Privacy policy Europcar Martinique

Version dated 28 July 2026

Preamble

The General Data Protection Regulation (GDPR) entered into force on 25 May 2018 and supplements the legislation governing the protection of personal data.

Personal data means any information relating to an identified natural person or to a natural person who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to that person, such as their surname, first name, address, email address, telephone number, contract number or bank card number.

The processing of personal data means any operation performed on such data, including its collection, storage, transmission or deletion, whether on paper or electronically. The data controller is the person who determines the purposes of each processing operation and the means used to achieve those purposes.

For CORAIL, trading as EUROPCAR MARTINIQUE, protecting your personal data is a priority. In the interests of transparency, this Privacy Policy is intended to explain why your personal data is collected and processed by CORAIL in its capacity as data controller, how it is processed, what rights you have in relation to your data and how you can exercise those rights.

CORAIL reserves the right to amend this Privacy Policy at any time. Any amendment will take effect immediately.

We therefore encourage you to consult this Policy regularly, as it is accessible from all pages of the Website, so that you remain informed of the latest applicable online version. For changes that we consider particularly significant, a notice will be published on the Website. We also encourage you to check the date shown at the beginning of this Policy to determine when it was last updated.

Why Does CORAIL Need to Collect Your Data?

The data collected by CORAIL is necessary for the following purposes:

• Responding to requests received through the online contact form;

• Managing contracts, including vehicle bookings, invoices and payments;

• Conducting satisfaction surveys and customer studies, including surveys and rental statistics;

• Managing complaints;

• Carrying out commercial prospecting and marketing activities, including sending advertising messages by email and SMS;

• Selecting suppliers;

• Managing claims and incidents;

• Managing road traffic offences and other criminal offences.

As a general rule, CORAIL does not process your data for purposes that are incompatible with those for which it was collected, unless you have given your prior consent.

What Data Does CORAIL Collect?

CORAIL collects different types of personal data concerning you.

Personal Data You Provide Directly

You may provide personal data directly to us:

• When you complete a contact form;

• When you submit a booking request;

• When you wish to enter into a rental agreement;

• When you contact customer service to ask a question or submit a complaint;

• More generally, whenever you communicate with CORAIL by any other means.

Providing your personal data is voluntary. However, certain information identified by an asterisk is essential for CORAIL to process your request. Without this information, CORAIL will not be able to process your request.

Personal Data Provided to Us by Commercial Partners

Personal data may be provided to us by the following commercial partners:

• Tour operators offering complete travel packages;

• Brokers and comparison websites;

• Assistance providers and insurance companies;

• Hotel and accommodation partners, including hotels and holiday cottages;

• Automotive franchises with which we have partnerships.

Personal Data We Collect Automatically

We automatically collect certain information about you when you access CORAIL’s Website, including information relating to your browsing activity.

CORAIL uses cookies and other tracking technologies to collect information about you when you interact with its Website.

For further information about cookies and how to disable them, please consult the Cookie Policy.

Tracking of Electronic Communications

When we send you communications by email, some messages may contain technical devices known as tracking pixels, which make it possible to determine whether an email has been opened.

Depending on the type of communication concerned, this information may be used to:

• Ensure the proper delivery of our emails;

• Manage our mailing lists and reduce or stop communications to inactive recipients;

• Measure the effectiveness of our communications;

• Adapt or personalise the communications sent to you;

• Identify your interests;

• Trigger follow-up communications or marketing activities.

Where tracking email openings requires your consent, this consent is collected when your email address is obtained or, where appropriate, at a later stage through an untracked email requesting your consent.

You are free to accept or refuse this tracking. Refusing tracking will not prevent your request from being processed or, where we are authorised to send them to you, prevent you from receiving our communications.

You may, at any time:

• Unsubscribe from our commercial communications;

• Withdraw your consent or object to the tracking of email openings.

These two choices are independent. Objecting to tracking will not automatically unsubscribe you from our commercial communications.

You may therefore continue to receive communications that we are authorised to send you, but future emails concerned will be sent without the tracking to which you have objected.

You can exercise these choices using the separate options included in our emails: “Unsubscribe from our commercial communications” and “Object to the tracking of my emails”.

You may also contact us using the contact details provided in this Privacy Policy.

Information relating to your choices is retained so that we can comply with your request and demonstrate that it has been taken into account.

What Are the Legal Bases for Processing Your Data?

CORAIL collects your personal data for the purposes described in this Policy. In all cases, CORAIL collects and processes your data only where such collection and processing are based on a valid legal basis.

Performance of Contractual Relations With CORAIL

Your data is necessary for the performance of a contract that you have entered into or wish to enter into.

Where processing is based on the performance of a contract, refusing to provide your personal data will prevent the contract from being entered into and performed.

Compliance With a Legal Obligation Applicable to CORAIL

Some of your data is processed by CORAIL in order to comply with its legal obligations, including:

• Complying with applicable accounting requirements relating to the management of customer and supplier accounts;

• Identifying individuals who commit offences while driving rental vehicles, in accordance with Article L.121-6 of the French Highway Code;

• Reporting motor vehicle claims;

• Managing requests to exercise rights of access, rectification and objection;

• Managing an objection list for telephone marketing.

Your Consent

Subject to obtaining your prior consent, CORAIL may process your data in order to:

• Send you commercial offers relating to its products and services;

• Offer you products or services from its partners;

• Place cookies under the conditions described in the Cookie Policy;

• Track the opening of your emails using tracking pixels.

You may change your decision and withdraw your consent at any time, under the conditions described in the section concerning the exercise of your rights.

The withdrawal of your consent does not affect the lawfulness of any processing carried out on the basis of your consent before it was withdrawn.

CORAIL’s Legitimate Interests

CORAIL may process your personal data where necessary for the purposes of its legitimate interests, particularly in connection with managing commercial relationships.

These legitimate interests include:

• Responding to requests submitted through the online form;

• Selecting suppliers.

How Long Is Your Data Retained?

Your data is retained by CORAIL for the period necessary to fulfil the purposes described in this Policy, together with any applicable statutory limitation periods.

Cookies

CORAIL may retain cookie-related data for 13 months.

Commercial Management and Marketing

CORAIL may retain data for three years from the date of the last contact between you and CORAIL.

Bank Data

CORAIL may retain bank data for a maximum of 13 months after the end of the contract, in an intermediate archive, for evidentiary purposes.

This data may only be used in the event of a dispute concerning the transaction.

Satisfaction Surveys and Customer Studies

CORAIL may retain data relating to satisfaction surveys, customer studies, surveys and rental statistics for two years in order to monitor changes in performance indicators.

Traffic Offences

CORAIL may retain data relating to a traffic offence for a maximum of 45 days from receipt of the notice of offence.

After this period, the data may be archived for no longer than the applicable limitation period for traffic offences, namely 12 months.

Invoicing

CORAIL may retain invoicing data for 10 years, in accordance with Article L.123-22, paragraph 2, of the French Commercial Code.

Accounting

CORAIL may retain accounting data for 10 years, in accordance with Article L.123-22, paragraph 2, of the French Commercial Code.

For further information about the retention periods applicable to your data, you may contact CORAIL’s Data Protection Officer at dpo@gbh.fr.

What Are Your Rights and How Can You Exercise Them?

Your Rights in Relation to Your Data

Right of Access

You may obtain confirmation from CORAIL as to whether or not your personal data is being processed.

Where your data is being processed, you may request access to all personal data and related information held by CORAIL.

Right to Rectification

You may ask CORAIL to correct, without undue delay, any personal data concerning you that is inaccurate or incorrect.

You may also ask for incomplete data to be completed where appropriate.

Right to Erasure

Subject to legal exceptions, you may ask CORAIL to erase your personal data without undue delay, particularly where you consider that the processing carried out by CORAIL is no longer necessary for the purposes for which the data was collected.

Right to Data Portability

You may obtain some of your personal data in an open, structured and machine-readable format or ask CORAIL to transmit that data to another organisation.

This right applies only to:

• Data that you have actively and knowingly provided to CORAIL, such as information entered into an online form;

• Data generated through the use of a service or device in connection with entering into or managing your contract;

• Data processed by automated means on the basis of your consent or the performance of a contract.

Right to Object

Where your data is processed for marketing purposes, you may object to such processing at any time.

You may also object to targeted advertising carried out through cookies.

You may object to the tracking of email openings by using the “Object to the tracking of my emails” option included in the footer of our emails.

Right to Restriction of Processing

You may ask CORAIL to retain your data without using it in any of the following circumstances:

• You dispute the accuracy of the data used by CORAIL;

• You object to the processing of your data;

• The processing is unlawful, but you object to the erasure of the data;

• You require the data for the establishment, exercise or defence of legal claims.

Right to Withdraw Your Consent

Where the processing of your personal data is based on your consent, for example for the electronic delivery of commercial offers, you may withdraw your consent at any time.

You may withdraw your consent to cookies under the conditions described in the Cookie Policy.

You may also object at any time to the tracking of email openings by using the “Object to the tracking of my emails” option included in the footer of our emails.

Right to Give Instructions Concerning Your Data After Your Death

You may define instructions relating to the retention, erasure and disclosure of your data after your death.

These instructions determine how you wish your rights relating to your data to be exercised after your death.

You may send these instructions by email to dpo@gbh.fr, using the subject line “Post-mortem instructions”.

You may amend or revoke your instructions at any time.

Right to Lodge a Complaint With the CNIL

Where you consider that your rights have not been respected or that your data is not protected in accordance with the GDPR, you may lodge a complaint at any time with a competent supervisory authority.

In France, the competent supervisory authority is the Commission Nationale de l’Informatique et des Libertés, or CNIL.

Complaints may also be sent by post to:

CNIL 3 Place de Fontenoy TSA 80715 75334 Paris Cedex 07 France

Exercising Your Rights

You may exercise your rights by email or post using the following contact details:

Email: dpo@gbh.fr

Postal address:

CORAIL – AÉROPORT 97232 LE LAMENTIN France

Please mark your request for the attention of the Data Protection Officer.

Your request must state:

• The reason for the request, such as the exercise of a right of access or objection;

• The company concerned by the request;

• The address to which the response should be sent.

CORAIL will respond within a maximum period of one month from the date on which your request is received.

This period may be extended by a further two months where necessary, taking into account the complexity and number of requests.

Where, after contacting CORAIL, you believe that your data protection rights have not been respected, you may submit a complaint to the CNIL.

Marketing and Targeted Advertising

Where you have agreed to receive commercial offers from CORAIL, you may change your decision at any time by using the unsubscribe option included in our communications.

For any general question concerning this Privacy Policy, or for any request relating to CORAIL’s management of your personal data, you may contact us by email or post using the contact details provided above.

With Whom Does CORAIL Share Your Data?

CORAIL may transmit your data to the following entities where necessary to fulfil one of the purposes described in this Policy.

Management of Commercial Activities

Your data may be transmitted to:

• Authorised CORAIL personnel, including sales, accounting and management personnel;

• Departments responsible for auditing and control, including statutory auditors and teams responsible for internal procedures.

Commercial Prospecting Activities

For the management of commercial prospecting activities, your data may be disclosed to communications service providers acting on behalf of CORAIL.

Insurance and Claims Management

For the management of insurance matters and claims, your data may be transmitted to insurers and assistance providers.

Management of Traffic Offences

For the management of traffic offences, your data may be transmitted to the French National Agency for the Automated Processing of Offences, known as ANTAI.

Criminal Offences

In connection with criminal offences, CORAIL may transmit your information to the competent authorities or departments.

Service Providers and Processors

More generally, your personal data may be accessible to CORAIL’s processors in connection with outsourced services, such as IT service providers and software publishers.

CORAIL does not share your data with its commercial partners unless such sharing is necessary for one of the purposes described in this Policy.

Is Your Data Transferred Outside the European Union?

Your data is hosted on secure servers located in France.

If your data were to be transferred outside the European Union, particularly through one of our processors, we would take particular care to ensure that the recipient processes your data in strict compliance with the applicable personal data protection legislation.

How Does CORAIL Secure the Processing of Your Data?

CORAIL implements all necessary technical, physical and organisational measures to ensure the security and confidentiality of your data during its collection, processing and transfer.

CORAIL’s infrastructure is protected against malicious software, including viruses and spyware. However, you remain responsible for the security of your own device.

Where we use service providers to process part of your data, we undertake to verify that they provide sufficient guarantees to protect the personal data entrusted to them and to require them to sign confidentiality clauses that comply with Article 28 of the GDPR.

Personal Data Breaches

A personal data breach is a security incident, whether malicious or accidental and whether intentional or unintentional, that compromises the integrity, confidentiality or availability of your personal data.

In the event of a personal data breach, we undertake to comply with the applicable legal obligations.

The breach register contains the following information:

• The nature of the breach;

• The categories and approximate number of individuals concerned;

• The categories and approximate number of files concerned;

• The likely consequences of the breach;

• The measures taken to remedy the breach and, where appropriate, limit its adverse consequences;

• Where applicable, the reasons why the CNIL was not notified or the individuals concerned were not informed.

In accordance with applicable regulations, we are not required to inform you of a breach in the following circumstances:

• Your personal data is protected by measures that make it unintelligible to any person who is not authorised to access it;

• Measures have been taken to ensure that the risk is no longer likely to materialise;

• Informing you would require disproportionate effort, particularly where we do not have sufficient information to contact you.

Mandatory Fields

Fields marked with an asterisk in our forms are mandatory.

If you do not provide the requested information, the sole consequence will be that your request cannot be processed.

The obligation to provide the requested data is contractual because the data is necessary for the performance of a contract to which you are a party or for pre-contractual measures taken at your request, particularly when requesting information or a quotation relating to our products and services.

Data Protection by Default

We undertake to integrate personal data protection into the design of any project, service or other tool involving the handling of personal data.

This includes:

• Minimising the personal data collected;

• Limiting the purposes for which data is collected;

• Protecting the integrity and confidentiality of the data;

• Limiting data retention periods.

Accountability

In accordance with the accountability principle, CORAIL:

• Adopts internal procedures intended to ensure compliance with applicable regulations, including an IT charter and a personal data protection charter;

• Maintains documentary records of all processing carried out under its responsibility or that of its processors, including records of processing activities, confidentiality agreements with employees and service providers, the company’s security policy and procedures for managing requests for access, rectification and objection;

• Carries out data protection impact assessments for processing operations that present particular risks to individuals’ rights and freedoms.

The purpose of these measures is to maintain comprehensive documentation demonstrating compliance with personal data protection requirements at all times.