Privacy policy for visitors to this website with references to declarations of consent

Hello and thank you for your interest in our website. For the sole purpose of improved readability, the following privacy policy does not use male, female or gender-neutral language forms. All personal references apply to all genders: male, female, and gender-neutral. Along with this and other matters, we also take your rights to privacy, data protection and informational self-determination very seriously. For this reason we would like to provide you with the following information:

Who are we? Who is responsible for data protection (Data Protection Officer)?

Choice AG, Thomas-Mann-Strasse 16–20, 90471 Nuremberg, Germany. Telephone: +49 911 480499-0; Email: info@choice.de, Management Board: Mr Antonio Pardo, Mr Bego Jasenac, Mr Hannes Beyer. Together with Jaguar Land Rover Europe and Jaguar Land Rover España S.L.U, we operate “Jaguar & Land Rover Rent”. We have also decided to nominate a Data Protection Officer. This is lawyer Dr Stephan Gärtner from StanhopeONE (Data Protection Officer certified by TÜV Süd), who you can reach via dsb@stanhope.de.

What happens when using the website purely for information?

(1) If you use our website purely for information, i.e. if you neither register as a user nor transmit additional information, we capture the following information from you: IP address, data and time of the request, time difference to Greenwich Mean Time (GMT), requested content (the specific page), access status/HTTP status code, the relevant size of data transfer, website responsible for the request, browser, operating system and its interface, language and browser software version. We receive this data by means of cookies and directly from your browser.

(2) The purpose of this processing is to make our website available and to carry out statistical analysis.

(3) The legal basis for this is Article 6(1)(1)(f) GDPR, whereby the processing of personal information is possible even without the consent of the affected party if processing is necessary for the safeguarding of the legitimate interests of the responsible party or a third party, except where these interests are overridden by the interests or fundamental rights and freedoms of the relevant person and where these require the protection of personal data, particularly if the relevant person is a child. The purposes listed under Clause 2 are in our economic interest. If we use cookies, we will refer you to the information under “How do we use cookies on this website?”, in particular with regard to the maximum period of retention.

(4) There is no legal duty to process this data.

What happens when using our contact form?

(1) If you communicate with us using our contact form, we will capture the data that you input into the form.

(2) Only you know the reasons for making contact; the reaction to this simultaneously describes the purpose of our processing.

(3) If it concerns a specific debt obligation, be that in relation to its initiation, execution or conclusion, the legal basis for processing is Article(6)(1)(b) GDPR, because communication is then required for the initiation, execution and conclusion of the debt obligation. We always save this personal information until the end of the contractual relationship between us. In this instance we also process your data to fulfil legal duties to which we are subject. The legal basis is Article 6(1)(1)(c) GDPR, § 147 German General Fiscal Law, § 257 German Commercial Code. These regulations state that some of the above data must be kept after the purpose has been fulfilled. We are therefore obliged to keep:

1. data about your person for ten years that originates from books and records, inventories, annual financial statements, separate financial statements as defined by § 325(2a) of the German Commercial Code, group accounts, management reports and group management reports, opening balance sheets, journal vouchers, documents as defined by Article 15(1) and Article 163 of the Union Customs Code, account books and the operating instructions and other organisational documents required for their comprehension. The retention period typically begins at the end of the calendar year in which the relevant document was created (Article 6(1)(1)(c) GDPR, in conjunction with § 147 German General Fiscal Law and § 257 German Commercial Code);

2. data about your person for six years that originates from commercial or business correspondence, reproductions of commercial and business correspondence and other documents that are relevant for taxation. The retention period typically begins at the end of the calendar year in which the relevant document was created (Article 6(1)(1)(c) GDPR, in conjunction with § 147 German General Fiscal Law and § 257 German Commercial Code).

(3) In all other instances, the legal basis for this is Article 6(1)(1)(f) GDPR, whereby the processing of personal data is possible even without the consent of the affected party if processing is necessary for the safeguarding of the legitimate interests of the responsible party or a third party, except where these interests are overridden by the interests or fundamental rights and freedoms of the relevant person and where these require the protection of personal data, particularly if the relevant person is a child. Communication outside a debt obligation is in both our interests, as we must examine your request. We save your data until the purpose connected to legitimate interests has been fulfilled and there are no more retention obligations in accordance with Article 6(1)(1)(c) GDPR.

(4) To the extent that it is not expressly stated in Article 6(1)(1)(c) GDPR, there is no legal obligation to process data.

What happens when I register for and use the internal area?

(1) If you register for the internal area, we capture the data that you provide during the registration process, including salutation, title, first name, surname, company, address, date of birth, landline and mobile number, email address, password. We register your actions in the internal area if this is necessary to establish the debt obligation that is being pursued. The purpose of processing is the establishment, fulfilment and conclusion of the services offered (for example booking a rental vehicle with a selected connected Jaguar and Land Rover Rent partner company).

(2) The legal basis for processing is Article(6)(1)(b) GDPR, because communication is then required for the initiation, execution and conclusion of the debt obligation. We always save this personal information until the end of the contractual relationship between us. However, if this contract ends before six years have passed after receipt of your data, we will save this data for at least six years; this retention period begins at the end of the calendar year in which we received your data.

(3) In this instance we also process your data to fulfil legal duties to which we are subject. The legal basis is Article 6(1)(1)(c) GDPR, § 147 German General Fiscal Law, § 257 German Commercial Code. These regulations state that some of the above data must be kept after the purpose has been fulfilled. This means we may be obliged to keep:

1. data about your person for ten years that originates from books and records, inventories, annual financial statements, separate financial statements as defined by § 325(2a) of the German Commercial Code, group accounts, management reports and group management reports, opening balance sheets, journal vouchers, documents as defined by Article 15(1) and Article 163 of the Union Customs Code, account books and the operating instructions and other organisational documents required for their comprehension. The retention period typically begins at the end of the calendar year in which the relevant document was created (Article 6(1)(1)(c) GDPR, in conjunction with § 147 German General Fiscal Law and § 257 German Commercial Code);

2. data about your person for six years that originates from commercial or business correspondence, reproductions of commercial and business correspondence and other documents that are significant for taxation. The retention period typically begins at the end of the calendar year in which the relevant document was created (Article 6(1)(1)(c) GDPR, in conjunction with § 147 German General Fiscal Law and § 257 German Commercial Code).

(4) To the extent that it is not expressly stated in Article 6(1)(1)(c) GDPR, there is no legal obligation to process data.

What happens when you grant consent during the registration process?

(1) As part of the registration process, you will provide the following declarations of consent:

I hereby agree that Jaguar Land Rover Europe and Jaguar Land Rover España S.L.U, and the European National Sales Companies may use the personal data that was processed during registration and use to contact me for promotional purposes. This can be in writing, by telephone, by email or via social networks.

By providing this declaration of consent, you agree that the personal data provided as part of the initiation, conclusion and execution of this rental contract may be processed and used by Jaguar Land Rover Europe, Jaguar Land Rover España S.L.U, the European National Sales Companies and any service providers contracted by these parties for the purpose of further personal customer care, e.g. for sending product information and service offers, invitations to product launches and other events, information and technical updates, customer magazines and market and opinion polling, particularly customer satisfaction surveys about the Jaguar and Land Rover brands. This can be in writing, by telephone, by email or via social networks. You may revoke such consent at any time.

(2) You can change or revoke a declaration of consent you have made and refuse the processing or use of your data for the purposes of promotional activity or market and opinion polling at any time at datenschutz@choice.de.

(3) Processing is carried out as part of the declarations of consent and is based upon Article (6)(1)(1)(a) GDPR. Data will be saved until consent is revoked, unless there are retention obligations in place at the time consent is revoked.

(4) The legal basis for processing necessary for the collection of consent is Article 6(1)(1)(c) GDPR. According to these regulations, we are permitted to process your data if this is necessary for the fulfilment of a legal obligation to which we are subject. The legal obligation to which we are subject is based upon Article (7)(1) GDPR and Article (5)(1) GDPR. According to these regulations, we are legally obliged to document the collection of consent. This is only possible if we can collect your data as proof. We save the data if it is necessary for proof purposes. If you confirm your consent, the retention period will only end after you revoke your consent, plus the time until the end of the limitation period of any civil claims, i.e. typically on 31 December of the third calendar year after the year in which you revoke your consent.

(6) To the extent that it is not expressly stated in Article 6 (1)(1)(c) GDPR, there is no legal obligation to process data.

How do we use Google Analytics?

(1) We use Google Analytics, a web analytics service from Google LLC (“Google”), which is represented in Europa by Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001. You can find an overview of this provider’s privacy policy at policies.google.com/privacy. In those cases where personal data is transmitted to the USA, Google is subject to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework. We use Google Analytics in order to analyse and regularly improve use of our website. The statistics acquired enable us to improve our service and make it more attractive to you as a user. You can find more details about the function of Google Analytics in Clauses 2 and 3.

(2) Google Analytics uses “cookies”. These are text files stored on your computer that enable analysis of how you use the website. The information about your use of this website generated in this way is usually transmitted to and stored on a Google server in the United States. However, if you are in a country that is a member state of the European Union or a contracting party to the Agreement on the European Economic Area, Google will first truncate your IP address. Only by way of exception will the full IP address be transmitted to a Google server in the United States and truncated there. Google will use this information on our behalf for the purposes of analysing how you use the website, compiling reports on website activity and providing further services related to website and internet use to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. We also use Google Analytics for the measurement of visitor flows across multiple devices, which is carried out using a user ID. You can deactivate the measurement of your use across multiple devices in your customer account under “My data”, “Personal information”.

(3) We would like to note that we use Google Analytics with the extension “_anonymizeIp()”. This causes all IP addresses to be processed in truncated form, which thus rules out any direct personal reference. If collected data includes personal references, this data will be immediately excluded and the personal data will be deleted.

(4) The legal basis for the processing described in Clauses 2 and 3 is your consent in accordance with Article 6(1)(1)(a) GDPR, which you provided through our cookie banner and that you can revoke in particular by deactivating through the cookie banner. With this revocation we will delete your data immediately. Without this revocation, deletion will take place after [14 months] at the latest. You can also disable cookies by setting your browser accordingly; however, if you do this you may not be able to use the full functionality of this website. You can also prevent the data generated by the cookie and related to your use of this website (including your IP address) being transmitted to and processed by Google by downloading and installing the browser plug-in available here: https://tools.google.com/dlpage/gaoptout?hl=en.

(5) The legal basis for processing necessary for the collection of consent is Article 6(1)(1)(c) GDPR. According to these regulations, we are permitted to process your data if this is necessary for the fulfilment of a legal obligation to which we are subject. The legal obligation to which we are subject is based upon Article (7)(1) GDPR and Article (5)(1) GDPR. According to these regulations, we are legally obliged to document the collection of consent. This is only possible if we can collect your data as proof. We save the data if it is necessary for proof purposes. If you confirm your consent, the retention period will only end after you revoke your consent, plus the time until the end of the limitation period of any civil claims, i.e. typically on 31 December of the third calendar year after the year in which you revoke your consent.

(6) To the extent that it is not expressly stated in Article 6 (1)(1)(c) GDPR, there is no legal obligation to process data.

How do we use Google Maps?

(1) On this website we use the Google Maps service. This allows us to display interactive maps directly on the website and enables you to conveniently use the map function.

(2) When you visit the website, Google receives information that you have accessed the relevant subpage of our website. In addition, the data referred to in Clause 3 is transmitted. This happens regardless of whether Google provides a user account that you can log into or whether no user account exists. If you are logged in via Google, your data is directly associated with your account. You should log out prior to activating the button if you do not wish data to be associated with your Google profile. YouTube stores your data as a user profile and uses it for purposes of advertising, market research and/or demand-led configuration of its website. Such evaluation takes place (even for users who are not logged in) for the purposes of demand-oriented advertising and to inform other users of the social network about your activities on our website. You have a right of objection to the creation of these user profiles, whereby you must contact Google in order to exercise this right.

(3) For more information on the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider's privacy policy. Here you will also find further information about your rights in this regard and setting options to protect your privacy: www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield,

https://www.privacyshield.gov/EU-US-Framework.

(4) The legal basis is your consent in accordance with Article 6(1)(1)(a) GDPR, which you provided through our cookie banner and that you can revoke in particular by deactivating through the cookie banner. With this revocation we will delete your data immediately. Without this revocation, deletion will take place after [14 months] at the latest.

(5) The legal basis for processing necessary for the collection of consent is Article 6(1)(1)(c) GDPR. According to these regulations, we are permitted to process your data if this is necessary for the fulfilment of a legal obligation to which we are subject. The legal obligation to which we are subject is based upon Article (7)(1) GDPR and Article (5)(1) GDPR. According to these regulations, we are legally obliged to document the collection of consent. This is only possible if we can collect your data as proof. We save the data if it is necessary for proof purposes. If you confirm your consent, the retention period will only end after you revoke your consent, plus the time until the end of the limitation period of any civil claims, i.e. typically on 31 December of the third calendar year after the year in which you revoke your consent.

(6) To the extent that it is not expressly stated in Article 6 (1)(1)(c) GDPR, there is no legal obligation to process data.

How do we use cookies on this website?

(1) Cookies are also stored on your computer when you visit our website. Cookies are small text files that are saved by your browser to the hard disk of your computer and enable certain information to be sent to the agency that placed the cookie (in this case, to us). Cookies cannot run programs or transmit viruses to your computer. They serve to make the website more user-friendly and effective in general.

(2) We use transient cookies. Transient cookies are automatically erased when the user closes the browser. These include in particular the session cookie. These store a “session ID”, with which various requests from the visitor’s browser can be assigned to the joint session. This allows the visitor’s computer to be recognised when the visitor returns to the website. The legal basis for this is Article 6(1)(1)(f) GDPR, whereby the processing of personal information is possible even without the consent of the affected party if processing is necessary for the safeguarding of the legitimate interests of the responsible party or a third party, except where these interests are overridden by the interests or fundamental rights and freedoms of the relevant person and where these require the protection of personal data, particularly if the relevant person is a child. The purposes listed under Clause 2 are in our economic interest. If we use cookies, we will refer you to each cookie’s explanation, in particular with regard to the maximum period of retention.

(3) We use persistent cookies. Persistent cookies are automatically erased after a prescribed period, which may vary depending on the cookie. The legal basis is your consent in accordance with Article 6(1)(1)(a) GDPR, which you provided using our cookie banner and that you can revoke in particular by deactivating using the cookie banner. With this revocation we will delete your data immediately. Without this revocation, deletion will take place after [14 months] at the latest.

(4) The legal basis for the processing necessary to collect consent in accordance with Clause 3 is Article 6(1)(1)(c) GDPR. According to these regulations, we are permitted to process your data if this is necessary for the fulfilment of a legal obligation to which we are subject. The legal obligation to which we are subject is based upon Article (7)(1) GDPR and Article (5)(1) GDPR. According to these regulations, we are legally obliged to document the collection of consent. This is only possible if we can collect your data as proof. We save the data if it is necessary for proof purposes. If you confirm your consent, the retention period will only end after you revoke your consent, plus the time until the end of the limitation period of any civil claims, i.e. typically on 31 December of the third calendar year after the year in which you revoke your consent.

(5) To the extent that it is not expressly stated in Article 6(1)(1)(c) GDPR, there is no legal obligation to process data.

Do we ensure sufficient data security?

We maintain current technological measures to ensure data security, particularly with regard to the protection of your personal data against risks during data transfer and data access by third parties. These are updated in line with current technological capabilities.

What rights do you have?

You have a number of rights. You have the right to information about the personal data of yours that we process, the right to rectification or deletion, restriction of processing, the right to object to processing and to data portability. You also have the option of complaining about us to the responsible regulatory authority. We politely inform you that these rights may be subject to conditions of which we will avail ourselves.