Security and Privacy Policy

Auto 44 is a subsidiary of SEPAMAT group. It uses the group's Security and Privacy Policy.

SEPAMAT undertakes to process your personal data in accordance with the provisions of the General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Law No. 78-17 of 6 January 1978 amended relating data processing, files and freedoms ("Informatique et Libertés" Law); which define under which processing of personal data may be implemented. Any information collected on this website that would allow indentifying you, either directly or indirectly, is considered as personal data, and will be treated in accordance with this policy. 

I. Who processes your personal data collected through this website ?

SEPAMAT, whose registered office is located at 310 route de Vannes - BP 30915 - 44703 Orvault cedex 03 - France, is the data controller of your personal data. 

SEPAMAT SAS is the parent company of a group developing rental activities in short and long terms (Europcar Atlantique on a franchise, Loc Eco, Formule LLD), car-sharing (marguerite) and fleet services (Formule). AUTO 44 SAS gathers rental activities. 

II. For what purposes does SEPAMAT collect your personal data ?

The personal data collected on our website are used for the following purposes : 

a. Create your account and provide you with an ID.
This processing is necessary to identify you and to prepare and facilitate your future bookings and rental contracts.

b. Manage your reservation and your rental contract :

• to confirme and guarantee your booking ;
• to modify or cancel your booking ;
• to exchange with you in relation to your booking and leasing (e.g. to provide you with information on your booking, to send you reminder notice before your check-in/check-out, to respond to your questions or suggestions) ;
• to manage your leasing (check-in / check-out of the vehicle) ;
• to manage your invoices ;
• to manage the recovery or amounts due ;
• to manage the potential claims ;
• to manage the potential recovery of compensation for damage to the vehicle ;
• to manage your car insurance.

This processing is necessary for the management of your booking and the preparation of the rental contract.

c. Manage your payment of products and services. 
This processing is necessary to allow the exceution of the rental contract.

d. The improvement of Europcar Atlantique products/services on the basis of customer surveys you have completed.
This processing is based on our legitimate interest in gaining a better understanding of our customers' needs and offering you customized functions to enhance your experience of products and services.

e. The operation of live web chat to provide you a preliminary online assistance.
This processing is based on our legitimate interest in aiming at creating more proximity and establishing a closer relationship with you by notably answering more quickly to your questions.

f. Conduct commercial prospecting and marketing activities, namely : 

• the sending of email and SMS notifications for special promotions/deals ;
• the recording of your rental history to suggest you preferred products/services when looking for new booking/rentals ;
• the recording or your rental history to send you commercial messages, to send you special offers, to make you benefiting from special advantages depending on the frequency of your orders ;
• the sending of emails related to a booking you did not complete or send you a summary concerning a booking enquiry ;
• the management of your loyalty program and membership card ;
• the organisation of promotional contests and sweepstakes ;
• the management and update of Europcar Atlantique customers / prospects database.

Direct marketing processing activities, i.e. any commercial message aiming at promoting SEPAMAT products and services, are subject to your express consent. By exeption, if you are already an existing customer and that the message concerns similar products or services to those you have already pruchased, the underlying processing at promoting these products and services will not be based on your consent but on our legitimate interest.

g. The management of fines, in particular :

• to transfer to the Agence Nationale de Traitement Automatisé des Infractions the identity of the main driver mentioned in the rental contract ;
• to satisfy with the procedures for the recovery of fines to which SEPAMAT is subject with regard to the French and foreign authorities and the corresponding invoicing.

This processing is required by law.

h. Managing and updating a list of customers with certains contractual risks, with regard to :

• payment incidents resulting in legal proceedings ;
• traffic accidents or repeated damages caused by a SEPAMAT customer ;
• accidents or damages caused voluntarily by a SEPAMAT customer ;
• the use of SEPAMAT vehicles in violation of the general conditions of car rental.

This processing is based on our legitimate interest and aims to reduce SEPAMAT's exposure to risks during the execution of the lease agreements. If you appear on this list of at-risk customers, your reservation or rental request will be rejected. Under certain conditions, you will be able to contest this decision by contacting rgpd@sepamat.fr.

i. Geolocation
The geolocation of the rental vehicles intervenes in certain specific cases only - the prevention of the potential infrigements, the fight against the cases of theft and fraud, the verification of the number of kilometers traveled and the obtaining of a state of the vehicle in case of emergency. This processing is based on the respect of a legal obligation and the execution of the lease contract.

III. Who are the data recipients of the personal information we collect about you ?

Categories of recipients

Your personal data will be disclosed, as necessary/relevant, to :

a. To employees and authorized representatives of SEPAMAT ;

b. To agencies and services providers, including IT for technical purposes in order to help SEPAMAT to provide you with its products and services. 
The main IT service providers of SEPAMAT are : 

• 6tm, for development and maintenance of business applications as well as for the maintenance and support of uses of these systems ;
• DoList, for the automation of marketing services ;
• Sales Force, for commercial prospecting between professionals ;
• Adyen, for payment on the website ;
• Oceanet Technology, for data hosting and business applications ;
• iAdvize, for the live web chat ;
• Guest Suite, for the collection and the diffusion of customers reviews ;
• Reynolds and Reynolds, for the information system ;
• Ouest Digital, for community management and the management of advertising campaigns on social networks (Social Ads) ;
• Google Inc. for tracer and cookie management.

c. Regarding the information processed for the payment of fines, to the Agence Nationale de Traitement Automatisé des Infractions in case of contraventions committed abroad ;

d. Regarding the information processed for the purpose of the management and update of a watch list of customers presenting certain contractual risks to the rental division of the Conseil National des Professions de l'Automobile; with a view to their mutualisation among the member companies of this rental division.
SEPAMAT may also disclose your personal data to the extent required by law and/or by the competent authorities.

International transfers (outside the EU)

Depending on the case, certain recipients may be located in countries which have been recognized by the European Commission as ensuring an adequate level of data protection or in countries which has not been recognized as ensuring such a level of protection.
In any case, SEPAMAT has put in place appropriate safeguards to protect your personal data, in compliance with the GDPR.

IV. For what period will Sepamat retain to your personal data ?

• Creation of the account
  Management of the bookings and the leasing contracts
  For the duration of the commercial relationship. However, information that may evidence a right or a rental agreement, or that must be kept in compliance with a legal requirement, may be subject to an intermediate archiving policy for a period of time that does not exceed the time that is necessary for the purposes for which it is kept.
  
• Payment
  Upon effective completion of the payment.
  
• Improvement of products and services according to your preferences
  3 years as from the end of the relationship with the person.
  
• Operation of live web chat
  3 years as from the end of the relationship with the person.
  
• Promotional and marketing activities
  For the customers : 3 years as from the end of the relationship with Europcar Atlantique
  For prospects : 3 years from the collection of personal data or from the last contact from the prospect.
  
• Payment of fines
  For the time necessary to identify the driver (or the potential driver) liable for the infraction leading to the fine, which cannot exceed 45 days after receipt of the fine. However, relevant information may be retained for a longer period of time after receipt of the ticket, as part of an interim archiving policy. Requests from Agence Nationale de Traitement Automatisé des infractions including personal information are deleted once these requests have been proceeded.
  
• Management and update of a blacklist of customers presenting certain contractual risks, including : 
  - payment incidents resulting in legal proceedings ; 
  - traffic accidents or repeated damages caused by an Europcar Atlantique customer ; 
  - accidents or damage intentionally caused by a Europcar Atlantique customer.
  3 years as from the occurrencee of the relevant event.
  
• Use of Europcar vehicle in breach general terms and conditions for rental of vehicles 
  5  years as from the occurrence of this event.

V. What rights can you exercise with respect to the processing of your personal data

In accordance with the GDPR, you can also benefit from the following rights :

• Right to access : the right to obtain confirmation that your personal data are or are not processed and, where necessary, to access such personal data ;
• Right to rectification : right to obtain rectification of inaccurate personal data or the right to have incomplete personal data completed ;
• Right to erasure : right to obtain the deletion of your personal data in certain circumstances ;
• Right to object : at any time, the right to the processing of your personal data for certain situations ;
• Right to limitation : the right to request the limitation of processing in certain cases ;
• Right to data portability : the right to receive personal data that you have provided in a structured format, usually machine-readable, and to communicate it to a third party.

You can exercise any of these rights :

• by post at SEPAMAT - 310 route de Vannes - BP 90315 - 44703 ORVAULT cedex 03 - France
• by email to the DPO : rgpd@sepamat.fr

If you feel, after contacting us, that your rights are not respected, you have the possibility to file a complaint with the CNIL.

VI. Update of this policy

This privacy policy has been published on 26/10/2018. In case of changes to this policy, you will be informed on this page.

VII. Cookies

a. Cookies management policy

When you visit our website www.en.europcar-atlantique.fr, a certain amount of data is deposited on the hard disk of your computer. These are cookies. Cookies and other similar technologies are tracing programs stored on your device that allow us to recognize you. 
It mainly allows to prepare your reception better for the next visit on our website and to personalize for you the pages you will visit. Only the website issuing the cookie can read the information retained there.

Auto 44 uses the Google Analytics Universal tool to measure its visits. When you connect on our website, the tool puts various "first-party" cookies (_ga,_gat,_gid) in your terminal. These cookies allow us to identify the source of your navigation on our website, which is very important for knowing the impact of our content and profile-raising measures on search engines and social networks. 

The configuration of the Google Analytics Universal tool on our website is limited to its audience measurement function at 6 levels :

1. User and event data are retained for a limited period of 14 months at the Google Analytics property. However, the GDPR requires a retention period of 13 months. The Google Analytics cookies are initialised for a period of 13 months in non-slippery mode upstream from the console in Google Tag Manager. Cookies are therefore not reset on each visit.
2. IPs are anonymised (last byte replaced by 0) in Google Tag Manager.
3. Remarketing data, advertising reporting features and demographics and interests reporting are disabled at the Google Analytics property level. Only Google Analytics account association is enabled to identify the performance of our paid ads.
4. Data sharing settings including "Google products and services" and "benchmarking" are disabled at the Google Analytics account level.
5. The "user ID" feature is not enabled at the Google Analytics property level.
6. No personal data (email, surname, first name, address, city) is sent in plain language in the Google Analytics console because we remove some URL parameters at the view level in Google Analytics.

The Google Analytics Universal's configuration is therefore restricted to respect the privacy of users as much as possible. For financial and technical reasons, while waiting to opt for an audience measurement solution excused from consent among those listed by the CNIL, we are therefore activating Google Analytics Universal on loading the first page viewed because the tool is restricted to its only audience measurement function.

b. Types of cookies

• Essential cookies : these cookies are aboslutely necessary for the proper functioning of our website ;
• Fuctional cookies : these cookies are used to give you access to certain features of our website, to facilitate and improve your browsing experience and the selection of products and services ;
• Analytics cookies : these cookies are used to analyze how customers use their website to improve their quality and navigation ;
• Advertising cookies : these cookies are used to measure the effectiveness of our advertising campaigns in the media.