Privacy policy

This privacy policy applies to our website www.dcrentcars.de, our online booking form and the rental of our vehicles. You can also download it as a PDF.

DATA CONTROLLER WITHIN THE MEANING OF DATA PROTECTION LAW

Diamond Cars GmbH, Nördliche Münchener Str. 9c, 82031 Grünwald, Germany

YOUR RIGHTS AS A DATA SUBJECT

You may exercise the following rights at any time using the contact details of our data protection officer:

access to the data we hold about you and how it is processed,
rectification of inaccurate personal data,
erasure of the data we hold about you,
restriction of processing where we may not yet erase your data due to statutory obligations,
objection to our processing of your data, and
data portability, provided you have consented to the processing or have entered into a contract with us.

Where you have given us consent, you may withdraw it at any time with effect for the future.

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.htmlYou may lodge a complaint with the supervisory authority responsible for you at any time. Which authority is responsible depends on the federal state of your residence, your place of work or the alleged infringement. A list of supervisory authorities (for the non-public sector) with addresses is available at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

CATEGORIES OF PERSONAL DATA

We may process the following categories of personal data in connection with our services:

Master data: first name, surname, gender, date of birth, address, customer number
Communication data: telephone number, e-mail address, content of communications (in particular from e-mails)
Contract data: driving licence data, identity card and passport data, vehicle categories, pick-up and return date, pick-up and return station, booked extras/services, reservation and rental agreement number, result of the credit check
Financial data: credit card data, bank and account details
Third-party data: personal data, e.g. of relatives or passengers, in connection with your rental
Vehicle data: e.g. chassis number, model, manufacturer, registration plate
Telematics data: e.g. location data (GPS), movement and alarm data of the vehicle, mileage
Special categories of data: in the event of an accident, vehicle damage or a similar incident, we process information on the course of events and the damage. This information may be provided by customers, passengers or injured parties. In such cases health data may also be processed, such as information on injuries, blood alcohol level, driving under the influence of drugs or similar.

LEGAL BASES OF DATA PROCESSING

Art. 6 (1) sentence 1 (a) of the General Data Protection Regulation (GDPR): under this provision, the processing of personal data is permitted if you have given your consent.

Art. 6 (1) sentence 1 (b) GDPR: under this provision, processing is lawful if it is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract (e.g. when reserving a vehicle).

Art. 6 (1) sentence 1 (c) GDPR: under this provision, processing is lawful if it is necessary for compliance with a legal obligation to which Diamond Cars is subject.

Art. 6 (1) sentence 1 (f) GDPR: under this provision, processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller, i.e. Diamond Cars, or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, i.e. you.

Art. 9 (2) (f) GDPR: under this provision, special categories of personal data may be processed, inter alia, where processing is necessary for the establishment, exercise or defence of legal claims. Special categories of personal data also include health data of the persons concerned.

PURPOSES OF PROCESSING BY THE CONTROLLER AND THIRD PARTIES

We process your personal data only for the purposes stated in this privacy policy. Your personal data will not be transferred to third parties for purposes other than those stated. We only pass your personal data on to third parties if:

you have given your express consent,
the processing is necessary for the performance of a contract with you,
the processing is necessary for compliance with a legal obligation,

or the processing is necessary to protect legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in your data not being disclosed.

VALIDATION OF IDENTITY AND DRIVING LICENCE

Before the vehicle is handed over, our employees verify your identity and your driving licence on the basis of your original documents (identity card or passport and driving licence). The check includes a visual inspection of security features to rule out the use of forged documents. During the handover, photos or copies of these documents may be taken and stored together with the contract documents of the rental. No app-based identification procedure and no biometric matching take place.

We store the photos or copies of your documents as part of the contract documents until the expiry of the statutory limitation and retention periods (→ Duration of storage).

Legal bases of the above processing

Art. 6 (1) sentence 1 (b), (c) GDPR in conjunction with Section 21 of the German Road Traffic Act (StVG), and Art. 6 (1) sentence 1 (f) GDPR; our legitimate interest is to be able to prove that the driving licence was duly checked.

Recipients of your data

No data are transferred to external service providers for this purpose.

RESERVATION OF VEHICLES

Before renting a vehicle, you can make a reservation via our website, by e-mail or by telephone. For this purpose we process your master data, communication data, contract data and, where applicable, your financial data. If you reserve your vehicle through travel agencies, online travel agents or other intermediaries, your master data, communication data, rental information and, where applicable, financial data are transmitted to us by our partners.

We use financial service providers to process payments (including the lodging of security deposits on credit cards). In the course of processing, data identifying the device used by the user may be processed in addition to the data mentioned above in order to secure payment transactions and comply with regulatory requirements (e.g. strong customer authentication).

Legal bases of the above processing

Art. 6 (1) sentence 1 (a) GDPR where consent has been given.

Art. 6 (1) sentence 1 (b) GDPR for processing for the reservation of vehicles, including payment processing and customer service.

Art. 6 (1) sentence 1 (c) GDPR for processing for the purpose of complying with regulatory requirements for payment transactions and retention obligations under commercial and tax law.

Recipients of your data

For the above purposes we disclose your data to the following recipients: IT service providers, call centres, debt collection agencies, financial service providers, credit agencies, agency partners, Diamond Cars franchisees and cooperation country companies.

As part of our fraud prevention measures, in cases of established or imminent fraud we also transmit personal data to third parties who have actually been harmed or are at risk of harm.

ONLINE BOOKING AND DIGITAL CONCLUSION OF CONTRACT

On our website you can submit binding requests for vehicles and make reservations via an online booking form. In doing so, we process the master data, communication data and contract data you enter in the form (in particular rental period, handover location, selected vehicle, booked extras and additional drivers).

Proof of conclusion of contract: when you submit a binding request, or confirm a rental agreement via a confirmation link sent to you or by signing on one of our devices, we record the time of confirmation, the version of the contract documents you confirmed (including the incorporated rental terms and rental information) and the IP address of the device used. This information serves as proof of the conclusion and content of the rental agreement.

Storage in your browser: the booking form stores the state of your entries, your language choice and information for returning from the payment process exclusively locally in your browser (localStorage/sessionStorage). This storage is technically necessary for providing the form (Section 25 (2) no. 2 of the German TDDDG); it is not evaluated for analytics or advertising purposes.

Online payment: if we require a down payment at the time of booking, the payment is processed by one of the payment service providers Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, or Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. The respective provider receives the data necessary for payment processing. Stripe privacy notice: https://stripe.com/privacy. Mollie privacy notice: https://www.mollie.com/privacy.

Delivery to an address of your choice: if you request delivery of the vehicle to an address you specify, we transmit this address server-side to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in order to calculate distance and delivery costs (Google Maps Platform services). Your IP address is not transmitted to Google in this process.

Legal bases of the above processing

Art. 6 (1) sentence 1 (b) GDPR for handling the booking, including payment processing and the calculation of delivery costs. Art. 6 (1) sentence 1 (f) GDPR for recording the conclusion of the contract; our legitimate interest is to be able to prove the conclusion and content of the rental agreement.

Recipients of your data

For the above purposes we disclose your data to the following recipients: IT service providers (operation of the booking system), Stripe Payments Europe, Limited or Mollie B.V. (payment processing), Google Ireland Limited (delivery address only, for distance calculation).

COOKIES AND SIMILAR TECHNOLOGIES

On our website www.dcrentcars.de and in our booking form we store information on your device or access information stored there (e.g. cookies, localStorage). Storage that is technically necessary – for example to provide the booking form or to store your cookie choice – is based on Section 25 (2) No. 2 TDDDG. All other storage and access, in particular for audience measurement and for measuring the success of our advertising, only takes place with your consent (Section 25 (1) TDDDG, Art. 6 (1) sentence 1 lit. a) GDPR).

Consent management: on your first visit we ask for your consent via a banner. You can select the categories “Statistics” and “Marketing” individually or allow only necessary technologies. We store your choice in the cookie “dc_consent” for the domain dcrentcars.de for 180 days. Using the “Cookie settings” link in the footer of the website you can change your choice at any time and withdraw consent with effect for the future.

GOOGLE ANALYTICS AND GOOGLE ADS (WITH CONSENT ONLY)

With your consent to the “Statistics” category we use Google Analytics 4; with your consent to the “Marketing” category we use Google Ads conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics evaluates how our website is used (e.g. pages viewed, time spent, origin of the visit, device and browser information, shortened IP address). Google Ads conversion tracking shows us whether an enquiry, a call or a booking results from one of our ads; for this purpose cookies (e.g. “_ga”, “_gcl_au”, “_gcl_aw”) are set and, for a booking, its value is transmitted to Google.

We use Google’s consent mode. Without your consent Google does not set cookies or read identifiers from your device for these purposes; only signals without identifiers are transmitted (e.g. that a page was viewed), which Google uses for statistical estimation.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR).

Legal basis: Art. 6 (1) sentence 1 lit. a) GDPR, Section 25 (1) TDDDG. Storage period: analytics data is deleted after the retention period set in Google Analytics (no more than 14 months); Google Ads cookies expire after 90 days at the latest. Further information: https://policies.google.com/privacy

META PIXEL (WITH CONSENT ONLY)

With your consent to the “Marketing” category we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). It allows us to measure whether visitors make an enquiry or booking after clicking one of our ads on Facebook or Instagram, and to target our ads more effectively. For this purpose a cookie (“_fbp”) is set and, among other things, the IP address, browser information, pages viewed and events such as a booking including its value are transmitted to Meta. Without your consent the Meta Pixel is not loaded.

We are jointly responsible with Meta for the collection and transmission of this data to Meta (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. Data may be transferred to Meta Platforms, Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework.

Legal basis: Art. 6 (1) sentence 1 lit. a) GDPR, Section 25 (1) TDDDG. Further information: https://www.facebook.com/privacy/policy

SPECIFICS OF THIS WEBSITE

Hosting and server log files: when you visit our website, our hosting provider automatically processes, on our behalf, data transmitted by your browser (IP address, date and time of access, page requested, referring page, browser and operating system). This processing is necessary to deliver the website and ensure its security. The legal basis is Art. 6 (1) sentence 1 lit. f) GDPR; our legitimate interest lies in the secure and stable operation of the website. The log files are deleted as soon as they are no longer required for this purpose.

Fonts (Google Fonts): to ensure a consistent appearance, we load the “Archivo” font from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In doing so, your IP address is transmitted to Google; a transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework). The legal basis is Art. 6 (1) sentence 1 lit. f) GDPR; our legitimate interest lies in a consistent and appealing presentation of the website.

Google reviews (Elfsight): to display our Google reviews we use a widget provided by Elfsight, LLC. When the widget loads, your IP address and technical information about your browser are transmitted to Elfsight; this may involve a transfer to countries outside the EU. The legal basis is Art. 6 (1) sentence 1 lit. f) GDPR; our legitimate interest lies in showing prospective customers independent customer reviews. Further information: https://elfsight.com/privacy-policy/

Ahrefs Web Analytics: to evaluate visitor numbers we use Ahrefs Web Analytics provided by Ahrefs Pte. Ltd., Singapore. The service does not set cookies or store identifiers on your device; it records aggregated information such as pages viewed, referring page, country and device and browser type. Your IP address is transmitted to Ahrefs in the process. The legal basis is Art. 6 (1) sentence 1 lit. f) GDPR; our legitimate interest lies in improving our services. Further information: https://ahrefs.com/legal/privacy-policy

Links to WhatsApp, Instagram and Facebook: our website contains simple links to these services. Data is only transmitted when you click a link; the privacy policy of the respective provider then applies.

RENTAL OF VEHICLES

We process your master data, communication data, contract data, vehicle data, financial data and any voluntary information for the performance of a rental agreement (including conclusion, performance and billing).

We process master data, communication data, vehicle data and contract data for customer-service purposes in the event that you contact us (e.g. complaints, rebookings). We also process your master data and contract data for the purposes of commission settlement and sales processing (e.g. with travel agencies, agency/franchise/cooperation partners). We transmit your data to partner companies if a vehicle or vehicle type you have requested is not available from us, in order to fulfil your reservation request.

In addition, we are legally obliged to compare your master and communication data with officially prescribed offender lists for the purpose of preventing and investigating criminal offences. This comparison also serves to avert danger and to enable state prosecution.

For the credit check, we process your master and payment data in order to be able to assess your creditworthiness by obtaining information from credit agencies (see also → Credit check).

We also use your data for your and our security, for example to avoid payment defaults and to prevent property offences (in particular fraud, theft, misappropriation; see also → Fraud prevention).

Diamond Cars reserves the right not to conclude rental agreements with persons who have attracted attention due to payment defaults, breaches of contract or law, or improper conduct towards customers or employees. For this purpose we process personal data in order to exercise our right to freedom of contract. For this purpose we process your master data and communication data.

After mutual performance of the rental agreement, your master, payment, vehicle and contract data remain stored until the expiry of the retention obligations and periods imposed by law or supervisory authorities, which may arise from the German Commercial Code, the German Fiscal Code and the German Money Laundering Act and are generally 6 to 10 years.

Legal bases of the above processing

Art. 6 (1) sentence 1 (b) GDPR for processing for the conclusion and performance of rental agreements, including payment processing and customer service.

Art. 6 (1) sentence 1 (c) GDPR for processing for the purpose of detecting, preventing and investigating criminal offences, complying with regulatory requirements for payment transactions, verifying and storing driving licence data, and retention obligations under commercial and tax law.

Art. 6 (1) sentence 1 (f) GDPR for processing for the purpose of billing third parties, enforcing our own claims, and risk and fraud prevention.

Our legitimate interest in using your personal data to improve our services and customer service consists in offering you the best possible services and sustainably increasing customer satisfaction.

As far as the processing of data for the purpose of preventing damage to our company or our vehicles through appropriate analyses is concerned, our legitimate interest consists in ensuring cost certainty and avoiding economic disadvantages, for example due to payment defaults or the loss of our vehicles.

Recipients of your data

As part of our fraud prevention measures, in cases of established or imminent fraud we also transmit personal data to third parties who have actually been harmed or are at risk of harm.

GPS TRACKING AND ALARM FUNCTIONS

Our vehicles are equipped with GPS tracking systems. These enable us to determine the location of our vehicles and to use alarm functions, for example when the agreed contractual territory is left, in the event of suspected theft or other unusual events (→ Conduct in breach of contract or law). The tracking data also enable us to organise, maintain and care for our vehicle fleet. For this purpose we process your contract data, vehicle data and telematics data (in particular location data).

Legal basis of the above processing

Depending on which specific processing of telematics data is carried out, the corresponding legal basis of the respective processing from this privacy policy applies (see → Damage and accidents; → Conduct in breach of contract or law). In principle, however, this is: Art. 6 (1) sentence 1 (f) GDPR (protection of our property and maintenance, care and organisation of our vehicle fleet).

Our legitimate interest consists in protecting our vehicles against theft and use in breach of contract and in providing you with roadworthy vehicles at all times.

Recipients of your data

For the above purposes we disclose your data to the following recipients: IT service providers (provider of the tracking system).

CREDIT CHECK

In order to reduce the risk of payment defaults, a credit check of natural persons is carried out before rental agreements are concluded.

In the context of these contractual relationships, Diamond Cars transmits personal data collected regarding the application for, performance and termination of the business relationship, as well as data on non-contractual or fraudulent behaviour, to SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany (“SCHUFA”).

The legal bases for these transmissions are Art. 6 (1) sentence 1 (b) and Art. 6 (1) sentence 1 (f) GDPR. Transmissions on the basis of Art. 6 (1) sentence 1 (f) GDPR may only take place insofar as this is necessary to protect the legitimate interests of Diamond Cars or third parties and the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail. The exchange of data with SCHUFA also serves to fulfil statutory obligations to carry out creditworthiness checks on customers (Sections 505a and 506 of the German Civil Code).

SCHUFA processes the data received and also uses them for profiling (scoring) in order to provide its contractual partners in the European Economic Area and Switzerland and, where applicable, other third countries (insofar as an adequacy decision of the European Commission exists for these) with information for assessing, among other things, the creditworthiness of natural persons. Further information on SCHUFA’s activities is available online at www.schufa.de/datenschutz.

Legal basis of the above processing

Art. 6 (1) sentence 1 (b) and (f) GDPR (see above).

Our legitimate interest in processing your personal data for the credit check consists in protecting ourselves against payment defaults.

Recipients of your data

For the above purpose we transmit data to SCHUFA (see above).

DAMAGE AND ACCIDENTS

In the event of damage to our vehicles or accidents involving our vehicles, we process your personal data for the following purposes:

customer service in the event of damage,
settlement of damage,
handling of accident damage (processing on the basis of your information and information from third parties, such as the police, subsequent renters, witnesses, etc.),
claims settlement,
receipt and handling of complaints,
help and assistance services,
securing and enforcing our own claims.

For these purposes we process your master data, communication data, contract data, financial data, third-party data, vehicle data, telematics data and, where applicable, special categories of personal data (health data).

Legal bases of the processing

Art. 6 (1) sentence 1 (b), (c), (f) GDPR and Art. 9 (2) (f) GDPR.

Our legitimate interest in using your personal data consists in properly handling damage and accidents and thereby averting damage from our company. This also includes our legitimate interest in exercising or defending our legal claims in the settlement of damage and accidents. We also have a legitimate interest in providing you with undamaged vehicles at all times. Furthermore, we are also obliged, on the basis of contractual relationships with third parties (e.g. insurers), to process your data for the purpose of claims settlement. Our legitimate interest in this respect consists in being faithful to our contracts.

FRAUD PREVENTION

With the aid of cookies and other technologies (→ see Cookies and similar technologies), we process data to identify the device used by the user and the usage behaviour. The data are stored in fraud prevention databases; in this way we can, for example, determine whether login processes have already been carried out with your device and whether it is accordingly “trustworthy”. In the case of logins with unknown devices, we can point out to you that this may represent a security risk. The databases also store data on devices that have already been used in (attempted) fraud, as well as any associated master, communication and contract data. As part of a reservation process, we retrieve a risk assessment of the user’s device from the database of a specialised service provider. This risk assessment of the likelihood of an attempted fraud takes into account, among other things, whether the device has dialled in via different telecommunications providers, whether the device has a frequently changing geo-reference, how many transactions have been carried out via the device and whether a proxy connection is being used. In addition, for the purpose of risk assessment, we check whether your e-mail address has shown anomalies or fraud patterns in the past in the database of a specialised fraud prevention service provider and take this into account in our own decision on the performance of contracts or the handover of vehicles.

Legal bases of the processing

Art. 6 (1) sentence 1 (f) GDPR.

Our legitimate interest in using your personal data to prevent property offences consists, in this processing too, in protecting our vehicle fleet and our contractual and non-contractual rights.

Recipients of your data

For the above purpose we transmit data to specialised fraud prevention service providers.

CONDUCT IN BREACH OF CONTRACT OR LAW

For the purposes of preventing damage and securing our ownership of our vehicles, vehicle parts and fuel, we take the following measures in the event of criminally relevant conduct, e.g. theft, misappropriation, unauthorised use, and in the event of use in breach of contract, e.g. exceeding the maximum permitted rental period or sub-letting:

Leaving the contractual territory: in order to inform you if you leave the agreed contractual territory, some of our vehicles are equipped with an alarm function. With the aid of this alarm function, an automatic report is made to us if the vehicle leaves the agreed contractual territory. At the same time as the automatic report, master data, communication data, contract data and telematics data are assigned to your person in order to enable us to contact you and point out the breach of contract;
Locating stolen vehicles: for locating vehicles in the event of theft, some of our vehicles are equipped with an alarm function that is only used in the specific individual case where there is a well-founded suspicion of unlawful conduct. In such a case, vehicle and telematics data may be assigned to your person;
Detection of unauthorised tyre changes / fuel removal: to detect an unauthorised tyre change or fuel removal, our vehicles are equipped with an alarm function. This alarm function generates an automatic report. Only when unauthorised conduct is established are master data, contract data, communication data, vehicle data and telematics data assigned to your person;