PRIVACY STATEMENT

For the company named "FLEXCAR CAR RENTAL AND SALES SINGLE MEMBER SOCIETE ANONYME" (GEMI Registration No. 147820101000, 6-8 Tagiapiera Str., Athens) (hereinafter "FlexCar" or "Data Controller" or "We"), the protection of our customers' and partners' Personal Data and respect for individual privacy is a self-evident commitment, and the company takes all necessary measures to collect and process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR") and other applicable national and European legislation. We take all necessary organizational and technical measures required to ensure the security, availability, and validity of our customers' and partners' data.

It is very important to us that this strong commitment is clear to all our customers and partners. For this reason, we created this "Privacy and Personal Data Protection Statement" which describes and explains what kinds of personal data of our customers and partners we collect, how we manage it, and for what purpose. Please take a moment to study and understand this notice.

1.      What is personal data?

The term "personal data" refers to information of natural persons, such as indicatively full name, postal address, email address, contact telephone number, etc., which identify or can identify your identity, hereinafter "Personal Data or Data".

2.      What is Personal Data Processing?

Any operation or set of operations performed with or without the use of automated means, on personal Data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

3.      How do we collect your Data?

Your personal data is collected directly from you, either directly through representatives of our company or by other means of distance communication, mainly through the FlexCar platform operating at the website address flexcar.gr and through the FlexApp application (other distance collection means may be email, electronic forms, telephone/fax, etc., as applicable). In certain cases, you may have provided your data in the past within the context of a prior collaboration or relationship with FlexCar. Finally, in specific cases of collaboration, it is possible, following your explicit notification, to collect your data from other organizations or registries, in the context of a potential creditworthiness check for solvency control, financing, or credit insurance purposes of our company.

4.      For what purposes do we process your data?

FlexCar collects only personal data that is strictly necessary to fulfill requests from our customers and partners, to execute our collaboration with them, and for the smooth conclusion and operation of contractual relationships with them, the leasing and sale of vehicles, and in general its commercial activity and operation. Also, a portion of this data is collected and used in order for our company to comply with its legal obligations toward public authorities (tax, social security, health legislation, etc.). Furthermore, data collection and processing take place for critical functions of our business, such as checking credit policy, customer solvency, and insuring claims. In case additional, optional information is requested on our part, you will be informed accordingly at the time of data collection. Finally, your contact details (such as your email address, phone number, or mailing address) may be used by our company to inform you about new vehicles, offers, discounts, and other promotional activities. In any such communication, you will be given the immediate and cost-free option to opt out of receiving such updates and communications from FlexCar in the future by any method.

During the exercise of our company's commercial activity, we may collect the following personal data of customers, partners, or prospective customers and partners:

• Personal details (such as full name, father's name, address, Tax Identification Number [AFM], identity card number, signature sample).
• Financial transaction details (such as bank account numbers, debit or credit card details, and in general other payment methods and means, such as PayPal). You should know that by entering into a vehicle lease agreement with FlexCar, in the case of using a credit or debit card or PayPal, you authorize FlexCar to collect the amounts corresponding to the monthly rent at the predetermined time, as well as any other overdue debt owed to it, without prior notification and consent. Consequently, we necessarily collect and process all data concerning your payment methods and details to FlexCar.
• Financial status details (such as tax authority tax assessment notices, balance sheets, accounting records, court or chamber certificates, and generally data related to financial condition).
• Contact details (phone number, contact email, mailing address).
• Accident declaration details, motor vehicle accident data involving vehicles of our Company.
• In our vehicles, there is the capability to install geolocation and telematics systems, which are activated for fleet management, as well as in cases of theft, breach of lease agreement terms, or detection of damage/malfunction in the vehicle or the geolocation system.
• Within the context of your leasing relationship with FlexCar, we also collect data necessary for the lawful and smooth execution of the contract, such as your driver's license, details of the vehicle you have leased from FlexCar, details regarding its maintenance, as well as the person(s) authorized to use it.
• Recording of phone calls for professional communication purposes, provided it is necessary to prove that the specific conversation took place and had specific content (such as in the case of recording complaints, your requests, or requests from third parties for providing information regarding vehicle management queries, damage, etc.).
• Identification data to the extent required to fulfill one of your rights (access, erasure, rectification, etc.) for the purpose of identifying you and settling your request.
• Information collected from the use of cookies in your web browser on our website.
• Finally, within the context of your relationship with FlexCar, you may be required to submit details demonstrating your creditworthiness, such as tax data proving your income.

5.      What is the legal basis for processing your Personal Data?

Within the framework of the purposes described in this Privacy Policy, FlexCar processes personal data of its customers and partners only when it has a legal basis to proceed with the relevant processing, based on the following legal bases, as applicable to specific processing acts:

• Performance of a contract: processing necessary for the fulfillment of and compliance with our contractual obligations.
• Compliance with legal obligations of our company, such as recording in our accounting books, fulfillment of tax and other legal obligations (e.g., issuance and entry of legal documents, etc.).
• Management of our customers and suppliers and ensuring the smooth operation of our company and the proper service and handling of requests from customers and suppliers.
• For the safeguarding of our legitimate interests, to the extent that processing does not override the legitimate interests of data subjects, such as maintaining records for defending our company against legal claims, pursuing claims, as well as documentation in case of administrative and similar audits, or creditworthiness checks of our counterparties and processing for credit insurance purposes.
• Your consent: in case our company sends you updates regarding new products, offers, discounts, and other promotional activities, or for activating special features of the FlexApp application. In such a case, you will always have the option to withdraw your consent immediately, easily, and free of charge, resulting in the immediate cessation of sending such material or the corresponding processing.

6.      To whom do we disclose your Personal Data?

FlexCar does not disclose your personal data to third parties that are not affiliated entities, unless required for the purpose of lawfully fulfilling our professional and business needs, in order to respond to our contractual obligations to our customers and partners, or required or permitted by law, or with the explicit consent of the data subject.

The data of our customers and partners are processed within the framework defined herein by departments and employees of our company responsible for entering into, executing, and managing our contractual commercial relationships, as well as by any partners of ours for the same reasons. Likewise, they will be processed by other departments of our company within the context of our lawful operation, for the fulfillment of our legal obligations (e.g., accounting, legal department).

Furthermore, your data, to the extent appropriate for fulfilling our contractual or other obligations and serving you better, meeting your requests, and ensuring smooth collaboration, may be transferred to Banking Institutions or other payment service providers, or to providers collaborating with the Company, such as insurance companies, collaborating debt recovery agencies, advisory and audit service providers, any collaborating archive storage and management companies, collaborating IT companies and software/cloud/telematics providers, collaborating printing, organization, and document delivery service providers, collaborating advertising and promotion companies, vehicle service workshops and technicians, etc. In every case where such data transfer becomes necessary, FlexCar ensures that data is transferred to third parties if and only if they meet high levels of data security and confidentiality and provide sufficient guarantees and commitments for their protection, which they undertake, among other things, by virtue of written contracts.

Your data may be processed for solvency, creditworthiness assessment purposes, and for credit insurance purposes of our company through disclosure to corresponding bodies and registries, as well as collaborating credit insurance companies.

Finally, the company may disclose data to public authorities of any nature (public services, tax authorities, social security organizations, etc.) or to judicial or independent authorities, prosecutorial authorities, or investigative bodies, provided this is provided for or required by law or deemed absolutely necessary for defending our legal rights.

If we intend to transfer your data to a recipient established in a third country, we ensure that an adequate level of protection for your transferred personal data is secured in accordance with Articles 46-49 of the GDPR.

7.      What is the retention period of your Personal Data?

Personal data is retained for the period strictly necessary to carry out and complete the processing purposes mentioned above. The exact retention period for each data category is linked to: (a) the necessary time, within reasonable commercial and operational frameworks, to fulfill our contractual and commercial obligations; (b) any applicable legislative provisions regarding data retention, as indicatively applies to maintaining our company's accounting and tax records or data addressed to social security organizations; (c) the duration of our commercial or contractual relationship with customers or partners; (d) any necessity to retain records to defend our legitimate interests, prove compliance, defend against claims, and pursue our claims in court; (e) if processing is based on data subject consent, the retention time is determined by the duration of that consent.

Indicatively, the usual retention periods applicable per case for the personal data we process are:

• Data we retain within the context of the contractual relationship are kept for a maximum period of twenty (20) years from the end of the lease relationship.
• Data falling within the pre-contractual stage, which we process in the context of submitting offers and/or evaluating applications for entering into a lease contract, if the contract does not proceed, are retained for two (2) years after the end of the year in which the offer expired.
• Data submitted through accident declarations are retained for five (5) years from the end of the year in which they were submitted, unless legal claims arise from this cause, in which case they are retained for twenty (20) years.
• The data of the vehicle driver/holder will be retained for five (5) years from the date the driver stops using the vehicle. This period may be extended in case of legal claims or criminal proceedings involving the driver.
• Call recording data within the context of our communication will be retained for thirty (30) days from the date of each communication.
• Data you provide to us to exercise a right related to personal data (access, rectification, erasure, etc.) are retained for two (2) years from the processing of the request.
• The specific retention times for FlexApp data (telematics, device permissions, notifications, voice commands) are detailed in the section "Processing via the FlexApp Application & Vehicle Data" above.

8.      Processing via the FlexApp Application

To use the FlexApp application and provide our new digital features, we may carry out the following processing activities:

A. Device Permissions

Data collected: Mobile technical details (Device ID, IP, OS) may be collected, as well as access to your device's camera, photo gallery, and storage space.

Purpose: User identification, the ability to upload/scan documents (e.g., driver's license, ID card), and submission of damage/accident photos through the application.

Legal Basis: Your explicit consent (Article 6 par. 1 (a) GDPR) provided through your device's permission settings when activating the corresponding feature.

Recipients: Authorized FlexCar personnel and collaborating technical support/cloud providers of the application. 

Retention period: Technical data are retained for as long as the application is installed. Uploaded documents/photos are retained according to the retention periods of the contractual relationship (up to 20 years).

B. Push Notifications

Data collected: Device ID/Push Token and notification content (maintenance reminders, lease updates, promotional messages) may be collected.

Purpose: Direct updates regarding your vehicle lease, maintenance, as well as sending offers.

Legal Basis: Your explicit consent upon the first activation of notifications in the application, which you can revoke at any time from your device settings.

Recipients: Authorized FlexCar personnel and collaborating Push Notification service providers (e.g., Apple/Google Push Notification Services).

Retention period: Until the revocation of your consent (deactivation of notifications) or the uninstallation of the application.

C. Voice Assistant

Data collected: Recorded voice commands/audio files and corresponding speech-to-text metadata.

Purpose: Execution of voice commands within the application (e.g., vehicle search, support call, navigation) and improvement of voice recognition. 

Legal Basis: Your explicit consent (Article 6 par. 1 (a) GDPR) granted upon activating the microphone/voice assistant.

Recipients: Authorized FlexCar personnel and specialized voice processing/AI technology providers.

Retention period: Audio files are deleted or anonymized immediately after processing and command execution (within a maximum period of 30 days for quality assurance purposes).

D. Telematics & Vehicle Location Data (GPS)

Data collected: Geolocation data (GPS), vehicle location coordinates, mileage covered, speed, engine/battery status, diagnostic fault codes, and driving patterns may be collected.

Purpose: Systematic fleet management and maintenance, diagnostic testing, protection of the vehicle against theft or breach of contractual terms, and provision of remote services to the lessee.

Legal Basis: Legitimate interest of FlexCar for the protection, safety, and proper operation of its assets (vehicles) and execution of the lease contract.

Recipients: Authorized FlexCar personnel, collaborating telematics platform & cloud infrastructure providers, authorized service workshops/technicians, roadside assistance companies, and (in case of theft/incident) insurance companies and police/judicial authorities.

Retention period: Telematics data are retained throughout the duration of the lease contract and up to five (5) years after its termination (or up to twenty [20] years in case of legal claims or criminal proceedings).

9.      How do we ensure the confidentiality and security of your Personal Data?

FlexCar maintains appropriate technical and organizational measures to ensure the confidentiality and integrity of Personal Data and protect it against accidental or unlawful destruction, loss, alteration, unauthorized access or disclosure, as well as any other unlawful form of processing. The processing of data by FlexCar is carried out only in a manner that ensures data confidentiality and security, based on state-of-the-art developments, costs, nature, context, and purposes of processing, assessing risks and the probability of their occurrence, and their effects on data subjects. In this context, we ensure that processing is carried out exclusively by personnel assigned for this purpose, who are bound by confidentiality obligations and provide the necessary safeguards for protection. The same applies to all our partners who may be involved in the process (see above under "Disclosure of personal data - categories of recipients").

10.  What are your Rights?

According to current national and European legislation, you have the following rights regarding your personal data:

• Right to information and access: You have the right to receive information from FlexCar regarding the processing of your personal data. Insofar as we process your data, you have the right to receive information about the purpose of processing, the category of your data, the recipients of the data, and their storage period, whether automated decision-making takes place, as well as your other rights as detailed herein.
• Right to rectification: You have the right to request the correction of inaccurate data or the completion of incomplete data kept by us.
• Right to erasure: You have the right to request the deletion of your data. We remind you that this right is not absolute and is subject to statutory restrictions. We may have legal grounds not to comply with such a request.
• Right to restriction of processing: You have the right to request the restriction of processing of your data, i.e., you have the right to request that further processing stop and your data simply be retained by our company. The exercise of this right is subject to the condition that such capability is granted to you by existing legislation. If legal requirements are not met, the company may not be obligated to satisfy your request.
• Right to data portability: You have the right to receive data concerning you in a readable format and to request its transfer to another controller, provided this is technically feasible.
• Right to object: You have the right to object at any time to the processing of your data, within the limitations provided by existing legislation. Your request may not be accepted by the Data Controller if there are demonstrated compelling legitimate grounds for the processing that override your rights.
• Right to withdraw your consent: If the processing of your personal data is based on your consent (such as for device permissions, push notifications, or voice assistant), you have the right to withdraw your consent immediately, easily, and free of charge at any time (including through your application/device settings) so that such processing ceases. The withdrawal of your consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
• Right to lodge a complaint with the Data Protection Authority: In case you consider that your rights are being violated, you have the right to submit a complaint to the Hellenic Data Protection Authority at the following contact details: Address: 1-3 Kifissias Ave., Athens, P.C. 11523, Contact Phone: +30 210 6475600, Email: contact@dpa.gr.

In order to exercise any of your rights, as well as for any information or clarification regarding them and the conditions for exercising them, or to be informed about the status of your submitted requests, you can contact FlexCar at the email address dpo@flexcar.gr and at the contact details stated herein. The designated representative of FlexCar will provide you with any further information and guidance on the steps you need to take. Likewise, you can address any questions, queries, comments, or complaints regarding the management of your data to our company's designated representative. FlexCar will respond to your request, depending on its validity, within 30 days. In case your request is complex or we have received a large number of requests from you, we will inform you within the aforementioned timeframe if an extension of an additional two (2) months is required to respond to you. If upon reviewing your requests we determine that they are manifestly unfounded or excessive, FlexCar may charge you a reasonable fee, the amount of which is determined by the administrative costs for handling it, for its execution. Please note that FlexCar may, with justification, refuse to respond to your request.

11.  How do we process Cookies?

Cookies are small text files stored by your browser on your computer or electronic device when you visit a website. Cookies allow web applications to tailor their operations to your needs by gathering and remembering information about your preferences. For more information about cookies and how you can configure their operation, please refer to FlexCar's Cookie Policy, which is posted on our website.

12.  Changes to this Privacy and Personal Data Protection Statement

FlexCar may unilaterally modify this Privacy Statement at any time so that it reflects current changes regarding our company's existing relevant policies and practices. We recommend that you regularly visit our company's website or the FlexApp application to stay immediately informed about any changes to this Privacy and Personal Data Protection Statement.

13.  What is our Contact Information?

The following options are available if you wish to contact us, submit a complaint, or manage your account details:

• You can send us your request in writing to the following postal address: 6-8 Tagiapiera Str., P.C. 115 25 Athens, Greece.
• You can call us at: +30 210 220 3450
• You can send an email to: dpo@flexcar.gr

The Privacy and Personal Data Protection Policy was updated on 12/08/2026.