This Privacy Policy explains what personal data we collect, why we use it, who we may share it with and what rights you have when you visit europecar.gr, contact us or use our vehicle rental services.

1 Data controller

The controller responsible for the processing of personal data is Europe Rent a Car.

• Main office: 2 Ouranou Street, 714 14 Gazi, Heraklion, Crete, Greece
• Branch office: Ammoudi Lygarias, 715 00 Heraklion, Crete, Greece
• Email: info@europecar.gr
• Telephone: +30 2810 311 712
• Customer service: +30 6948 836 983
• Website: https://europecar.gr/

For any question about this policy or the processing of your personal data, contact us at info@europecar.gr.

2 Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data.

Booking and contact details

• Name, email address, telephone number and country of residence.
• Pick-up and return dates, times and locations, vehicle category, flight number and special requests.
• The content of messages sent through forms, email, telephone, WhatsApp or Viber.

Driver and rental details

• Date of birth and driver age group.
• Identity card or passport and driving licence details, including details of authorised additional drivers.
• Rental agreement, optional services, charges, receipts and invoices.
• Information relating to an accident, damage, traffic offence, fine, loss or theft of a vehicle or equipment.

Website technical data

• IP address, device and browser type, operating system, access date and time, pages visited and technical logs.
• Information collected through essential cookies and, only with consent where required, measurement cookies or other optional technologies.

3 How we obtain personal data

• Directly from you when you make a booking, submit a form, contact us, or collect or return a vehicle.
• From a person, company, travel agent or partner lawfully making a booking on your behalf.
• From public authorities, insurers, involved parties or witnesses following an accident, offence, damage or other incident.
• Automatically through the website and related technologies, in accordance with your consent choices.

4 Purposes and lawful bases

5 Cookies and measurement services

The website uses essential cookies for functions such as security, navigation, storing preferences and operating the booking process. These cookies do not require consent where they are strictly necessary to provide a service you request.

If Google Analytics 4 or another measurement service is enabled, related non-essential cookies or identifiers are activated only in accordance with the choices made through the consent tool. The information may include usage data, approximate location, device information and session information. We do not intentionally send analytics providers details such as your name, email address, telephone number or driving licence number.

You can accept, reject or withdraw consent through Cookie Settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6 Recipients of personal data

We disclose personal data only where necessary and subject to appropriate contractual and organisational safeguards. Recipients may include hosting, IT support, booking software, email, communications and cybersecurity providers; accountants and invoicing providers; banks or payment providers where relevant; insurers, roadside assistance, experts and repairers; competent public authorities; and lawyers, courts or collection providers. Google or other technology providers receive data only for services that are actually enabled and in accordance with the user’s consent choices.

We do not sell personal data.

7 International transfers

Some technology providers may process data outside the European Economic Area. Where this occurs, transfers rely on a European Commission adequacy decision, the EU–US Data Privacy Framework for certified organisations, Standard Contractual Clauses or another lawful GDPR transfer mechanism, together with supplementary measures where required.

8 Retention

We keep personal data only for as long as necessary for the purpose for which it was collected and for as long as applicable law requires. Booking and contact records are retained for service delivery and a reasonable period for documenting communications. Rental contracts, invoices and accounting or tax records are retained for the statutory period. Accident, damage, fine and claim records are retained until the matter is resolved and relevant limitation periods expire. Technical logs and analytics data are retained according to the security and retention settings of the relevant system.

When data is no longer required, it is securely deleted or anonymised.

9 Data security

We use appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access, disclosure or destruction. Access is limited to people who need it for their work and who are bound by confidentiality obligations.

10 Your rights

• Access your data and receive a copy.
• Correct inaccurate data or complete incomplete data.
• Request erasure where the legal conditions apply.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Receive data you provided in a portable format where processing is automated and based on consent or contract.
• Withdraw consent at any time without affecting earlier lawful processing.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where applicable.

To exercise a right, email info@europecar.gr. We may request additional information to verify your identity securely and will respond within the time limits set by the GDPR.

You may also lodge a complaint with the Hellenic Data Protection Authority, 1–3 Kifisias Avenue, 115 23 Athens, Greece, www.dpa.gr.

11 Other people and children

If you provide details of an additional driver or another person, you must be entitled to do so and inform that person about this policy. Vehicle rental services are not directed at children. We do not knowingly collect children’s data unless it is strictly necessary for a specific lawful service and is provided by a parent or guardian.

12 Changes to this policy

We may update this Privacy Policy when our services, systems or the legal framework change. The current version is always published on the website with its last-updated date.