Privacy Policy
Ssc 365 Alquilar Un Coche, S.L.
Last updated: June 22, 2026
1. Data Controller
The controller responsible for processing personal data is:
SSC 365 ALQUILAR UN COCHE, S.L. Avenida Maisonnave 41, 3 03004 Alicante Spain CIF: B56570963
hereinafter referred to as the “Controller” or the “Company”.
The Controller processes personal data in accordance with applicable data protection laws, in particular:
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”),
Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”),
Spanish Law 34/2002 on Information Society Services and Electronic Commerce (“LSSI-CE”).
2. Scope of this Privacy Policy
This Privacy Policy sets out the rules regarding the processing of personal data of:
customers using vehicle rental services,
persons making reservations,
website users,
persons contacting the Controller,
business partners and contractors,
persons receiving commercial or marketing communications.
3. Categories of Personal Data Collected
The Controller may process the following categories of personal data:
3.1 Identification Data
full name,
date of birth,
nationality,
ID card or passport number,
driving licence number,
issue and expiry date of the driving licence.
3.2 Contact Data
e-mail address,
phone number,
residential or correspondence address.
3.3 Vehicle Rental Related Data
reservation details and rental history,
payment, deposit and security hold information,
additional driver information,
accident and damage information,
traffic fines and traffic offence information.
The Controller does not store full payment card details. Payments are processed through certified payment providers compliant with PCI-DSS security standards.
3.4 Technical Data
IP address,
device and browser information,
cookie-related data.
3.5 Vehicle GPS and Telematics Data
For property protection, fleet management and service security purposes, vehicles may be equipped with GPS and telematics systems.
Important: Such systems are not used for continuous monitoring or profiling of drivers’ private behaviour. GPS and telematics data are processed exclusively for:
protection against theft, misappropriation or abandonment,
verification of geographical restrictions established in the rental agreement,
fleet management and roadside assistance,
accident reconstruction,
recovery of lost or stolen vehicles.
4. Purposes and Legal Bases for Processing
4.1 Reservation and Rental Agreement Performance
Personal data are processed for:
reservation management,
execution of the rental agreement,
vehicle handover and return,
payment processing,
provision of additional services.
Legal basis:
- Article 6(1)(b) GDPR.
4.2 Identity and Driving Licence Verification
The Controller may verify the customer’s identity and driving eligibility to prevent fraud and ensure road safety.
Legal basis:
Article 6(1)(b) GDPR,
Article 6(1)(f) GDPR — legitimate interest consisting in fleet protection and contractual risk reduction.
4.3 Compliance with Legal Obligations
Personal data may be processed in order to comply with legal obligations, including:
accounting and tax obligations,
administrative obligations,
road traffic safety obligations,
obligations to identify drivers upon request from competent authorities.
Legal basis:
- Article 6(1)(c) GDPR.
4.4 Claims, Damages and Insurance Management
Personal data may be processed for:
damage handling,
insurance claim management,
debt recovery,
legal defence and enforcement of claims.
Legal basis:
- Article 6(1)(f) GDPR — legitimate interest of the Controller.
4.5 Marketing of Own Services
The Controller may send commercial and marketing communications electronically or by telephone.
Legal basis:
Article 6(1)(a) GDPR — consent, or
Article 6(1)(f) GDPR in conjunction with Article 21.2 LSSI-CE — regarding existing customers and similar services previously contracted.
4.6 Security and Property Protection (GPS)
GPS and telematics systems may only be used for operational and security purposes described in Section 3.5.
Legal basis:
- Article 6(1)(f) GDPR — legitimate interest consisting in crime prevention and protection of Company property.
4.7 Customer Support and Communication
Personal data are processed for:
answering inquiries,
handling contact forms,
complaint management,
customer support.
Legal basis:
Article 6(1)(b) GDPR,
Article 6(1)(f) GDPR — legitimate interest related to customer service quality.
5. Recipients of Personal Data
Personal data may be disclosed only to entities authorised by law or processing data on behalf of the Controller, including:
payment providers and banks,
insurance companies and brokers,
law firms and debt collection agencies,
accounting and auditing firms,
IT, hosting and reservation system providers,
public authorities,
As a general rule, personal data are not transferred outside the European Economic Area (EEA).
If the use of certain technological services requires such transfer, the Controller shall ensure an adequate level of protection in accordance with Chapter V GDPR, particularly through the use of Standard Contractual Clauses approved by the European Commission.
7. Data Retention and Data Blocking (Bloqueo de datos)
Personal data shall be retained for the period necessary to fulfil the purposes for which they were collected, including the duration of the rental agreement and the legally required retention periods.
After the purpose has been fulfilled or the contractual relationship has ended, data shall be blocked (“bloqueadas”) in accordance with Article 32 LOPDGDD.
Blocked data shall only remain accessible to:
public authorities,
courts,
prosecutors,
tax authorities,
other legally authorised entities,
solely for the purpose of legal claims, defence of rights or compliance with legal obligations.
After the applicable limitation periods expire, the data shall be permanently deleted or anonymised.
8. Rights of Data Subjects
Data subjects have the right to:
access their personal data,
rectify inaccurate data,
erase personal data,
restrict processing,
data portability,
object to processing,
withdraw consent at any time,
not be subject to decisions based solely on automated processing.
To exercise these rights, users may contact:
E-mail: set-rent@set-rent.com
or by post to the Company’s registered office.
The Controller may request additional information necessary to verify the identity of the applicant.
Data subjects have the right to lodge a complaint with the competent supervisory authority.
In Spain, the competent authority is:
10. Cookies and Tracking Technologies
The website uses cookies and similar technologies to:
ensure proper website operation,
improve security,
conduct statistical analysis,
optimise website performance,
personalise content and marketing.
Analytical, marketing and advertising cookies are installed only after obtaining the user’s prior consent in accordance with Article 22 LSSI-CE.
Users may manage cookies, grant or withdraw consent through the cookie management panel available on the website and through browser settings.
Further details are available in the separate Cookie Policy.
The Controller has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
SSL encryption,
access control systems,
restricted user permissions,
server and IT infrastructure protection measures.
Only authorised persons have access to personal data.
12. Voluntary Nature of Data Provision
Providing personal data required during reservation and rental agreement procedures is voluntary; however, it constitutes a contractual requirement.
Failure to provide the required data may prevent:
identity and driving licence verification,
reservation processing,
execution of the rental agreement.
The Controller does not make decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect users.
13. Decisiones automatizadas
14. Amendments to this Privacy Policy
The Controller reserves the right to update this Privacy Policy in the event of:
legal changes,
organisational changes,
technological developments,
modifications to website functionalities or services,
The current version of the Privacy Policy shall always be available on the Controller’s website together with the date of the latest update.