Privacy Notice regarding GPS Tracking / Telematics Use

Pursuant to Article 13 of the General Data Protection Regulation (GDPR)

Dear Customer,
To protect our vehicle fleet against theft and misappropriation and to ensure the efficient administration of our rental agreements, some of our vehicles are equipped with GPS tracking systems and telematics units. Below, we provide information on how your personal data is processed in this context.

1. Who is responsible for the data processing?

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Debereca GmbH
Südliche Münchner Str. 8
82031 Grünwald, Germany
Email: info@debereca.com

2. What data is processed?

The systems installed in the vehicle may collect and transmit the following data:

  • The vehicle's current geographical location (GPS coordinates)
  • Timestamp (date and time of the location record)
  • Vehicle status (e.g. ignition on/off, odometer reading, battery status)
  • Collision and accident data (airbag deployment, severe deceleration)

3. For what purposes and on what legal basis is the data processed?

GPS and telematics data are processed exclusively for the following purposes:

  • Prevention and investigation of criminal offences (theft protection): to locate the vehicle in the event of a reasonable suspicion of theft, misappropriation, or use in breach of the rental agreement.
    Legal basis: Article 6(1)(f) GDPR (legitimate interests of the company as the owner of the vehicles).
  • Performance of the contract and billing: to verify the vehicle's mileage upon return or to calculate mileage-based rental charges.
    Legal basis: Article 6(1)(b) GDPR (performance of the rental agreement).
  • Roadside assistance and emergency management: to quickly locate the vehicle in the event of a breakdown or accident in order to arrange assistance.
    Legal basis: Article 6(1)(b) GDPR (performance of the contract) and, where applicable, Article 6(1)(d) GDPR (protection of vital interests in emergency situations).

Important notice: There is no continuous or indiscriminate real-time monitoring of your driving behaviour, nor are general movement profiles created. Data is accessed only when there is a specific reason, such as failure to return the vehicle, a system alarm, or another justified incident.

4. Who receives your data?

Within our company, access to the data is limited to employees responsible for fleet management, claims handling, and customer service. Your data will only be disclosed to third parties:

  • to external service providers acting as data processors and contractually bound to process the data solely in accordance with our instructions;
  • to law enforcement authorities and insurance companies in the event of theft, misappropriation, or an accident.

5. How long is the data stored?

Recorded location data is routinely overwritten or deleted after 7 days, unless a specific incident (e.g. theft report, accident, or outstanding payment) requires longer retention for evidentiary purposes. In such exceptional cases, the data will be deleted once the matter has been finally resolved.

6. Your rights

You have the right to:

  • access your personal data (Article 15 GDPR);
  • request rectification of inaccurate data (Article 16 GDPR);
  • request erasure of your data (Article 17 GDPR);
  • request restriction of processing (Article 18 GDPR).

You also have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data pursuant to Article 21 GDPR.

Furthermore, you have the right to lodge a complaint with a competent data protection supervisory authority.

Grünwald, 18 June 2026