Legal
Privacy Policy
Last updated: 11 May 2026 · GDPR (Regulation EU 2016/679) compliant
1. Who we are (the data controller)
Car & Go is the data controller for any personal information you provide through this website or by phone, email, WhatsApp, or in person.
Contact: Cargocarrentals2@gmail.com · +30 698 512 1879 · Corfu 49100, Greece
2. What data we collect
We only collect the data we need to provide our car rental service:
- Booking form: full name, email, phone, hotel/agency/referral source, pickup & return location, pickup & return date/time, flight number (if airport pickup), passengers, luggage, driver age band, selected car, extras chosen, optional special requests.
- Reservation record: every reservation you submit is stored in our own database on our private server in the EU (Hetzner, Helsinki). We use it to confirm availability, prepare the car, contact you about the booking, and meet Greek tax-law record-keeping requirements.
- Acknowledgement & confirmation emails: when you submit a reservation, we send you an automatic acknowledgement email; when we approve it, a confirmation email. These are sent via Resend (EU-based email provider), our data processor.
- Driver identification at pickup: full name, driver's licence number, ID/passport number, date of birth.
- Payment record: amount paid, method (cash, card terminal). We do not store card numbers.
- Technical data (essential only): IP address (server logs, kept 14 days), user agent, accept-language. No third-party tracking, no analytics cookies by default.
How long we keep reservation data: bookings remain in our database for up to 24 months after the return date (for refund, dispute, and quality-of-service handling) and are then automatically removed, except where Greek tax law requires longer retention of invoice records (5 years).
3. Why we use it (purpose & legal basis)
| Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|
| Provide the rental service you book | Contract performance (6.1.b) | 5 years (Greek tax law) |
| Contact you to confirm availability | Contract performance (6.1.b) | 30 days if no booking, 5 years if booking |
| Fulfil legal obligations (invoicing, ΦΠΑ records) | Legal obligation (6.1.c) | 5 years |
| Manage damage claims or accidents | Legitimate interest (6.1.f) | Until claim is resolved + 1 year |
| Security & fraud prevention (server logs) | Legitimate interest (6.1.f) | 14 days |
4. Who we share it with
We do not sell or rent your data. Limited sharing only when strictly necessary:
- Insurance provider (in case of accident or claim)
- Greek tax authority (AADE) for invoicing records
- Hosting provider (technical processing only, EU-based, GDPR-compliant)
- Law enforcement only when legally compelled
We do not share your data with marketing partners, advertisers, or social networks.
5. International transfers
Your data is processed inside the European Union. We do not transfer personal data outside the EU/EEA.
6. Your rights under GDPR
You have the right to:
- Access · request a copy of the data we hold about you
- Rectification · correct inaccurate or incomplete data
- Erasure ("right to be forgotten") · delete your data, subject to legal retention obligations
- Portability · receive your data in a machine-readable format
- Restriction · limit how we use your data
- Objection · object to processing based on legitimate interest
- Withdraw consent · at any time, where consent is the legal basis
To exercise any right, email Cargocarrentals2@gmail.com. We respond within 30 days at no cost (GDPR Art. 12).
7. Right to lodge a complaint
If you believe your rights have been violated, you can complain to the Hellenic Data Protection Authority:
Hellenic DPA (HDPA / ΑΠΔΠΧ)
Kifisias 1-3, 11523 Athens, Greece
Tel: +30 210 6475600 · Email: contact@dpa.gr · Web: dpa.gr/en
8. Cookies
We use minimal cookies · essential only. Full details on our Cookie Policy.
9. Children
Our service is intended for adults aged 21 or older. We do not knowingly collect data from minors.
10. Updates to this policy
We may update this policy. Material changes will be highlighted on the homepage. The "Last updated" date at the top reflects the latest revision.
Need to reach our data controller?
Email Cargocarrentals2@gmail.com with the subject "Data request" and we will respond within 30 days.