At Enterprise Holdings, Inc., through our independent regional subsidiaries (collectively “Enterprise Holdings”) and network of independent franchisees and fulfillment partners operating the Enterprise Rent-A-Car, National Car Rental, Alamo Rent A Car, as well as other various programs, features and services (" Enterprise Holdings", "we", "our" or "us" as referred to in the policy below), we respect your privacy.  We have implemented our privacy policy ("Privacy Policy") and cookie policy ("Cookie Policy") to explain our data collection, use, disclosure, and transfer practices, as well as individual access rights you may have when you use our sites and services, including global reservations and other rental services.

We host and maintain this website on behalf of a franchisee or fulfillment partner. For information about their privacy practices, please see below.

1. General

Reykjavik Excursions Ltd., Almenningsvagnar Kynnisferða ehf., Enterprise Rent-A-Car Ltd., Hópbifreiðar Kynnisferða ehf. og Garðaklettur ehf. strongly emphasize that the processing of personal data is always in accordance with the applicable privacy laws. This notice states what personal data the companies collect in relation to its operations and for what purpose. Here you can find information about other recipients of the information and for how long we keep the information.

You can also find information on the basis on which we collect personal data, what rights individuals have, and further important information related to the Act no. 90/2018 on Data Protection and the Processing of Personal Data.

2. What is personal data and processing of personal data?

Personal data is information that relates to an identified or identifiable individual, such as name, ID number, address, email address, telephone number, finances, health, IP address and more. The processing of personal data means all processing and use of personal data such as collection, registration, preservation, alteration, or deletion.

There are "special categories" of more sensitive personal data which are more private in nature and therefore require a higher level of protection, such as genetic data, biometric data, information about sex life or sexual orientation, race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and health.

The processing of personal data refers to all processing and use of personal information such as collection, registration, storage, modification, or deletion.

3. How do the companies process personal data?

Processing of personal data is conducted on a legitimate basis and in accordance with the Privacy Act and the processing of personal data no. 90/2018.

The companies ensure that the following principles are adhered to:

• that personal information is processed fairly.
• that personal information is only collected for a clear purpose.
  
• that no more personal information is collected than is necessary.
  
• ensure that your personal information is accurate and updated when necessary.
  
• that personal information will not be kept longer than is necessary.
  
• ensure the security of personal information with appropriate security measures.
  

4. On whom do the companies collect personal data?

In our operations it is necessary to collect and process personal data about different groups of individuals. The personal data held by us may be about customers, contractors and other third parties that are necessary to communicate with.

5. What personal data do the companies collect about you?

We collect different personal data about different groups of individuals depending on the activities of the companies. In all circumstances, we endeavour to collect only the personal data necessary for the purpose of the processing.

We collect and handle the following categories of personal information about applicants, former and current staff:

• basic information (name, address, email address, etc.)

• photo

• trade union membership

• bank information

• tax information

• information:

• from a job application

• from the employment contract

• from time registration

• on wage payments

• on health

• from e-mail communications

• on paid leave

• on child support payments

• on project status

• from performance surveys

• from staff interviews

• the reason for the reprimand / termination

• telephone usage record (duration and timing of calls)

• about course attendance

• about accidents/incidents

We collect necessary information about our customers, such as name and in some cases identification number. We also need to keep the necessary contact information about the contractors and other third parties, such as name and email address.

We collect the following personal information about customers and contacts of their customers (legal entities):

5.1 E-mail Communication

The information we collect when it comes to email communication with customers, customer contacts and others is the name, email address and the communication itself.

5.2 Booking

When booking a trip with us, whether on the companies' websites or with an agent, various basic information is shared with us, such as e.g., name and email address and payment information as well as travel information.

5.3 Network

When calling our telephone number, we record the telephone number dialed, the time of the call and its duration.

5.4 Customer service surveys

To improve our service, we send emails with service surveys to our customers' email addresses. When a response is received to a survey, we collect basic personal information, travel information and the results of the survey.

5.5 Service notifications

In order to provide various information regarding our travels and services, we collect customers' e-mail addresses.

5.6 Internet use

We monitor data usage.

5.7 Car rental

When you book a rental car, we collect basic information such as e.g., name, age, telephone number and email address; payment information and driving license information.

5.8 Customer management

The information we need to collect to be able to keep track of customers’ and clients' contacts (legal entities), is contact information such as e.g., name, ID number, address, e- mail address and telephone number.

5.9 Contracts

We retain contracts that the companies make in their operations. The personal information we collect in connection with contracts is mainly name, ID number, job title and other contact information.

5.10 Requests

In connection with requests to us, the companies collect the name, e-mail address, subject matter of the request and the content of the message.

5.11 Mailing list registration

We list customers' names and email addresses in mailing lists for the purpose of sending them marketing materials.

5.12 Newsletter

We send our customers a newsletter by e-mail and for that purpose we collect the customer's name, e-mail address and information on whether and when the person opens the newsletter.

5.13 Social media (Instagram, Facebook and Tripadvisor)

In connection with social media marketing, we collect images, the person's name, username and communication content.

5.14 Online chat (Chatbot)

The information we collect when a customer contacts the companies via online chat is the name, booking number and the communication itself.

In some cases, we need to collect sensitive personal data, such as health information and information on employee trade union membership. In such cases, special care is taken in handling such information.

In addition, we collect footage from surveillance cameras located in our premises, where personal data can be found.

6. Why do we collect personal data about you?

The purpose of collecting the information is:

• to be able to fulfil contractual obligations, for example with negotiators.

• to be able to provide customers with the requested services.

• to safeguard the legitimate interests of the companies, for example with security cameras for security and asset management purposes.

7. On what legal basis do we process your personal data?

We collect and processes personal data on the following legal basis:

• your consent.

• to fulfil contractual obligation.

• to comply with legal requirements.

• to safeguard the legitimate interests of the companies.

8. For how long do we keep your personal data?

We will keep your data if there is a statutory or legal requirement to do so or as long as we need in order to provide our services to you, after which time it will be destroyed. Foraccounting and auditing purposes we may retain your personal data for a period of time after our services have been rendered.

Your information that we use for direct marketing purposes will be kept with us until such time you notify us that you no longer wish to receive marketing information from us.

9. From whom do the companies collect information about you?

We collect your personal data directly from you. If third-party personal data is collected, we will, as far as possible, endeavour to inform the individual concerned.

10. When do the companies share your personal information to third parties and why?

We share personal data to third parties hired by us to perform certain tasks, such as service providers, agents or contractors. In these cases, the companies enter into a data processing agreement with the party in question. Such an agreement stipulates, among other things, the obligation to comply with our instructions on the processing of personal data and it is not permitted to use it for any other purpose. It is also obligatory to ensure the security of the information in an appropriate manner.

Part of our services is providing tours in co-operation with other, third party tour operators as well as selling tours solely operated by third party tour operators. In these cases we will provide them with your basic personal data so that they may be able to provide you with the services you have purchased.

We also share information to third parties when required to by law.

11. Transfer of personal data outside the European Economic Area

We are aware that stringent conditions apply to the transfer of personal data to countries located outside the European Economic Area. We do not under any circumstances do so unless there is sufficient authority to do so under the Act no. 90/2018 on Data Protection and the Processing of Personal Data.

12. What are your rights?

If you have given your consent to the processing of certain personal data, you are entitled under the Act no. 90/2018 on Data Protection and the Processing of Personal Data to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. You also enjoy other rights, such as the right to access your personal data, the right to have inaccurate personal data rectified, the right to have personal data erased , the right to request the restriction or suppression of your personal data, and the right to data portability. Keep in mind that your rights are not always absolute and may be subject to various conditions.

13. Security of personal data

The companies have implemented appropriate technical and organizational security measures to ensure the security of personal data in accordance with the Act no. 90/2018 on Data Protection and the Processing of Personal Data. This means, among other things, that the only employees that have access to personal data are the ones required to by their work. In addition, we promote regular training for employees on the security and processing of personal data.

14. Data Controller Information

Name: Enterprise Rent-A-Car Ltd.

SSN: 611298-3239

Address: Arnarvöllur 4, 235 Keflavíkurflugvöllur

Name: Reykjavik Excursions Ltd. SSN: 501006-0250

Name: Hópbifreiðar Kynnisferða ehf.

SSN: 620372-0489

Name: Almenningsvagnar Kynnisferða ehf.

SSN: 631299-2379

Name: Garðaklettur ehf.

SSN: 440204-3760

Address: Klettagarðar 12, 104 Reykjavík, Iceland

E-mail: privacy@re.is.

15. Right to file a complaint with the Data Protection Authority

If you doubt that we process your personal data in accordance with the Act no. 90/2018 on Data Protection and the Processing of Personal Data, you have the right to file a complaint with the Data Protection Authority (www.personuvernd.is).

16. Changes to this Privacy Notice

This Privacy Notice may change from time to time in accordance with chances to applicable laws and regulations or if changes are made to how we process personal data.

Updated: January 2023