Privacy and Data Protection Policy

1. Introduction

ENCARS values the privacy of customers, website users, drivers, company representatives and other data subjects. This Policy explains how we collect, use, retain, protect and, where necessary, share data through our website, Rent-a-Car services, services for companies and TVDE fleets, and contractual relationships.

We process data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Portuguese law.

2. Data controller

The controller is ENCARS Rent-a-Car, Unipessoal, Lda., Tax ID 519 416 074, Rua Coronel Figueiredo, no. 5, 8400-306 Lagoa, Portugal. For questions or to exercise your rights: info@encars.pt.

3. Personal data we may collect

3.1 Identification

• Name, date of birth and nationality;
• identification document, driving licence and signature;
• other information needed to verify identity.

3.2 Contact details

Address, postcode, town/city, telephone number and email address.

3.3 Rental data

Bookings, contracts, vehicle use, additional services, damage, accidents, claims, tolls, fines, payments, pre-authorisations and outstanding amounts.

3.4 Payment data

Data needed for payments, transaction confirmation, pre-authorisations, debt collection, accounting and tax documents. Specialist providers may process data directly. ENCARS does not intend to retain full payment-card details beyond what is necessary and legally required.

3.5 TVDE company data

Company name, tax number, address, contacts, permanent commercial certificate, TVDE licence, representatives, fleet managers and necessary contractual information.

3.6 Communications

Emails, messages, enquiries, quotation requests, complaints, assistance requests and contract-related communications.

4. How we collect data

Through the website, online forms, contact and quotation requests, bookings, contracts, email, telephone, in-person service, customer documents, payments, claims and public authorities where permitted or required. Third parties providing data must have an appropriate legal basis.

5. How we use data

5.1 Bookings

To receive and manage bookings, verify identity and rental requirements, changes and cancellations.

5.2 Contracts

To enter into and perform contracts, provide vehicles, manage payments, deposits, pre-authorisations, rental periods, returns, invoicing and assistance.

5.3 Fleet management

To manage vehicles, maintenance, breakdowns and damage.

5.4 Accidents and claims

To record and manage claims, communicate with insurers, determine liability and handle compensation.

5.5 Tolls and Via Verde

To identify toll use, associate it with the contract and collect amounts due.

5.6 Fines

To identify the responsible driver, respond to authorities and manage fines and administrative costs.

5.7 Security and fraud

To prevent and investigate fraud, misuse, theft, document forgery, payment fraud and other unlawful activities.

5.8 Customer service

To answer enquiries, quotations, complaints, assistance requests and questions about contracts, payments or data protection.

5.9 Legal obligations

To comply with legal, tax, accounting, regulatory and judicial obligations.

6. Geolocation and telematics

Vehicles may use systems collecting location, mileage, vehicle status, technical information, maintenance and usage data. These support fleet management and security, theft prevention and recovery, assistance, maintenance, mileage control and contract performance, and are limited to legitimate purposes.

7. Legal bases

• Contract: entering into and performing a contract;
• legal obligation: compliance with applicable law;
• legitimate interests: fraud prevention, security, fleet protection and management, debt collection, complaints, defence of rights and prevention of misuse, unless overridden by the data subject’s rights;
• consent: where required, which may be withdrawn at any time without affecting prior lawful processing.

8. Marketing communications

We may send information about services, campaigns, products and offers where legally permitted. Consent will be requested where necessary. You may unsubscribe through the communication or at info@encars.pt. This does not prevent essential contractual or service communications.

9. Sharing with third parties

Where necessary or legally required, data may be shared with insurers, assistance companies, workshops, maintenance, payment and IT providers, toll operators, police and administrative authorities, tax authorities, courts, lawyers, advisers, collection agencies and other contractual service providers. We seek appropriate safeguards from processors acting on our behalf.

10. International transfers

Transfers outside the European Economic Area will comply with the GDPR and use appropriate safeguards where necessary.

11. Retention

We keep data only as long as necessary, considering the contractual relationship, tax, accounting and legal duties, complaints, disputes, claims, defence of rights and fraud prevention. Data is then erased or anonymised unless further retention is legally justified.

12. Data security

We use appropriate technical and organisational measures against unauthorised access, loss, destruction, alteration, improper disclosure and unlawful use, limiting access to those who need it. No IT system or Internet transmission is completely secure.

13. Your responsibility

Customers must provide accurate, complete and current data and report changes, especially to name, address, email, telephone, company and contractual details.

14. Third-party data

Customers providing data about additional drivers, representatives, employees or company contacts must ensure those persons are informed and that an appropriate basis exists.

15. Data-subject rights

• Access;
• rectification;
• erasure where legally applicable;
• restriction of processing;
• objection to processing based on legitimate interests;
• data portability where applicable;
• withdrawal of consent at any time.

16. Exercising your rights

Contact ENCARS at info@encars.pt or at the address above. Identify the right and provide enough information to identify you. We may request further information to verify identity and protect personal data.

17. Response time

We respond within statutory time limits. Lawful extensions may apply to particularly complex or numerous requests.

18. Right to complain

You may complain to the competent supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD). You may first contact ENCARS so we can try to resolve the matter.

19. Cookies

We may use cookies for website operation, preferences, user experience, statistics, analytics and features. Non-essential cookies are used only with consent where required. Preferences can be managed using website tools. A specific Cookie Policy supplements this Policy where available.

20. Third-party links

We do not control or accept responsibility for third-party websites’ policies, content or processing. Please read their policies before providing data.

21. Minors

Services are intended for persons meeting legal and contractual requirements. We do not deliberately seek minors’ data beyond what is necessary for services or legal obligations.

22. Automated decisions

We do not intend to make decisions producing legal or similarly significant effects solely by automated means, except where permitted with required safeguards. Data subjects will be informed if relevant automated decision-making or profiling is introduced.

23. Changes to this Policy

We may update this Policy following legal, service, website, technology or internal-process changes or authority recommendations. The current version and date will be published, and significant changes may be communicated appropriately.

24. Contact

ENCARS Rent-a-Car, Unipessoal, Lda.
Tax ID: 519 416 074
Rua Coronel Figueiredo, no. 5, 8400-306 Lagoa, Portugal
info@encars.pt