Privacy Policy for Customers of Debereca GmbH

This Privacy Policy explains how Debereca GmbH processes your personal data in connection with the rental of a vehicle and the performance of long-term rental agreements, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data Controller

The controller responsible for processing your personal data is:

  • Company: Debereca GmbH
  • Registered Office: Südliche Münchner Str. 8, 82031 Grünwald, Germany
  • Legal Representative: Christian De Beni
  • Email: info@debereca.com
  • Telephone: +49 89 255 49 59 811

2. Categories of Personal Data Processed

For the establishment and administration of the contractual relationship, we collect and process the following categories of personal data:

  • Personal identification and contact details: first name, last name, residential address, tax identification number/VAT identification number, email address and telephone number.
  • Driving licence and identification data: driving licence details (licence number, category, issue date and expiry date) and a copy of the driving licence to verify its validity. For legal representatives of companies, we also require a copy of an identity document and the tax identification number.
  • Financial data: bank account details (IBAN), commercial register information, verification of the VAT identification number, and, where applicable, creditworthiness information.
  • Vehicle and usage data: registration details of the rented vehicle and, where applicable, geolocation (GPS) data if the vehicle is equipped with such security systems (subject to prior notification and used only for lawful purposes).

3. Purposes of Processing and Legal Basis

Your personal data is processed for the following purposes:

  • a) Performance of contractual obligations (Article 6(1)(b) GDPR): to manage rental quotations, conclude the rental agreement, hand over the vehicle, issue invoices, provide customer support during the rental period, manage the return of the vehicle, and fulfil all obligations relating to the termination of the agreement.
  • b) Creditworthiness assessment (Article 6(1)(f) GDPR): processing is based on our legitimate interest in assessing the customer's creditworthiness before handing over a vehicle of significant economic value.
  • c) Compliance with legal obligations (Article 6(1)(c) GDPR): to comply with obligations under German tax, accounting and civil law, as well as to manage communications with public authorities concerning traffic offences (fines), accidents, or other legal obligations.
  • d) Protection of the company's legal interests (Article 6(1)(f) GDPR): processing is based on our legitimate interest in establishing, exercising or defending legal claims, recovering outstanding debts, and assessing or documenting damage to the rented vehicle.

4. Recipients of Personal Data

Your personal data will not be made publicly available. However, it may be disclosed to third parties closely connected with the purposes described above, including:

  • Insurance companies (for claims handling and policy administration);
  • Public authorities and law enforcement agencies (in Germany and other countries) in connection with traffic offences, accidents, criminal offences, vandalism, or damage caused by force majeure (e.g. severe weather events);
  • Tax advisors, legal counsel and external auditors;
  • IT service providers and cloud service providers acting as data processors under a Data Processing Agreement (DPA).

Your personal data is processed and stored exclusively within the European Economic Area (EEA).

5. Data Retention

Your personal data will be retained for as long as necessary to fulfil the contractual purposes and for the statutory limitation periods applicable to traffic-related matters.

In accordance with the retention requirements of German commercial and tax law (German Commercial Code – HGB and Fiscal Code – AO), contractual documents and invoices are retained for 10 years following the end of the calendar year in which the rental agreement terminated.

6. Your Rights

Under the GDPR, you have the right at any time to exercise the following rights:

  • Right of access (Article 15 GDPR);
  • Right to rectification (Article 16 GDPR);
  • Right to erasure ("right to be forgotten") (Article 17 GDPR), provided there are no statutory retention obligations;
  • Right to restriction of processing (Article 18 GDPR);
  • Right to data portability (Article 20 GDPR);
  • Right to object to processing based on legitimate interests (Article 21 GDPR).

To exercise any of these rights, you may submit a written request using the contact details provided in Section 1.

You also have the right to lodge a complaint with the competent data protection supervisory authority. As Debereca GmbH is established in Germany, you may contact the competent data protection authority of the Federal State of Bavaria.

Grünwald, 18 June 2026