Privacy Statement

 

PRIVACY NOTICE

 

 

1. PURPOSE OF THE PRIVACY NOTICE

 

 

• Schiller Group, as a whole, respects your privacy, and all Schiller Group companies are committed to protecting the information that identifies or can identify an individual (“personal data“[1]), and any such information that we process, collect, use or have access to.

1.2                The purpose of this Privacy Notice is to provide information to natural persons (hereinafter: Data Subject or you) affected by the services – as detailed below – of SCHILLER FLOTTA Autópark Kezelő Kft. (registered office: H-1133 Budapest Dráva u. 17, company registration number: 01-09-884812, tax number: 14014587-2-41), as data controller (hereinafter: Controller or us/we), on the practices and information concerning the controlling[2],  processing[3],  transfer[4] and protection of their personal data and, in this context, on the processing activities we perform, the purposes of processing, data processed, data processing principles and data subject rights in relation to data processed, while ensuring compliance with the obligation to provide information set out in the applicable data protection legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR) and Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter: Privacy Act).

 

1.3                This Privacy Notice applies to our short-term car rental services (Rent a Car) – hereinafter collectively: Services – in the course of which we process personal data that we maintain in our record-keeping systems and other records electronically (recorded data, digitised documents) and/or on paper, manually.

 

 

1.4               Contact details of the Controller and how to contact Us:

 

Name: SCHILLER FLOTTA Autópark Kezelő Kft.

Registered office: H-1133 Budapest Dráva utca 17	Postal address: H-1138 Budapest Váci út 113
Company registration number: 01-09-884812	Tax number: 14014587-2-41

Telephone: + 36 1 450 2523

Website: https://schillerrent.hu

Email: hello@schiller.hu

Represented by: Mariann Csizekné Szilágyi Company Manager

Data Protection Officer: Márk Schiller

 

If you have any questions, comments, requests, or would like to exercise your rights in relation to data processing, you can send your request by post to our mailing address. Our replies will be sent without undue delay, but in any case within 30 days to the address you have specified.

If necessary, taking into account the complexity of the request and the number of requests, we may extend this deadline by an additional two months, and we will inform you of the reasons for the delay within one month of receipt of such request.

 

1. Persons affected by processing

 

2.1                The data subjects[5] affected, and the sources of personal data:

1. private individual lessees, and the contact persons, financial managers, senior officers, representatives, employees, agents of legal entity lessees (hereinafter: Customers);
2. private individual customers, additional drivers, and persons authorised by us or by legal entity Customers to use the vehicles (hereinafter: Drivers);
3. Contact persons, financial managers, senior officers, representatives, employees and agents of brokers, subcontractors, agents, performance assistants and contributors engaged to use and provide Rent a Car services (hereinafter: Partners);
4. site visitors, users;
5. contact persons, senior officers, representatives, employees and agents of our other private individual partners and legal entity partners;
6. contact persons, senior officers, representatives, employees and agents of all other private individuals or legal entities (e.g. buyers of used motor vehicles) who have dealings with us

(hereafter collectively: Data Subject or you).

 

 

 

• Purpose of processing

 

We process data in accordance with applicable laws for the following purposes, which are set out in detail in Chapter V.

 

3.1                We process your data to the extent and for the duration necessary for the processing of the Contract for the Services, primarily for the purposes of entering into and performing the contract, and for the purposes of liaising, contact, administration and the addressing of issues and notifying the Data Subjects in the course of the performance of the Services.

                  In order to use and provide certain Services, it may be necessary to process additional personal data beyond the above.

3.2                We also process your data for a variety of business purposes for legitimate interests, including providing you with personalised products and services, meeting and satisfying the needs of our Customers to the highest possible degree, developing products and services, creating new products and services, operating and improving our business, and for identification purposes, to assess your financial capacity, financial and legal standing and to analyse risk.

3.3                We may also process data for marketing purposes in connection with offers and enquiries made by telephone, email, by completing an online form, or in connection with data provided in person.

 

• When making any video recording, we may also process personal data for the enforcement of aspects of the protection of persons and property.

 

• We also process personal data for the purpose of identifying and assessing the suitability of applicants for employment.

 

• We also process personal data for other, technical, IT purposes (e.g. cookies[6]), such as for back-up and storage purposes.

 

1. Legal basis for processing

 

4.1                Subject to the purposes of processing set out in Chapters III and V, we process the personal data of the Data Subjects determined in Chapter II on the legal basis for processing set out below, the details of which are set out in Chapter V.

 

4.2                Contact data processed for the purposes of liaising, contact, administration and the addressing of issues, or sending notifications while performing the Services are processed pursuant to Article 6(1)(b) of the GDPR for the purpose of the performing the contract, for the contractual performance and provision of the Services, or in the legitimate interest of our legal entity Customer.

 

 

4.3                The Customer shall be entitled to provide us with data relating to the Drivers of the vehicles, if the Customer has a legal basis for processing such data (including the processing of the data by us and by data controllers and processors appointed by us). To this end, the Customer must make a declaration on the above when providing the Driver’s personal data.

 

4.4                In the cases set out in Chapter V, we process personal data for our own legitimate interests, or for the legitimate interests of third parties. We have carried out an interest assessment test in relation to the legitimate interests identified in the Privacy Notice and have determined that these legitimate interests are not overridden by your interests or fundamental rights and freedoms that require the protection of personal data.

 

4.5                We require you to provide us with certain personal data in order to provide the Services you have ordered (“mandatory” data).

                  If you fail to provide the required information, we may not be able to provide the requested Services or we may be delayed in providing the Services.

                  If you share other people’s personal data with us or our Partners in connection with the Services, we shall assume that you have the right to do so, and you authorise us to process and transfer the shared data in accordance with this Privacy Notice.

4.6                With respect to the data provided “voluntarily”, you voluntarily, specifically and expressly consent to and agree that your personal data marked as “voluntary” will be processed under the conditions, for the purposes of and for the period of time specified in this Privacy Notice.

 

By granting your consent as set out above, you acknowledge that the personal data provided about you will be processed for the relevant processing purposes in accordance with this Privacy Notice.

You have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing performed before the withdrawal of such consent. In all cases, we will indicate how you can withdraw your consent prior to processing, by allowing you to exercise this right in the same simple manner as you have given your consent.

 

With regard to data marked as “voluntary” in Chapter V, the granting of consent is voluntary (you are not obliged to grant your consent to processing), and if you fail to grant your consent, you will not suffer any disadvantage, however, in this latter case, you will acknowledge that we are unable to fulfil the purpose of processing related to the data concerned, as indicated in the relevant table in Chapter V.

 

 

 

 

 

 

1. Scope of personal data processed, purpose and legal basis for processing

 

5.1     Processing of personal data related to senior officers and representatives of legal entity Customers in the course of and in connection with the provision and performance of Rent a Car Services

 

Activity	Data processed	Purpose of processing	Legal basis for processing	Data transfer
Contracting	o  name, o  email address, o  phone number, o  job title	To conclude contracts for the Services and to contact the Customer’s representative, contact person, financial contact, for the purpose of recording and processing the data necessary for o   making contact, o   liaising, o   addressing of issues, administration, o   business management, o   contracting, for recording and processing the necessary data	performance of a contract (Article 6(1)(b) of the GDPR)	Schiller Autóház Kft. (for accounting purposes) Bank
Communication, maintaining customer relationship in connection with the Services	o  name, o  email address, o  phone number, o  job title	Necessary in connection with the Services or in order to perform the Services in compliance with the contract, for the purpose of o   making contact o   liaising o   addressing of issues, administration o   business management o   sending notifications	performance of a contract (Article 6(1)(b) of the GDPR)	Partner performing the Service
Customer identification, financial capacity, risk analysis	o  name, o  data included in identification document	Customer identification Assessing, checking, performing risk analysis and reviewing the conditions for the financing of the vehicle and for establishing the contractual relationship as well as the risks associated with the Customer and their eligibility (financial capacity, financial and legal situation) in order to reduce the risks involved and to determine the need for a collateral.	legitimate interest (Article 6(1)(b) of the GDPR)	Companies within the Group
Measuring customer satisfaction (in the case of the representatives of legal entity Customers)	o  name, o  email address	To provide customised products and services in order to meet and satisfy the needs of Customers to the highest possible degree, and to assess the needs of Customers and Drivers.	legitimate interest (Article 6(1)(f) of the GDPR)   We have a legitimate interest in continuously monitoring and improving the quality of our Services to provide customised products and services in order to meet and satisfy the needs of our Customers to the highest possible degree and to assess the needs of Customers and Drivers.	For companies within the Group and external agents performing marketing and market research activities
Sending out email communications to the contact persons of legal entity Customers, to financial managers, employees and to other persons designated as other contact persons)	o  name, o  email address	To share information and provide information to Customers about our various services provided to legal entity Customers in order to promote, facilitate and support the use of our services	legitimate interest (Article 6(1)(f) of the GDPR)	Schiller Autóház Kft.
Sending newsletters, marketing promotions and offers applicable to the whole of Schiller Group (to the representatives of legal entity Customers, contact persons and Drivers)	o  name, o  email address	Advertising the activities and services of Schiller Group as a whole, and providing marketing communications, sending offers electronically and/or on paper	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	Schiller Autóház Kft.
Communication of Customer events (contact person and managing director)	o   name, o   email address	Sending invitations to events and activities organised by us as well as managing the related registration process.	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	Schiller Autóház Kft.
Audio recording (in case of call centre activity).	o   date/time and duration of the call o   the caller’s telephone number o   personal data provided by the Data Subject during a telephone conversation	o   customer complaints handling o   retrievability of oral statements o   consumer protection, quality assurance o   promoting more efficient administration, exercising the rights of the data subjects and our own rights	voluntary consent of the data subject (Article 6(1)(a) of the GDPR) legitimate interest in case of a complaint (Article 6(1)(f) of the GDPR)	no data transfer carried out

 

• In case of ordering and contracting by email (when the Customer is not present at the conclusion of a contract), we will receive copies of the official instruments and other documents containing the Customer’s data required for the conclusion of such contract, as defined above, based on which we will record the necessary personal data in our records, and we will subsequently delete and destroy such copies of the official instruments and other documents.

5.2  Processing of personal data related to the Drivers and contact persons of legal entity Customers in the course of and in connection with the provision and performance of Rent a Car Services

 

Activity	Data processed	Purpose of data processing	Legal basis for processing	Data transfer
Contracting	o  name, o  email address, o  phone number, o  place and date of birth o  mother’s name o  address o  driver’s licence number, validity, limitations	Contact details for concluding contracts related to the Services and for recording and processing data required for the following in relation to the Driver: o   making contact, o   liaising, o   addressing of issues, administration, o   business management, o   contracting, for recording and processing the necessary data.   Personal data are necessary to verify the use of the vehicle, and the driver’s licence data are necessary to verify that the Driver holds the required driver’s licence.	performance of a contract (Article 6(1)(b) of the GDPR)	no data transfer carried out
Electronic contracting, use of the Services (in case of self-service car rental) concerning the Driver	o  name, o  address o  place and date of birth o  driver’s licence number, validity, category, limitations o  identification card number, passport number, validity o  email address, o  phone number,	For concluding contracts related to the Services by electronic means and, for ensuring the use of the Services, recording and processing data required for the following in relation to the Driver of the legal entity Customer o   making contact, o   liaising, o   addressing of issues, administration, o   business management, o   electronic contracting, for recording and processing the necessary data   Credit card data is required for fulfilling and enforcing the payment obligation related to the use of the Service.	performance of a contract (Article 6(1)(b) of the GDPR) processing pursuant to Sections 13/A(1)-(9) of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society-Related Services	no data transfer carried out
Verification of the existence and validity of a valid driver’s licence (in case of electronic contracting, self-service car rental) concerning the Driver	o  a photo of both sides of the driver’s licence	The car rental service is only available to persons who have the required licence to drive a vehicle. For this purpose, we verify the details of the driver’s licence by having the Customer upload a photo of both sides of the driver’s licence.	legitimate interest (Article 6(1)(f) of the GDPR)   We have a legitimate interest in ensuring that the Services are only used by persons who are eligible to do so under the conditions set forth in legal regulations, i.e. who have the required licence to drive a vehicle and, to this end, we check the existence of the driver’s licence and the data of the driver’s licence and its validity.	no data transfer carried out
Driver identification (in case of electronic contracting, self-service car rental)	o  selfie of the driver of the vehicle (self-portrait photo) o  a photo of both sides of the driver’s licence o  for EU nationals driving the vehicle, photo of both sides of their identity card o  for non-EU nationals driving the vehicle, photo of both sides of their passport	Verification of the identity of the Driver and the holder of the driver’s licence.   Driver identification Examination and verification of the conditions necessary for the establishment of a contractual relationship.	legitimate interest (Article 6(1)(f) of the GDPR)   We have a legitimate interest in verifying that, in the event of electronic contracting, we identify the Driver in order to ensure that the data provided relates to the person whose documents and selfie are uploaded and that this person has a valid driver’s licence.	no data transfer carried out
Handover of the vehicle	o   name, o   email address, o   phone number, o   registration number/number plate	For the purpose of handing over the vehicle to the Driver o   making contact o   addressing of issues, administration o   making appointments, o   sending notifications.   The purpose of processing the registration number/number plate is to identify the vehicle to be handed over.	performance of a contract (Article 6(1)(b) of the GDPR)	no data transfer carried out
Vehicle assistance service	o   name, o   email address, o   phone number, o   position, location data, o   registration number/number plate	In order to provide or organise the vehicle assistance service, the vehicle assistance service provider shall contact the relevant Driver or the Customer’s contact person for the following purposes: o   making contact, liaising, o   sending notifications.   The purpose of processing the location data is to enable the vehicle assistance service provider to reach the Driver’s location and to enable the Driver to use the service at the location reported by the Driver.   The purpose of processing the registration number/number plate is to identify the affected vehicle, and performing the related administrative tasks as well as accounting and billing.	performance of a contract (Article 6(1)(b) of the GDPR)	to our Partner performing the service
Claims, insurance administration	o   name, o   email address, o   registration number/number plate, o   address o   place and date of birth o   driver’s licence number, validity, category, limitations o   other personal data indicated on the claims form (e.g. details of the incident, details of the damage, photographs of the incident, number of passengers in the vehicle, details of the witnesses)	Forwarding the claims form to the insurer completed by the legal entity Customer or Driver regarding the insured event, and documenting the claim and assessing the damage in order to process the claim.   We process the insurance claims report sent to us by the insurer and the data contained therein (driver’s name and vehicle registration number/number plate) for statistical purposes in order to summarise the insurance claims of the vehicles owned by us.   The purpose of processing the registration number/number plate is to report any damage, to identify the vehicle involved in the incident, and performing the related administrative tasks as well as accounting and billing.	performance of a contract (Article 6(1)(b) of the GDPR)       performance of a contract (Article 6(1)(b) of the GDPR) and legitimate interest (Article 6(1)(f) of the GDPR) It is in our legitimate interest to have a comprehensive picture of the insurance claims of our vehicles, to be able to recover and manage the related damages, and to provide customers with adequate information on the procedures followed by the insurers.	The claims form will be forwarded to the insurer by us or directly by the repair shop, in which case the repair shop will forward the claims form to us so that we can approve the necessary repairs.   If the claims form is sent to us by the insurer, it will be forwarded to the legal entity Customer upon request.   To the legal entity Customer or to the contact person of the legal entity Customer   We may also forward the relevant information on the claim to experts on the matter.
Managing penalties	o   name, o   email address, o   address o   registration number/number plate o   details of the infringement, as described by the authority o   information provided by the parking company	Managing and payment of fines.   At the request of the legal entity Customer, we may also charge the Driver directly for fines, penalties and fees imposed by the authorities and parking companies, and we will send the relevant official decision, the letters from the parking companies and the invoice on the fine, penalty or fee to the driver’s address. The purpose of processing the registration number/number plate is to identify the vehicle affected by the service, and performing the related administrative tasks as well as accounting and billing.	legitimate interest (Article 6(1)(f) of the GDPR)   It is in the legitimate interest of the legal entity Customer that the fine incurred during the use of the rented vehicle is passed on directly to the Driver.	To the legal entity Customer or to the contact person of the legal entity Customer   Only the data of legal entity Customers will be transferred to public authorities
Responding to the requests and notices given by law enforcement and investigative authorities, bodies and authorities	o   name o   other data provided or requested by law enforcement and investigative authorities and bodies	Complying with statutory obligations in order to respond to requests and notices given by law enforcement and investigative authorities, bodies and public authorities	Complying with legal obligations (Article 6(1)(c) of the GDPR)	Law enforcement and investigative authorities, bodies and authorities
Location of the vehicle	location data of the vehicle	To enable the identification of the vehicle’s location and position in the event of Driver’s failure to return the vehicle at the time agreed in the contract, and if Driver cannot be reached by telephone, or in the event of theft of the vehicle, or if an emergency is reported by the Customer or Driver.	legitimate interest (Article 6(1)(f) of the GDPR)	Law enforcement and investigative authorities, bodies and authorities
	o
Issuing a permit for the Driver/a country exit permit or a vehicle use permit. If the vehicle use policy in place at the company of the legal entity Customer allows, the Driver’s relative may also be registered as data subject.	o  name, o  address o  place and date of birth o  personal data included in personal documents (driver’s licence number, validity, category, identification card number, passport number, validity) o  registration number/number plate	The processing of personal data is necessary for verifying the lawful use of the vehicle and, at the request of the legal entity Customer, for issuing a country exit permit and, depending on the country of destination, for getting notarisation for the vehicle. The purpose of processing the registration number/number plate is to identify the vehicle affected by the service, and performing the related administrative tasks as well as accounting and billing.	performance of a contract (Article 6(1)(b) of the GDPR)	To the legal entity Customer or to the contact person of the legal entity Customer   Notary public
Measuring customer satisfaction	o  name, o  email address,	To provide customised products and services in order to meet and satisfy the needs of legal entity Customers to the highest possible degree and to assess the needs of legal entity Customers and Drivers.	legitimate interest (Article 6(1)(f) of the GDPR)   We have a legitimate interest in continuously monitoring and improving the quality of our Services to provide customised products and services in order to meet and satisfy the needs of our Customers to the highest possible degree and to assess the needs of Customers and Drivers.	Schiller Autóház Kft.
Sending newsletters and marketing promotions applicable to the whole of Schiller Group (to the representatives, contact persons and Drivers of legal entity Customers)	o  name, o  email address	Advertising the activities and services of Schiller Group as a whole, and providing marketing communications, sending offers electronically and/or on paper	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	Schiller Autóház Kft.
Audio recording (in case of call centre activity)	o   date/time and duration of the call o   the caller’s telephone number o  personal data provided by the Data Subject during a telephone conversation	o   customer complaints handling o   consumer protection, quality assurance supporting more efficient administration, exercising your and our own rights	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	no data transfer carried out

• In case of ordering and contracting by email (when the Customer or Driver is not present at the conclusion of a contract), we will receive copies of the official instruments and other documents containing the Customer’s or Driver’s data required for the conclusion of such contract, as defined above, based on which we will record the necessary personal data in our records, and we will subsequently delete and destroy such copies of the official instruments and other documents.

 

5.3     Processing of personal data of private individual customers in the course of and in connection with the provision and performance of Rent a Car Services

 

Activity	Data processed	Purpose of processing	Legal basis for processing	Data transfer
Contracting	o  name, o  address o  place and date of birth o  driver’s licence number, validity, category, limitations o  identification card number, passport number, validity o  email address, o  phone number, o  credit card number, expiry date, type (if no master agreement has been concluded with the private individual Customer)   If the Vehicle is also driven by someone other than the private individual Customer: o  name, o  address o  place and date of birth o  driver’s licence number, validity, category, limitations o  identification card number, passport number, validity	For concluding contracts related to the Services and for recording and processing data required for the following in relation to the private individual Customer: o   making contact, o   liaising, o   addressing of issues, administration, o   business management, o   contracting, for recording and processing the necessary data   Credit card data is required for fulfilling and enforcing the payment obligation related to the use of the Service.	performance of a contract (Article 6(1)(b) of the GDPR)	Schiller Autóház Kft. (for accounting purposes) Bank   Credit card data are transferred to the financial service provider, or to the broker, if the contract is concluded through a broker
Electronic contracting, use of the Services (in case of self-service car rental)	o  name, o  address o  place and date of birth o  driver’s licence number, validity, category, limitations o  identification card number, passport number, validity o  email address, o  phone number, o  credit card number, expiry date, type (if no master agreement has been concluded with the private individual Customer)   If the Vehicle is also driven by someone other than the private individual Customer: o  name, o  address o  place and date of birth o  driver’s licence number, validity, category, limitations o  identification card number, passport number, validity	For concluding contracts related to the Services by electronic means and, for ensuring the use of the Services, recording and processing data required for the following in relation to the private individual Customer o   making contact, o   liaising, o   addressing of issues, administration, o   business management, o   electronic contracting, for recording and processing the necessary data   Credit card data is required for fulfilling and enforcing the payment obligation related to the use of the Service.	performance of a contract (Article 6(1)(b) of the GDPR) processing pursuant to Sections 13/A(1)-(9) of Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society-Related Services	Schiller Autóház Kft. (for accounting purposes) Bank   Credit card data are transferred to the financial service provider, or to the broker, if the contract is concluded through a broker
Verification of the existence and validity of a valid driver’s licence (in case of electronic contracting, self-service car rental)	o  a photo of both sides of the driver’s licence	The car rental service is only available to persons who have the required licence to drive a vehicle. For this purpose, we verify the details of the driver’s licence by having the Customer upload a photo of both sides of the driver’s licence.	legitimate interest (Article 6(1)(f) of the GDPR)   We have a legitimate interest in ensuring that the Services are only used by persons who are eligible to do so under the conditions set forth in legal regulations, i.e. who have the required licence to drive a vehicle and, to this end, we check the existence of the driver’s licence and the data of the driver’s licence and its validity.	no data transfer carried out
Driver identification (in case of electronic contracting, self-service car rental)	o  selfie of the driver of the vehicle (self-portrait photo) o  a photo of both sides of the driver’s licence o  for EU nationals driving the vehicle, photo of both sides of their identity card o      for non-EU nationals driving the vehicle, photo of both sides of their passport	Verification of the identity of the Driver and the holder of the driver’s licence.   Driver identification Examination and verification of the conditions necessary for the establishment of a contractual relationship.	legitimate interest (Article 6(1)(f) of the GDPR)   We have a legitimate interest in verifying that, in the event of electronic contracting, we identify the Customer, Driver in order to ensure that the data provided relates to the person whose documents and selfie are uploaded and that this person has a valid driver’s licence.	no data transfer carried out
Handover of the vehicle	o   name, o   email address, o   phone number, o   registration number/number plate	For handing over the vehicle to a private individual Customer o   making contact o   addressing of issues, administration o   making appointments, o   sending notifications.   The purpose of processing the registration number/number plate is to identify the vehicle to be handed over.	performance of a contract (Article 6(1)(b) of the GDPR)	[**********]
Vehicle assistance service	o   name, o   email address, o   phone number, o   position, location data, o   registration number/number plate	In order to provide or organise the vehicle assistance service, the vehicle assistance service provider shall contact the relevant Driver or the Customer’s contact person for the following purposes: o   making contact, liaising, o   sending notifications.   The purpose of processing the location data is to enable the vehicle assistance service provider to reach the Driver’s location and to enable the Driver to use the service at the location reported by the Driver.   The purpose of processing the registration number/number plate is to identify the affected vehicle, and performing the related administrative tasks as well as accounting and billing.	performance of a contract (Article 6(1)(b) of the GDPR)	to our Partner performing the service
Communication, maintaining customer relationship in connection with the Services	o  name, o  email address, o  phone number,	Necessary in connection with Rent a Car Services or in order to perform the Services in compliance with the contract: o   making contact o   liaising o   addressing of issues, administration o   business management	performance of a contract (Article 6(1)(b) of the GDPR)	Partner performing the Service
Measuring customer satisfaction	o  name, o  email address	To provide customised products and services in order to meet and satisfy the needs of private individual Customers to the highest possible degree, and to assess the needs of private individual Customers.	legitimate interest (Article 6(1)(f) of the GDPR)   We have a legitimate interest in continuously monitoring and improving the quality of our Services to provide customised products and services in order to meet and satisfy the needs of our private individual Customers to the highest possible degree and to assess the needs of private individual Customers.	For companies within the Group and external agents performing marketing and market research activities
Sending out email communications	o  name, o  email address	To share information and provide information to private individual Customers about our various services provided to private individual Customers in order to promote, facilitate and support the use of our services	legitimate interest (Article 6(1)(f) of the GDPR)	Schiller Autóház Kft.
Sending newsletters, marketing promotions and offers applicable to the whole of Schiller Group	o  name, o  email address	Advertising the activities and services of Schiller Group as a whole, and providing marketing communications, sending offers electronically and/or on paper	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	Schiller Autóház Kft.
Communication of Customer events	o   name, o   email address	Sending invitations to events and activities organised by us as well as managing the related registration process.	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	Schiller Autóház Kft.
Audio recording (in case of call centre activity).	o   date/time and duration of the call o   the caller’s telephone number o   personal data provided by the Data Subject during a telephone conversation	o   customer complaints handling o   consumer protection, quality assurance o   promoting more efficient administration, enforcing the rights of the data subjects and the Controller	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	no data transfer carried out
Claims, insurance administration	o   name, o   email address, o   registration number/number plate, o   address o   place and date of birth o   driver’s licence number, validity, category, limitations o   other personal data indicated on the claims form (e.g. details of the incident, details of the damage, photographs of the incident, number of passengers in the vehicle, details of the witnesses)	Forwarding the claims form to the insurer completed by the private individual Customer regarding the insured event, and documenting the claim and assessing the damage in order to process the claim.   We process the insurance claims report sent to us by the insurer and the data contained therein (name and vehicle registration number/number plate of the private individual Customer) for statistical purposes in order to summarise the insurance claims of the vehicles owned by us.   The purpose of processing the registration number/number plate is to report any damage, to identify the vehicle involved in the incident, and performing the related administrative tasks as well as accounting and billing.	performance of a contract (Article 6(1)(b) of the GDPR)       performance of a contract (Article 6(1)(b) of the GDPR) and legitimate interest (Article 6(1)(f) of the GDPR) It is in our legitimate interest to have a comprehensive picture of the insurance claims of our vehicles, to be able to recover and manage the related damages, and to provide customers with adequate information on the procedures followed by the insurers.	The claims form will be forwarded to the insurer by us or directly by the repair shop, in which case the repair shop will forward the claims form to us so that we can approve the necessary repairs.   If the claims form is sent to us by the insurer, it will be forwarded to the private individual Customer upon request.   To the private individual Customer   We may also forward the relevant information on the claim to experts on the matter.
Managing penalties	o   name, o   email address, o   address o   registration number/number plate o   details of the infringement, as described by the authority o   information provided by the parking company	Managing and payment of fines.   We may charge private individual Customers for fines, penalties and fees imposed by the authorities and parking companies, and we will send the relevant official decision, the letters from the parking companies and the invoice on the fine, penalty or fee to the private individual Customers’ address. The purpose of processing the registration number/number plate is to identify the vehicle affected by the service, and performing the related administrative tasks as well as accounting and billing.	Performance of a contract (Article 6(1)(b) of the GDPR)	Authorities
Responding to the requests and notices given by law enforcement and investigative authorities, bodies and authorities	o   name o   other data provided or requested by law enforcement and investigative authorities and bodies	Complying with statutory obligations in order to respond to requests and notices given by law enforcement and investigative authorities, bodies and public authorities	Complying with legal obligations (Article 6(1)(c) of the GDPR)	Law enforcement and investigative authorities, bodies and authorities
Location of the vehicle	o   location data of the vehicle	To enable the identification of the vehicle’s location and position in the event of Driver’s failure to return the vehicle at the time agreed in the contract, and if Driver cannot be reached by telephone, or in the event of theft of the vehicle, or if an emergency is reported by the Customer or Driver.	legitimate interest (Article 6(1)(f) of the GDPR)	Law enforcement and investigative authorities, bodies and authorities
	o
Issuing a permit for the Driver/a country exit permit or a vehicle use permit.	o  name, o  address o  place and date of birth o  personal data included in personal documents (driver’s licence number, validity, category, identification card number, passport number, validity) o  registration number/number plate	The processing of personal data is necessary for verifying the lawful use of the vehicle and, at the request of the private individual Customer, for issuing a country exit permit and, depending on the country of destination, for getting notarisation for the vehicle. The purpose of processing the registration number/number plate is to identify the vehicle affected by the service, and performing the related administrative tasks as well as accounting and billing.	performance of a contract (Article 6(1)(b) of the GDPR)	Notary public
Settlement with the broker	o    name of private individual Customer o    rental period o  registration number/number plate	In the case of a contract concluded through a broker, settlement with the broker requires the processing of the data of the private individual Customer and the data of the Service necessary for such settlement	performance of a contract (Article 6(1)(b) of the GDPR)	Broker

 

• If the private individual Customer books the Service via our website, the credit card data will be processed solely by the financial service provider.
• If the Vehicle is also driven by a person other than the private individual Customer (hereinafter: additional driver) and the additional driver is not present at the conclusion of a contract, we will receive copies of the official documents of the additional driver containing their data required for the conclusion of such contract, as defined above, based on which we will record the necessary personal data in our records, and we will subsequently delete and destroy such copies.

 

5.4     Processing of the personal data of Partners or, in the case of a legal entity Partner, of the senior executives, representatives, contact persons, agents, employees acting on their behalf

 

Activity	Data processed	Purpose of data processing	Legal basis for processing	Data transfer
Contracting	o  name, o  email address, o  phone number, o  job title	In connection with the performance of the tasks required for the provision of the Services, to conclude contracts with subcontractors and designated partners and to contact the Customer’s representative, contact person, sales and technical manager, financial contact, for the purpose of recording and processing the data necessary for o   making contact, o   liaising, o   addressing of issues, administration, o   business management, for recording the necessary data	performance of a contract (Article 6(1)(b) of the GDPR)	Schiller Autóház Kft. (for accounting purposes) Bank
The performance of the tasks necessary for the provision of the Services by subcontractors, agents, contributors	o   name, o   email address, o   phone number, o   job title	The performance, provision and support of Services provided to Customers and performance of other business activities   In the course of the services we use o   making contact, liaising, o   addressing of issues, administration o   making appointments sending notifications	performance of a contract (Article 6(1)(b) of the GDPR)	no data transfer carried out
Communication of Customer events (contact person and managing director)	o   name, o   email address	Sending invitations to events and activities organised by us as well as managing the related registration process.	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	Companies within the Group
Sending newsletters and marketing promotions applicable to the whole of Schiller Group (to the Partner’s representatives, contact persons)	o  name, o  email address	Advertising the activities and services of Schiller Group as a whole, and providing marketing communications, sending offers electronically and/or on paper	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	Companies within the Group

 

 

 

5.5  Processing related to applicants applying for job vacancies

Activity	Data processed	Purpose of data processing	Legal basis for processing	Data transfer
Selection and assessment of applicants to advertised job vacancies	o    name oplace and date of birth o    name of previous job, position held and duration of employment o    Academic qualification o    Foreign language skills o    other information on CV o    other details of motivational letter	In order to ensure our workforce needs, to identify and distinguish the data subject, to assess the applicant’s suitability to fill the advertised position	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	Companies within the Group

 

 

5.6  Processing related to requests for offers and clarifications

Activity	Data processed	Purpose of data processing	Legal basis for processing	Data transfer
Responding in connection with offers and enquiries made by telephone, email, by completing an online form, or in connection with data provided in person, and providing information	o    name o    telephone number o    email address	Informing the enquiring data subject, answering their questions, making offers, providing information	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	no data transfer carried out
Sending newsletters and marketing promotions applicable to the whole of Schiller Group	o  name, o  email address	Advertising the activities and services of Schiller Group as a whole, and providing marketing communications, sending offers electronically and/or on paper	voluntary consent of the data subject (Article 6(1)(a) of the GDPR)	Companies within the Group

 

 

 

 

 

1. Duration of processing

 

6.1       We process the personal data of Customers’ contact persons (financial managers), senior officers, representatives for 5 years after the termination of our legal relationship with the given Customer and the full settlement with the Customer.

 

6.2       We keep the personal data of Drivers for 2 years after the vehicle used by the Customer and the Driver as specified in the contract has been returned to us and the Customer has fully met all payment and other obligations to us. In the event of a claim involving the vehicle, we may also process Driver data until the final insurance, legal and/or financial settlement of the claim. In the case of penalties incurred during the use of the vehicle, we may also process the data of the Drivers of the vehicle until the period of the enforceability or the statute of limitations of the penalty (subject to the legal regulations of foreign countries).

 

6.3       In the case of self-service car rental, the  selfie of the driver of the vehicle (self-portrait photo), the photo of both sides of the driver’s licence, for EU nationals driving the vehicle, photo of both sides of their identity card, for non-EU nationals driving the vehicle, photo of both sides of their passport – as uploaded to the online reservation system during online contracting – are processed for the duration absolutely necessary for verification, but for no longer than 60 days, after which they are permanently deleted from the online reservation system.

6.4       We delete the location data of the Vehicles, if equipped with such a device, when the Vehicles are returned, or we ask the Drivers to delete the location data from the GPS device before returning the Vehicle.

 

6.5       The personal data of Partners or, in the case of a legal entity Partner, of the senior executives, representatives, contact persons, agents, employees acting on their behalf are processed for 5 years after the termination of our legal relationship with the Partner and the full settlement of accounts with the Partner.

 

6.6       In the course of processing in connection with a request for a quote, the data provided is stored for the period necessary to process the request for a quote or other request, but for a maximum of 12 months, unless the requesting party or interested party has consented to other processing.

 

6.7       In the case of job applicants, the retention and processing period is 6 months after selection for the given position.

 

6.8       In the case of the sales of used vehicles, we process personal data until the limitation period for claims (usually 5 years from the date of performance).

 

6.9       The general duration of the processing for purposes other than the above and, in relation to the above processing, the duration of the processing of personal data necessary for the enforcement of claims, is until the limitation period for the enforcement of rights and obligations arising from the legal relationship in relation to which the personal data are processed.

 

6.10   For the purposes of complying with a legal obligation to which we are subject, the period of processing may be longer.

 

6.11    Documents that qualify as accounting documents and the personal data contained therein are retained for 8 years pursuant to Section 169 of Act C of 2000 on Accounting.

 

6.12   The data provided with your voluntary consent is processed for the period specified above, but not longer than until your consent is withdrawn.

You have the right to withdraw your consent at any time, without justification and free of charge, at the following addresses or at our registered office. Withdrawal of consent shall not affect the lawfulness of processing performed before the withdrawal of such consent.

 

6.13   In the absence of an applicable legal provision, we process the data until the purpose is fulfilled or, in the case of processing with voluntary consent, until your consent is withdrawn at the latest or, where relevant, for a specified period of time for the fulfilment of obligations related to the processing (taxation, accounting).

 

6.14   We shall erase any and all personal data whose processing has ceased to serve a purpose, or for which we do not have the consent of the data subject or for which there is no legal basis for processing.

 

• Processors

 

7.1       In order to provide and contractually perform the Services and to conduct our business in relation to the Services, we use and cooperate closely with members of Schiller Group, other service providers, subcontractors, agents, brokers and Partners who qualify as processors. The Partners support us in the performance and provision of the Services.

These processors become aware of and process your personal data for the purposes, to the extent and for the duration necessary for their activities.

7.2       Our other partners (e.g. IT service providers, security companies, attorneys) support our business operations, maintain our IT systems and related infrastructure, provide personal, property and object protection, provide legal advice and drafting/editing services (e.g. for the preparation of contracts, claim enforcement and debt collection).

7.3       Personal data may be transferred to comply with legal requirements and for the purposes of public administration and the provision of information.

7.4       We may transfer your personal data for marketing and market research purposes on the basis of your voluntary, specific and explicit consent.

 

• Your rights

 

Data protection legislation gives you certain rights in relation to your personal data. Some of these rights are complex and include exceptions and, as such, we recommend that you read the applicable data protection legal regulations and/or seek guidance from the regulatory authorities for a full explanation of these rights. Below is a summary of your rights regarding the processing of your personal data, with the proviso that certain rights only apply to specific types of processing or processing operations based on certain legal grounds.

 

8.1           Right to receive information

8.1.1            In order to keep you appropriately informed, we make our currently effective Privacy Notice available on our website.

In the Privacy Notice, you as the Data Subject are provided information on the purpose, legal basis and duration of processing, if data transfer occurs the fact of transfer, the name and contact details of the recipient to whom the data was transferred, the fact of processing, the rights of the data subject and the legal remedies available to the data subject prior to processing.

8.1.2            You can request written information about the processing of your data at any time.

Information is provided without undue delay, but in any case within 30 days,

 in a clearly understandable form to the address you have specified.  If necessary, taking into account the complexity of the request and the number of requests, we may extend this deadline by an additional two months, and we will inform you of the reasons for the delay within one month of receipt of such request. In certain cases set out in legal regulations, we are required to refuse to provide the information.

8.1.3            Information is provided free of charge if you did not submit any application for information relating to the same matter in the current year. In other cases, or if your request is clearly unfounded, a reasonable fee of HUF 1,000/information request may be charged. An already paid fee is reimbursed if it is established that data has been processed unlawfully, or if the request for information has led to rectification.

 

 

8.2            Right of access (access to data, whether or not data is being processed)

8.2.1            You have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:

1. the purposes of processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. your right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where the personal data are not collected from the data subject, any available information as to their source;
8. the existence of automated decision-making, including profiling, and, at least in those cases, comprehensible information about the logic applied, as well as the significance and the envisaged consequences of such processing for the data subject.

8.2.2            In case of your exercise of the right of access, we make a copy of the personal data subject to processing available to you. For any further copies requested by you, we charge a reasonable fee based on administrative costs at a rate of HUF 300/page.

8.2.3            Where you make the request by electronic means, and unless otherwise requested by you, the information is provided in a commonly used electronic form.

 

8.3            Right to rectification (correction, completion of inaccurate data)

8.3.1            You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

8.3.2            You are required to notify us of any changes to your data without delay, but within no later than 5 working days after the change. You are liable for the consequences of your failure to comply with the obligation to report changes in data.

 

8.4            Right to erasure – “right to be forgotten” (only in case of processing based on consent)

8.4.1            You have the right to obtain from us the erasure of personal data concerning you without undue delay and we have the obligation to erase personal data without undue delay where one of the following grounds applies:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. you withdraw your consent or, in the case of processing of special categories of personal data, the consent on which processing is based, and there is no other legal ground for the processing;
3. you object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR;
4. the personal data have been unlawfully processed;
5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject;
6. the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

8.4.2            We may not delete data whose processing is required by law or necessary for the performance of a contract. We are obliged to retain such data for the period required by law and may only erase the data after such periods have expired.

8.4.3            If the processing is necessary for the establishment, exercise or defence of our legal claims, we are not required to delete the data.

 

8.5            Right to restriction of processing

8.5.1            You have the right to obtain from us restriction of processing where one of the following applies:

1. you contest the accuracy of the personal data, in which case the restriction applies to a period that enables us to verify the accuracy of such personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
4. you have objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

8.5.2            Where processing has been restricted on the basis of the above, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest in the European Union or a Member State.

 

8.6            Right to data portability

8.6.1            You shall have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

1. the processing is based on consent pursuant to Article 6(1)(a) (processing based on voluntary consent) or consent pursuant to Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) of the GDPR; and
2. the processing is carried out by automated means.

 

8.6.2            In exercising your right to data portability in accordance with the above, you shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

8.6.3            The right to data portability shall not adversely affect the rights and freedoms of others.

 

8.7            Automated decision-making

8.7.1            The Controller does not employ fully automated decision-making.

 

8.8            Right to object

8.8.1            You may object to the processing of your personal data if

• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

8.8.2            We investigate the objection within the shortest time possible from the submission of such request, but within 30 days at the latest, make a decision on the substantiation of the request and inform you of the decision in writing.

8.8.3            In this case, we shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or which are required for the establishment, exercise or defence of legal claims.

8.8.4            You may also object to the processing of your personal data if the personal data is used or transferred for direct marketing purposes. Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

 

8.9            Right to lodge a complaint with a supervisory authority

8.9.1            Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

8.9.2            The supervisory authority for complaints on data processing is the Hungarian National Authority for Data Protection and Freedom of Information.

 

8.10          Right to judicial remedy

8.10.1         Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority as per the above, you shall have the right to an effective judicial remedy where you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in non-compliance with the GDPR.

8.10.2         Proceedings against the controller or a processor shall be brought before the courts of the Member State where they are established. Alternatively, such proceedings may be brought before the courts of the Member State where you have your habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

8.10.3         You may withdraw your consent for the processing of data based on your voluntary consent in accordance with Article 6(1)(a) of the GDPR by sending a declaration to our registered office, email address, at any time, without restriction and without justification, free of charge, provided that the withdrawal of consent does not affect the lawfulness of the processing based on consent prior to the withdrawal.

 

8.11          Restriction of data subject rights relating to processing

8.11.1         Where the processing of personal data is required by law, these legal measures applicable to the controller or processor may restrict the scope of their rights and obligations concerning the processing to which you are subject and set out in Sections 1-11 of Chapter VIII of this Privacy Notice, if the restriction respects the material content of fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society for the protection of those rights and freedoms:

1. the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
2. the detection and prosecution thereof;
3. the protection of the data subject or the rights and freedoms of others;
4. the enforcement of civil law claims.

 

8.11.2         You may exercise your data subject rights specified in Sections 1-11 of Chapter VIII of this Privacy Notice in a limited manner, if the processing of any personal data relating to the controller or processor is required by law.

 

 

8.12          Information on legal remedies

8.12.1         You acknowledge that your rights in relation to processing, the exercise of such rights and the legal remedies available to you are governed by Articles 15-22 and Articles 77 and 79 of the GDPR.

8.12.2         The data protection supervisory authority in Hungary is: Hungarian National Authority for Data Protection and Freedom of Information (H-1125 Budapest, Szilágyi Erzsébet fasor 22/C) ugyfelszolgalat@naih.hu.

8.12.3         Court action: data protection litigation procedures fall within the jurisdiction of the tribunal. The action may also be brought, at the discretion of the data subject, before the regional court with jurisdiction at the data subject’s residence or place of stay.

 

1. Data security

 

9.1                Taking into account the provisions of Article 32 of the GDPR, we implement appropriate and reasonable technical, organisational and administrative measures to ensure a level of data security appropriate to the level of risk, including the prevention of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.

 

1. HOW WE USE COOKIES AND HOW WE USE YOUR PERSONAL DATA

 

10.1             Information on cookies

We collect and analyse data concerning your use of the website. The purpose of such processing is to optimise user experience and we also collect data for statistical and marketing purposes. You can decide whether or not to allow the use of cookies by

making individual settings in your browser. For more information about cookies, how to use them and how to reject them, please see our Cookie Notice.

 

1. Scope and amendment of the Privacy Notice

 

11.1             The provisions of this Privacy Notice may be supplemented by other information that you have received from us and other terms and conditions of use that apply to our website or to which you have given your voluntary consent when you contacted us.

 

11.2             Where the Customer or a third party has access to the personal data, the Customer or the given person is the controller and is responsible for the controlling, processing, transfer and use of the data. This Privacy Notice does not cover the personal data processed and used by our Customers, Partners and other persons associated with us.

 

11.3             The Privacy Notice is published on our website (https://schiller.hu/flotta) and is also available at our registered office (H-1138 Budapest Váci út 113).

 

11.4             We may unilaterally amend this Privacy Notice at any time. See below for the most recent amendment of the Privacy Notice. We inform Data Subjects of any amendments to the Privacy Notice on our website. Any amendments to this Privacy Notice enter into force when the amended Privacy Notice is published on our website.

By using or continuing to use our services, you agree to be bound by the provisions of this Privacy Policy, as amended.

 

11.5             This Privacy Notice is effective as of 30 September 2019.

[1] personal data: any data that may be connected to an identified or identifiable natural person [data subject] – including in particular the name or the ID number, or one or more items of information regarding the physical, physiological, mental, economic, cultural or social identity of the data subject, or any conclusion that can be drawn, with regard to the data subject, from the data.

[2] data controlling: independently of the procedure followed, any operation or the totality of operations performed on the personal data or data sets, including in particular their collection, admission, recording, systematising, storing, changing, utilisation, retrieval, transmission, publication, harmonisation or association, blocking, deletion and cancellation and the preventing of the further utilisation of such data, the taking of photos, recording of audio signals or images.

controller: the natural person or legal entity or organisation without legal personality who/which determines, either individually or in cooperation with others, the purpose and instruments of data processing, makes the decisions on data processing (including the tools to be used) and executes them or ensures they are executed by a designated data processor.

[3] data processing: the execution of technical tasks related to data management operations, regardless of the methods and tools used for executing these operations, and of the place of application, assuming that such technical task is performed on the data.

processor: the natural person or legal entity or organisation without legal personality who/which, under a contract concluded with the controller – including any contracts concluded by virtue of a legal provision – processes data.

[4] data transfer: making the data accessible to specified third parties.

[5] data subject: any natural person who is or who can be – directly or indirectly – identified based on a specified item of personal data

[6] cookies: a cookie is a small file that is placed on your computer when you visit a website. Cookies have many functions. Among other things, they collect information, remember the visitor’s individual settings and preferences and generally make the website easier for users to use.