Privacy Policy

Protection policy of personal data

We inform you that the personal data you provide will be processed by Canary Islands Car, SLU (CICAR), as the data controller, for the purposes indicated below. Additionally, in application of Recital 48 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR), your personal data may be communicated to other companies within the Group - https://www.grupocabreramedina.com - in accordance with the legitimate interest of the Business Group.

Processing and Purposes: (I) Responding to information requests received through any means. (II) Managing requests received through the website, by phone, or at the counter, for vehicle rental reservations. (III) Creating a web user and authorized driver account, and preloading data into the rental contract. (IV) Monitoring service quality. (V) Customer registration for managing the contract linked to the rental service. (VI) Issuing invoices, accounting, fiscal, and commercial management. (VII) Responding to user privacy rights. (VIII) Registering and communicating vehicle renters' data to competent authorities.

Legal Basis: (I), (II), and (III) Consent of the data subject. (IV) and (V) Execution of a contract or pre-contract for the provision of services. (VI), (VII), and (VIII) Legal obligation.

Recipient: (II) Enterprise Holdings, Inc. (https://privacy.ehi.com/en/home.html) for managing reservations outside the Canary Islands (Peninsula and Balearic Islands). (IV) Trustpilot (https://legal.trustpilot.com/for-businesses/data-processing-agreement). (V) D.G. de Tráfico in case of a reported infraction. (VI) AEAT, Commercial Registry, Canary Islands Tax Agency. (VIII) Security Forces, Judicial Authorities, and Public Prosecutor's Office.

Retention Period: (I) and (II) The necessary period to address and manage the request. (III), (IV), (V), (VI), and (VII) Six years for commercial and contractual purposes; in the case of certain tax regulations, during the period for potential audits by tax administrations. Subsequently, the data will be stored blocked for judicial purposes. (VIII) Three years, as required by the data controller.

In all cases, while legal obligations and possible responsibilities derived from the purposes persist.

You can exercise your rights of access, deletion, and rectification of your data, as well as limitation or opposition to its processing, by sending us an email to: lopd@cicar.com, always indicating the Reference: “Cicar / Data Protection” and attaching a document proving your identity, such as a copy of your ID. You may also file a complaint with the Spanish Data Protection Agency, especially if the previous exercise of rights has not been addressed. We also commit to complying with the confidentiality obligation of all personal information and to adopt necessary security measures to prevent unauthorized processing, loss, or destruction.