Last updated: 01.04.2026
Eurocar Italia S.r.l., Eurocar Tech S.p.A. and PWP S.r.l. (the "Companies") intend, by means of this document, to provide information on the purposes and methods of processing, as well as on the methods of protection of the personal data ("Data") of those who come into contact with them, for example as customers or potential customers, suppliers, candidates (hereinafter "Data Subjects" or "Users"), also through the Companies' website (hereinafter, the "Website").
This document (hereinafter, "Notice") constitutes a notice pursuant to Articles 13 and 14 of the European Regulation of 27 April 2016, No. 679 (hereinafter "GDPR"). The Notice may be subject to amendments and additions following the introduction of new regulations or as a result of changes in processing activities or changes to IT systems or the Website.
This Notice may be supplemented with additional information on the processing of personal data following the use of a specific section of the Website (e.g., the cookie notice, the notice relating to events, etc.) or through notices issued on an ad hoc basis and relating to a specific service rendered (e.g. quotation, purchase proposal, service activities, notice issued in the case of requests for tax benefits for persons with disabilities, etc.) or also regarding the indication of additional joint controllers of each Company (e.g. importing companies, manufacturing companies, etc.) for the specific purposes of reference.
The Joint Controllers of the data processing for the purposes referred to in this Notice (hereinafter "Joint Controllers" or, individually, "Joint Controller") are:
It is hereby noted that pursuant to Art. 26 GDPR, the Joint Controllers have transparently determined, by means of a joint controllership agreement, their respective responsibilities. The essential content of that agreement is made available to the Data Subject upon request.
It is further noted that Eurocar Italia S.r.l., Eurocar Tech S.p.A. and PWP S.r.l. act as independent Controllers (hereinafter "Controllers" or, individually, "Controller") with specific reference to certain of the purposes referred to in this Notice, as specifically indicated in the following paragraph 3.
For all matters relating to data processing, for the exercise of rights arising from the GDPR (see the following paragraph 10 on this point), as well as for any doubts or clarifications regarding this Notice, the Data Subject may contact any of the Joint Controllers indifferently, by sending a registered letter with return receipt or an e-mail to the addresses indicated above.
Each Joint Controller has appointed a Data Protection Officer, who can be contacted at the following addresses:
The personal data collected are processed for the following purposes:
To make the Website accessible and to monitor the proper functioning of its web pages, to update and/or supplement their content through the back end of the Website, to manage the operation and technical maintenance of the AI chatbot (AI Assistant) on the Website, to consult data visible through the various sections of the Website's back end, in particular those relating to leads, and possibly also to obtain statistical information through certain functions available on the Website's back end.
Legal Basis: legitimate interest of the Joint Controller (Art. 6.1, let. f), GDPR) in ensuring the proper functioning of the Website and its continuous improvement.
To manage requests submitted by the User through the completion of data collection forms in dedicated areas of the Website (by way of example and without limitation the "Contact Us", "Request Information", "Book Appointment/Assistance", "Register for Event" sections, etc.), or through the use of the AI chatbot (AI Assistant) on the Website (through which, as described in more detail below, it is possible to obtain information about the products and services offered by the Companies, as well as to book an appointment), through the use of the Companies' social media channels (e.g. Facebook), through the Companies' WhatsApp contact channel, or during telephone calls made by Users to the Companies, and for the purpose of managing activities related to providing a response to Users.
Legal Basis: necessity to carry out pre-contractual measures taken at the request of the Data Subject (Art. 6.1, let. b), GDPR).
For the execution of such services, as described in the Website's General Terms of Service, following a request submitted by a User.
Legal Basis: necessity to carry out pre-contractual and contractual measures taken at the request of the Data Subject (Art. 6.1, let. b), GDPR).
Requested by the Data Subject, also through digital channels (via the Website, by telephone, by e-mail). This purpose includes the execution of related administrative requirements, verification of product availability and the consequent estimation of waiting times.
Legal Basis: necessity to carry out pre-contractual measures taken at the request of the Data Subject (Art. 6.1, let. b), GDPR).
Requested by the Data Subject, in particular relating to the purchase and sale of vehicles, or products or other financial services, long-term rental or financial leasing, the provision of service activities as well as any other related services.
Legal Basis: necessity to perform a contract at the request of the Data Subject (Art. 6.1, let. b), GDPR).
To carry out preliminary activities and to initiate and execute, at the request of the Data Subject, the steps required to obtain the tax benefits provided for the automotive sector (for example, reduced VAT at 4%) by Law No. 104/1992 and, among others, by Law No. 97/1986, Law No. 449/1997, Law No. 342/2000 and Law No. 388/2000, as well as for purposes closely related thereto (e.g., vehicle adaptation activities).
Legal Basis: necessity to carry out pre-contractual measures or to perform a contract at the request of the Data Subject (Art. 6.1, let. b), GDPR) and necessity to comply with a legal obligation of the Joint Controller (Art. 6.1, let. c), GDPR). Personal data belonging to special categories (health data) are processed pursuant to Art. 9.2, let. a), GDPR: "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes (…)".
To manage financing requests by carrying out financial intermediation activities (banking or non-banking).
Legal Basis: necessity to perform a contract at the request of the Data Subject (Art. 6.1, let. b), GDPR).
To allow each Joint Controller to evaluate its own performance, the achievement of its own bonuses/KPIs, including with regard to financial penetration and the management of sales commissions.
Legal Basis: legitimate interest of the Joint Controller (Art. 6.1, let. f), GDPR) in carrying out business evaluations in line with its own objectives.
To fulfil the requests of individuals who wish to benefit from a test drive and/or enter into a loan for use or short-term driverless rental contract for a vehicle owned by a Controller.
Legal Basis: necessity to perform a contract at the request of the Data Subject (Art. 6.1, let. b), GDPR).
To provide services connected to the legal warranty or commercial goodwill.
Legal Basis: necessity to comply with a legal obligation of the Controller (Art. 6.1, let. c), GDPR) or, in cases of commercial goodwill, legitimate interest of the Controller (Art. 6.1, let. f), GDPR) in addressing any customer requests and issues arising at the time of sale and/or service to ensure a high quality of the products and services offered.
To send the Data Subject, by e-mail, post, SMS (Short Message Service) or other means, as well as by telephone, including through an operator, communications, newsletters, informational materials, promotional, commercial and advertising materials or materials relating to events and initiatives, or for the conduct of market research or other sample surveys.
Subject to obtaining consent, the Joint Controllers may use systems for sending newsletters and promotional communications, which generate reports containing information such as, for example, the number of readers, openings, "clickers" and clicks related to communications or the operating systems used to read the communication. This information may be used to compare and possibly improve the effectiveness of communications and the redemption of marketing campaigns.
The Joint Controllers may also carry out personalised marketing activities which, in any case, may only be carried out following the collection of the User's specific consent to the use of profiling cookies, as detailed in the cookie policy.
Legal Basis: processing is carried out only after obtaining the express consent of the Data Subject (Art. 6.1, let. a), GDPR).
To improve the offering of products/services, to enable the elaboration of the Data Subject's profile and the analysis of their habits and consumption choices, with the aim of improving the commercial offering and the services proposed, as well as to improve the customer experience in the context of quoting and purchasing a vehicle. The analyses also consist of electronic processing (by geographical area, activity or profession, hobbies, age, etc.) of the User's data to identify their preferences, behaviours and interests in relation to the products and services used.
Legal Basis: processing is carried out only after obtaining the express consent of the Data Subject (Art. 6.1, let. a), GDPR).
To enable the conduct of surveys on the degree of customer satisfaction and the quality of services offered.
Legal Basis: legitimate interest of the Controller (Art. 6.1, let. f), GDPR) in providing customers with a better service by analysing their degree of satisfaction.
To enable the collection of CVs and candidate profiles, possibly also through an online platform, and subsequently to enable the conduct of personnel selection activities. Specifically, such activities consist of (i) evaluating the candidate's profile against open positions and/or in the case of unsolicited applications, (ii) verifying that what was communicated by the candidate is true, (iii) making all appropriate considerations regarding the possibility of establishing an employment relationship, and/or similar (e.g. internship) and/or collaboration. As a rule, no special category data is processed, unless these are characteristics that affect the way in which the work activity is carried out, or that constitute an essential and determinative requirement for the performance of such activity.
Legal Basis: necessity to carry out pre-contractual measures taken at the request of the Data Subject (Art. 6.1, let. b), GDPR). Any personal data belonging to special categories are processed pursuant to Art. 9.2, let. b), GDPR: "processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law (…)".
To allow the Controller to carry out the activity of registering the Data Subject for the event, in order to allow their participation, as well as for organisational and safety purposes for the people present at the event, in all events/manifestations organised by the Controller, including at the Controller's commercial partners.
Legal Basis: necessity to carry out pre-contractual measures or to perform a contract at the request of the Data Subject (Art. 6.1, let. b), GDPR).
To allow the Joint Controllers to use and publish audio-visual material, collected mainly on the occasion of events, or on the occasion of the delivery of the vehicle to the Data Subject, and exclusively following a suitable release for the use of images, depicting the Data Subject on the internal or external channels used by the Joint Controllers, in particular on dedicated apps, dedicated sections of the Website, social media channels, brochures or specialist magazines.
Legal Basis: processing is carried out only after obtaining the express consent of the Data Subject (Art. 6.1, let. a), GDPR).
To allow the organisation of contests and promotional operations run by the Controller, as well as the Data Subject's participation therein.
Legal Basis: necessity to carry out pre-contractual measures taken at the request of the Data Subject (Art. 6.1, let. b), GDPR).
To enable each Joint Controller to comply with the compliance procedures adopted by the Companies (for example, relating to the tracking and monitoring of gratuities offered to Data Subjects, including any invitations to events, or of gratuities received from Data Subjects, the possible existence of conflicts of interest, the realisation of sponsorships or the provision of donations, etc.).
Legal Basis: legitimate interest of the Joint Controller (Art. 6.1, let. f), GDPR) in carrying out activities aimed at complying with the compliance procedures adopted by the Companies.
Pursuant to provisions/requests from authorities empowered by law or supervisory and control bodies: the Controller may process the personal data of Data Subjects collected to fulfil the obligations to which it is subject, in particular obligations arising from tax legislation.
Legal Basis: necessity to comply with a legal obligation of the Controller (Art. 6.1, let. c), GDPR).
In the event that the Controller needs to take legal action and/or defend its own rights, it may process the personal data of Data Subjects involved in the proceedings/dispute.
Legal Basis: legitimate interest of the Controller (Art. 6.1, let. f), GDPR) in protecting and defending its own rights. Any personal data belonging to special categories are processed pursuant to Art. 9.2, let. f), GDPR: "processing is necessary for the establishment, exercise or defence of legal claims".
For the sending of reminder communications and deadline notifications relating to (i) the mandatory periodic vehicle inspection, (ii) vehicle servicing and (iii) brake fluid replacement, in order to ensure the mechanical efficiency and reliability of the vehicle, high standards in sales and service activities and, more generally, public road safety.
Legal Basis: legitimate interest of the Controller (Art. 6.1, let. f), GDPR) in ensuring the mechanical efficiency of the vehicle, high standards in sales and service activities and, more generally, public road safety.
For the management, maintenance and monitoring of the company's IT infrastructure (information systems, programmes, software, platforms, electronic devices, internet and intranet networks, wi-fi, etc.) in order to ensure the operational continuity of the organisation and the structure of the IT resources used.
Legal Basis: legitimate interest of the Joint Controller (Art. 6.1, let. f), GDPR) in maintaining, monitoring and managing the company's IT infrastructure and resources.
* with regard to these purposes, as already stated above, Eurocar Italia S.r.l., Eurocar Tech S.p.A. and PWP S.r.l. act as independent Controllers.
The provision of Data for the purposes referred to in letters b), c), d), e), f), g), i), j), n), o), q), s) and u) above is necessary for the achievement of the purposes indicated above and refusal to provide such Data will make it impossible to proceed with Data Subjects' requests relating to the purposes indicated above.
The provision of data for the purposes referred to in letters k) marketing, l) profiling, p) management of images and audio/video recordings is optional. A potential refusal will make it impossible for the Joint Controllers and/or for the third parties indicated above to carry out, in relation to the Data Subject, marketing and/or profiling activities, or to use images and audio/video recordings of Data Subjects, collected mainly on the occasion of events and vehicle deliveries.
In pursuit of the purposes indicated above, Eurocar Italia S.r.l. and Eurocar Tech S.p.A., depending on the purposes, in their capacity as Joint Controllers or independent Controllers, will process the following information and categories of data of Data Subjects:
The processing of your personal data will be carried out by paper and electronic means, in compliance with the provisions on the protection of personal data and, in particular, the appropriate technical and organisational measures referred to in Art. 32 GDPR, as well as with the observance of every precautionary measure that guarantees their integrity, confidentiality and availability.
Your personal data may also be processed through artificial intelligence systems, in compliance, in addition to the provisions on the protection of personal data, with the provisions on artificial intelligence, established by Regulation (EU) 2024/1689 on artificial intelligence and by Law No. 135/2025. In this regard, particular reference is made to the AI Chatbot system (AI Assistant) made available to Users on the Website, which consists of a conversational tool for initial commercial contact through which the User can request information about the products and services offered by the Companies, as well as book an appointment at one of our locations. The tool was developed by an external supplier, acting as the system provider, and is based on an OpenAI artificial intelligence model, acting as the model provider.
It should also be noted that the AI chatbot system (AI Assistant), in pursuing the purpose of managing customer information requests and booking appointments, may, where necessary, perform an approximate geolocation of the User (macro area or city) derived from GeoIP. This is not a User geolocation tool, but rather a technology that uses a server-side geolocation mechanism based on the approximate correspondence between the User's IP address and geographical area. It operates exclusively server-side, having no profiling purpose and producing geographical information of low granularity.
The processing activities referred to in this Notice are not subject to automated decision-making processes.
Personal data will not be disclosed, except where required by law. Data may be communicated, in strict relation to the purposes indicated above, to the following categories of subjects:
The Companies undertake to rely exclusively on parties that provide adequate guarantees regarding data protection, appointing them, where required by current regulations, as Data Processors pursuant to Art. 28 GDPR. The list of Data Processors is available at the Companies and the Data Subject may consult it upon request. Data will also be processed, exclusively for the purposes referred to above, by the Companies' employed and/or collaborative staff, specifically authorised and instructed by the Companies pursuant to Art. 29 of the GDPR.
Eurocar Italia S.r.l. and Eurocar Tech S.p.A. do not intend to transfer data to countries outside the European Union/EEA. In any case, the Companies ensure that any such transfers will take place in compliance with specific standard contractual clauses approved by the European Commission pursuant to Art. 46 GDPR or towards countries that the European Commission has deemed to ensure an adequate level of protection, in accordance with the provisions of Arts. 44 et seq. GDPR. Any derogations from the foregoing will only occur in compliance with Art. 49 GDPR.
Data are retained for the period of time indicated below, specifically identified in relation to each purpose; in general, Data are retained for the time strictly necessary to achieve the purpose in question and, in any case, no longer than the periods established by law. Upon expiry of the retention periods indicated below, data will be subject to automatic deletion or irreversible anonymisation. A longer period of data retention may be determined by legal provisions, by legitimate requests/orders from public administration authorities or other judicial, governmental or regulatory bodies, or by the Companies' participation in judicial proceedings involving the processing of personal data.
A. Website management purposes:
Data are retained for the time strictly necessary for the purpose of Website management and, in any case, no longer than 30 days from the time of data collection.
B. Management of information requests received via the Website or by telephone:
Data are retained for the time strictly necessary to provide the Data Subject's response and, in any case, no longer than 30 days from the request.
C. Management of Save Search, Monitor Price and Newsletter services available on the Website:
Data are retained for the time strictly necessary for the performance of the services and, in any case, until the User unsubscribes.
D. Quotation preparation purposes:
Data are retained for the period of validity of the quotation and, in any case, for a maximum period of 24 months from the date of the quotation by reason of the purpose referred to in letter H.
E. Performance of contractual obligations requested by the Data Subject:
Data are retained for a period of 10 years from the date of termination of the contractual and/or commercial relationship.
F. Management of requests for 4% tax relief:
Data are retained for a period of 10 years from the date of termination of the contractual and/or commercial relationship.
G. Activities within the scope of a financing request:
Data are retained for a period of 10 years from the date of termination of the contractual and/or commercial relationship.
H. Internal analysis and monitoring of business activities:
Data are retained, depending on the case, (i) for a period of 6 months from the information request where collected in the context of processing for the purpose referred to in letter B., (ii) for a period of 24 months from the preparation of the quotation where collected in the context of processing for the purpose referred to in letter D. and (iii) for a period of 10 years from the date of termination of the contractual and/or commercial relationship where collected in the context of processing for the purpose referred to in letter E.
I. Loan for use or rental for test drives:
Data are retained for the duration of the contract and for a period of 10 years from the conclusion of the contract. Data processed on the occasion of the test drive will be retained for a period of 24 months, in the event of failure to purchase the vehicle following the test drive.
J. Provision of warranty services:
Data are retained for a maximum of 10 years from the date of termination of the contractual and/or commercial relationship.
K. and L. Marketing and profiling purposes:
Data will be retained for a maximum of 10 years from collection (a period considered appropriate by the Italian Data Protection Authority (Garante) by provision No. 274 of 09.05.2018 and also considered compliant with current regulations by the Controller, pursuant to Arts. 24 and 25 GDPR).
M. Customer satisfaction purposes:
Data are retained until the Data Subject objects to such processing activity and, in any case, for a maximum of 10 years from collection. Objection may be exercised through the dedicated link at the bottom of each customer satisfaction communication.
N. Recruitment and personnel selection purposes:
Data are retained for a period of 12 months from receipt of the CV or the collection of additional information or in any case from the end of the selection procedure.
O. Event management purposes:
Data are retained for a period of 1 month from the holding of the event.
P. Management of images and audio/video recordings:
Data are retained in the Joint Controllers' databases for a period of 24 months from the granting of consent.
Q. Participation in a contest/promotional operation:
Data are retained for a maximum of 12 months from the time of collection.
R. Compliance with the compliance procedures adopted by the Companies:
Data are retained for a maximum of 10 years from the time of their collection.
S. Compliance with legal obligations, in particular tax legislation:
Data are retained for a period of 10 years from the time of data collection.
T. Defence of rights in the course of judicial, administrative or out-of-court proceedings and in the context of disputes:
Data are retained for the entire duration of the litigation, until the expiry of the time limits for bringing and/or appealing actions.
U. Reminder and deadline services for vehicle inspection, servicing and brake fluid:
Data are retained until the Data Subject objects to such processing activity. Objection may be exercised through the dedicated link at the bottom of each reminder e-mail.
V. IT resource management purposes:
Data are retained for the time strictly necessary to achieve the purpose in question and, in any case, no longer than the periods established by law.
The Data Subject may exercise the rights recognised to them by the GDPR at any time, in the manner described in the preceding paragraph 1). In particular:
The Data Subject also has the right to lodge a complaint with the supervisory authority, if they consider that a processing operation that concerns them infringes the GDPR and/or applicable personal data protection legislation. It should be noted that in Italy this Authority is the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), with its seat in Rome. Data Subjects not resident in Italy may lodge a complaint with the supervisory authority designated in their country of residence.
