Privacy policy

1. Who is responsible

The controller of your personal data is Goldy Rent a Car, Irodotou 96, Nea Alikarnassos, 71408 Heraklion, Crete, Greece. For any question about your data, email info@goldyrentacar.gr or call +30 694 900 8675.

2. What data we collect

• When you search: pick-up and return points, dates and times, and the driver's age.
• When you book: first and last name, email, mobile phone, country of residence, flight number (optional), and the car, cover, extras and price you choose.
• When you pay: Stripe processes your card on its own secure page. We receive only the payment result, the amount and a transaction reference, never your full card number.
• At pick-up and during the rental: the details of the driving licence and passport or ID card of every driver, the signed rental agreement, the condition, fuel level and mileage of the car, and any accident, damage or fine reports.
• When you contact us: your messages by email, phone or WhatsApp.
• Technical data: your IP address, browser type and the pages you request, recorded by our hosting provider to keep the website secure.

We do not ask for sensitive data, such as health information. If you do not give us the booking details, we cannot take your booking.

3. Why we use it

• To show availability and prices, take your booking, take payment, provide the car and contact you about your rental. Legal basis: the contract with you, and the steps you ask for before it (Article 6(1)(b) GDPR).
• To issue invoices, keep our accounts and answer requests from the authorities, for example about traffic fines. Legal basis: our legal obligations (Article 6(1)(c) GDPR).
• To protect our cars and business: preventing fraud, handling damage and insurance claims, defending legal claims and keeping the website secure. Legal basis: our legitimate interests (Article 6(1)(f) GDPR).

We do not use your data for advertising, we do not send newsletters, and we do not make decisions about you by automated means alone.

4. Who we share it with

• Karpadu, the reservation platform that processes availability and bookings on our behalf.
• Stripe, the licensed payment provider that processes your payment. Stripe is responsible for your card data under its own privacy policy.
• Vercel Inc., which hosts this website on our behalf.
• Our accountant, insurers, lawyers, repair shops and road assistance partners, only when they need the data for your rental or a claim.
• Public authorities, such as the tax authority, the police or the courts, when the law requires it.
• WhatsApp (Meta), if you choose to message us on WhatsApp. Those messages are also covered by WhatsApp's own privacy policy.

We never sell or rent your personal data.

5. Transfers outside the EU

Our hosting provider, Vercel, is a US company, so some data may be processed outside the European Economic Area. Where this happens, it is protected by the safeguards the GDPR requires, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Searches are not linked to you and are not stored by us.
• Booking and rental records are kept for as long as Greek tax and accounting law requires, generally 5 years after the end of the year of the rental, and longer only while a claim, fine or dispute is still open.
• Messages are kept as long as we need them to answer you and handle your booking.
• Hosting logs are kept for a short time and then deleted automatically.

7. Cookies and browser storage

• We use one cookie, “lang”, which remembers the language you choose for one year. It is set only when you pick a language.
• During a booking, your search and driver details are kept in your browser tab (session storage) so they are not lost on the way to the payment page and back. They are deleted when you close the tab.
• We use no analytics, advertising or tracking cookies, and our fonts are served from our own website, so your visit is not reported to Google or any ad network.
• The Stripe payment page may use its own cookies, as described in Stripe's privacy policy.

Because we only use what the website needs to work, we do not show a cookie banner. If we ever add analytics, we will ask for your consent first and update this policy.

8. How we protect it

The website uses an encrypted connection (HTTPS), card payments are handled by a PCI DSS certified payment provider, and only the people who need your data for your rental can access it.

9. Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• have incorrect data corrected;
• have your data deleted, when we no longer need it or have no legal reason to keep it;
• restrict how we use your data, or object to uses based on our legitimate interests;
• receive the data you gave us in a common electronic format (data portability).

To use any of these rights, email info@goldyrentacar.gr. We reply within one month and may ask you to confirm your identity first. You also have the right to complain to the Hellenic Data Protection Authority (www.dpa.gr) or to the data protection authority of the EU country where you live.

10. Changes to this policy

We may update this policy when our services or the law change. The date of the latest version is shown at the top of this page.