Privacy Policy
This policy explains what personal data GustoCar collects when you search for or book a rental car through this site, how that data is used, how long it's kept, and the rights you have over it under the EU General Data Protection Regulation (GDPR).
What Data We Collect
When you search availability, request a price quote, or complete a booking, we collect:
- Identity & contact data — full name, email address, phone number.
- Driving licence data — licence number, issuing country, and expiry date, plus a photo/scan of the licence where submitted at booking or pickup, used to confirm you're eligible to drive the vehicle you've booked.
- Booking data — rental dates, pickup/drop-off location, vehicle selected, and price/payment records.
- Payment data — processed by our payment provider; we do not store full card numbers on our own systems.
- Technical data — IP address, browser/device type, and on-site analytics events, collected to operate and secure the site.
How We Use Your Data
- To create and manage your booking, including availability checks and price quotes.
- To verify your eligibility to drive the vehicle (licence, minimum age) at pickup.
- To process payments and deposits/excess holds.
- To contact you about your booking, including delivery/pickup logistics.
- To request a review after a completed rental (you can opt out of this contact at any time).
- To comply with legal, tax, and insurance obligations tied to the rental.
How Long We Keep It
Booking, driving-licence, and payment records are kept for as long as required to fulfil the rental and to meet our legal, tax, and insurance retention obligations, and are deleted or anonymized afterward. Data submitted for a quote or availability search that never becomes a booking is retained only for a limited period to support your follow-up enquiries before being deleted.
Your Rights
Under GDPR, you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request erasure of your data (“right to be forgotten”), subject to our legal retention obligations above.
- Object to or restrict certain processing (e.g. review-request contact).
- Request a portable copy of your data.
- Lodge a complaint with your national data protection authority.
To exercise any of these rights, contact our [Data Protection Officer contact].
Data Controller
The data controller for the purposes of this policy is [Company Legal Name] — see the Legal Information page for registration and contact details.
This is placeholder policy text — must be reviewed and approved by qualified legal counsel before publishing.