Privacy Policy
Basic information
Data subject
This data protection declaration is directed at all persons who visit this website. All personal designations refer to all genders and the associated forms of language, in particular diverse, female, male. Each personal designation is to be understood with the addition "(m/f/d)".
Person responsible
The person responsible for the processing described here is: Choice AG, Thomas-Mann-Str. 16-20 90471 Nürnberg, T: +49 911 480499-0, E: info@choice.de, represented by the managing directors Antonio Pardo unc Bego Jasenac. The data protection officer can be reached as follows: Stanhope SG Datenschutz GmbH, dpo@thenextstanhope.de.
Rights
(1) The data subjects have the following rights with regard to the data stored about them: the right to information, the right to correction of incorrect data, the right to deletion of data for which there is no longer a reason for storage, to restriction of processing and to data portability. Furthermore, they have the right to complain to the supervisory authority responsible for the controller.
(2) Insofar as the processing is based on the consent of the data subjects, the data subjects may revoke their consent at any time and with effect for the future; for example, by sending an informal message to one of the above-mentioned contact channels (controller).
(3) Insofar as the processing is based on the fulfilment of a legitimate interest, thus on Article 6 (1) sentence 1 lit. f DSGVO, the data subjects may object to the processing at any time, for example by sending an informal message to one of the above-mentioned contact channels (responsible party). If the objection is justified, the processing will be terminated. If the legitimate interest lies in direct marketing, the objection is always justified.
Transfer to countries outside the European Union
(1) If personal data are transferred to bodies outside the European Union, the controller must communicate supplementary safeguards in accordance with Article 44 et seq. GDPR.
(2) If the controller refers to a so-called adequacy decision in the following data protection declaration, this means that the receiving body is located in a country, territory or specific sector for which the EU Commission has decided that it offers an adequate level of data protection. The guarantee then follows from Article 45 GDPR.
(3) If the controller refers to the so-called EU standard contractual clauses in the following data protection declaration, this means that the receiving body has contractually committed itself to respecting the EU data protection principles on the basis of the so-called EU standard contractual clauses, the guarantee then follows from Article 45 of the GDPR.
(4) If the controller refers to so-called binding, internal data protection regulations in the following data protection declaration, this means that the competent supervisory authority has approved the transfer. The guarantee then follows from Article 47 DSGVO.
(5) If the controller refers in the following privacy statement to the fact that the data subjects have expressly consented to the transfer to a country outside the European Union, this means that they nevertheless consent to the transfer in the knowledge of all the risks involved. The guarantee then follows from Article 49(1)(a) of the GDPR. In this context, we point out the following risks: In the USA, the Republic of India and the Russian Federation, no data protection law comparable to the GDPR has been codified. The state authorities there have approved intensive data access, whereby the principle of proportionality regulated in the EU is not applied. Furthermore, there is no effective legal protection for EU citizens in these countries.
(6) The above advice is given only as a precautionary measure. They only apply if and insofar as reference is made to them in the following data protection declaration.
Further notes
(1) Automated decision-making, including profiling, does not take place.
(2) A legal obligation to process exists only if reference is made below to Article 6(1) sentence 1 lit. c DSGVO.
Processing operations in connection with contracts
Purpose and legal basis, clarification on contractual partners
(1) Unless otherwise specified in this section ("Processing operations in connection with contracts"), all processing operations described in this section have as their purpose the establishment, performance and/or termination of contracts. At
a. Contracts that are not employment contracts, the legal basis is then Article 6(1), first sentence, lit. b DSGVO.
b. Employment contracts then Article 88 DSGVO in conjunction with. § Section 26(1) BDSG2018 the legal basis.
(2) The only contractual connection between the data subject and the controller concerns the user relationship. As soon as a contact occurs that leads to the initiation of a contract for the booking of a rental car with an affiliated selected partner company of Jaguar and Land Rover Rent, the data controller here acts only as a processor of the respective rental company. This rental company is then responsible within the meaning of Article 4 (7) of the Data Protection Regulation.
Storage period
(1) Personal data, the processing of which is described in this section, shall be processed for as long as it is required for the establishment, implementation and/or termination of the contracts. A longer retention period, which is independent of the achievement of the purpose described in sentence 1, may result from paragraphs 2 to 5.
(2) Personal data shall be retained for three years, with this period commencing on 31 December of the calendar year in which the data were collected. By way of derogation from the above (processing operations in relation to contracts / purpose and legal basis), this processing serves the legitimate interest of the controller to defend itself against claims arising from the contractual relationship within the regular limitation period. Exceptionally, therefore, Article 6(1) sentence 1 lit. f DSGVO is the legal basis.
(3) Personal data contained in received commercial or business letters as well as in other documents that are relevant for taxation purposes shall be retained for six years, in derogation from the above (processing operations in connection with contracts / purpose and legal basis), with the retention period generally starting at the end of the calendar year in which the relevant document was created. This processing serves the fulfilment of tax and commercial law obligations according to § 147 AO and § 257 HGB. Exceptionally, therefore, Article 6(1) sentence 1 lit. c DSGVO is the legal basis.
(4) Personal data resulting from books and records, inventories, annual financial statements, individual financial statements, consolidated financial statements, management reports and group management reports, opening balances, accounting vouchers, customs-related documents, commercial books as well as work instructions and other organisational documents required for their understanding shall be retained for ten years in deviation from the above information (processing operations in connection with contracts / purpose and legal basis). As a rule, the retention period begins with the end of the calendar year in which the relevant document was created. This processing serves the fulfilment of tax and commercial law obligations according to § 147 AO and § 257 HGB. Exceptionally, therefore, Article 6(1) sentence 1 lit. c DSGVO is the legal basis.
(5) Personal data resulting from an application that does not lead to an employment relationship will be stored for six months after receipt of the rejection by the data subject, in derogation of the above (processing operations in connection with contracts / purpose and legal basis). This storage serves the legitimate interest of the data controller to defend itself against the allegation of a violation of the AGG, whereby the interest usually ceases to exist after six months, because then an assertion within the period stipulated by Article 15(4) AGG can usually no longer be expected. Exceptionally, Article 6(1) sentence 1 lit. f DSGVO is therefore the legal basis.
Form
In brief: The controller provides one or more forms on this website.
Processing in detail: Communication takes place between data subjects and the data controller via the form tool, whereby the data subject's input is documented and transmitted to the data controller.
Data processed: Data on the content, manner and scope of the entries in the respective form.
Internal area
In brief: Data subjects can log into an internal area on this website, for which the data controller processes their access data. Furthermore, the controller processes information about interactions of data subjects within this area.
Processing in detail: On this website, data subjects have the possibility to register for the use of an internal area, subsequently log in to it and finally log out again. When they register for the internal area, the data controller collects the data they provide during the registration process. Within the internal area, the controller registers actions of data subjects to the extent necessary to provide the internal area with its functions (e.g. booking a rental car with an affiliated selected partner company of Jaguar and Land Rover Rent).
Data processed: (1) registration data entered by data subjects, (2) data about logins, (3) about actions taken by data subjects within the log-in area, (4) about log-out status.
Processing operations with the consent of the data subjects
Purpose and legal basis
Unless otherwise stated in this section ("Processing operations with the consent of the data subjects"), the processing operations are based solely on the consent of the data subjects. The respective purpose is stated in the individual description of the processing. At
a. Data subjects who are not employees of the controller, the legal basis is then Article 6 (1) sentence 1 lit. a DSGVO.
b. Employees of the controller are then Article 88 DSGVO in conjunction with. § Section 26 (2) BDSG is the legal basis.
Storage period
(1) Personal data whose processing is described in this section shall be processed until the relevant consent has been revoked.
(2) By way of derogation from subsection (1), the Controller shall retain the data from which the granting of consent is derived for three years, such period commencing on 31 December of the calendar year in which the consent is revoked. By way of derogation from the above (processing operations with the consent of the data subjects / purpose and legal basis), this processing serves to fulfil the legal obligation to be able to prove that consent was given. Exceptionally, Article 6(1) sentence 1 lit. c DSGVO in conjunction with. Article 7(1) DSGVO is the legal basis. Three years after revocation of consent, this obligation ceases, at the latest when the statute of limitations is reached.
Type of consent (cookie consent tool)
Certain declarations of consent, in particular those obtained by the controller for the use of marketing and/or analysis cookies and the associated data processing, are obtained via a so-called cookie consent tool. In this process, all data (IP address, consent status) are stored. In deviation from the above (processing operations with consent of the data subjects / purpose and legal basis), this processing serves to fulfil the legal obligation to be able to prove that consent has been given. Exceptionally, Article 6(1) sentence 1 lit. c DSGVO in conjunction with. Article 7(1) DSGVO is the legal basis. Three years after revocation of consent, this obligation ceases to apply, at the latest when the statute of limitations is reached.
Analysis tools
Very briefly: In order to evaluate the usage behaviour on and interaction with this website, the controller uses cookies. He then evaluates this information in order to be able to design this website in a more targeted manner.
Processing in detail: So-called cookies are used to analyse the user behaviour of the persons concerned on this website. These are text files that are stored on the computer of the data subject and enable an analysis of the use of the website. The information about the usage behaviour is used to create reports about the activities and interactions. The data controller here uses this data to be able to regularly improve the user experience on the website. The statistics obtained also enable him to improve his offer in order to direct the interest of the data subjects more specifically to products and services that are suitable for them.
Data processed: cookie-based data on interactions (ins. order of interactions, length of stay).
Third party providers: In connection with the analysis of user behaviour, the analysis tool "Google Analytics" of Google Ireland Ltd (Ireland - EU) is used, which has been commissioned in accordance with Article 28 DSGVO. More details on the type and manner of processing by this third-party provider are described here: https://support.google.com/analytics/answer/9306384?hl=de. In this regard, it should be added: The IP address is shortened beforehand by the provider within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a server of the provider in the USA and shortened there. The IP address transmitted by the browser when using this tool is not merged with other data by the provider. The tool is also used for a cross-device analysis of visitor flows, which is carried out via a user ID. The persons concerned can deactivate the cross-device analysis in their customer account under "My data", "Personal data". For information purposes, it should be noted that this tool is used with the extension "_anonymizeIp()". This means that IP addresses are processed in abbreviated form, which means that they cannot be linked to a specific person. Insofar as the data collected about the persons concerned is related to a person, this is therefore immediately excluded and the personal data is thus immediately deleted. The processing is not prevented by the fact that the data is transmitted to the USA, possibly in cooperation with Google LLC (USA). This is because the personal data is only processed if the data subjects consent to the associated data transfer to the USA (cf. Article 49(1)(a) DSGVO). In this respect, the above-mentioned risk information (basic information / transfer to countries outside the European Union) is authoritative.
Third-party provider: In connection with the analysis of usage behaviour, the central control tool "Google Tag Manager" of Google Ireland Ltd (Ireland - EU) is used, which has been commissioned in accordance with Article 28 of the GDPR. More details on the type and manner of processing by this third-party provider are described here: https://marketingplatform.google.com/intl/de/about/tag-manager/. It should be added that this tool enables the controller to integrate various codes and services on this website in an orderly and simplified manner. This tool implements the tags or triggers the tags integrated with them. When a tag is triggered, the provider may also process personal data. It cannot be ruled out that the provider also transmits the data to a server in a third country. However, the processing is not prevented by the fact that the data is transmitted to the USA, possibly in cooperation with Google LLC (USA). This is because the processing of personal data only takes place if the data subjects consent to the associated data transfer to the USA (cf. Article 49(1)(a) DSGVO). In this respect, the above risk information (basic information / transfer to countries outside the European Union) is authoritative.
Data transfer to Jaguar Landrover
In brief: Data subjects may consent to the transfer of their contact details to Jaguar Landrover.
Processing in detail: As part of the registration process, data subjects can provide the following declarations of consent: "I consent to Jaguar Land Rover Deutschland GmbH using my data processed during the registration and usage process for advertising purposes as described in the data protection information. This may be done in writing, by telephone, by email." If a declaration of consent is given, the data controller will then pass the data on to Jaguar Land Rover Deutschland GmbH. The latter processes the data of the data subjects for the purpose of direct marketing. Data subjects can find more information at: https://www.jaguar.de/datenschutz/index.html oder https://www.landrover.de/privacy-policy/index.html
Data processed: Name, address, telephone number, e-mail address, status consent
Map service.
In brief: In order to show the data subjects directions or to display a map for other reasons, the data controller displays maps on this website. If data subjects access pages that show these maps, data about the data subjects will be transmitted to the data controller here and, in some cases, to the provider of the map service.
Processing and third-party providers in detail: On this website, a map is displayed that shows the data subjects directions. As soon as the data subject accesses the corresponding page, the data to be mentioned in a moment are transmitted to the data controller here as well as to the provider of the map service. The map is only displayed if consent has been given in advance.
Data processed: (1) data on the use of this website, (2) IP address and, where applicable, (2) data on the address entered for route planning.
Third-party providers: The map service "Google Maps" of Google Ireland Ltd (Ireland - EU) is used, which has been commissioned in accordance with Article 28 DSGVO. However, it cannot be ruled out that a data transfer to or an integration of the parent company, Google LLC (USA) takes place. More details on the manner of processing by this third-party provider are described here: https://support.google.com/maps/answer/7576020?hl=de#null. The specific data transferred also depends on whether the data subject uses this website as a logged-in user of a Google account. Details on data transmission and use can be found here: https://policies.google.com/privacy?hl=de. The use of this third-party provider is not precluded by the fact that data transfer to or integration of the parent company based in the USA cannot be ruled out. This is because the processing of personal data only takes place if the data subjects consent to the associated data transfer to the USA (cf. Article 49(1)(a) DSGVO). In this respect, the above-mentioned risk information (basic information / transfer to countries outside the European Union) is decisive.