Legal
Privacy Policy
Last updated: 11 May 2026 · GDPR (Regulation EU 2016/679) compliant
1. Who we are (the data controller)
Car & Go is the data controller for any personal information you provide through this website or by phone, email, WhatsApp, or in person.
Contact: Cargocarrentals2@gmail.com · +30 698 512 1879 · Corfu 49100, Greece
2. What data we collect
We only collect the data we need to provide our car rental service:
- Booking form: pickup & return location, pickup & return date/time, driver age band, selected car, extras chosen.
- Contact data (when you reach out): name, phone, email, WhatsApp number.
- Driver identification at pickup: full name, driver's licence number, ID/passport number, date of birth.
- Payment record: amount paid, method (cash, card terminal). We do not store card numbers.
- Technical data (essential only): IP address (server logs, kept 14 days), user agent, accept-language. No third-party tracking, no analytics cookies by default.
3. Why we use it (purpose & legal basis)
| Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|
| Provide the rental service you book | Contract performance (6.1.b) | 5 years (Greek tax law) |
| Contact you to confirm availability | Contract performance (6.1.b) | 30 days if no booking, 5 years if booking |
| Fulfil legal obligations (invoicing, ΦΠΑ records) | Legal obligation (6.1.c) | 5 years |
| Manage damage claims or accidents | Legitimate interest (6.1.f) | Until claim is resolved + 1 year |
| Security & fraud prevention (server logs) | Legitimate interest (6.1.f) | 14 days |
4. Who we share it with
We do not sell or rent your data. Limited sharing only when strictly necessary:
- Insurance provider (in case of accident or claim)
- Greek tax authority (AADE) for invoicing records
- Hosting provider (technical processing only, EU-based, GDPR-compliant)
- Law enforcement only when legally compelled
We do not share your data with marketing partners, advertisers, or social networks.
5. International transfers
Your data is processed inside the European Union. We do not transfer personal data outside the EU/EEA.
6. Your rights under GDPR
You have the right to:
- Access · request a copy of the data we hold about you
- Rectification · correct inaccurate or incomplete data
- Erasure ("right to be forgotten") · delete your data, subject to legal retention obligations
- Portability · receive your data in a machine-readable format
- Restriction · limit how we use your data
- Objection · object to processing based on legitimate interest
- Withdraw consent · at any time, where consent is the legal basis
To exercise any right, email Cargocarrentals2@gmail.com. We respond within 30 days at no cost (GDPR Art. 12).
7. Right to lodge a complaint
If you believe your rights have been violated, you can complain to the Hellenic Data Protection Authority:
Hellenic DPA (HDPA / ΑΠΔΠΧ)
Kifisias 1-3, 11523 Athens, Greece
Tel: +30 210 6475600 · Email: contact@dpa.gr · Web: dpa.gr/en
8. Cookies
We use minimal cookies · essential only. Full details on our Cookie Policy.
9. Children
Our service is intended for adults aged 21 or older. We do not knowingly collect data from minors.
10. Updates to this policy
We may update this policy. Material changes will be highlighted on the homepage. The "Last updated" date at the top reflects the latest revision.
Need to reach our data controller?
Email Cargocarrentals2@gmail.com with the subject "Data request" and we will respond within 30 days.