The data controller is SC AUTOREVOLUTION SRL (hereinafter referred to as “ExpediCAR”). car-rentals.ro does not collect or directly process any user information but automatically and securely transfers the data provided by users to the ExpediCAR.ro system without storing it. I. MEANING OF SOME TERMS To ensure better understanding of the information contained in this document, we include below a clarification of the main terms used herein. These definitions are taken from EU Regulation No. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (GDPR Regulation), effective from 25.05.2018. * “personal data” means any information relating to an identified or identifiable natural person (“data subject”); * “special/sensitive data” means personal data revealing racial or ethnic origin, political opinions, religious beliefs, philosophical convictions, etc. * “processing” means any operation performed on personal data, including collection, recording, organization, storage, use, etc. II. TYPES OF PERSONAL DATA processed by ExpediCAR in connection with you You directly provide us with personal data. For example, we receive information from you as follows:

• When subscribing to newsletters, you provide: social status, first name, last name, address, email, phone.
• When renting a vehicle, additional information is required to conclude the contract.

III. PURPOSES AND LEGAL BASES OF PROCESSING We use your personal data for the following purposes:

• Processing orders, including vehicle rental, provision of vehicles, technical support, and invoicing;
• Providing support services;
• Improving our services;
• Marketing and commercial communications.

IV. WHAT YOU NEED TO KNOW ABOUT DATA PROCESSED BASED ON CONSENT

• You are not obliged to provide such data;
• You may withdraw your consent at any time;
• Withdrawal of consent does not affect processing carried out before withdrawal.

V. HOW LONG WE RETAIN YOUR PERSONAL DATA

• We store your data for the duration of the contract;
• Retention of some data may be required by applicable law.

VI. DATA UPDATES

• If you notice errors regarding your personal data, please notify us for correction.

VII. WHO WE SHARE PERSONAL DATA WITH

• Data may be provided to affiliated entities, partners, collaborators of ExpediCAR;
• Public authorities and relevant institutions according to applicable law.

VIII. WE DO NOT TRANSFER DATA OUTSIDE THE EUROPEAN UNION

• ExpediCAR does not transfer your data to entities outside the European Union.
• If a transfer is necessary, we ensure appropriate protection measures are implemented.

IX. HOW WE PROTECT THE SECURITY OF YOUR PERSONAL DATA

• ExpediCAR implements technical and organizational measures to protect data.
• Any unauthorized access will be recorded and reported to the competent authorities.

X. YOUR RIGHTS REGARDING PERSONAL DATA PROCESSING

• Right to access data;
• Right to rectify data;
• Right to erasure (“right to be forgotten”);
• Right to restrict processing;
• Right to object to processing;
• Right to data portability;
• Right to withdraw consent;
• Right to lodge a complaint with the supervisory authority (ANSPDCP).