This page explains which personal data we use when you ask for a car on the website, rent from us or visit the website, why we use it, how long we keep it and what your rights are.
Who we are
The controller of your data, the one who decides why and how it is used, is RentaCar, a car rental service in Budapest, with the website rentacar-hu-site.pages.dev.
We process data under the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and Hungarian Act CXII of 2011 on the right to informational self-determination and on freedom of information (Infotv.).
We use only the data each purpose below really needs.
Rental request on the website
What data
Your name, phone, the rental dates, the car you chose and the site language. If you add a comment or we agree on a delivery address, those too. The form asks only for your name and phone; you don't upload any documents.
Why
To call you back, check that the car is free and prepare the rental.
Legal basis
Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
How long
If the request does not become a rental, the name, phone, address and comment are deleted automatically after 12 months. If it does, the data moves to the rental (below).
The rental
What data
Your name, phone, email (if you give it), passport or ID card, residence permit (if you have one), driving licence, address, handover and return places, the rental itself, payments and the deposit. We ask for these documents in a messenger or at the office, not through the website.
Why
To sign and carry out the contract, hand over and take back the car, issue invoices and keep the accounts.
Legal basis
Performance of the contract (Article 6(1)(b) GDPR) and our legal obligations (Article 6(1)(c)), such as accounting, or giving the driver's details to the authorities when the law requires it, for example for a traffic fine.
How long
Contact details in our client list are deleted automatically 36 months after your last rental. The contract and invoices must be kept for 8 years under Hungarian Act C of 2000 on accounting (section 169).
Rental history
What data
Notes about past rentals, for example damage or unpaid amounts.
Why
To decide whether to rent to you again and to protect our cars.
Legal basis
Our legitimate interest in protecting our property (Article 6(1)(f) GDPR). You can object; see Your rights.
How long
The same as client details: 36 months after the last rental.
Messages and calls
What data
Your number or account name and what you write or tell us (phone, Instagram, Telegram or email).
Why
To answer you and agree on the rental.
Legal basis
Steps before a contract or its performance (Article 6(1)(b) GDPR); for other questions, our legitimate interest in answering you (Article 6(1)(f)).
How long
For as long as the conversation and the rental need. Messages also stay with the app's provider under its own rules.
Visiting the website
What data
IP address, browser and device type, the pages requested and the time. When you send the form, Cloudflare Turnstile uses technical data from your browser to check that a person is sending it.
Why
To deliver the pages and protect the site from attacks, bots and abuse. Our hosting provider, Cloudflare, does this.
Legal basis
Our legitimate interest in a secure, working website (Article 6(1)(f) GDPR).
How long
A short time, in Cloudflare's technical logs.
Map on the home page
What data
IP address, browser details and the address of the page the map is requested from.
Why
The map shows our office and where cars are handed over. It loads only when you press the button to show it: your browser then fetches the map from OpenStreetMap's servers (tile.openstreetmap.org). Until then, nothing is sent to them. Links to Google Maps open Google's site only if you follow them.
Legal basis
Our legitimate interest in showing where to pick up the car (Article 6(1)(f) GDPR); the map loads only when you click.
How long
We keep none of it. The OpenStreetMap Foundation keeps its server logs under its own privacy policy.
Who else receives the data
Our staff who handle requests and rentals. They work in an internal app with personal accounts, and each sees only what their job needs.
Cloudflare, Inc., as our processor, under a contract and on our instructions: it hosts the website, its server functions, the database and files, runs the Turnstile check on the request form, and provides the machine translation our staff use for the site's texts.
If you load the map: the OpenStreetMap Foundation (United Kingdom), which provides it.
Our accountant, the insurer in case of damage, and the authorities, such as the police, when the law requires it.
We don't sell data and don't make automated decisions about you.
Data outside the European Economic Area
Our provider Cloudflare is based in the United States, so data may be transferred there. It takes part in the EU-US Data Privacy Framework, which the European Commission recognises as giving adequate protection, and also uses the Commission's standard contractual clauses.
The OpenStreetMap Foundation is based in the United Kingdom. The European Commission has decided, in an adequacy decision, that the United Kingdom gives adequate protection.
Your rights
To find out what data we hold about you and get a copy.
To correct wrong or incomplete data.
To have your data deleted when we no longer need it and the law does not require us to keep it.
To ask us to restrict the use of your data, for example while we check a complaint.
To receive the data you gave us in a format you can pass on to someone else.
To object to uses based on our legitimate interest.
To withdraw your consent to cookies at any time, under Cookie settings at the bottom of the page. What was done before stays lawful.
Write to us at rentacarbud@gmail.com or call +36 70 302 5577. We reply within one month; if the request is complex, this can be extended by two more months, and we will let you know. So that we don't give your data to someone else, we may ask you to confirm it's you, for example by calling from the number in the request.
If you think we don't respect your rights, you can complain to the Hungarian data protection authority, the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH): 1055 Budapest, Falk Miksa utca 9–11., postal address: 1363 Budapest, Pf. 9., +36 1 391 1400, ugyfelszolgalat@naih.hu, naih.hu. You can also go to court, including the regional court (törvényszék) where you live or stay. If you live or work in another EU country, you can also complain to the authority there.
Cookies
Which cookies we use and how to change your choice: Cookie policy.
How we protect the data
The site opens only over an encrypted connection (HTTPS). Only our staff get into the internal app, with personal accounts, and each sees only what their job needs. We keep a record of changes.
Minors
We rent cars only to adults, from the age given in the rental terms, and the site is not aimed at children. We do not knowingly collect data from minors.
Changes
We update this policy when the data we use or the services we work with change; the date at the top shows the current version. The policy is published in Hungarian, Russian, Ukrainian and English. If the versions differ, the Hungarian one prevails.
