Porsche Drive S.r.l., a company belonging to the Porsche Group (hereinafter referred to as "we" or "Porsche Drive"), is pleased that you have chosen to visit our website www.porsche-drive.it. We thank you for your interest in our company and our services. Your privacy is a top priority for us. We take very seriously the protection of your personal data, which we process in accordance with the applicable data protection legislation, and in particular with the provisions of the General Data Protection Regulation of the European Union (EU Regulation 2016/679, hereinafter "GDPR").

We hereby inform you about the processing of your personal data and your rights as a data subject in the context of the use of our website. For information on other products and services offered by other companies of the Porsche Group, please refer to the respective privacy statements for these services or companies of the Porsche Group.

Should there be links to this privacy policy on external social media sites, this will only apply to the extent that the data processing operations within the scope of these social media are actually within our area of responsibility and that there are no more specific, and therefore overriding, privacy statements relating to the processing operations on these social media sites.

1. Data Controller and Data Protection Officer

The data controller within the meaning of data protection legislation is:

Porsche Drive S.r.l.
Via Alessandro Manzoni 16
38122 Trento
Italia

If you have any questions or comments on data protection, please send a communication by post to the above address or by e-mail to privacy.drive@porsche.it or to the PEC address poschedrivesrl@legalmail.it .

2. Protection of your personal data

As data controller, we protect your personal data. Personal data means all information relating to an identified or identifiable natural person (so-called 'data subject'). This information includes, but is not limited to, the type of customer (natural person/legal entity), first name and surname, gender, date of birth, citizenship, social security number, postal address, e-mail address/PEC or telephone number, contractual and billing data, as well as other information, which is automatically collected during the use of our website and which is further detailed in the following paragraphs.

3. Type, scope, purpose and legal basis of automatic data processing

In general, it is possible to use our website without registration. However, the use of some services and functions may be restricted to registered users. Even when using our website without registration, personal data may be processed.

Below you will find an overview of the types, scope, purpose and legal basis of automatic data processing carried out through our website. Information on the processing of personal data in connection with the use of specific services and functionalities can be found in the following paragraphs.

3.1 Provision of our website

When you access our website via your device, we process data relating to the date and time of access, duration of the visit, type of terminal, operating system used, functions used by you, amount of data sent, type of event, IP address, referring URL, domain name.

We process this data on the basis of Article 6(1)(f) of the GDPR for the purpose of providing the website, ensuring its technical functionality and identifying and remedying website malfunctions. In doing so, we pursue the interest of making the use of our website possible and ensuring its technical functionality over time. When you visit our website, this data is processed automatically. If you do not make this data available, you cannot use our website. We do not use this data for the purpose of drawing conclusions about you or your identity.

3.2. Cookies, tracking technologies and related services

We use cookies and tracking technologies on our website. Please read our cookie policy.

3.3. Integration of third-party content

We also use services of external providers on our website to supplement our offers and content (hereinafter the "Content"). Unless otherwise specified below in relation to individual services of external providers, data processing is carried out on the basis of Article 6(1)(f) of the GDPR, in the light of our legitimate interest in using the Content and services of third-party providers to enable effective and optimised operation of our website.

4. Device access authorisations

Certain functions of our website require that you grant permission for access to your device (e.g. access to location data).
The granting of authorisations is optional. However, if you wish to use the corresponding functionality, you must grant authorisations, otherwise you will not be able to use this functionality.
The authorisations will remain active until you have cancelled them in your device and/or Internet browser by deactivating the corresponding setting.

5. Registration process and creation of a functional user profile for the short-term rental service

You can voluntarily provide personal data or register for services or functionalities with an individual profile on various pages of our website, e.g. as part of the search and booking of vehicles for short-term rental, enquiries and contact with Porsche Centres for the execution of your rental service request; when you register and use the services and functionalities described below, we store, process and use the data as specified below. Without registration, the above services cannot be used or can be used only to a limited extent.

The compulsory information required for registration is marked with an "*" in the respective input field and generally consists of, at a minimum, the following data: E-mail, First Name, Last Name, Telephone, Mobile Phone. If you do not provide the mandatory information, you will not be able to proceed with registration and create a user profile. During the registration and user profile creation process, you have the opportunity to provide additional information on a voluntary basis, such as: -Customer type (private/company), Gender, Date of birth, Tax code, PEC address, SDI code. Please note that this information is not required for registration and you are free to decide whether or not to provide us with this data.

The personal data you provide during registration will be used by us to create your profile and identify you after each login. The applicable legal basis for these data processing operations is Article 6(1)(b) of the GDPR. Depending on the service for which you register, further data may be collected and then linked to your profile data; in some cases such data may be collected and processed directly by our Company and in others it may be collected and processed by third parties acting as autonomous Data Controllers in order to provide the services and offers you have requested; reference is made, for example, to the Porsche Centre selected by you, which will provide you with its privacy policy when you sign the short-term rental contract or to the company appointed to manage payment services as part of the booking phase of the vehicle you have selected, which will provide you with its privacy policy when you book the vehicle.

We carry out the processing described in this paragraph to process your request for the short-term rental service.

6. Contact methods

If you provide us with personal data by e-mail or via a contact form, this will always be done on a voluntary basis. Your information will be processed by us in order to process your contact request and in accordance with Article 6 of the GDPR, paragraph 1 b) (if your request relates to a possible contract to be concluded with us or a contract already concluded with us) or f) (for any other type of request) and in this context may also be passed on to third parties (e.g. Porsche Centres).

7. Pursuit of legitimate interests

Data processing operations within the context of our website or after registration are carried out in pursuit of our legitimate interests as follows:

• ensuring the availability, operation and security of technical systems, as well as technical data management;
• further development of products, services and service offerings;
• analysis of customer needs, e.g. processing of warranty claims, as well as non-contractual questionnaires addressed to interested persons and customers;
• prevention of violations of the law and cases of fraud, actions relating to legal claims.
  
  

The respective data processing for the pursuit of legitimate interests is carried out on the basis of Article 6(1)(f) of the GDPR.

8. Consent: Marketing

With your free and optional consent (article 6, paragraph 1, letter a) of the GDPR), we will process your data for marketing purposes (sending of advertising material, carrying out market research, commercial communication and customer satisfaction surveys), also through suitably selected and formally commissioned third party suppliers, by sending you information and offers relating to products and services of the Porsche Group, which we think may be of interest to you by post, e-mail, text message, fax and landline/mobile phone with or without operator, social media. Consent to the processing of your personal data is free and optional and in case of non-consent you will not suffer any prejudicial consequences. You may revoke your consent to the processing of your data for marketing purposes at any time and free of charge, without any consequences, in the manner set out in paragraph 15 below, including selectively, by informing us that you no longer wish to be contacted via one or more contact methods. Therefore, please let us know if you wish to consent to the processing of your data for marketing purposes and to be contacted by Porsche Drive S.r.l., by ticking the appropriate consent request box.

In this context, we would like to point out that, again on the basis of your free and optional consent, the aforementioned marketing activities may also be carried out through the communication of your data to Porsche Centres, Porsche Service Centres and other companies belonging to the Porsche Group.

9. Recipients of personal data / Disclosure of data to third parties for marketing purposes

Internal recipients: within Porsche Drive S.r.l. only those persons who need the data for the stated purposes have access to the data.

External recipients: we only pass on personal data to external recipients outside Porsche Drive S.r.l., if this is necessary for the processing or fulfilment of your request and/or to provide you with a service and/or for the performance of a contractual relationship, if there is another legal basis or obligation and/or if you have given us your consent to do so and/or if this is otherwise permitted under applicable law.
External recipients may be:

a) Data Processors
External service providers that we use for the provision of services, e.g. in the areas of technical infrastructure and maintenance for the Porsche Drive S.r.l. offering or the provision of contractually relevant content. These processors (in some cases they may be companies belonging to the Porsche Group) are carefully selected, also from a technical and IT point of view, and evaluated by us to ensure that your privacy is preserved. Service providers may only use the data for the purposes specified by us and in accordance with our instructions.

b) Public entities
Authorities and governmental institutions, such as prosecutors, courts or tax authorities to which we must transfer personal data in order to fulfil legal obligations. The transfer takes place in accordance with Article 6(1)(c) of the GDPR.

c) Private entities
The Porsche Centre selected by you, which will provide its privacy policy when signing the short-term rental contract, and the company appointed to handle payment services as part of the booking process for your chosen vehicle.

The transfer takes place in accordance with Article 6(1)(b) of the GDPR.

9.1 Disclosure of data to third parties for marketing purposes

With your voluntary consent (Article 6(1)(a) of the GDPR), your personal data may be disclosed by us to other companies belonging to the Porsche Group. Should you give your consent, these third parties may in turn process your personal data for marketing purposes (sending advertising material, carrying out market research, commercial communication and customer satisfaction surveys) and send you information and offers regarding their own products and services or those of the Porsche Group which may be of interest to you, by post, e-mail, text message, fax and landline/mobile phone with or without operator, social media.

10. Data processing in third countries

If a data transfer takes place to entities whose seat or place of data processing is not in a Member State of the European Union or in another State party to the Agreement on the European Economic Area, we ensure prior to the transfer that, except where permitted by law, the recipient ensures an adequate level of data protection (e.g. through an adequacy decision of the European Commission pursuant to Article 45 of the GDPR, through adequate safeguards pursuant to Article 45 of the GDPR or by entering into so-called EU standard contractual clauses with the data importer pursuant to Article 46(2)(c) of the GDPR or, alternatively, by fulfilling the obligations and providing the safeguards under Art. 49(1) of the GDPR) or you have given your consent to such data transfer pursuant to Article 49(1)(a) of the GDPR.

You may obtain from us an overview of recipients in third countries and a copy of the specific provisions agreed upon to ensure the appropriate level of data protection. To obtain this information, you may contact us as indicated in paragraphs 1 and 15.

11. Sources and categories of data in the case of third-party research

Through our website we only process personal data that we acquire directly from users. We do not acquire personal data through intermediaries or other third parties.

12. Automated decision-making processes

We do not use any automated decision-making processes that produce legal effects on a person or that affect your person in a similar significant way, within the meaning of Article 22 of the GDPR.

13. Duration of storage and deletion

We only retain your personal data for as long as it is necessary for the pursuit of the intended purposes or, in the case of consent, until you have withdrawn your consent. If you object to the processing, we will delete your personal data, unless their further processing is necessary to pursue other legitimate processing purposes. We will also delete your personal data when we are obliged to do so by any legal obligation.
Applying these general principles, we will delete your personal data immediately:

• if the legal basis on which the processing is based should cease to exist, unless further storage is necessary to comply with legal obligations or to pursue other legitimate processing purposes. If the latter is the case, we will delete the data after the further legal basis also ceases to exist;
• if they are no longer necessary for the purposes of the preparation and performance of a contract or for the pursuit of legitimate interests and there is no other legal basis (such as where further storage is necessary to comply with legal obligations regarding taxation or the retention of business records). If, on the other hand, there is another legal basis, we will delete the data when the other legal basis also ceases to exist;
• if the purpose of the processing pursued by us ceases to exist and there is no other legal basis (such as in the case where further storage is necessary to comply with legal obligations regarding taxation or the retention of business records). If, on the other hand, there is another legal basis, we will delete the data when the other legal basis also ceases to exist.

Information on how long cookies are stored can be found in our cookie policy.

14. Rights of the data subject

As a data subject, you have the right to ask us for access to and rectification or erasure of your personal data or restriction of the processing concerning you or to object to its processing, as well as the right to data portability. In detail:

Right of access: you have the right to obtain confirmation as to whether or not personal data concerning you is being processed and if so, to obtain access to the personal data and information specified in Article 15 of the GDPR;

Right of rectification and right to erasure: you have the right to obtain the rectification of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration. You also have the right to obtain the deletion of personal data concerning you without undue delay if one of the grounds indicated in Article 17 of the GDPR applies;

Right to restriction of processing: you have the right to obtain the restriction of processing when one of the hypotheses indicated in Article 18 of the GDPR applies;

Right to data portability: if the processing of your data is based on consent or on contract and is carried out by automated means, you have the right to receive in a structured, commonly used and machine-readable format, personal data concerning you and you have the right to transmit such data to another data controller without hindrance.

Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you in accordance with Article 6(1)(f) (processing based on legitimate interest). Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you carried out for such purposes;

Withdrawal of consent: if you have given us your consent to process your data, you may withdraw it at any time with immediate effect. The lawfulness of the data processing remains unaffected until revocation;

Right to lodge a complaint with a supervisory authority: you have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates the applicable law. You may contact the Data Protection Authority (www.garanteprivacy.it) or the different Supervisory Authority of the EU Member State where you reside or work;

15. Links to third-party sites

The websites and services of other parties to which links are provided on our website are designed and provided by third parties. We have no influence on the design, content and function of these third-party websites and services. We accept no responsibility for the content of these sites and services and their data processing. Please note that such third parties whose sites and services are linked to on our site may install their own cookies on your device or collect personal data if you use the links. We have no influence on this possibility. If necessary, please inquire directly with the providers of these sites and services.

16. How to contact us

You may contact us free of charge if you have any questions regarding the processing of your personal data and to exercise your rights. Please contact us by e-mail at privacy.drive@porsche.it or at the PEC address poschedrivesrl@legalmail.it or by post at the following address, making sure to clearly identify yourself:

Porsche Drive S.r.l.
Via Alessandro Manzoni 16
38122 Trento
Italia

17. Version

The latest version of this Privacy Policy applies.

Latest update: 30 November 2023