Skip to main content

Privacy policy

Dear Customer, pursuant to articles 13 of EU Reg. n. 679/2016 “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 relating to the protection of natural persons with regard to the processing of personal data” (“Regulation”) and Legislative Decree 196/2003, “Code regarding the protection of personal data” (“Code”), where compatible with the Regulation, in relation to personal data referable to you, we inform you of the following.

  1. Identity and contact details of the Data Controller

The Data Controller is E-Vai Srl, with registered office in Piazzale Luigi Cadorna 14 – 20123 Milan (MI) (hereinafter also the “Owner” or the “Company”). Any request relating to personal data processed by the Company may be sent to the registered office indicated or by writing to the email address customerservice @e-vai.com.

  1. Contact details of the Data Protection Officer

The Data Protection Officer (“RPD”) or Data Protection Officer (“DPO”) of the Company can be contacted at its registered office (P.le Cadorna 14, 20123) or at the following address: dpo @e-vai. Com.

  1. Purpose of data processing and legal basis thereof.

In compliance with current legislation on the protection of personal data, the Company informs the Customer that it intends to acquire - or already holds - personal data relating to the Customer, for the following purposes:

  1. provide the requested service and execute the Framework Car Sharing Service Contract (“Contract”) stipulated by the Customer in the manner and within the terms described by the same Contract and by the Car Sharing Service Regulations; in relation to this purpose, the legal basis of the processing is provided for by art. 6 paragraph 1 letter. b) of the Regulation: “Processing is lawful only if and to the extent that at least one of the following conditions occurs: ....b) processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same";
  2. rilevare the level of satisfaction with the car sharing service: in relation to this purpose, the legal basis of the processing is provided for by art. 6 paragraph 1 letter. a) of the Regulation: "the interested party has expressed consent to the processing of his/her personal data for one or more specific purposes"; the processing will be carried out only if the Customer has given his free consent;
  3. for commercial and promotional purposes: in relation to these purposes, the legal basis of the processing is the same as referred to in point 2; the processing will be carried out only if the Customer has given his free consent;
  4. for market research: in relation to this purpose, the legal basis of the processing is the same as referred to in point 2; the processing will be carried out only if the Customer has given his free consent;
  5. for organizational and production (efficiency) needs, the protection of company assets and workplace safety; the legal basis of the processing is provided for by art. 6 paragraph 1 letter. f) of the Regulation: "processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that it does notevathe interests or fundamental rights and freedoms of the data subject which require protection of personal data”.

Please remember that the art. 130, paragraph 4 of the Code, provides that the e-mail coordinates can be used for commercial communication activities, the sending of advertising material or direct sales even without the prior consent of customers provided that:

  1. the owner intends to offer similar services to those covered by the previous sale;
  2. the interested party is adequately informed, in particular of the possibility of objecting to the processing at any time, easily and free of charge (so-called OPT-OUT system);
  3. the interested party does not refuse such use initially or during subsequent communications.

Therefore the Customer may object to the aforementioned processing at any time by sending an e-mail to the following address customerservice @e-vai.com, as well as exercising all the rights referred to in the Regulation and the Code. Some data may be processed in aggregate and anonymous form in order to develop statistics aimed at improving the service offered.

  1. Any recipients or categories of recipients of the data

The personal data provided by the Customer are those strictly necessary for the provision of the service and may also be communicated and transmitted to other subjects, such as insurance companies or public bodies (for example in the case of traffic violations). The personal data strictly necessary for the provision of the service may also be communicated by the Company to external parties due to the assignment to them of certain services, carried out on its behalf and on the basis of specific contracts, of a technical, organisational, operational and/or nature. or legal such as, by way of example: parent companies, consultants, companies that offer IT, telematic, financial, administrative and insurance services.

  1. Transfer of data to a third country or to an international organization

The personal data provided by the Customer will not be transferred to third countries or to an international organization outside the EU.

  1. Period of retention of personal data

The personal data provided for the purposes referred to in point 3.1 are kept for a period not exceeding one year from the expiry of the Contract, without prejudice to the existence, at the aforementioned deadline, of disputes, or requests for compensation/penalties arising under the same Contract , for which it is necessary to keep the relevant documentation until their resolution. Some of the personal data, processed for tax and administrative purposes, are retained for a period of at least 10 years in relation to the civil obligations of keeping accounting records.

Any personal data provided in relation to points 3.2 and 3.4 are anonymized after collection or after the closure of any disputes in relation to the same.

The personal data provided in relation to point 3.3 are retained until consent is revoked.

The personal data referred to in point 3.5, in particular relating to the geolocation of vehicles, are kept for the times proportionate to the purposes pursued as described in the following art. 8.

  1. Rights of interested parties
    1. Right of access, rectification, cancellation and limitation of processing The Customer has the right to request:
      • access to data (the right to obtain confirmation from the Data Controller as to whether or not personal data is being processed and, in this case, to obtain access to personal data and information concerning you, as well as, if the personal data are transferred to a third country or to an international organisation, to be informed of the existence of adequate guarantees pursuant to current legislation);
      • data rectification (the right to obtain from the Data Controller the rectification of inaccurate personal data concerning you, as well as, taking into account the purposes of the processing, the integration of incomplete personal data, also by providing a supplementary declaration);
      • the deletion of data (the right to obtain from the Data Controller the deletion of personal data concerning you in the cases provided for by current legislation);
      • the limitation of processing (the right to obtain the limitation of processing in the cases provided for by current legislation; if processing is limited, personal data are processed, except for storage, only with the consent of the interested party or for the verification, the exercise or defense of a right in court or to protect the rights of another natural or legal person or for reasons of public interest relatingevabody of the Union or of a Member State).
    1. Right to data portability

If the processing is based on consent or a contract and is carried out by automated means, the Customer has the right to receive the personal data concerning him or her in a structured, commonly used and machine-readable format, as well as the right to transmit such data to another data controller.

In exercising your rights regarding data portability, you have the right to obtain the direct transmission of personal data from one data controller to another, if technically feasible.

The exercise of the right to portability is without prejudice to the right to obtain the deletion of data. This right does not apply to processing necessary for the execution of a task of public interest or connected to the exercise of public powers vested in the data controller.

    1. Right to object

The Customer has the right to object, at any time, for reasons related to his particular situation, to the processing of personal data concerning him in case of processing necessary for the pursuit of a legitimate interest of the data controller or of third parties. If personal data is processed for direct marketing purposes, the Customer has the right to object at any time to the processing of personal data concerning you carried out for such purposes, including profiling to the extent that it is connected to such direct marketing. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

    1. Exercise of rights

Any request connected to the exercise of the rights referred to above may be sent to the Data Controller at the following address: customerservice @e-vai.com.

    1. Right to withdraw consent

If the processing of the Customer's personal data or particular categories of personal data is based on consent, the Customer will have the right to withdraw consent at any time. In this case, processing operations carried out before the revocation will remain unaffected. Consent may be revoked by sending a specific request to the Data Controller at the contact details and addresses indicated above.

    1. Right to lodge a complaint with a supervisory authority

In the event that the Customer believes that the processing concerning him violates the legislation in force, he will have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which he habitually resides, works or the place where it occurred the alleged violation.

    1. Nature of the provision of data. Obligation to provide personal data and possible consequences of any refusal.

The provision of data is not mandatory. Without the data whose communication is necessary to provide the service requested by completing the form on the website www.e-vai.com the Company will not be able to activate the Contract.

  1. Data processing through satellite devices (GPS)

The Company informs the Customer that satellite devices capable of detecting are installed on the vehiclesevare the location of the vehicle (and therefore of the Customer and any other authorized drivers).

The geolocation data is necessary for the following purposes: 1) to allow the opening and closing of the rental; 2) protect the company (e.g. in the event of theft or failure to return the vehicle according to the prescribed deadlines, for the management of administrative violations of the Highway Code, for the management of accidents; 3) allow emergency intervention in the event of a breakdown on the vehicles; 4) optimize fleet management (i.e. consult the history of data recorded for the vehicles in the fleet such as routes taken, travel and stop times, km traveled and time taken, kilometer monitoring and diagnostics); for this purpose the data is processed in anonymous and aggregate form.

The data is stored up to a maximum of:

  • 24 months, in accordance with the deadline set by the art. 2947 paragraph 2 of the civil code, in the event of an accident for a limited period of time (30 seconds before and after the accident)
  • 180 days in the case of administrative violations of the Highway Code for a limited period of time (30 seconds before and after the event which is the subject of the dispute report).
  • 24 months for the purposes referred to in point 4.

The data will not be used in processing operations incompatible with the purposes declared above. The processing of the aforementioned data is carried out with measures aimed at preventing any tampering and therefore preserving its authenticity, accuracy and integrity. This data is stored in compliance with all necessary security requirements.

For the protection purposes described above, the data may be communicated exclusively to insurance companies, parent companies for the performance of administrative and legal services, law firms, public bodies and judicial authorities.

Close Menu