – the identity and contact details of the data controller, if any, its representative; the purposes of the processing of the personal data and legal grounds for processing – Article 14 of the GDPR.
    4. The data subject’s right of access – the data subject shall have the right to obtain from the data controller confirmation that data relating to it are being processed and, where appropriate, the right to access to the data and, inter alia, the following information – the purposes for which the data are being processed; the categories of data; where possible, the envisaged period for which the personal data will be stored, or if not possible, the criteria used to determine that period; the existence of the right to request from the data controller the erasure or limitation of processing of personal data, or the right to object to such processing the right to lodge a complaint with a supervisory authority; if the data have not been collected from the data subject, the available information on the origin of such data; when the data are transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards, as per Article 46 of the GDPR; the data controller provides a copy of the personal data being processed and may require the payment of a reasonable fee taking into account the administrative costs. If the data subject makes the request by electronic means and unless otherwise requested, the information is provided in ordinary electronic format – Article 15 of the GDPR.
    5. Right of rectification – the data subject has the right to obtain, without undue delay, from the data controller the rectification of inaccurate personal data concerning it; and to have incomplete personal data completed, including by means of an additional declaration – Article 16 of the GDPR.
    6. Right to erasure of data – the data subject has the right to obtain from the data controller, the erasure of their personal data, without undue delay, and the data controller has the right to an obligation to erase the personal data, in the following situations – the personal data are no longer necessary for the purpose for which they were collected or processed; the data subject withdraws the consent on which the processing is based; the data subject objects to the processing and there are no legitimate interests justifying the processing, or the data subject objects to the processing; the personal data has been unlawfully processed; the personal data must be erased for compliance with a legal obligation arising from the European Union or Member State to which the data controller is subject Article 17 of the GDPR.
    7. Right to restriction of processing – the data subject has the right to obtain from the data controller the restriction of processing in the following cases – where the data subject contests the accuracy of the personal data, the processing has been unlawful and the data subject opposes erasure and requests, alternatively, restriction of use; the data controller no longer needs the personal data for the purpose of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; where the data subject has objected to the processing, until it is established that the legitimate grounds of the data controller outweigh those of the data subject – Article 18 of the GDPR.
    8. Obligation of notification or rectification or payment of personal data or restriction of processing – the data controller shall communicate to each of the recipients to whom the personal data have been transmitted any rectification or erasure of data or restriction of processing, unless such communication proves impossible or involves a disproportionate effort. If the data subject so requests, the data controller shall provide it with information on those recipients – Article 19 of the GDPR.
    9. Right to portability – the data subject has the right to receive the personal data concerning it that they have provided to a data controller in a structured, commonly used and machine-readable format – Article 20 of the GDPR.
    10. Right to object and automated individual decisions – the data subject shall have the right to object at any time, on grounds relating to its particular situation, to processing of the data, including profiling. The data controller shall cease the processing of personal data, unless the latter demonstrates compelling legitimate grounds for such processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims – Article 21 of the GDPR.
    11. Automated individual decisions, including profiling – the data subject has the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, which produces legal effects concerning it, unless, it is necessary for the conclusion or performance of a contract between the parties; it is authorised by European Union law or the law of the Member State to which the data controller is subject; it is based on the data subject’s explicit consent – Article 22 of the GDPR.
16. Revocation of consent already given for the processing of data
    Any consent that has been given by the data subject for the processing of personal data may be withdrawn at any time, free of charge and with effect for the future. The withdrawal of consent does not affect the lawfulness of processing previously carried out on the basis of consent, or of other processing activities carried out for contractual or legal reasons.
17. Objection to the processing of personal data
    The Customer or Authorised Driver shall have the right to oppose the processing of their personal data at any time. PRIME AZORES shall stop the processing, unless there are compelling legitimate reasons for such processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
18. Complaint on the processing of personal data
    The Customer or Authorised Driver may lodge a complaint about the way their personal data is handled, by means of communication addressed to PRIME AZORES, through the Complaints Book or with recourse to the National Commission for Data Protection. To exercise any right or request, the data subject may contact PRIME AZORES through:
    
    CIBERAÇORES – Tecnologias de Informação Lda.
    Rua do Contador, 4
    9500-050 Ponta Delgada
    E-mail: protecaodados@primeazores.pt

Privacy Policy

What kind of personal information does PRIME AZORES use?
When you make a rental car booking or request a quote, you will be asked for the relevant pieces of information required to fulfil the services requested; this may include the main driver’s name, age, contact details (email, address and telephone number), date and place of birth, passport information, driving license information and payment information.
To make it easier to manage your bookings, you can open a user account. This allows you to save your personal settings, review previous bookings and manage future bookings.

Security

What security procedures does PRIME AZORES put in place to safeguard your personal information?

In accordance with European data protection laws, we observe reasonable procedures to prevent unauthorized access and the misuse of personal information.
We use appropriate business systems and procedures to protect and safeguard the personal information you give us. We also use security procedures and technical and physical restrictions for accessing and using the personal information on our servers. Only authorized personnel are permitted to access personal information in the course of their work.