Privacy Notice

This Privacy Notice explains how we collect, use and protect any information about you. It also tells you how to get in touch if you have any questions, which we will be more than happy to answer. If you’re interested in what we do with cookies and similar technologies, please check out our Cookie Statement.

We may change this Notice from time to time; so please check back here for any updates.

We offer a range of services related to online car rental, including products and services such as insurance, through our own websites, mobile apps, emails and text messages (‘platforms’). We also do this through our business partners’ websites, social media and other platforms. This Notice applies to all the personal data we collect while we’re doing this, or when you contact us by email, live chat, phone or post.

Our business partners should also visit our Privacy and Cookie Statement for Business Partners to understand how personal data is processed as part of our business relationship.

Personal data you give us

We can’t help you book your car rental without information, so when you use our services there are certain things we ask for. This is typically routine information – your name, email address, and your payment information. We might also ask for your home address, billing address, phone number, date and place of birth, passport and driving licence information, government issued identification (where required by law) and the names of any additional drivers.

In addition to this, we also collect information from the computer, phone, tablet or other device you use to access our services. This includes the IP address, the browser you’re using and your language settings. There are also situations in which we receive information about you from others or when we automatically collect other information.

This is the general overview but if you’d like to know more about the information we collect, we go into more detail below.

Personal data you give us

We store and use the information that you give us. When you make a booking, we need at least your name, email address and payment information. We might also ask for your home address, phone number and date of birth, and the names of any additional drivers.

If you get in touch with us (by phone, by email or through social media, for example) we will collect information from you there too.

After your booking, we may ask you to provide a review to help us improve our services, and to help ensure future customers get exactly what they’re looking for.

There are also other ways you might give us information. For example, if you’re browsing with your mobile device, you can share your current location with us, so we can provide you with the best possible service. To make things easier, you can also open a user account, which lets you review and manage your bookings, as well as saving your personal settings and your passport and driving licence details. It also makes it easier to make future bookings.

Personal data you give us about others

You might add someone as an additional driver, or you might make a booking on behalf of someone else, for example, a friend, family member or colleague. If you do, please make sure that that person knows you’re giving us their details, and has accepted the way we handle their personal data (as described in this Notice). This is your responsibility.

Personal data we collect automatically

When you make a booking, we record what platform you made it on, and how you got to our platform (if you came through from another site, for example).

Even if you don’t end up making a booking, we may automatically collect some information when you visit our platforms. This may include your IP address, which pages you’ve visited, which browser you’re using, and information about clicks. It might also include information about your computer’s operating system, its application version, language settings, device-specific setting and characteristics, and data that identifies your device.

If you’re using a mobile device, we might also collect location details. And we might analyse, and process basic data related to the apps installed on it (e.g. name, description and category).

Personal data we get from other companies

We may also get information about you from social media platforms, our business partners, subsidiaries of the Rentalcars.com corporate family, affiliates of the Booking Holdings Inc corporate group (see here for more information) and other third parties. For example:

• We work with affiliate business partners to offer our services on other platforms. When you make a booking on one of these platforms, we may share your personal data with them, and they may share your personal data with us.
• The companies that provide the services you have booked through our platforms may need to send us information about you – for example, if your booking leads to an insurance claim or customer service dispute.
• Our business partners may also send us information about you that may help us show you more relevant adverts.

We may combine any of this information with the information you give us directly.

Please see ‘Why do we collect and use your personal data?’ for details.

Why do we collect and use your personal data?

We ask for your personal data so we can book your car (and anything else you need for your booking), and make sure you get the best possible service. We also use it to contact you, and to tell you about our latest deals and special offers. These are the main reasons we collect your personal data, but there are other reasons too. Would you like to know more?

Why do we collect and use your personal data?

We may use your personal data in the following ways:

1. Bookings: First and foremost, we use your personal data to make and administer your booking, and to forward the necessary details to the company that provides your car (or other product or service, such as insurance). This includes sending you communications in relation to your booking, such as confirmations, modifications and reminders.
2. Customer service: We provide international customer service 24/7 in over 40 languages. Our international customer service teams need your details so they can help you make a booking, for example, or to reply to any queries you may have before, during or after your booking.
3. Customer reviews: We may use your contact details to send you a short questionnaire about your booking. This helps us understand and improve our service and the service our business partners provide.
4. Account facilities: To make things easier, you can create a user account on our platforms. This involves giving us your personal data, and it lets you do a number of useful things. You can manage your bookings or other purchases, take advantage of special offers, and manage your personal settings and preferences. It also makes it easier to make future bookings.
5. Marketing activities: We also use your personal data for marketing activities, which may include:
   • Contacting you by post, phone, email or SMS (depending on the contact details you give us) with our latest news, special offers, discounts and updates, including details of our products and services (and/or those of our group companies or affiliate business partners). You can unsubscribe from these marketing communications quickly, easily and at any time – just click the “unsubscribe” link in any email or visit our Data Subject Request Portal.
   • Contacting you by phone, email or SMS with information about insurance products that you didn’t include in your booking.
   • Showing you relevant offers on our platforms or on third-party websites, including social media sites.
   • Inviting you to participate in promotional activities (such as referral programs or competitions).
6. Communicating with you: There may be other times when we contact you by phone, email or SMS. There could be a number of reasons for this, including:
   • Responding to, and handling any requests you have made.
   • Emailing you a reminder about a booking you didn’t finalise, to see if you need any help to do so. We see this as a useful additional service because it lets you carry on with a booking without having to find the car again or fill in all the booking details from scratch.
   • Sending you a questionnaire or inviting you to review your experience.
   • Sending you other material related to your booking, such as how to contact us (or another company) if you need help during your booking.
   • Sending you a summary of your previous bookings.
   • Sending you other administrative messages, which may include security alerts, even if you don’t have an upcoming booking.
7. Market research: We may ask you to take part in market research. Any additional personal data that you give us as part of this research will be used only with your consent.
8. Fraud detection and prevention: To provide a safe, trustworthy service, we use your personal data to detect and prevent fraud and other illegal or unwanted activities. Similarly, we may use personal data for risk assessment and security purposes, which can include verifying users and bookings. This can sometimes mean we may have to put certain bookings on hold.
9. Improving our services: We analyse personal data to help us improve the functionality and quality of our online services, and enhance the whole user experience. We’re always working to make our platforms easier and more enjoyable for you to use.
10. Customer reviews: After your booking, we may invite you to review the services that we or our business partner provided. Your review will help future customers make the right choice, and help our business partners improve the services they offer. By submitting a review, you are agreeing that it can be displayed, as explained in our Terms and Conditions. You can make a review anonymously or simply put your first name and country location.
11. Call monitoring: We may record phone calls and/or allow other staff to listen in to them, to help us train our colleagues and make sure we’re consistently providing a top-quality service. We automatically delete recordings after a specified time, unless we have a legitimate reason not to (if we think there’s evidence of fraud, for example).
12. Legal purposes: Finally, in certain cases, we may need to use your personal data to handle and resolve legal disputes, for regulatory investigations, for compliance reasons, or to make sure we apply our terms and conditions accurately.

Providing your personal data to us is voluntary. However, depending on the type of service you may want to use, we may only be able to provide you with this service if certain personal data is collected. For instance, we cannot process your booking if we do not collect your name and contact details.

If we use automated means to process personal data which produces legal effects or significantly affects you, we will implement suitable measures to safeguard you rights and freedoms, including the right to obtain human intervention.

To process your personal data like this, we rely on the following legal grounds:

• Performance of a contract: We need to use your personal data to fulfil any contract you’ve made with us. For example, when you book a car, we need to transfer your booking details to the rental company to make sure your car is waiting for you.
• Legitimate interests: We may use your information for our ‘legitimate interests’ (a term which applies to anything we believe is an essential part of carrying out our business effectively – at the same time as respecting your rights and upholding the law). For example, to provide you with the most suitable content on our platforms, including our emails and newsletters; to improve and promote our products and services; and for administrative purposes.
• Consent: We may rely on your consent to use your personal data in certain circumstances, for example direct marketing purposes. You may withdraw your consent at any time via our Data Subject Request Portal or by emailing [email protected], stating “Privacy” in the subject line.

What third parties do we share your personal data with – and why?

There are a number of different business partners integrated in the services we provide, and in certain situations we may share your personal data with them. In most cases, we’re simply passing on your booking details to the business partners that are helping us deliver the service you’re requesting. We will also share your data with other third parties, which may include payment service providers, advertising partners, subsidiaries of the Rentalcars.com corporate family and affiliates of the Booking Holdings Inc corporate group, and – in some cases – the authorities. These are the main reasons we would share your personal data. Would you like to know more?

What third parties do we share your personal data with - and why?

In certain circumstances, we'll share your personal data with third parties. These third parties include:

1. The car rental company you booked with: In order to complete your booking, we transfer relevant booking details to the company/companies supplying the car and/or other related products (including insurance) that you have requested. This is one of the most essential things we do for you.

   Depending on the booking, the details we share can include your name, age range, contact details, the names of any additional drivers and any other information or preferences you specified when you made your booking.

   If the car rental company you select on our platform participates in our pre-registration scheme, the details we share can also include your email address, home address, phone number, date and place of birth, passport and driving licence information if you have provided this information to us at your sole discretion. Providing further pre-registration information will enhance your pick-up experience, but it is optional and you will still be able to pick-up your car rental even if you do not provide any pre-registration information.

   In cases of booking or insurance related claims, disputes or any other kind of customer service issue, we may provide the car rental company with your contact details, including your email address and information about the booking process as well as the dispute itself as needed to handle the dispute. This can include, but may not be limited to, a copy of your booking confirmation to demonstrate that a booking was actually made, as well as any information related to your complaint.

   Please note that, sometimes, at the direction of the car rental company, we will need to share your personal data with parties related to the car rental company in order to finalise and administer your booking. These parties might include other entities of a car rental company's corporate group or service providers who are handling the data on the car rental company's behalf. Please be aware that any information you provide directly to the company/companies supplying your car and/or related products will be stored and used in accordance with their own privacy notice(s) and terms and conditions.

   Car rental companies will further process your personal data, outside of the control of Rentalcars.com. They may also ask for additional personal data, for instance to provide additional services, or to comply with local restrictions. If available, please read the privacy statement of the car rental company to understand how they process your personal data.

2. Connectivity Providers: Please note that, sometimes, at the direction of the car rental company, we will need to share your personal data with connectivity providers related to and/or contracted by the car rental company in order to finalise and administer your reservation. Connectivity providers act on behalf of the car rental company.
3. Your local Rentalcars.com office: To support the use of Rentalcars.com services, your details may be shared with subsidiaries of the Rentalcars.com corporate group, including for customer service. To find out more about the Rentalcars.com corporate group, visit About Rentalcars.com.
4. Third-party service providers: We use service providers from outside of the Rentalcars.com corporate group to support us in providing our services. These include:
   • Customer support
   • Market research
   • Fraud detection and prevention (including anti-fraud screening)

   • Payment.

     We use third parties to process payments, handle chargebacks or provide billing collection services. When a chargeback is requested for your booking, either by you or by the holder of the credit card used to make your booking, we need to share certain booking details with the payment service provider and the relevant financial institution so they can handle the chargeback. This may also include a copy of your booking confirmation or the IP address used to make your booking. We may share information with relevant financial institutions, if we consider it strictly necessary for fraud detection and prevention purposes.

   • Marketing services.

     We share personal data with advertising partners, including your email address, as part of marketing Rentalcars.com services via third parties (to ensure that relevant advertisements are shown to the right audience). We use techniques such as hashing to enable the matching of your email address with an existing customer database, so that your email address cannot be used for other purposes. For information on other personalised advertisements and your choices, please read our Cookie Statement.

   • Advertising partners.

     We use advertising partners, such as metasearch providers, to allow you to compare our offers with the offers of other companies. When you make a booking on Rentalcars.com after using an advertising partner, we will send the details of the booking that you made on Rentalcars.com to that partner. All service providers are required to continue to adequately safeguard your personal data.

5. Competent authorities: We disclose personal data to law enforcement to the extent that it is required by law or is strictly necessary for the prevention, detection or prosecution of criminal acts and fraud, or if we are otherwise legally obliged to do so. We may need to further disclose personal data to competent authorities to protect and defend our rights or properties, or the rights and properties of our business partners.

6. Business partners: We work with many business partners around the world. These business partners distribute or advertise the Rentalcars.com services, including the services and products of our business partners.

   When you make a booking on one of our business partner' websites or apps, certain personal data that you give them, such as your name and email address, your address, payment details and other relevant information, will be forwarded to us to finalise and manage your booking.

   If customer service is provided by the business partner, Rentalcars.com will share relevant booking details with them (as and when needed) in order to provide you with appropriate and efficient support.

   When you make a booking through one of our business partners' websites, the business partners can receive certain parts of your personal data related to the specific booking and your interactions on these partner websites. This is for their commercial purposes.

   When you make a booking on a business partners' website, please also take the time to read their privacy notice if you'd like to understand how they process your personal data.

   For fraud detection and prevention purposes, we may also exchange information about our users with business partners - but only when strictly necessary.

7. The Booking Holdings Inc. corporate group: Please read here how we may share your personal data with the Booking Holdings Inc. corporate group.

Rentalcars.com is a global business. The data that we collect from you, as described in this Privacy Statement, could be made accessible from, transferred to or stored in countries which may not have the same data protection laws as the country in which you initially provided the information. In such cases, we will protect your data as described in this Privacy Statement.

This may also be applicable if you are in the European Economic Area (EEA). Countries to which your data could be transferred may not have laws that provide the same level of protection to your personal data as laws within the EEA. Where this is the case, we will put in place appropriate safeguards to ensure that such transfers comply with applicable UK data protection legislation.

In particular, when your data is transferred to third-party service providers, we establish and implement appropriate contractual, organisational and technical measures with such providers. In certain specific cases, we transfer your data outside the UK and/or EEA because this is necessary to conclude or fulfil the contract we have with you or is in your interest. For instance, when you make a reservation on Rentalcars.com or through a business partner, we may need to transfer your data to our supply partner or business partner, which might be located outside the EEA.

You can ask us to see a copy of implemented safeguards (where possible) by contacting us at [email protected].

How is your personal data shared within the Booking Holdings Inc. corporate group?

Booking.com Transport Limited (trading as Rentalcars.com) is part of the Booking Holdings Inc. corporate group. More information is available at Bookingholdings.com. Read on to find out more about how your data may be shared within the Booking Holdings corporate group.

We may receive personal data about you from other companies in the Booking Holdings Inc. corporate group, or share your personal data with them, for the following purposes:

1. To provide services (including to make, administer and manage bookings or handle payments) and administrative support;

2. To provide customer service;

3. To detect, prevent and investigate fraudulent, other illegal activities and data breaches;

4. For analytical and product improvement purposes;

5. To provide personalised offers or send you marketing with your consent or as otherwise permitted by applicable law;

6. For hosting, technical support, overall maintenance and maintaining security of such shared data; and

7. To ensure compliance with applicable laws.

As applicable and unless indicated otherwise, for purposes A to F, Rentalcars.com relies on its legitimate interest to share and receive personal data. For purpose G, Rentalcars.com relies, where applicable, on compliance with legal obligations (such as lawful law enforcement requests).

All companies within the Booking Holdings Inc. group of companies may need to exchange personal customer data to ensure all users are protected from fraudulent activities on its online platforms.

How do we make use of mobile devices?

We offer free apps for a range of mobile devices, as well as versions of our regular website that have been optimised for mobile and tablet browsing. They collect and process your personal data in much the same way as our other platforms do, and they also allow you to find local rental cars based on your current location. Would you like to know more?

How do we make use of mobile devices?

If you agree to it, we can send ‘push’ notifications straight to your mobile device, so you don’t miss important information about your booking. And, if you let us access your device’s location or contact details, we can provide extra services if you request them. Your mobile device will have instructions on allowing push notifications and giving us access to this kind of data.

To give you a better service and more relevant marketing, we may use something known as ‘cross-device tracking’. This just means we look at the way you use our platforms on more than one device: we could, for example, combine data from your mobile phone and your home computer. This is something we may or may not use cookies for (for more on cookies and similar technologies, please see our Cookie Statement).

To make sure you find deals that are more likely to interest you in our newsletter, we look at the searches you make and the services you book on multiple devices once you’ve signed in to your user account. If you don’t want us to do this, just sign out before you browse, or unsubscribe from our newsletter.

Cross-device tracking can also mean that when you’re using one device, you may see personalised advertisements from lots of different companies, based on your activities on linked devices. The NAI (Network Advertising Initiative) should stop this happening if you opt out of the NAI behavioural advertising program (our Cookie Statement gives you the link you need, under “It's your choice: Opting in and opting out”). Please note: simply signing out of your user account won’t stop this happening.

What security and retention procedures do we put in place to safeguard your personal data?

Our business systems and procedures ensure we take all reasonable steps to protect your personal data and safeguard it against any misuse or unauthorised access, in accordance with UK and European data protection laws. We also have specific security procedures and restrictions (both technical and physical) that limit access to, and use of, any personal data that we hold. Only authorised personnel can access personal data – and they’re only allowed to do it for specific, authorised reasons.

We will retain your personal data for as long as we deem it necessary to enable you to use our services, to provide our services to you (including maintaining your online user account (if created)), to comply with applicable laws, resolve disputes with any parties and otherwise as necessary to allow us to conduct our business, including to detect and prevent fraud or other illegal activities. All personal data we retain will be subject to this Privacy Notice.

How do we treat the personal data of children?

We don’t provide services to children under the age of 18 and we reserve the right to delete any information we may receive from a child under this age. We may receive information about children in certain situations, such as an insurance claim or a customer service dispute. If that happens, we will only collect and use that information with the consent of the child’s parent or guardian.

How can you control the personal data you have given us?

You have the right to review the personal data we keep about you at any time. You can request access to or deletion of your personal data by submitting this form. If you want to find out more about your rights to control your personal data, read on.

We want you to be in control of how your personal data is used by us. You can do this in the following ways:

1. You can ask us for a copy of the personal data we hold about you,

2. You can inform us of any changes to your personal data, or you can ask us to correct any of the personal data we hold about you. As explained below, you can make some of these changes directly online yourself when you have a user account,

3. In certain situations, you can ask us to erase, block, or restrict the processing of the personal data we hold about you, or object to particular ways in which we are using your personal data,

4. In certain situations, you can also ask us to send the personal data you have given us to a third party,

5. Where we are using your personal data on the basis of your consent, you are entitled to withdraw that consent at any time subject to applicable law, and

6. Where we process your personal data based on legitimate interest or the public interest, you have the right to object to that use of your personal data at any time, subject to applicable law.

We rely on you to make sure that your personal information is complete, accurate and current. Please do let us know about any changes to, or inaccuracies in, your personal information as soon as possible.

If you have a Rentalcars.com user account, you can access a lot of your personal data through our website or apps. You’ll generally find the option to add, update or remove information we have about you in your account settings.

If any of the personal data we have about you isn’t accessible through our website or apps, you can send us a request.

If you want to exercise your right of correction, access, erasure or objection or if you do not want us to share your data with Booking.com, all you need to do is complete and submit the form found in the Data Subject Request Portal. For any requests relating to this Privacy Statement, to exercise any of your other rights, or if you have a complaint, please contact our Data Protection Officer at [email protected]. You can also contact your local data protection authority if you have a complaint.

If you’d like to object to your personal data being processed on the basis of legitimate interest and there’s no way to opt out directly, please contact us at [email protected]. If you’d like to contact us by post, please address it to the Data Protection Officer and use the following postal address: 6 Goods Yard Street, Manchester, M3 3BG, United Kingdom.

Requests from law enforcement should be submitted to [email protected].

Who is responsible for the processing of personal data on our platforms?

Booking.com Transport Limited (trading as Rentalcars.com) located in the United Kingdom, controls the processing of personal data for the provision of its services. That includes its websites and mobile apps, except for some exceptions that are clarified in this privacy statement.

Booking.com Transport Limited (trading as Rentalcars.com) controls the processing of personal data, as described in this Privacy Statement, except where explicitly stated otherwise. Booking.com Transport Limited is a private limited liability company, incorporated under the laws of the United Kingdom, and has offices at 6 Goods Yard Street, Manchester, M3 3BG, United Kingdom.

If you have any questions about this Privacy Statement, or about our processing of your personal data, please contact our Data Protection Officer at [email protected], stating 'Privacy' in the subject line and we'll get back to you as soon as possible. If you reside in the EU, you can still contact us, but you may also contact our EU Representative, Booking.com B.V., Herengracht 597, 1017 CE Amsterdam, the Netherlands at [email protected], and for related information or complaints you can also contact your local data protection authority using the channels it may make available.

For questions about a booking, please contact our customer service team through the customer service contact page.

Country-specific provisions

Depending on the law that applies to you, we might be required to provide some additional information. If you'd like to know more, please read on.

For California Residents - California Law

This section supplements our Privacy Statement and only applies if you reside in the state of California. Where applicable, it describes how we use and process your personal information (the term used under the law) and explains your particular rights under California law.

We describe below the personal information we collect about you, including by identifying specific categories of information:

• Identifiers (e.g. your name, account number, email address, IP address)
• Financial, medical, or health insurance information (e.g. your bank account number, payment card number, medical information if provided by you or on your behalf)
• Characteristics of protected classifications under California or federal law (e.g. your gender, religion, sexual orientation)
• Commercial information (e.g. your purchase information)
• Internet or other electronic network activity information (e.g. information about your website or app usage)
• Geolocation data (e.g. your physical location)
• Inferences (e.g. analytics and preferences)

If you would like more information about the categories of sources from which we obtain personal information, the specific types of personal information we collect, or the purposes for which we collect them, please read the sections of our Privacy Statement titled “Personal data you give us”, “Personal data you give us about others”, and “Why do we collect and use your personal data?”.

To learn more about the receipt of personal information from and the sharing of personal information with third parties, please read the sections “Personal data we get from other companies” and “What third parties do we share your personal data with – and why?”.

We may share certain pieces of your personal information with third parties, which under California law can be treated as a 'sale' of information. This may include information related to Identifiers, Commercial information, Geolocation data, Internet activity, and Inferences, as described above. We may also share your personal information, listed above under A-I for “business purposes,” such as to service providers who assist us with securing our services, for payment purposes, customer support services, delivering marketing messages, or advertisements. For more details, including the recipients of your personal information, you can check out the “Personal data we get from other companies” and “What third parties do we share your personal data with – and why?” sections of our Privacy Statement.

California law provides you with certain rights, including the right to access specific pieces of personal information, learn about how we process personal information, including disclose or sell personal information, request deletion of personal information, opt out of 'sales' and not to be denied goods or services for exercising these rights.

You may exercise your right to opt out of 'sale' by clicking on this link, selecting 'California' from the dropdown menu and following the instructions.

To exercise your right to request access to or the deletion of your personal information under California law, please submit a request via our Data Subject Request Portal. To otherwise exercise these or any of your other rights under California law, or to contact us with questions and concerns about this privacy statement and our practices, you can also contact us by telephone at 01 833 574 3225 or by email at [email protected] with the subject line: “California Resident Privacy Rights - Request”.

If you are an authorized agent wishing to exercise rights on behalf of a California consumer, please contact us at the email above, attaching a copy of the consumer's written authorization, designating you as their agent. We may need to verify your identity before completing your rights request by, for example, requesting information about your previous bookings with us.

Rentalcars.com's services are not directed at children under the age of 16 years. Therefore, Rentalcars.com does not knowingly sell the personal information of minors under the age of 16 years without appropriate consent, as required under the California Consumer Privacy Act (CCPA).

For the period until 31st December 2020, we have compiled the following statistics about the receipt and handling of requests identified as requests submitted under the CCPA by consumers from California as of 1st January 2020:

• Number of requests to know received, complied with in whole or in part or denied: 13
• Number of requests to delete received, complied with in whole or in part or denied: 48
• Number of requests to opt out of sales received, complied with in whole or in part or denied: 13110
• Average number of days to substantially respond to requests to know, delete or opt out: < 30

For US residents – excluding California residents

If you live in the United States (excluding California), this section applies to you (along with the rest of this Privacy Statement). It informs you of certain rights you have in various US States (excluding California), which may be different from those described elsewhere in this Privacy Statement. If you are a resident of California, please go to the ‘For California Residents’ section directly above to learn more about your specific rights.

In addition to the ones listed earlier in this Privacy Statement, the categories of personal data we may collect about you include:

• A. Geolocation data (i.e. your physical location)
• B. Sensitive data (citizenship or immigration status, data revealing your racial, ethnic origin, religious beliefs, mental or physical health diagnosis or sexual orientation - if provided by you
• C. Inferences (e.g. analytics and preferences)

If you would like more information about these categories, the specific types of personal data we collect, or the purposes for which we collect them, please read the sections of our Privacy Statement titled “Personal data you give us”, “Personal data we collect automatically”, “Personal data we get from other companies" and "Why do we collect and use your personal data?".

To learn more about the receipt of personal data from and the sharing of personal data with business partners, please read the sections “Personal data you give us”, “Personal data we collect automatically”, “Personal data we get from other companies” and “What third parties do we share your personal data with – and why?”.

We may share certain elements of your personal data with third parties, which under US State privacy laws may be considered the sale of personal data. This may include information related to inferences and analytics. We may also share your personal data with service providers who assist us with delivering marketing messages, or advertisements.

For more details you can find more information about this in the “Personal data you give us”, “Personal data we collect automatically”, “Personal data we get from other companies” and “What third parties do we share your personal data with – and why?” sections of our Privacy Statement.

Your rights under privacy laws include the right of access to your personal data, the right to correct your personal data, the right to request deletion of your personal data and the right to obtain a copy of your personal data. US State privacy laws provide you with certain additional rights, which include the right to opt out of: the sale of your personal data, targeted advertising, and profiling which may have a legal impact on you.

Please fill out the DSR form in our Data Subject Request Portal to exercise your right to:

• request access to, obtain a copy of, correct and/or delete your personal data, and/or
• opt out of targeted advertising, profiling and/or the sale of your personal data.

You can also contact us with any questions and/or concerns about this Privacy Statement and our practices, or to exercise any of your rights, by sending an email to [email protected] with the subject line: ‘US Resident Privacy Rights - Request’.

If you are the parent, legal guardian, or authorised agent of a consumer and you wish to exercise rights on their behalf, please contact us at [email protected]. We may need to verify your identity and authorisation before completing the rights request.

When you exercise your rights, we verify your identity in various ways, including whether the name and the email address you provide in the request match the data you (or the person on whose behalf you are acting) provided when using our services. You may authorise another individual to exercise opt-out rights on your behalf. If we receive such a request, we will send an email to confirm you authorised the requester to act for you.

Rentalcars.com’s services are not directed at children under the age of 16 years. Therefore, Rentalcars.com does not intentionally collect the personal data of minors and we do not knowingly sell the personal information of minors under the age of 16 years without appropriate consent

South Korea

This section supplements our Privacy Statement and only applies if you reside in South Korea.

1. Items of personal information collected

   For information about the items of personal information that we collect, please read the sections of our privacy statement titled “Personal data you give us”, “Personal data you give us about others”, “Personal data we collect automatically” and “Personal data we get from other companies”.

2. Purposes of collection and use of personal information

   For information about the purpose and use of the personal information that we collect, please read the section of our privacy statement titled “Why do we collect and use your personal data?”.

3. Third Party Recipients and Trustees of Personal Information

   • Trustees: Business/Supply Partners

     Purpose / Entrusted Duties: Personal information is used by the business partner to arrange the service you have booked. The information is retained and deleted as stated in this Privacy Statement.

   • Trustees: Payment Processing trustees

     Purpose / Entrusted Duties: Personal information is shared with third party payment providers who process payments, handle chargebacks or provide billing collection services on our behalf. The information is retained as stated in this Privacy Statement.

   • Trustees: Customer support trustees

     Purpose / Entrusted Duties: Personal information is shared with these trustees so that we can provide customer support services to you when you need us.

   • Trustees: Market research trustees

     Purpose / Entrusted Duties: We share personal information with trustees who help us in carrying out market research.

   • Trustees: Security trustees

     Purpose / Entrusted Duties: Personal information is shared with trustees that provide fraud detection and prevention (including anti-fraud screening) services.

   • Trustees: Advertising trustees

     Purpose / Entrusted Duties: When you make a reservation on Rentalcars.com after using an advertising partner, we will send the details of the reservation that you made on Rentalcars.com to that partner.

   • Trustees: Booking Holdings Inc.

     Purpose / Entrusted Duties: Personal information is shared with companies in the Booking Holdings Inc. corporate group for the following purposes: to provide services (including to make, administer and manage reservations or handle payments); to provide customer service; to detect, prevent and investigate fraudulent and other illegal activities, and data breaches; for analytical and product improvement purposes; to provide personalised offers or send you marketing with your consent or as otherwise permitted by applicable law; for hosting, technical support, overall maintenance and maintaining security of such shared personal information; and to ensure compliance with applicable laws.

   • Trustees: Connectivity Providers

     Purpose / Entrusted Duties: We provide details of your booking to connectivity providers on behalf of business/supply partners.

4. Process and method of destruction of personal information

   When destroying personal information, Rentalcars.com takes commercially reasonable and technically feasible measures to make the personal information irrecoverable or irreproducible. Electronic documents or files containing personal information will permanently be deleted using a technical method that makes recovery or retrieval of such information impossible. Non-electronic documents or files containing personal information will be shredded or incinerated. In case any personal information is required to be retained for a period beyond the period of retention and use as prescribed by applicable law, to the extent technically possible, such information will be stored or maintained separately from other items of personal information.

5. Department for protection of personal information

   If you have a request that is related to this privacy statement or your data subject rights, you may contact our department that is responsible for the protection of personal information and related complaints:

   Data Protection Office

   +82 2 6323 8008

   [email protected]

   You may also use any of the addresses below to contact or consult your local authorities about personal information related matters:

• Privacy Infringement Report Center privacy.kisa.or.kr / 118
• Cyber Investigation Division, Supreme Prosecutors' Office www.spo.go.kr / 1301
• National Police Agency Cyber Security Bureau www.ctrc.go.kr / 182

6. Representative in Korea

   Pursuant to the Act on the Promotion of the Use of the Information Network and Information Protection, the information regarding the domestic agent is as follows:

   • Name and representative: Booking.com Korea Limited (Representative: Su Yeon Kim)
   • Address, telephone number and e-mail address: 17F Gran Seoul, 33 Jongro, Jongro-Gu, Seoul, South Korea, +82 2 6323 8008, [email protected].

Pursuant to the Act on the Promotion of the Use of the Information Network and Information Protection, the information regarding the domestic agent is as follows:

Name and representative: Booking.com Korea Limited (Representative: Su Yeon Kim)

Address, telephone number and e-mail address: 17F Gran Seoul, 33 Jongro, Jongro-Gu, Seoul, South Korea, +82 2 6323 8008, [email protected].

Japan

If you live in Japan, this section applies to you (along with the rest of this Privacy Statement).

It describes how we use and process your personal data, and explains your particular rights under Japanese law - specifically, the ‘Act on the Protection of Personal Information’ (APPI).

If there’s a mismatch between any provision in this section and any provision in another part of this Privacy Statement, the provision in this section will determine how we process your personal data if you live in Japan.

Sensitive personal information

‘Sensitive personal information’ is any personal information that can be the basis for discrimination or prejudice. When using Rentalcars.com’s services, sensitive information may be collected by Rentalcars.com or a third party. For example, when making a booking, you might disclose information about a disability you have.

We will ask for your consent before we collect sensitive personal information. However, where you voluntarily provide other sensitive personal information, we will assume that you have given us consent to process that information within the context it was submitted.

Data sharing

To enable us be able to provide our services, your personal information will be shared with, processed by and stored by third parties, as further described below under “List of third parties”, many of which are located outside of Japan. We ask for your consent before sharing your personal information with such third parties.

In order to complete your reservation, we transfer relevant reservation details to the service provider with whom you have booked. This is one of the most essential things we do for you.

Depending on the reservation and the service provider, the personal information we transfer can include your name, contact and payment details, the names of the people accompanying you, and any other information or preferences you've specified when making your reservation.

In addition to the list of third parties provided, other recipients of your personal information may include Booking Holdings Inc. corporate group and its service providers.

You can find out more about this in the “How is your personal data shared within the Booking Holdings Inc. corporate group?” section of our Privacy Statement.

List of third parties

With your consent, we may disclose your personal data to third parties in the following categories and for the following purposes, as permitted by the APPI. These parties can be located inside or outside Japan, as described below.

Types of third parties and Purposes of processing:

Payment service providers

• To help us process payments, handle chargebacks and/or provide billing collection services.
• View list of payment service providers

Advertising

• To help advertise more relevant products and services to you.
• View list of advertising parties

Market research

• To help us carry out research, so that we can improve the products and services we offer.
• View list of market research parties

Customer support

• To provide support with requests, claims and queries in relation to your reservation or other aspects connected to your trip.
• View list of customer support parties

Connectivity providers

• To facilitate the transfer of your reservation details to the car rental provider you have booked with.
• View list of connectivity providers

Cloud providers

• To help us to run the services we offer to you.
• View list of cloud providers

Fraud prevention

• To help us detect and prevent fraud and fraudulent transactions.
• View list of fraud prevention providers

We take all necessary steps to ensure the above third parties are selected based on their capacity to comply with Booking.com Transport Limited’s privacy and data protection requirements and the applicable privacy and data protection laws, including the relevant international data transfer requirements.

To find out more about the measures and systems in place regarding the protection of personal information in the countries where the above third parties are based, please visit the website for The Japanese Data Protection Authority (the Personal Information Protection Commission, or PPC). There, you will find issued investigations regarding the systems for the protection of personal information in certain countries and/or regions.

If you have any questions, please contact us at [email protected]. Please use the subject line: ‘Japan APPI - Data Sharing’.

Safety management measures

Booking.com Transport Limited takes its responsibilities for privacy and security seriously and implements appropriate technical and organisational measures to protect your personal information.

We have established – and continue to maintain and apply – a framework of policies and procedures to comply with all the privacy and data protection laws that apply to us. This includes organising recurring security and privacy awareness initiatives and training for employees and maintaining an inventory of information assets and processing activities.

We have also implemented physical safety management measures, to prevent theft of or damage to personal information, and technical security management measures, such as system access restrictions and authentication mechanisms. We take further measures to protect your data against data leakage and exfiltration, as well as accidental data destruction.

Booking.com Transport Limited requires that any third party it appoints has similar (or better) security and organisation measures in place, so that your personal information is kept confidential and secure at all times.

For details of the measures we take for the safety of our customers' personal information, contact us at [email protected]. Please use the subject line: ‘Japan APPI - Safety management measures’.

How to exercise your rights

If you have a Rentalcars.com account, you can find the personal information we store about you in your account settings. This includes your name, email address, phone number, address and payment information. You can exercise your right to access, rectification or erasure of this information by viewing, changing or deleting it at any time.

If you want to delete your account, you can also do this by going to account settings on the Rentalcars.com website, clicking into the ‘Account Details’ section and selecting ‘Deactivate Account’.

In addition, if you’d like to exercise your right to access or delete your data, to unsubscribe from email marketing, or to withdraw the consent you have given us to process your personal information, please fill out our form: Data Subject Request Portal.

To protect your personal information, we will need to verify your identity before completing your request. We will do this by asking you questions about your previous reservations with us. We will respond to your request without undue delay.

To otherwise exercise these or any of your other rights under the APPI, or to contact us about this Privacy Statement, you can email us at [email protected]. Please use the subject line: ‘Japan APPI Privacy Rights - Request’.

Turkey

Customers from Turkey may also use the contact details set out below for requests related to this privacy statement:

The local representative for Booking.com Transport Limited. in Turkey is Ozdagistanli Ekici Avukatlık Ortaklığı, located at Al Zambak Sok No: 2 Varyap Meridian Grand Tower A Blok K: 32 D: 270 Ataşehir-İstanbul.

Brazil

As a customer in Brazil, you have certain rights under the Lei Geral de Proteção de Dados Pessoais (“LGPD”). These rights include the right to confirmation of the existence of processing, access to your data, correction of incomplete, inaccurate or outdated data, blocking or deletion of unnecessary personal data, obtaining a copy of personal data, deletion of data when processed with consent, information about public or private entities with which Rentalcars.com shared your data, information on the possibility of not providing consent and the consequences of denial, as well as the right to revoke consent. In order to exercise your rights, please use the webform and/or contact details as set out under “How can you control the personal data you have given us?”.

Booking.com Transport Limited (trading as Rentalcars.com) is located in the United Kingdom. As a globally operating company, when making use of our services your personal data can be transferred to locations outside of the UK & EEA. When transferring your personal data outside of the UK & EEA, we will apply appropriate safeguards to protect your personal data as required by the LGPD.

Please read under “How do we treat the personal data of children?” about how Rentalcars.com processes personal data of children. As required under the LGPD, Rentalcars.com will at all times consider the child’s best interest when knowingly processing personal data of persons under the age of 18 years old.