Privacy Policy
Last updated:
1. Data Controller
For the purposes of the GDPR, the data controller responsible for your personal data is:
Company Name: [Insert Company Name]
Address: [Insert Physical Address]
Email: [Insert Support/Privacy Email]
Data Protection Officer (DPO) / Privacy Contact: [Insert Name/Email if applicable, or state "Our Privacy Team can be reached at [Email]"]
2. Personal Data We Collect & Our Legal Basis
Under the GDPR, we must have a valid legal basis to process your personal data. We collect and process the following categories of data:
Category of Personal Data | Why We Collect It (Purpose) | Our Legal Basis (GDPR Art. 6) |
Identity & Contact Data (Name, email, phone number, address) | To create your account, manage bookings, and communicate updates. | Performance of a Contract: Necessary to fulfill your car rental booking. |
Driver Verification Data (Driver's license details, ID/Passport) | To verify your eligibility to drive and prevent fraud. | Legal Obligation / Legitimate Interest: To comply with local road laws and protect our fleet. |
Financial & Payment Data (Credit/debit card details) | To process rental payments, deposits, and security holds. | Performance of a Contract: Necessary to process payments for your rental. |
Technical & Usage Data (IP address, browser type, cookies) | To monitor website performance, secure our platform, and analyze traffic. | Consent / Legitimate Interest: Consent for non-essential cookies; Legitimate Interest for security/essential cookies. |
3. How Long We Keep Your Data (Data Retention)
We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.
Booking and Rental Records: Retained for [e.g., 5 to 7 years] after the end of the contract to comply with tax, financial, and legal liabilities.
Driver’s License & Identity Verification Logs: Deleted or heavily redacted [e.g., within 30 days] of rental completion, unless required for active insurance claims or legal disputes.
Marketing Data: Retained until you withdraw your consent (unsubscribe).
4. Recipients of Your Data (Who We Share It With)
We do not sell your personal data. To provide our services, we may share your information with trusted third-party service providers (Data Processors):
Payment Processors: To securely handle payment transactions (e.g., Stripe, PayPal).
Identity Verification Services: To confirm your driver's license validity.
IT & Cloud Hosting Providers: To host our booking engine and database.
Authorities: Where required by law, court order, or to report traffic/toll violations during your rental.
All our third-party processors are bound by strict Data Processing Agreements (DPAs) to ensure your data is kept secure and used only under our instructions.
5. International Data Transfers
If we transfer your personal data outside of the European Economic Area (EEA), we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
We transfer your data to countries that have been deemed to provide an adequate level of protection by the European Commission.
We use specific Standard Contractual Clauses (SCCs) approved by the European Commission which give personal data the same protection it has in Europe.
6. Your Rights Under the GDPR
As an EU/EEA resident, you have the following rights regarding your personal data:
Right of Access (Art. 15): You can request a copy of the personal data we hold about you.
Right to Rectification (Art. 16): You can request that we correct inaccurate or incomplete data.
Right to Erasure / "Right to be Forgotten" (Art. 17): You can request that we delete your data, subject to legal retention limits (e.g., tax laws).
Right to Restrict Processing (Art. 18): You can ask us to temporarily suspend processing your data.
Right to Data Portability (Art. 20): You can request your data in a structured, commonly used, machine-readable format.
Right to Object (Art. 21): You can object to us processing your data based on "legitimate interests" or for direct marketing.
Right to Withdraw Consent (Art. 7(3)): If we rely on your consent to process data (like cookies or newsletters), you can withdraw it at any time.
How to Exercise Your Rights
To exercise any of these rights, please email us at [Insert Email Address]. We will respond to your request within one month of receipt. We may request proof of identity to protect your security.
7. Right to Lodge a Complaint
If you believe that our processing of your personal data infringes on the GDPR, you have the right to lodge a complaint with a supervisory authority in your member state.
