This policy will be updated as needed – Version November 2020.
ITC Tropicar, as the data controller, explains how we collect, process, and use your personal data to provide you with new services on a daily basis while respecting your rights.
We protect your privacy by ensuring the protection, confidentiality, integrity, availability, and security of the personal data you entrust to us across all our communication channels.
We take all necessary measures to:
Provide you with clear and transparent information on how your personal data will be collected and processed;
Implement all necessary technical and organizational measures to protect your personal data against disclosure, loss, alteration, or access by unauthorized third parties;
Retain your personal data only for as long as necessary for the purposes of the processing or the service provided;
Offer you at any time the ability to access and modify your personal data that we process directly through your personal accounts on our various websites.
To achieve these objectives, we implement appropriate technical and organizational measures to ensure that data processing complies with applicable personal data protection laws.
Your personal data may be collected when you:
Contact us via the contact form;
Join our loyalty programs;
Create an account on our websites or mobile applications;
Visit our websites, which may use cookies;
Rent a car online or use our services;
Subscribe to our newsletter;
Call our customer service;
Interact with us, notably on social media;
Participate in one of our contests;
Exercise your rights regarding your data.
We collect the information you provide to us in the context of our business relationship, notably:
When you create a customer account and join a loyalty program;
When managing your orders;
During your interactions with our customer service, agency service teams, or our web pages;
When you participate in a contest.
Information that is strictly necessary to provide a service is marked with an asterisk (*) and includes your first and last name, postal address, email address, landline or mobile phone number, and your loyalty card numbers.
We also collect personal information when you purchase our products or use our services. In particular, we collect information regarding the amount and nature of your purchases, information related to your orders, invoices, and your customer journey on our online services.
In accordance with regulations, we do not collect data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning a person’s sex life or sexual orientation.These categories of special personal data are never collected or processed by ITC Tropicar.
We process your personal information in a transparent and secure manner. Your personal information is collected for the purposes detailed below.
We process your Data to allow you to browse our website https://www.itctropicar.fr.The legal basis for this processing is your consent.
We process your Data to handle your vehicle rental and storage requests.In the context of fulfilling our obligations to our customers, we collect and use your personal information to manage our business relationship, notably to handle your purchases and orders, deliver your products, and offer you our services and promotional offers that may interest you. This information helps us improve your online and in-store shopping experience as described above.The legal basis for this processing is the performance of the contract between you and us.
We process your Data to collect unpaid amounts and prevent fraud.This processing has the following sub-purposes: (i) securing payments, (ii) detecting and preventing fraud, and (iii) managing debt recovery.The legal basis for this processing is the performance of the contract between you and ITC Tropicar as the data controller.
We process your Data to manage ITC Tropicar’s advertising operations.The sub-purposes of this processing are:(i) managing technical prospecting operations,(ii) selecting individuals to conduct studies following advertising campaigns,(iii) conducting solicitation operations,(iv) creating commercial statistics,(v) prospecting customer and prospect files ourselves or with partners,(vi) updating prospect files through the organization responsible for managing the list of telephone solicitation opt-outs,(vii) organizing contests, sweepstakes, or any promotional operations excluding online gambling, and(viii) enriching customer and prospect files.The legal basis for this processing is your consent.
We collect and store your personal information to communicate with you regarding your orders, invoices, or customer service claims.The legal basis for this processing is the performance of the contract between you and ITC Tropicar as the data controller.
We analyze your personal information to enhance your customer experience. Unless you object, these analyses allow us to offer you innovative products, complementary or promotional offers, or display advertisements that match, as much as possible, your consumption habits and interests.The legal basis for this processing is your consent.
ITC Tropicar collects and analyzes your data for marketing purposes (profiling) with the help of specialized service providers. In this context, your personal data may be:
Transformed into detailed pseudonymized profiles (i.e., profiles that no longer allow personal identification during the display of advertising content while browsing the Internet) to be used by our brands and business partners in order to carry out targeted online advertising campaigns (display) based on your interests and to offer you promotions that match your consumption habits.
Used by ITC Tropicar or transmitted to our service providers to directly offer you advertisements via mail or phone calls (by call agents and not automated calls). The legal basis for this processing is your consent.
Used by ITC Tropicar or transmitted to our service providers to directly offer you advertisements via email. The legal basis for this processing is your consent.
When this prospecting concerns products or services similar to those for which the data were collected and comes from ITC Tropicar, the legal basis for this processing is ITC Tropicar’s legitimate interest.
If you do not wish to receive our targeted advertisements or those of our partners, you have several options to disable this feature:
On your mobile device, enable the “Limit Ad Tracking” setting on iOS or the setting that disables personalized ads on your Android phone.
We may be required to disclose your personal data in the case of legitimate requests from public authorities, in particular to comply with national security, fraud prevention, or legal enforcement requirements.
Your data may be transmitted to:
Staff responsible for purchasing, administrative, and accounting services, their supervisors, and individuals contractually linked to the company or organization to ensure accounting;
Personnel in charge of auditing (auditors, accountants, internal control departments);
External companies bound by contract for the execution of services;
Public authorities, exclusively to meet legal obligations;
Legal assistants and officers in the course of debt collection missions;
Financial institutions managing active accounts.
Candidate data is intended for the personnel in charge of recruitment (Human Resources department and managers of services that may be interested in the application).
In all other cases, you will be notified of the processing ITC Tropicar plans to carry out.
We ensure that only authorized personnel within ITC Tropicar can access your personal data when such access is necessary for the execution of our commercial relationship.
Our service providers and targeted advertising providers may also receive personal data strictly necessary to perform the services entrusted to them (for example: delivery of your orders, online payment, targeted promotional campaigns).
Data is stored in compliance with French law and European regulations.
We may share personal data with other companies when necessary to provide the services you have contracted or subscribed to (examples: home delivery, pick-up points, product availability alerts). Operations with a service provider receiving your data are governed by a contract to ensure the protection of your data and respect for your rights.
If our service provider operates outside the European Union, we protect the confidentiality of your personal information and your rights by using the data protection clauses recommended by the European Commission.
Data retention periods comply with CNIL recommendations and/or legal obligations:
Category of Personal Data | Retention Rules |
Customer account data | 3 years after last client contact |
Loyalty program data | 3 years after last client contact |
Personal login data for websites | 6 months to 1 year |
Cookies | Maximum validity: 13 months |
Purchase data | Invoices: 5 years |
Behavioral data | No limit for anonymized data |
Prospective customer data | 3 years after last client contact |
Identification data | Maximum 1 year |
Segmentation | No limit for anonymized data |
After these periods, data may be archived, particularly to comply with legal prescription periods.
The protection of personal data is governed in France by the General Data Protection Regulation of 27 April 2016 (GDPR) and by the amended French Data Protection Act of 6 January 1978.
As the data controller, we are committed to protecting the data of our clients and prospects (hereinafter “you”), which we process for the needs of our activity. This is why we pledge to respect the essential principles applicable to the protection of personal data.
This policy explains how we deposit and use cookies on the website www.itctropicar.fr. We also inform you about how you can manage your cookie preferences.
A cookie can be described as a tracker or browsing token, deposited, recorded, and/or read by the user’s browser when visiting a website, installing an application, or using software or a mobile application.
There are three types of cookies:
Technical (essential) cookies: Necessary for using a service or accessing content on the site; user consent is not required.
Analysis and performance cookies: Allow us to measure, for example, the number of visitors or pages visited. Their deposit generally requires your consent, with some exceptions.
Advertising or targeting cookies: Record data to control the display of advertisements to a specific user. Their deposit requires your consent.
The names of the cookies that may be set or read on your device, their purposes, and retention periods are summarized in the following table:
Cookies | Purpose | Duration |
Tarteaucitron | Saves your consent/refusal choices regarding cookie deposit | 12 months |
SessionID | Keeps information (dates, agencies, times, vehicle) specific to the search and booking of a rental car | Expires at the end of the browsing session |
atuvc | Cookie to track page shares on social networks | 13 months |
Cookies | Purpose | Duration |
hjSessionResumed | Cookies set by HotJar, used to identify a user as part of a sample for analysis, exclude a user from a survey they have already answered, etc. | Expires at the end of the browsing session |
hjlIncludedInSample | Cookies set by HotJar, used to identify a user as part of a sample for analysis, exclude a user from a survey they have already answered, etc. | Expires at the end of the browsing session |
hjid | Cookie set by HotJar to identify a user on arrival to the site and recognize them if they return | 365 days |
gid | Cookie set by Google Analytics to analyze user experience | 1 day |
ga | Cookie set by Google Analytics to analyze user experience | 24 months |
Cookies | Purpose | Duration |
fbp | Cookie set by Facebook to display targeted advertising in interaction with Facebook | 3 months |
Bing | Cookie set by Bing for interaction with ads | Not specified |
fbp | Cookie set by Facebook to display targeted advertising in interaction with Facebook | 3 months |
This site uses certain services provided by third-party sites, including:
Share buttons (Twitter and Facebook)
Twitter feeds
Videos embedded on the site (YouTube, Dailymotion)
These features use third-party cookies set directly by these services. During your first visit to www.itctropicar.fr, a banner informs you of these cookies and invites you to make your choice. They are only set if you accept them. You can at any time access information and configure your cookie preferences to accept or refuse them by visiting the Cookie Policy page at the bottom of each page of the site. You can indicate your preference either globally for the entire site or individually for each service.
You are informed that during your visits to our websites and mobile applications, cookies may be installed on your device (computer, tablet, or smartphone). Similarly, cookies may be set on your device via emails sent to you or when installing software or a mobile application.
These cookies may be set by us as the publisher of the above-mentioned digital spaces, or by third parties, who may act on our behalf as processors or in their own interest.
We provide you with the means to configure cookies, allowing you to accept or refuse all or part of the cookies set on our digital platforms. You can make your choice:
By using the management tool accessible at any time via the following link: [Cookie Settings URL];
By configuring your browser. Each browser has its own specific settings, which are generally accessible via their help menus. For example:
Google Chrome
https://support.google.com/accounts/answer/61416?co=GENIE.Platform%3DDesktop&hl=fr
Internet Explorer
https://support.microsoft.com/fr-fr/help/17442/windows-internet-explorer-delete-manage-cookies
Mozilla Firefox
https://support.mozilla.org/fr/kb/activer-desactiver-cookies-preferences
Opera
http://help.opera.com/Windows/10.20/fr/cookies.html
We cannot guarantee the permanence of these URLs or the quality of the information they contain.
For mobile applications, emails, and social networks, we invite you to refer to your account settings, which differ according to platforms and providers, but allow you to control the data collected about you.
As long as you have not given your consent, no cookies are set or read on your device (except for session cookies that do not require prior consent). Refusing to give consent does not prevent access to our website.
To allow you to control our use of your personal data, you have the following rights:
Right of access to your data
You can obtain from ITC Tropicar confirmation of whether or not your data is being processed and, if so, access to all data and information held by ITC Tropicar.
Right to rectify your data
You can request that ITC Tropicar correct any inaccurate or incomplete data concerning you. You may also request that your data be completed, if necessary.
Right to erasure of your data
Except as required by law, you may request that ITC Tropicar erase your data promptly, particularly if you consider that processing by ITC Tropicar is no longer necessary for the purposes for which it was collected.
Right to data portability
You have the possibility to retrieve part of your data in an open, machine-readable format or request that ITC Tropicar transmit it to another organization. This right only applies to data that you have actively and knowingly provided to ITC Tropicar (e.g., data entered in an online form) or data generated through the use of a service or device in the context of concluding or managing your contract, and which is processed automatically based on consent or contract execution.
Right to object
You may object to your data being used by an organization for a specific purpose. You must provide reasons related to your particular situation, except in the case of commercial solicitation, which you may oppose without justification.For data processing for commercial purposes, you may object at any time, just as you may object at any time to the setting of cookies (see Article 3 of this Policy). You also have the right to object to analytical profiling at any time.
Right to restrict processing
You may request that ITC Tropicar retain your data without using it in the following cases:
You contest the accuracy of the data processed by ITC Tropicar,
You object to your data being processed,
The data is processed unlawfully, but you oppose its deletion,
You need the data to establish, exercise, or defend legal claims.
Right to withdraw consent
When the processing of your personal data is based on your consent (e.g., receiving our commercial electronic offers), you may withdraw your consent at any time. Similarly, you may withdraw your consent to cookies following the procedures described in Article 3 of this Policy.
Right to post-mortem directives
You may define instructions regarding the retention, deletion, and communication of your data after your death. These directives determine how your rights over your data should be exercised posthumously. You can send these instructions to ITC Tropicar’s DPO by mail, with the subject “Post-mortem directives.” You may modify or revoke these instructions at any time.
Right to lodge a complaint with CNIL
If you believe your rights are not respected or that your data is not protected in accordance with the GDPR, you may file a complaint with a competent supervisory authority (in France, the CNIL), directly on the CNIL website or by mail at: CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.
You can exercise your rights:
By email: dpo.@gbh.fr
By mail: ITC Tropicar – 27 avenue de Bourbon 97434 Saint-Gilles-Les-Bains.
Proof of identity may be required in case of doubt about the requester’s identity.If you need further information about these rights, please contact us at the addresses above. We will respond to your requests as promptly as possible, and in any case within one month of receipt. You also have the right to lodge a complaint with a supervisory authority in France, the CNIL.
Respecting your right to the protection, security, and confidentiality of your data is our priority.
ITC Tropicar implements organizational and technical security measures appropriate to the sensitivity of personal data to protect them against any malicious intrusion, loss, alteration, or disclosure to unauthorized third parties.
During the development, design, selection, and use of our services that involve the processing of personal data, ITC Tropicar considers data protection by design.
For example, we pseudonymize or anonymize personal data whenever possible or necessary.
All personal data is confidential, and access is limited to ITC Tropicar employees or contractors acting on behalf of ITC Tropicar who need the data to perform their duties. All individuals with access to your data are bound by a confidentiality obligation and may face disciplinary measures and/or other sanctions if they fail to comply.
Transactions with third-party recipients are governed by contracts to ensure the protection of your personal data and the respect of your rights.
We are fully committed to the effective protection of the personal data you entrust to us. In this ongoing concern for security and protection, we encourage you to be vigilant to prevent any unauthorized access to your personal data and to secure your devices (computer, smartphone, tablet) against unwanted or malicious access by using a strong password, which should be changed regularly. If you share a device, we recommend logging out after each use.
Our Data Protection Officer (DPO) is available to answer your questions at the following addresses:
By email: dpo.@gbh.fr
By mail: ITC Tropicar – 27 avenue de Bourbon 97434 Saint-Gilles-Les-Bains
“Anonymization” is defined as “the result of processing personal data to prevent, irreversibly, any identification.”
“Collect” means the act of gathering personal data. This collection can be done, for example, through questionnaires or online forms.
“Consent” refers to any freely given, specific, informed, and unambiguous indication of your wishes by which you agree, through a statement or clear affirmative action, that personal data concerning you will be processed.
“Personal data” or “personal information” means any information relating to an identified or identifiable natural person; a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more specific elements of the person’s physical, physiological, genetic, mental, economic, cultural, or social identity.
“Rights protecting your personal data” refers to all fundamental rights described in European regulation*¹, concerning:
the right to information;
the right of access;
the right to rectification;
the right to erasure or “right to be forgotten”;
the right to data portability;
the rights to object;
the right to restriction of processing;
the right to set directives regarding the retention, deletion, and communication of personal data after death.
“Restriction of processing” refers to marking personal data kept to limit its future processing*².
“Data minimization” refers to limiting the collection or use of information.
“Data pooling” refers to the result of combining client or prospect databases from multiple partners.
“Profiling” *³ means “any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict elements concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that natural person.”
“Products or services” means all products and services, including technological ones (websites, applications, and associated services) offered or to be offered by ITC Tropicar.
“Commercial prospecting” means the search for clients; it is considered commercial because it relates to commerce*⁴.
“Pseudonymization” refers to any technical and organizational security measure that replaces an identifier to ensure that personal data cannot be attributed to an identified or identifiable natural person.
“Commercial relationship” includes all relationships between ITC Tropicar and its clients, such as purchases of products or services, after-sales service, participation in online games, product returns, complaints, participation in satisfaction surveys, or loyalty programs.
“Data controller” is the person or entity that, alone or jointly, determines the purposes and means of processing your personal data.
“Behavioral segmentation” allows, based on observed behavior, to establish the socio-economic or even psychological profile of a person in order to classify them into a segment.
“Online services” means the digital services offered by ITC Tropicar, such as websites, applications, associated services, or mobile services.
“Processor” is any entity that processes personal data on behalf of the person, structure, or organization responsible for the processing.
“Monitoring of individual behavior”, sometimes called “profile deduction,” refers to techniques that evaluate behavioral aspects of a natural person based on their use of the internet.
“Third party” refers to any person other than ITC Tropicar and yourself.
“Processing of personal data” means any operation or set of operations performed on your data, regardless of the online service used or the method employed.
*¹ REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016, Articles 15 to 21 and Article 23
*² EU Regulation 2016/679 of 27 April 2016, Article 4
*³ Regulation (EU) 2016/679 of 27 April 2016: OJ L 119 p.1, Article 4 §4
*⁴ Larousse Dictionary, 2017