Privacy Policy & Data Protection

1. What data is processed?

When you search, book online or sign a rental contract with a partner company, the following categories of data may be processed:

• Identification data: first and last name, identity document number (ID / passport), driving licence, date of birth and nationality.
• Contact data: phone number, WhatsApp, email address and home address.
• Rental and vehicle data: plate number, rental period, mileage, fuel level, photo inspection records and the signature on the contract.
• Administrative data: fines issued during the rental period, damage reports and the company's internal notes about contracts.

2. Purpose and legal basis of processing

Data is processed only for these purposes:

• Concluding and performing the rental contract: identifying the driver, checking the driving licence and drawing up the contract.
• The company's legitimate interest: protecting the vehicle against fraudulent rental and documenting its condition at handover and return.
• Legal obligations: fiscal invoicing, record keeping and responding to requests from the authorities.
• Booking communication: booking confirmation, handover times and notices about fines during the rental period.

3. Technical security and access control

The platform applies technical and organisational measures to protect data:

• Traffic is protected by an encrypted HTTPS (TLS) connection.
• Each company can access only the data of its own customers and contracts. From other companies it sees only the anonymous reports of the shared risk registry (see below).
• Sensitive documents (licences, passports, fines) are stored in protected folders and are never published on the internet.
• Administrative access is protected by strong passwords, two-factor authentication and attempt limits.

4. Your rights

Under Law no. 124/2024 you have the right to:

• get confirmation of whether your data is processed and a copy of it;
• ask for inaccurate or incomplete data to be corrected;
• ask for erasure or restriction of processing when there is no longer a legal or contractual duty to keep the data;
• object to processing based on legitimate interest and ask for the data you provided to be transferred;
• complain to the Commissioner for the Right to Information and Personal Data Protection (IDP).

Send requests about the data of a contract first to the company you signed the contract with.

5. Shared customer risk registry

To prevent fraud and damage to vehicles, the rental companies on the platform share a limited risk registry:

• What is shared: only the risk status (blacklist or warning) with its category (vehicle damage, non-payment, late return, fraud or other), the number of late returns, vehicles not returned after the end date and the number of unpaid fines.
• What is not shared: name, phone, address, email, internal notes and the reason written by the company. The reporting company stays anonymous to the other companies.
• How the customer is found: only by the number of the identity document (ID/passport) or of the driving licence. In the registry these numbers are stored only in coded form (keyed hash), not as readable text.
• Legal basis and duration: the legitimate interest of the companies in preventing fraud. A blacklist or warning is shown only while the company that set it keeps it active; late returns and fines are shown for up to 3 years. Disputed fines are not shared.
• No automated decisions: the registry never refuses a customer. The company that sees a report decides itself after verifying the customer, and every lookup or confirmation is recorded in the activity log.
• Your rights: you may request information, the correction or removal of an inaccurate report and object to this processing. Contact the company you have a contract with or, if you do not know which company made the report, the platform administrator (contacts below). A report is removed or corrected as soon as the problem is solved or it proves inaccurate.

6. Loyalty program, private profile and referrals

When a rental company offers the points program and you activate your private profile, the following data is also processed:

• What is stored: your name, the email and/or phone number you sign in with, your password only in encoded form (hash, not readable), your points history, vouchers and referrals (who invited you and whom you invited), separately for each company.
• How it is created and linked: when the company has the program on, your private profile is prepared automatically with your first rental, with a random password nobody knows, so that points count from the start. You take it over with the QR on your contract: the first time you verify with the last 4 characters of your ID or passport and choose your password. If the same email or phone already has a profile at another company, the card is linked only after you confirm it yourself. Companies do not see your points, rewards or data at other companies.
• Referral link: when you open a customer's personal link, a signed technical cookie ("fq_ref") with the company and the customer who invited you is kept for 30 days, only to give that customer the referral points. It is not used for advertising or tracking. The customer who invited you only sees your shortened name (e.g. "Arben H.").
• Legal basis: your voluntary participation in the program (activating the profile) and the legitimate interest in preventing abuse. For security, sign-in attempts are kept only as encoded values and deleted after 30 days.
• How long: points and history are kept as long as the company keeps your customer card; points may expire under the company's rules. When the company deletes your card, your points, vouchers and referrals at that company are deleted too; the private profile is deleted when it is no longer linked to any company.
• Your rights: in your profile you see every points movement, change your details and password and can sign out on all devices. To have your data deleted, contact the rental company or the platform administrator (contacts below).
• Notices: the rental confirmation email may include the points of the rental and the profile link; 14 days before your points expire you may receive a reminder email. These are sent only when the company has customer notifications on.

7. Privacy contact

For questions or requests about personal data you can contact the company you have a contract with or the platform's technical administrator: