Supplemental Privacy Notice — European Users

Legal Bases for Processing

Under the GDPR, we are required to identify a legal basis for each type of processing we carry out. The legal bases we rely on are:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide you with the services you have requested — creating your account, processing rental bookings, handling payments, coordinating delivery, and sending order-related communications.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, such as retaining transaction records for tax and accounting purposes.
• Legitimate interests (Art. 6(1)(f)): Processing carried out for our legitimate business interests, provided those interests are not overridden by your rights. This includes fraud prevention, platform security, analytics, and service improvement. You have the right to object to processing based on legitimate interests.
• Consent (Art. 6(1)(a)): Processing based on your freely given, specific, and informed consent — for example, non-essential cookies or marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Your Rights Under the GDPR

In addition to the rights described in our main Privacy Policy, EEA/UK/Swiss users have the following rights under the GDPR:

• Right of access (Art. 15): Obtain confirmation of whether we process your data and receive a copy of it, along with information about the processing.
• Right to rectification (Art. 16): Request correction of inaccurate or completion of incomplete personal data without undue delay.
• Right to erasure (Art. 17): Request deletion of your personal data where it is no longer necessary, where you withdraw consent, or where you object and we have no overriding legitimate grounds.
• Right to restriction of processing (Art. 18): Request that we limit processing of your data in certain circumstances, for example while a rectification request is pending.
• Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format, and transmit it to another controller where technically feasible.
• Right to object (Art. 21): Object at any time to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Rights related to automated decision-making (Art. 22): You have the right not to be subject to decisions based solely on automated processing that significantly affect you, unless necessary for a contract or based on explicit consent.

To exercise any of these rights, contact us at prextige.executives@gmail.com with the subject line "GDPR Request – [Your Name]". We will respond within 30 days (extendable by two months for complex requests, with notice to you).

You also have the right to lodge a complaint with your local supervisory authority. If you are in the EEA, you can find the relevant authority at edpb.europa.eu. If you are in the UK, the authority is the Information Commissioner's Office (ICO) at ico.org.uk.

International Data Transfers

Prextige is operated from Colombia, which is not currently recognized by the European Commission as providing an adequate level of data protection equivalent to the EEA. When your personal data is transferred to or processed in Colombia or other countries outside the EEA/UK, we rely on appropriate safeguards as required by Chapter V of the GDPR, which may include Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO, or other lawful transfer mechanisms. You may request further information about the specific safeguards applied to your data transfer by contacting us at prextige.executives@gmail.com.

Retention Periods

We apply the retention periods described in our main Privacy Policy. For EEA/UK/Swiss users, we do not retain personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is required by applicable EU or member state law.

Contact

For GDPR-related inquiries, contact us at prextige.executives@gmail.com with the subject line "GDPR Request".