Privacy policy

Who we are

The data controller is the rental company named in the footer and on the About us page. For privacy questions use the email on the Contact page.

What data we collect

When you book: name, email, mobile number, driver age, flight number if you give it, and your booking details.

At online check-in or pickup: driving licence number and expiry, ID or passport number, address, details of additional drivers, and your signature on the contract.

When you pay online, card details go directly to the payment provider. We never see or store your full card number.

Why we use it and the legal basis

To make and carry out your rental (performance of a contract).

To meet legal obligations, including reporting every rental to the Greek tax authority (AADE Digital Customer Registry), invoicing and accounting (legal obligation).

To protect our vehicles and handle damage, fines and claims (legitimate interest).

To send offers by email, only if you opt in (consent). You can unsubscribe at any time.

Who we share it with

Our booking and fleet platform (Platflix), which processes data on our behalf under a data processing agreement.

Payment providers (Stripe, Viva, Revolut), our insurer in case of a claim, the AADE and other authorities when the law requires it, and messaging services you choose to use with us (WhatsApp, Viber).

We do not sell personal data.

Transfers outside the EU

Some providers may process data outside the European Economic Area. Where they do, we rely on adequacy decisions or the EU Standard Contractual Clauses.

How long we keep it

Booking and contract data for as long as tax and accounting law requires. Marketing consent until you withdraw it. Chat messages for a limited period after your rental.

Cookies and analytics

We use necessary cookies to run the booking form. Analytics and advertising cookies are only set after you accept them in the cookie banner.

Your rights

You can ask to access, correct or delete your data, restrict or object to its use, or receive it in a portable format. We reply within one month.

You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).

Security

Data is stored on servers in the EU with encrypted connections and access limited to authorised staff.

Changes to this policy

We may update this policy. The date at the top shows the latest version.