Privacy Policy

1. Introduction and Scope

This Privacy Policy applies to all personal data collected and processed by Rent Car Warsaw, a car rental service operating in Warsaw, Masovian Voivodeship, Poland. It governs data collected when you visit our website at rentcarwarsaw.com, make a booking inquiry, complete a reservation, contact our customer support team, or otherwise interact with our services.

We are committed to protecting your privacy in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, "GDPR"), the Polish Act on Personal Data Protection of 10 May 2018, and all applicable Polish and EU data protection legislation.

By using our website or booking a vehicle with us, you acknowledge that you have read and understood this policy. If you have any questions, please contact us at [email protected] before proceeding.

2. Data Controller

The data controller responsible for your personal information is:

Rent Car Warsaw
Warsaw, Masovian Voivodeship, Poland
Email: [email protected]
Phone: +1 (859) 961-2952

As data controller, we determine the purposes and means by which your personal data is processed. Where we engage third-party processors - such as payment providers or insurance partners - we ensure appropriate data processing agreements are in place.

3. Information We Collect

We collect the following categories of personal data in the context of providing car rental services in Warsaw and the wider Masovian Voivodeship region:

3.1 Personal Identification Data

• Full name and date of birth
• Email address and telephone number
• Residential address
• Driver's license number, issuing country, and expiry date
• Passport or national identity card number (where required for cross-border rentals)

3.2 Booking and Rental Data

• Pickup and drop-off locations (e.g., Warsaw Chopin Airport, Modlin Airport, city centre hotels)
• Rental dates, duration, and vehicle category selected
• Additional services requested (child seat, GPS, insurance upgrade)
• One-way rental destinations (e.g., Warsaw to Krakow, Warsaw to Gdansk)
• Booking confirmation numbers and rental agreement records

3.3 Payment Information

We do not store full payment card details on our own servers. Payment transactions are processed by certified third-party payment processors who comply with the Payment Card Industry Data Security Standard (PCI-DSS). We may retain limited transaction references (such as partial card numbers or transaction IDs) solely for the purpose of managing refunds or resolving disputes. Our service is designed to accommodate debit card payments with no deposit hold.

3.4 Browsing and Technical Data

• IP address and approximate geographic location
• Browser type, version, and device identifiers
• Pages visited, time spent on site, and referral source
• Cookie identifiers and session data (see our Cookie Use policy)

3.5 Location Data

Where you consent to location services in your browser, we may collect approximate geolocation data to suggest nearby pickup points in Warsaw, including locations near major landmarks such as the Royal Castle, Palace of Culture and Science, or the Warsaw Barbican. This data is not stored beyond the active session unless you explicitly save a preferred pickup address.

4. How We Use Your Data

We process your personal data on the following legal bases and for the following purposes:

4.1 Performance of a Contract

• Processing and confirming your car rental booking
• Arranging vehicle pickup and drop-off logistics at Warsaw locations
• Coordinating with insurance providers to cover your rental period
• Issuing rental agreements, invoices, and receipts
• Managing modifications, cancellations, and refunds

4.2 Legitimate Interests

• Providing customer support before, during, and after your rental
• Improving the performance, security, and content of our website
• Detecting and preventing fraudulent bookings or misuse of our services
• Maintaining internal records for fleet management and operational planning

4.3 Legal Compliance

• Complying with Polish traffic law and insurance reporting obligations
• Responding to lawful requests from Polish authorities or courts
• Retaining financial records as required by Polish tax law (ustawa o rachunkowosci)

4.4 Consent-Based Marketing

With your explicit consent, we may send you promotional emails about deals, seasonal offers, and car rental tips for Warsaw and Poland. You may withdraw this consent at any time by clicking the unsubscribe link in any marketing email or by contacting us directly at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5. Data Sharing with Third Parties

We do not sell your personal data. We share it only in the following circumstances with trusted partners who are contractually bound to protect it:

• Payment processors: PCI-DSS-compliant providers who handle card transactions on our behalf. They receive only the data necessary to authorise and process payments.
• Insurance providers: Licensed insurers operating in Poland who require driver details to underwrite the rental insurance included with your booking.
• Booking and fleet management integrators: Technology partners who power our reservation system and help coordinate vehicle availability across Warsaw pickup locations.
• Legal and regulatory authorities: Where required by applicable Polish or EU law, including in the event of a traffic incident, parking infringement, or court order.

All third-party processors are required to process data only on our documented instructions and to maintain appropriate technical and organisational security measures.

6. Data Retention Periods

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

• Booking and rental records: Retained for 5 years from the end of the rental period, in accordance with Polish civil and commercial law obligations.
• Financial and invoicing data: Retained for 5 years as required by Polish accounting regulations.
• Customer support communications: Retained for up to 2 years following resolution of the query.
• Marketing consent records: Retained until consent is withdrawn, plus 1 year thereafter for audit purposes.
• Website analytics and browsing data: Aggregated data retained for up to 26 months; individual session data deleted after 13 months.

When data is no longer required, it is securely deleted or anonymised in accordance with our internal data retention procedures.

7. Your Rights Under GDPR

As a data subject under EU and Polish law, you have the following rights with respect to your personal data:

• Right of access: You may request a copy of the personal data we hold about you, free of charge, within 30 days of your request.
• Right to rectification: You may ask us to correct any inaccurate or incomplete data we hold about you, including corrections to your driver's license details or contact information.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
• Right to data portability: Where processing is based on your consent or a contract, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on our legitimate interests or to direct marketing at any time.
• Right to restrict processing: You may request that we limit how we use your data in certain circumstances, for example while a rectification request is being investigated.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Polish supervisory authority: the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

8. Data Security Measures

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS encryption for all data transmitted between your browser and our servers
• Access controls limiting data access to authorised personnel only
• Regular security assessments and software patching procedures
• Third-party processor due diligence and contractual data protection obligations
• Pseudonymisation of personal data where appropriate for analytics purposes

While we strive to protect your data, no transmission over the internet or electronic storage system is 100% secure. If you suspect any misuse of your data, please contact us immediately.

9. International Data Transfers

Our primary data processing activities are conducted within the European Economic Area (EEA). Where any third-party service provider processes data outside the EEA, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to ensure an equivalent level of data protection.

10. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email. We encourage you to review this policy periodically. Continued use of our website or services after any changes constitutes acceptance of the updated policy.

This policy was last reviewed and updated in 2024.

11. Contact for Privacy Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact us:

[email protected]
Warsaw, Masovian Voivodeship, Poland
+1 (859) 961-2952

We aim to respond to all privacy-related enquiries within 5 business days. For formal data subject rights requests, we will respond within 30 calendar days as required by GDPR Article 12.