PRIVACY NOTICE

Notice Last Updated: April 2020

Welcome to the Privacy Notice of those Budget Australia and Budget New Zealand companies within the Avis Budget Group, Inc. (we refer to these companies as "ABG," "we," "us," or "our" in this Privacy Notice). A full list of these companies and contact details is included below: see Data Controllers & Contact Details By Country

Please take the time to read this Privacy Notice as it is important for you to know how we collect and use your personal information. By "personal information" we mean all information that relates to a living individual and either identifies, or may be used to identify, that individual.

The nature of our business and our services to you may require us to share information with our independent licensees. This Privacy Notice does not apply to Budget locations that are owned and operated by an independent licensee not owned nor controlled by ABG or any ABG affiliate or subsidiary except where independent licensees use separate third parties from time to time. If you have any questions or concerns regarding the use of your personal information by any independent location, please contact us at DPO@abgroup.com.au.

We may change portions of this Privacy Notice from time to time, so be sure to check back. If we make a change that significantly affects your rights or, to the extent we are permitted to do so, significantly changes how we use your personal information, we will notify you by way of a prominent posting on our websites, e-mail and/or postal mail prior to the change becoming effective.

GETTING STARTED

ABG wants you to feel comfortable about giving us access to your personal information. Use this Privacy Notice to find out what happens to your personal information when you interact with ABG and what choices you have.

This Privacy Notice does not apply to our independent licensee locations. Please review the privacy notices of our independent licensees for information on how they use personal information that you provide to them.

This Privacy Notice covers the personal information the ABG companies collect, use and disclose through your use of our products and services either online or offline.

ABG needs to collect personal information from you to rent a vehicle or provide our other services. We collect personal information when you give it to us, such as by telephone, fax, postal mail, email, at the counter, upon completion of an application or enrollment form or through your use of one of ABG's website or mobile Apps or the use of our products and services.

Please be aware that, in certain circumstances, where you do not provide personal information which is required by us, we will not be able to provide the products and services under our contract with you or may not be able to comply with a legal obligation on us. For example, when renting a vehicle with us we will require information such as your name, address, payment information and driver's licence. If you fail to provide this information to us we will be unable to rent a vehicle to you. You will be made aware if this situation arises and what the consequences of not providing the personal information will be.

Sometimes, we will combine the personal information we receive from you with other information we received from other sources so we can provide you a more customised and hassle-free experience or provide you with offers that are relevant to you. This information may include your name, contact information, travel itinerary, booking request and other information that is relevant to your booking. These third parties include:

• Travel agents or a third-party booking service that you used to make your reservation or seek information about your travel needs;
• Your employer or association if you are using a corporate / association account;
• Our licensees and our affiliates, in order to create a Wizard account or if you are making a booking in one location served by our affiliates or licensees for rental services in another location served by us; and
• Police and other law enforcement agencies if you are involved in an accident during your rental, or suffer any loss, damage or theft of the vehicle, or if you incur any speeding, parking, toll or other traffic-related fines or commit any traffic offences during your rental.

The purposes for which we use this information is set out in further detail in the rest of this Privacy Notice. There are a number of bases in data protection law that permit Us to use your personal information for these purposes. These are: (1) that you have provided your consent to us using your personal information for that purpose (e.g. where you have given us your consent to send you electronic marketing); (2) that we need to use that personal information in order to fulfil our contract to provide products or services to you (e.g. using your information for vehicle rentals or join our frequent renter programme; (3) that the processing is necessary for the purposes of our legitimate interests, provided we have balanced these against your rights and interests; and (4) where we need to comply with a legal obligation (e.g. responding to government or law enforcement information requests).

These legitimate interests are: (a) to ensure effective administration and management of your relationship with us, including any rentals with us; (b) to understand how our customers use our services and to manage our vehicle fleet; (c) to carry out research and analysis on what services or products customers want or how they would like us to improve our services and products; (d) to understand how our customers use our websites and Apps and identify any issues in how the websites and Apps are used and how we can improve the customers usage experience; (e) to tell our customers about the various products and services we can offer; (f) understand and respond to customer feedback; (g) to better tailor and personalise the promotions and benefits that we or others offer to our customers; (h) to prevent, detect, or investigate unauthorised use of our vehicles and systems and ensure we comply with law and our policies; and (i) manage any disputes and accidents and take legal or other professional advice.

We will collect technical information about your devices when you use our website and App where permitted. To learn about our online data collection, go to the Online Data section.

RENTING A VEHICLE

When you make a reservation, rent a vehicle or join one of our programs such as a corporate programme or our preferred renter programme, we collect information to provide you with our great services (for example, renting a vehicle, including performing the vehicle rental contract as set out in our General Conditions of Rental, Location Specific Conditions and Rental Agreement, providing any requested optional extras, taking payment, pre-authorisations and security deposits and providing discounts and offers or other benefits) and for our legitimate business interests (for example research and development of new products and services, undertaking fraud and security checks and enforcing our legal rights). The information we collect includes:

• name;
• email address (if you are booking online or wish to receive e-receipts);
• home address (for licence validation and billing);
• employer details and business address (if you are a member of a corporate program);
• telephone numbers at which we can reach you;
• date of birth (for licence validation and legal requirements);
• gender (for licence validation);
• payment information such as your credit or debit card details (security code is obtained for transaction only – we do not keep it);
• tax number (if specifically requested);
• information from driver's licence and/or other government issued identification, including if you are an additional driver for the specific rental (for licence validation and legal requirements);
• information from another form of identification documentation such as passport or national identity card if your driver's licence does not include a photo, is not in English or is not recognisable as you and/or proof of address such as a utility bill (for security and anti-fraud purposes). The information we collect and retain will only include your photo ID where you are informed of this;
• special discount codes, partner member numbers, association memberships, corporate rewards programs (if you request discounts, special privileges and loyalty programs);
• special requests and preferences, including:
  • your preferences regarding optional extras such as damage waivers and other protections;
  • where a delivery or collection service is available, the address where we will drop off or pick-up the vehicle and any optional extras you requested; and
• other information that may be required to rent you a vehicle and/or provide you with services.

Some vehicles come equipped with a global positioning system (GPS) or similar type tracking device that may also collect information about the vehicle. To learn about vehicle data we collect, scroll down to read about Vehicle Data.

If you have an accident, or suffer any loss, theft or damage to the vehicle during your rental or suffer any mechanical failure, we will collect information regarding such incident including your report of the incident and any police or other third party report including details of those involved, together with the nature of any personal injuries and/or damage to the vehicle and optional extras. We will use this information to perform our contract with you (for example, the vehicle rental agreement and/or the terms of any optional extra like coverages); for our legitimate business interests (for example, in recovering the costs of any loss or damage caused to the vehicle); for complying with any legal obligation on us (for example, making any required notification of the incident to appropriate authorities); and establishing, exercising or defending legal claims arising as a result of such incident.

During your rental we will collect where and when you rented the vehicle, where and when you returned the vehicle, coverage preferences, fuel consumption, mileage, accident history and other information related to the vehicle and your use of it. This information is required in order to provide you with the services you requested under the rental contract or for our legitimate business interests (for example to monitor the usage of our vehicle fleet).

In addition to the purposes listed above, we use this information to better understand our customers and provide you with relevant offers.

We will also collect information about any speeding, parking, toll or other traffic-related fines that you incur or any traffic offences that you commit during your rental where these are provided to us by any law enforcement agency. We will use this information to deal with such fine or offence in accordance with the terms of your vehicle rental agreement with us.

Where you inform us that you have a medical disability that requires an adapted vehicle or other driver aid we will use that information in order to provide you with the service you requested and where you have given your explicit consent to us using that information.

When you call us (from any phone), we may record or monitor the call for quality control, training or similar purposes.

We will only use this information for the specific reason for which it is provided. If you believe that one of your contacts has provided us with your personal information and you would like to request that it be removed from our database, please contact our customer service at the details set out in the Data Controllers & Contact Details By Country section below.

FREQUENT RENTER PROGRAMMES

If you decide to join our frequent renter programme such as Budget Fastbreak we will collect and retain your name, contact details, drivers licence details, and date of birth to create an account for you in accordance with the terms and conditions of the programme.

We will use this information, along with information relating to your historic and future rentals, to allow you to take the benefits of membership of the programme, including fast-track service at our rental counters, the ability to self-service elements of the rental through our App, and to provide you with further benefits to which you are entitled under the programme such as free upgrades and free rentals.

We also use this information to tailor the communications we may send to you and/or the promotions we may offer to you as a member of the programme from time to time.

We will also use this information for our internal analysis of how our customers use our services and to improve how we provide our services.

COVERAGE PRODUCTS

If you have requested any of the products that we offer during your rental, we will pass your personal information to the insurer that is underwriting that product in connection with you entering into a contract with that insurer for that product. The name of the insurer will be made available to you when you are requesting the relevant product.

In the event that you make any claim under one of these products, your personal information relating to the claim will be provided to the insurer and any appointed claims handler. We do this to fulfil the terms of our agreement with you and to establish, exercise or defend any associated legal claims.

The use of your personal information by that insurer will be subject to the terms of that insurer's privacy notice.

VEHICLE DATA

Some vehicles you rent from ABG have been manufactured or equipped with on-board devices so as to be connected to the internet (connected car) which allow us to send commands to and receive certain information from the vehicle, including geolocation data from a global positioning system (GPS). If you rent a connected car from us your personal information will be processed in accordance with this Notice and any applicable Connected Cars Privacy Addendum included in the General Conditions of Rental (or such other notice regarding connected cars as we may provide to you in the future).

PHOTOS & VIDEO

ABG rental locations may be equipped with video security surveillance systems as well as cameras that may record as our vehicles depart/enter our lots and these cameras may take images or photos of you, authorised drivers and passengers.

We may take an image or photo of you and scan your drivers licence, passport or other identity document to confirm information you provided ABG.

ONLINE DATA

When you download, visit and use our websites and/or Apps, ABG automatically collects technical information. This section tells you more about what technical information we collect and why we collect it.

IP Addresses & other information collected automatically: We may collect your IP address when you visit our websites to help us diagnose problems with our main computers, for system administration, to report aggregated information to our business partners, and to audit the use of our website. We do not normally link IP addresses to anything personally identifiable. In select circumstances, we may use IP addresses to help us identify you when we feel it is necessary to enforce compliance with our Website Terms and Conditions or to protect our service, site, users or others. We may also collect your browser type, Internet Service Provider (ISP), referring/exit pages, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system, date/time stamp, and/ or clickstream data to analyse trends in the aggregate and administer the site or to provide you with relevant offers.

Session Replay: When you visit our website, we will sometimes also record information about your browsing session on the site, including which pages you visited and any forms on the website that you completed. We review this information to identify any technical issues in the operation of our sites and to improve the user interface of our sites. We use a third party to help us with this service and this information will be passed to that third party for this purpose but this information is not disclosed to any other third party.

Cookies & other similar technologies: We may send cookies (pieces of programming) to your computer when you visit our websites at www.budget.co.nz or www.budget.com.au. Cookies can be stored on your shared drive or other storage device (persistent cookies) or in memory (session cookies). Cookies enable us to enhance the web offerings to you and to optimise your online experience. We may, in some circumstances, collect your personal information with our cookies or match them to your identity. Persistent cookies identify pages accessed and provide personalised features, for example, choosing which page you would like to make your start page. They are used to help us develop the design and layout of the web site, improve applications, measure their effectiveness and to understand your personal preferences. Session cookies are used for security purposes as part of our customer identification process. These cookies allow you to be recognised once you have logged in and provide you with the confidential access to your rental records. We may also allow third parties (such as Google Analytics) to collect statistical data from our sites using their persistent cookies.

Mobile Analytics: When you download and use our Apps, we use mobile analytics software to help us better understand the functionality of our App on your mobile device. Our analytics may record how often you use the App, how you use the App, aggregated usage, performance data and where you downloaded the App from. To read more about how we use information for research please see the Analytics section.

Mobile GPS and Push Notifications: If you let us, when you use our Apps we may collect location markers using the GPS in your device. Knowing approximately where you are helps the App provide you better service, such as finding the nearest rental location near you. This also helps us send you push notifications or other communications based on your location (for example, nearby special offers) and for providing certain services such as arrival and return notifications, providing information about vehicle location, available upgrades, etc. We will only share this information with our mapping provider for the purpose of providing you our services. To ensure you receive proper notifications, we will need to collect certain information about your device such as operating system and user identification information. If you change your mind about sharing your location or receiving push notifications from the App, adjust the settings of your mobile device to turn off transmission of geolocation data or to stop transmission of push notifications at any time. Just remember if you do turn these features off, you will not receive information tailored to your location or special locations-based offers.

ONLINE ADVERTISING

ABG uses third-parties to provide online or electronic ads on our behalf and on behalf of our partners. These third parties use data about your visits to our websites and Apps usage to send you customised ads that may be of interest to you. This information is collected using cookies, scripts, pixel tags, etags, web beacons and other similar technologies by ABG and our third-party advertising partners in accordance with our Cookie Policy. Our third-party advertising partners may be located overseas and process data in countries including Singapore and the United States of America.

MARKETING

ABG may share personal information with third parties (as detailed in the Information Sharing section) to help us with marketing and promotional projects, such as managing our social media pages, running contests, sweepstakes and other promotions, or sending marketing communications.

We will only use your personal information to send you marketing where you have given us your consent to receive marketing or we are otherwise permitted by applicable law to do so. This marketing will be sent to you either electronically or to your postal address.

Don't want to receive promotional and marketing post, emails and text messages from ABG and our partners? No problem! You can withdraw your consent to direct marketing or tell us you do not want to receive such marketing at any time. See the Your Choices section to find out how.

ANALYTICS

We use analytic software, such as Adobe Analytics, Google Analytics and others, to help us to better understand the functionality of our software on our websites and Apps on your device. These software tools record technical information including about your device together with usage information such as how often you use our website or App, which features you use or don't use in the website App or which pages you visit on the website, aggregated usage, performance data, where the App was downloaded from and information about your visit to the site, including details of some of the URL clickstream to, through and from our website. Further information about these tools is set out in our Cookie Policy.

Want to learn about all what happens when you visit our websites or use our Apps? Learn more under the Online Data section.

CHILDREN

ABG's websites, Apps and services are not for children under the age of 16. This includes any links to other websites that we provide for your convenience. We don't knowingly collect personal information from children for any reason. If you think ABG has received personal information of your child or another minor, please contact our Data Protection Officer at the address set out in the Data Controllers & Contact Details By Country section.

INFORMATION SHARING

ABG may use and share your personal information and vehicle data to affiliated and non-affiliated organisations as follows:

We may also transfer or assign your personal information to third parties as a result of, or in connection with a sale, merger, consolidation, change in control, transfer of assets, bankruptcy, reorganisation, or liquidation. Or if we are involved in defending a legal claim, information about you that is relevant to such claim may be disclosed to third parties as a result of, or in connection with, associated legal proceedings.

We may, in accordance with the Marketing section, share your information with business and promotional partners (where you have provided your consent to such information sharing) in order to send you information about products and services you may like. If you decide you no longer want to receive such promotional and marketing messages, please read the Your Choices section to find out how you can opt-out.

YOUR CHOICES

If you want to opt out of receiving promotional and marketing emails, text messages, post and other forms of communications from ABG or our promotional partners in relation to which you might receive in accordance with the Marketing section, you can best opt out by using one of the following ways:

• Log into your account and update your profile.
• Click "unsubscribe" at the bottom of an email we sent you.
• Go to our Data Controllers & Contact Details By Country section to email the customer service representative suited for you.

To stop receiving promotional text messages:

If you do opt out of receiving promotional and marketing messages, we can still contact you regarding our business relationship with you, such as account status and activity updates, survey requests in respect of products and services we have provided to you after you rent from us, reservation confirmations or respond to your inquiries or complaints, and similar communications.

Want to close your account, stop doing business with ABG, or otherwise opt out of ABG collecting, using or disclosing your personal information? We will be sorry to see you go. Please contact our customer service representatives in accordance with the Data Controllers & Contact Details By Country section.

Please also see your rights set out in Your Privacy Rights section.

SAFEGUARDS

The security of your personal information is important to us. We take reasonable steps to make sure your information is protected from unauthorised use, access, disclosure, alteration, destruction or loss. For financial or payment information, we use firewalls and Transport Layer Security (TLS) encryption. We take security extremely seriously but as no system is 100% secure, we can't completely guarantee the protection of your personal information, any more than any other organisation can.

We do not ask for financial or payment information, such as your credit card number, passcode, account number or pin number, in an e-mail, text or any other communication that we send to you. Please always check that any website on which you are asked for financial or payment information in relation to our rentals or services is operated by ABG or its affiliates. If you do receive a suspicious request, do not provide your information and report it by contacting one our customer service representatives as set out in the Data Controllers & Contact Details By Country section.

You are responsible for keeping your account passcode, membership numbers and pin numbers safe and secure. Don't share those with anyone. If there is an unauthorised use or any other breach of security involving your information, you must notify us at the customer service contact information below as soon as possible.

INFORMATION RETENTION

ABG keeps your personal information for no longer than is reasonably necessary or required by law. How long we keep it depends very much on the type of information and purpose.

The criteria we use to determine the retention period for certain categories of data is as follows:

• the length of time that you are a member of our frequent renter programme or any other loyalty scheme that we operate or a member of any corporate programme;
• how frequently you rent with us or when you most recent rental occurred;
• whether there are contractual or legal obligations that exist that require us to retain the data for period of time;
• whether there is any ongoing legal claim that relates to any rental you have made with us, or that is otherwise related to your relationship with us;
• whether any applicable law, statute, or regulation allows for a specific retention period;
• whether the personal information is considered to be a special category of personal information, in which case a shorter retention period generally would be applied; and
• what the expectation for retention was at the time the data was provided to us.

INTERNATIONAL TRANSFERS

Rentals

As we offer the ability to rent vehicles and benefit from our services in many locations globally, we will transfer your personal information to our affiliates, independent licensees and travel agents in these locations for the purposes of fulfilling your rental request and/or entering into a rental agreement or providing you with services and other offers. The exact location of where your personal information will be transferred depends on the location of your rental. A list of these locations on our website at:

https://www.budget.com.au/en/locations/au

https://www.budget.co.nz/en/locations/new-zealand

Many of the countries to which your personal information may be transferred for these purposes that are located outside Australia or New Zealand do not benefit from an adequacy decision issued by the EU Commission regarding protection afforded to personal information in that country. Details of these specific countries can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en.

These transfers are made either as they are necessary for the performance of a contract to which you will be a party, or for pre-contractual measures. Alternatively, adequacy of data protection is ensured by standard data protection clauses that we have in place with the relevant recipient. A copy of these standard data protection clauses may be requested via our Data Protection Officer at the address set out in the Data Controllers & Contact Details.

Business operations

In addition, the information we collect from you may be transferred to, and stored by, IT vendors who operate on our behalf. In particular, these include our booking engine hosting provider that is located in the United States. We also transfer information to a number of providers of business application – such as CRM and marketing applications – as well marketing service providers. These providers are primarily located in the United States.

Adequacy of data protection is instead ensured by standard data protection clauses we have in place with that third party. A copy may be requested via our Data Protection Officer at the address set out in the Data Controllers & Contact Details.

Given the global nature of our business, we also transfer information within the group companies of Avis Budget Group, Inc as for certain activities the group uses shared IT functions. Transfers from within Australia or New Zealand for these purposes are primarily made to the United States, although transfers may be made to other countries as well. Adequacy of data protection is instead ensured by standard data protection clauses we have in place with the recipient. A copy may be requested via our Data Protection Officer at the address set out in the Data Controllers & Contact Details.

YOUR PRIVACY RIGHTS

You may have – in accordance with applicable data protection laws – the following rights when it comes to our handling of your personal information:

• Right of access – you may have the right to request a copy of the personal information we have about you and to request supporting information explaining how the personal information is used.
• Right of rectification– you may have the right to request that we rectify inaccurate personal information about you.
• Right to withdraw consent – where we process your personal information based on consent (including direct marketing consents), you have the right to withdraw consent at any time. However, this will not affect the lawfulness of the processing based on consent before its withdrawal. Furthermore, even in case of a withdrawal we may continue to use your personal information as permitted or required by law.

Right to complain:

If you feel that we have not respected your privacy or that we have conducted ourselves inconsistently with this Privacy Notice, please contact our Data Protection Officer in any of the ways set out in the Data Controllers and Contact Details by Country section and advise us as soon as possible. We will investigate your queries and privacy complaints within a reasonable period of time depending on the complexity of the complaint.

It would assist us to respond to your complaint promptly if it is made in writing. Please detail information relevant to your complaint.

WE WILL NOTIFY YOU OF THE OUTCOME OF OUR INVESTIGATION.

DATA CONTROLLERS AND CONTACT DETAILS BY COUNTRY

If you are making a rental or visiting a local country version of our websites or mobile sites in the following countries, the data controller is listed in the table below.

You can also contact our Data Protection Officer in respect of any issues or questions you have regarding our processing of your personal information. They act as the Data Protection Officer in respect of all of the data controllers listed below and can be contacted at:

Email:dpo@abgroup.com.au

Postal Address: Data Privacy Officer, Avis Budget Group, 197-201 Coward Street, Mascot, NSW 2020

Telephone: +61 (2) 9353 9033

INDEPENDENT LOCATIONS

Did you know that many of our locations are independently owned and operated? Each of these locations collects, uses and discloses personal information for its own purposes. ABG does not control the independent licensee's or franchisee's use of this personal information. Please ask to review the privacy notice for that location.

When you are dealing with an independent location, the licensee or franchisee is responsible for collecting and processing payment and may engage in its own email campaigns and other forms of marketing to you. ABG is not responsible for the compliance of the independent location with privacy laws. However, if you believe the independent location is violating privacy laws, you may report this to ABG’s Data Protection Officer at DPO@abgroup.com.au.

KEY CONTACTS

Want to talk to us? Check the list below to find out the best way to reach us. When you contact us, we may take steps to verify your identity for security purposes.