GDPR Policy for Vehicle Rental

Who we are?
This privacy notice is for University College Dublin, Belfield, Dublin 4, Ireland, in particular for UCD Estate Services and UCD SIRC. You can contact us at pia.polotto@ucd.ie and sarah.carry@ucd.ie

Why and how we collect and process the information and for how long we keep it?
We collect your personal data for the purpose of vehicle rental and vehicle accident management. On the basis of Data Protection Commission, the collection of the data is necessary for the performance of the rental service agreement for compliance with the legal obligations to which UCD Estate Services is subject to and for the purposes of the legitimate interests pursued by the controller, i.e., UCD Estate Services, UCD Safety, Insurance, Operational Risk and Compliance (SIRC) Office or by a third party (e.g. UCD Insurers), except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, i.e., you yourself.

We will collect the following types of personal data:
● Master data: These include, for example, a person’s first name, surname, business address, date of birth.
● Communication data: These include, for example, a person’s telephone number, email address business, as well as the content of communications (e.g., emails, letters).
● Contract data: These include, for example, Location and time of pick-up, destination, payment details.
● Voluntary data: This includes data that you provide to us on a voluntary basis that we do not expressly request from you.
We will keep your data until they are no longer necessary in relation to the purposes for which they were collected or otherwise processed (see purpose for data collection). If you have not rented or drove a UCD Estate Services vehicle for six years, your customer account will be deleted for inactivity. We carry out this deletion routine once a year. Where UCD Estate Services and UCD SIRC are under legal obligation to store personal data, it will store personal data for the preservation period stipulated by law. The preservation of data related to accident management will be determined by law. The preservation period for commercial documents, which include bookkeeping documents and accounting records (including invoices), is up to 10 years. During this period, your data may be subject to restricted use within day-to-day operations if its processing serves no further purposes. The data that are recorded by the mobile phones of drivers (cf. → pinpoint locations) are erased after a period of three months.

Who has access to the information and who we share it with?
Internal access: The personal data collected from you will be accessed by UCD Estate Services, UCD SIRC.
External access: In the event of an accident the University will share the relevant personal data with public authorities (investigating authorities; regulatory authorities; police authorities; etc.) in order to manage the accident as stipulated by law.
For the purpose of road assistance, the University will share personal data with assistance services providers, independent transportation service providers and insurance companies.

What are your rights?
Rights in the event of joint controllers

Where two or more controllers (UCD ES and UCD SIRC) are jointly responsible for data processing (cf. item points and Accident Management), the parties shall fulfil their obligations under data protection laws on the basis of the respective arrangement between the joint controllers. The parties shall inform each other without undue delay of any legal claims asserted by data subjects. They shall provide each other with all the information required to respond to information requests.

Rights pursuant to Art. 15 – 18 and 20 GDPR
You have the right to, at reasonable intervals, obtain information about your personal data under storage (Art. 15 GDPR). The information you are entitled to includes information about whether or not UCD ES and UCD SIRC has stored personal data concerning you, about the categories of personal data concerned, and about the purposes of the processing. Upon request, UCD ES and UCD SIRC will provide you with a copy of the personal data that is processed.
You also have the right to obtain from UCD ES and UCD SIRC the rectification of inaccurate personal data concerning you (Art. 16 GDPR).
You furthermore have the right to obtain from UCD ES and UCD SIRC the erasure of personal data concerning you (Art. 17 GDPR). We are under obligation to erase personal data in certain circumstances, including if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, if you withdraw the consent on which the processing is based, or if the personal data have been processed unlawfully.
Under certain circumstances, you have the right to have the processing of your personal data restricted (Art. 18 GDPR). These include circumstances in which you contest the accuracy of your personal data and we then have to verify such accuracy. In such cases, we must refrain from further processing your personal data, with the exception of storage, until the matter has been clarified.

No contractual or legal obligations to provide data/consequences of failure to provide data
You are not contractually or legally obliged to provide us with your personal data. Please note, however, that you cannot enter into a contract for our services if we are not permitted to collect and process the data as required for the purposes specified in the foregoing (see → The purposes of data processing at UCD ES and UCD SIRC)

Right to object pursuant to Art. 21 GDPR
If the processing of your data by UCD ES and UCD SIRC is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Art. 6 (1) sentence 1 point (e) GDPR) or if it is necessary in the legitimate interests of UCD ES and UCD SIRC, then you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. UCD ES and UCD SIRC will then end the processing, unless we can present compelling legitimate grounds for such processing that supersede the grounds for ending the processing.
You may object, at any time and without restriction, to the processing of your personal data for purposes of direct advertising.

Right to withdraw consent at any time
If data processing at UCD ES and UCD SIRC is based on your consent, then you have the right to, at any time, withdraw the consent you granted. The withdrawal of consent shall not affect the lawfulness of processing between the time consent was granted and the time it was revoked.

Right to lodge a complaint
If you have concerns about your rights, you can contact the UCD DPO by email gdpr@ucd.ie

If you are not satisfied with UCD’s response or believe we are not processing your personal data in accordance with the law, you can complain to the Irish Data Protection Commission. For more details see: www.datatprotection.ie