Six grounds for lawful data processing
Article 6.1 of the GDPR defines the lawful grounds for data processing as follows:
CitiRental | the hire firm
The Data Subject | you the hirer
Every rental essentially consists of the preparation and inputting of data (the contract of hire) – CitiRental will rent you a vehicle in exchange for rental fee, subject to the terms & conditions of hire. CitiRental accumulates data before during and after the rental process and will retain the data as they deem necessary for legislative reasons.
 Consent of the data subject. Retention of the data is an integral part of the rental process. CitiRental consent to hiring you a vehicle. Reciprocally you consent to CitiRental retaining and maintaining that data and part of the agreement between CitiRental (the hire firm) and you the customer
 Processing is necessary for the performance of a contract with the data subject (the hirer) or to take steps to enter a contract of hire
 Processing is necessary for the performance of a contract with the data subject or to take steps to enter a contract
 Processing is necessary for compliance with a various legal obligation
 Processing is necessary to protect the vital interests of a data subject or additional drivers.
 Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights, or freedoms of the data subject. Note that this condition is not available to processing carried out by public authorities in the performance of their tasks.