This policy explains how S.C. GLOBAL REFERENCE SRL, the operator of the www.car-rentals.ro website, processes your personal data when you use the website, submit a booking, check or cancel a booking, or write to us through the contact and support forms, in accordance with Regulation (EU) 2016/679 (GDPR) and the applicable Romanian legislation.
1. Who the data controller is
The controller of the data processed through this website is S.C. GLOBAL REFERENCE SRL, tax ID (CUI) 37309820, Trade Register no. J40/4430/2017, e-mail office@globalreference.ro (hereinafter “we”). We have not appointed a data protection officer (DPO); for any question about your data, write to us at the e-mail address above.
The rental company that takes the booking and concludes the rental contract with you (the Lessor, as defined in our Terms and Conditions) processes the data it receives from us and the data you give it at pick-up as an independent controller, under its own privacy policy (see section 5).
2. Definitions
- Personal data – any information relating to an identified or identifiable natural person (for example a name, an e-mail address or a telephone number).
- Processing – any operation performed on data, such as collecting, recording, storing, consulting, transmitting or erasing it.
- Controller – the person who determines the purposes and means of the processing.
- Processor – a provider that processes data on behalf of the controller (for example the hosting provider).
3. What data we process
3.1. When you submit a booking: the main driver’s first and last name, e-mail address, mobile phone number (with the country code), country, flight number (optional) and your notes (optional); the booking details: pick-up and return locations, dates and times, the car chosen, the protection and optional extras, the drivers’ age (when you enter it, to calculate the price), the total price, the deposit and excess communicated by the Lessor, the website language, the booking number and its status (confirmed, on request, cancelled); the time at which you accepted the Terms and Conditions and the versions of the documents shown.
3.2. Source of the visit (attribution): without your consent to cookies, we record only the page of the website on which you arrived. If you accepted analytics or marketing cookies, we also record the source of the visit with the booking (UTM campaign parameters, landing page, the domain of the website you came from, language); advertising click identifiers (for example gclid, msclkid, fbclid) only if you also accepted marketing cookies.
3.3. When you check or cancel a booking: the booking number and the e-mail address, used to identify you; when you cancel, also the reason you write, kept with the booking.
3.4. When you write to us through the contact or support form: first and last name, e-mail address, telephone number, type of request, your message, the language and the page from which you sent it.
3.5. Technical data: we do not keep your IP address with bookings or messages. The IP address is used only temporarily (at most one hour) to limit the number of requests and prevent abuse. For security purposes, the hosting server may keep standard technical logs (IP address, date, page accessed, browser type), only as long as they are needed for the security of the website and for diagnosing technical problems, after which the hosting provider deletes them automatically. Statistics about searches (locations, dates, durations, number of results) contain no data that identifies you.
3.6. Analytics data, only with your consent: if you accept analytics cookies, Google Analytics (through Google Tag Manager) collects pseudonymous online identifiers (cookies), the pages visited, information about your device and browser, an approximate location derived by Google from the IP address, and booking-process events (for example the search, the choice of car, the submission of the booking and its value). We do not send your name, e-mail address or telephone number to Google.
3.7. We do not ask for or process your bank card details: no payment is made on the website. We do not process special categories of data (for example health data).
3.8. Providing the data in point 3.1 is necessary to send the booking: without it the Lessor cannot confirm the booking or contact you. The data in the forms is needed so that we can answer you.
4. Purposes and legal bases
4.1. Intermediating your booking – sending the booking to the Lessor, confirming it, the e-mails about the booking, checking and cancelling it online, solving any problems. Legal basis: concluding and performing the intermediation contract between us and you (the Terms and Conditions) and the steps taken at your request before the rental contract is concluded (Art. 6(1)(b) GDPR).
4.2. Answering your messages sent through the contact and support forms, including forwarding them to the Lessor when they concern a rental. Legal basis: our legitimate interest in answering the requests we receive (Art. 6(1)(f) GDPR) or, when the message concerns a booking, the performance of the contract (point (b)).
4.3. Proof of acceptance of the Terms and defence of our rights in the event of complaints or disputes. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
4.4. Website security and prevention of abuse (for example automated bookings or messages). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
4.5. Compliance with legal obligations (for example accounting obligations or requests from the authorities). Legal basis: legal obligation (Art. 6(1)(c) GDPR).
4.6. Usage statistics and campaign measurement (Google Analytics, source of the visit). Legal basis: your consent, given through the cookie banner (Art. 6(1)(a) GDPR and Romanian Law no. 506/2004).
4.7. We do not use the data from bookings or forms to send you marketing messages, and we do not take decisions based solely on automated processing that produce legal effects concerning you.
5. Who receives the data
5.1. The Lessor – S.C. AUTOREVOLUTION SRL (ExpediCAR), Str. Johann Strauss nr. 2, Sector 2, Bucharest, e-mail office@expedicar.ro, the rental company that records the booking in its booking system, confirms it, concludes the rental contract with you and is responsible for performing it. The Lessor receives the data in point 3.1 and, when they concern a rental, the requests sent through the support form. It processes them as an independent controller, under its own privacy policy, published on expedicar.ro.
5.2. Processors that provide services to us, under a contract and only on our instructions: the website hosting and e-mail provider, the IT service providers who maintain the website and, only if you accepted analytics cookies, Google (Google Analytics and Google Tag Manager).
5.3. Public authorities, courts and advisers (for example accountants or lawyers), when the law requires it or to defend our rights.
5.4. We do not sell or rent out your data.
6. Transfers outside the European Economic Area
Data collected through Google Analytics, only with your consent, may be transferred to Google LLC in the United States of America. The transfer is based on the European Commission’s decision on the EU-US Data Privacy Framework, to which Google LLC has adhered, and on standard contractual clauses. If another provider were to process data outside the European Economic Area, we ensure that appropriate safeguards are in place (an adequacy decision or standard contractual clauses).
7. How long we keep the data
- Bookings: the contact details (name, e-mail, telephone), the flight number, the notes, the cancellation reason and the attribution data are deleted automatically 730 days after the car’s return date; for bookings whose status could not be clarified, 30 days later. After that we keep only pseudonymised booking data (reference numbers, locations, dates, car, total, country and drivers’ age), which no longer contains your contact details, for the records of the bookings we intermediated and for statistics, as long as they are needed for these purposes.
- Internal booking notifications (the e-mails received by the team that handles bookings, with the booking and contact details, including the cancellation reason) are kept in the team’s mailboxes only as long as needed to handle the booking and any complaints.
- Form messages: deleted automatically from the website’s database after 180 days. The copies received by e-mail by the team that answers you are kept only as long as needed to resolve the request.
- Unfinished offers (without contact details) are deleted after 7 days, and anonymous search statistics after 400 days.
- Application logs (designed not to contain your contact details) are kept for 30 days.
- Cookies and analytics data: as described in the Cookie Policy; user-level and event-level data in Google Analytics is kept for at most 14 months, after which only aggregated reports that do not identify you remain.
- Documents that the law requires us to keep, for the period set by law.
8. How we protect the data
The website uses encrypted connections (HTTPS). Access to booking and message data is limited to authorised persons with a personal account and password, and sensitive actions (export, cancellation, deletion) require the password to be confirmed again and are recorded. We collect only the data needed for the purposes above. No system is completely secure, however; if you notice a security problem, please let us know.
9. Your rights
Under the conditions set by the GDPR you have the following rights:
- the right of access – to find out whether we process data about you and to receive a copy of it;
- the right to rectification – to correct inaccurate or incomplete data;
- the right to erasure (“right to be forgotten”), in the cases provided for by law;
- the right to restriction of processing;
- the right to object to processing based on our legitimate interest;
- the right to data portability for the data you provided to us;
- the right to withdraw your consent at any time, without affecting the processing carried out before; for cookies, from the “Cookie settings” link in the footer;
- the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).
To exercise your rights, write to us at office@globalreference.ro or through the Support page. We answer free of charge, within one month of receiving the request (a period that may be extended by two further months for complex requests, in which case we inform you). To protect your data, we may ask for information that allows us to identify you (for example the booking number and the e-mail address used). For data processed by the Lessor in connection with the rental contract you can contact the Lessor directly; we will help you forward your request.
10. Cookies
We use strictly necessary cookies and, only with your consent, analytics and marketing cookies. The details are in the Cookie Policy. You can change your choice at any time from the “Cookie settings” link in the footer.
11. Changes to this policy
We may update this policy when the way we process data changes. The version in force and its date are shown on this page.
12. Contact and supervisory authority
Controller: S.C. GLOBAL REFERENCE SRL – e-mail office@globalreference.ro, Support page.
Supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, postal code 010336, Bucharest, Romania, e-mail anspdcp@dataprotection.ro, www.dataprotection.ro.