Privacy policy

PRIVACY POLICY AND DATA PROTECTION

Last updated: September 2026

In compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”), and all other applicable regulations, SECRET RENT A CAR S.L. informs users and customers about the processing of their personal data.

1. DATA CONTROLLER

• SECRET RENT A CAR S.L.
• Tax ID (CIF): B72450174
• Registered office:
• Calle Mérida 2, El Tablero, Maspalomas, 35109, Las Palmas, Spain.
• Business premises:
• Avenida de Gran Canaria 20, Playa del Inglés, Maspalomas, 35100, Las Palmas, Spain.
• Telephone / WhatsApp: +34 641 328 403
• Email: secretrentacar@gmail.com
• Website: www.secretrentacar.es

SECRET RENT A CAR S.L. is the data controller for the personal data provided by customers and users through the website, booking forms, rental agreements, email, telephone, WhatsApp, in-person assistance or any other channels made available by the company.

2. PERSONAL DATA WE PROCESS

Depending on the service requested, SECRET RENT A CAR may process the following categories of data:

• Full name.
• Date of birth.
• Nationality.
• Postal address and country of residence.
• Telephone number.
• Email address.
• National ID card (DNI), foreigner identity number (NIE), passport or other identification document.
• Driving licence number, country of issue, date of issue and expiry date.
• Data relating to the main driver and additional drivers.
• Data relating to the booking and rental agreement.
• Vehicle pick-up and return dates and times.
• Data relating to the rented vehicle, registration number and category.
• Hotel, accommodation and flight details where required for delivery, collection or transfer.
• Information relating to deposits, security deposits, charges, invoicing and payments.
• Information relating to damage, accidents, claims, fines, infringements, complaints or incidents.
• Communications made by email, telephone or WhatsApp.
• IP address, technical data, cookies and browsing data when the website is used.

SECRET RENT A CAR will process only the data necessary to provide the service, comply with legal obligations or fulfil the other purposes described in this policy.

3. PURPOSES OF PROCESSING

Personal data may be processed for the following purposes:

3.1. Booking and contract management

To manage requests for information, quotations, bookings and rental agreements for cars, scooters and other vehicles offered by SECRET RENT A CAR.

3.2. Provision of the rental service

To manage:

• vehicle delivery and return;
• additional drivers;
• deposits and security deposits;
• accessories;
• assistance;
• insurance;
• vehicle replacements;
• delivery and collection services;
• customer assistance during the rental period.

3.3. Administrative, tax and accounting management

To manage invoicing, payments, collections, refunds, deposits and other financial transactions, as well as to comply with applicable tax, commercial and accounting obligations.

3.4. Compliance with legal obligations relating to vehicle rental

SECRET RENT A CAR is required to record and report certain data relating to its customers, drivers, contracts and vehicles to the competent authorities where required by the regulations in force.

In particular, certain identification, documentary and contractual data may be transmitted to the Security Forces and other competent authorities in compliance with the legal obligations applicable to motor vehicle rental activities.

Where legally required, these communications may include:

• identification details of the renter;
• identity document or passport;
• driving licence details;
• contact details;
• rental agreement details;
• vehicle and registration number;
• rental start and end date and time;
• any other information required by applicable regulations.

SECRET RENT A CAR will communicate only the data legally required and through the procedures made available by the competent authorities.

3.5. Management of accidents, damage and claims

The data may be used to manage vehicle damage, accidents, assistance, insurance claims, assessments, repairs and complaints.

3.6. Management of fines and infringements

When SECRET RENT A CAR receives a fine, request or driver identification notice corresponding to the rental period, it may communicate the details of the responsible driver to the competent authority where there is a legal obligation to do so.

3.7. Prevention of fraud and breaches

The data may be processed to prevent fraud, theft, misappropriation, non-payment, misuse of the vehicle or contractual breaches.

3.8. Customer service

To respond to enquiries received via:

• telephone;
• WhatsApp;
• email;
• web form;
• in-person assistance.

3.9. Marketing communications

SECRET RENT A CAR may send information about promotions, offers and services where the user has given consent or where another valid legal basis applies.

The data subject may request at any time to stop receiving such communications.

4. LEGAL BASIS FOR PROCESSING

The main legal bases relied upon are:

Performance of a contract or pre-contractual measures:

to manage quotations, bookings, contracts, rentals, payments, deliveries and requested services.

Compliance with legal obligations:

for tax, accounting and administrative obligations, as well as those relating to vehicle rental and the communication of data to competent authorities.

Legitimate interest:

to prevent fraud, manage complaints, protect the vehicle fleet and the company’s financial interests, and establish, exercise or defend legal claims.

Consent:

for specific processing activities that require it, such as certain marketing communications.

5. DISCLOSURE OF DATA TO AUTHORITIES

Personal data may be disclosed to:

• State Security Forces and Corps;
• police authorities;
• judicial authorities;
• Directorate-General for Traffic (DGT);
• tax authorities;
• competent public bodies;

where such disclosure is required by applicable law or is necessary to comply with a legal request.

The disclosure of such data does not constitute a commercial or voluntary transfer, but rather compliance with the legal obligations applicable to SECRET RENT A CAR.

6. PAYMENT DATA

Electronic payments may be managed through external payment service providers, including, where applicable:

• financial institutions;
• Redsys;
• PayPal;
• other authorised payment providers.

SECRET RENT A CAR will not store full bank card details where these are processed directly by the relevant financial institution or payment provider.

Each provider will process the data in accordance with its own legal obligations and privacy policies.

7. SERVICE PROVIDERS AND DATA PROCESSORS

SECRET RENT A CAR may use external service providers necessary for its business activities, such as:

• rental management platforms and software;
• web hosting services;
• email services;
• booking system providers;
• payment providers;
• IT services;
• courier and messaging services;
• tax, employment or legal advisers;
• repair workshops;
• insurance companies;
• assistance companies.

Where these providers process data on behalf of SECRET RENT A CAR, they will act, where applicable, as data processors and must provide the safeguards required by the GDPR.

8. WHATSAPP AND COMMUNICATIONS

When a customer contacts SECRET RENT A CAR via WhatsApp, the following data may be processed:

• telephone number;
• user name;
• messages;
• files;
• photographs;
• documents;
• information relating to bookings or contracts.

The use of WhatsApp is also subject to the terms and privacy policies of its provider.

Users are advised not to send unnecessary or particularly sensitive information through this channel.

9. DATA RETENTION

Personal data will be retained for as long as necessary to manage the booking, contract and provision of the service.

Thereafter, the data may remain duly blocked for the periods required by applicable tax, commercial, administrative, contractual, traffic or security regulations, as well as for the periods necessary to address potential liabilities and claims.

When there is no longer a legal obligation or legitimate need to retain the data, it will be securely deleted or anonymised.

10. RECIPIENTS OF THE DATA

Where necessary, the data may be disclosed to:

• Security Forces;
• police authorities;
• judicial authorities;
• Directorate-General for Traffic (DGT);
• tax authorities;
• insurance companies;
• insurance brokers;
• loss adjusters and assessors;
• repair workshops;
• assistance companies;
• banking institutions;
• payment providers;
• administrative and accounting firms;
• tax, accounting or legal advisers;
• IT and technology providers;

other providers necessary to deliver the contracted service.

SECRET RENT A CAR does not sell personal data to third parties.

11. INTERNATIONAL DATA TRANSFERS

Some technology providers may process data outside the European Economic Area.

Where international data transfers take place, SECRET RENT A CAR will seek to ensure that they are carried out using mechanisms recognised by the GDPR, such as:

• adequacy decisions;
• standard contractual clauses;
• other legally valid mechanisms.

12. DATA SUBJECT RIGHTS

The data subject may exercise the rights of:

• access;
• rectification;
• erasure;
• objection;
• restriction of processing;
• data portability;
• withdrawal of consent.

To exercise these rights, the data subject may write to:

secretrentacar@gmail.com

Using the following subject line:

“Data Protection”

and specifying the right they wish to exercise.

Where necessary, SECRET RENT A CAR may request additional information to verify the identity of the applicant.

13. RIGHT TO LODGE A COMPLAINT

If the data subject believes that their personal data has not been processed correctly, they may first contact SECRET RENT A CAR.

They may also lodge a complaint with the:

Spanish Data Protection Agency (AEPD).

14. INFORMATION SECURITY

SECRET RENT A CAR will implement reasonable technical and organisational measures to protect personal data against:

• unauthorised access;
• loss;
• alteration;
• disclosure;
• destruction;
• improper processing.

Access to the data will be limited to employees, collaborators and service providers who need to use it in order to perform their duties.

15. DATA OF ADDITIONAL DRIVERS AND THIRD PARTIES

Where the customer provides personal data relating to an additional driver or another person, the customer declares that they are authorised to provide such data and that they have informed that person about the processing of their data.

16. REQUIREMENT TO PROVIDE CERTAIN DATA

To rent a vehicle, certain personal data is required in order to:

• identify the renter;
• verify the driving licence;
• enter into the contract;
• comply with legal obligations;
• manage payment;
• deliver the vehicle.

If the customer does not provide the mandatory data, SECRET RENT A CAR may be unable to enter into or perform the contract.

17. COOKIES AND BROWSING

The website uses cookies and similar technologies.

Users can consult specific information about cookies in the Cookie Policy published at www.secretrentacar.es.

18. MARKETING COMMUNICATIONS

Marketing communications are not required in order to rent a vehicle.

Where processing is based on consent, such consent must be given specifically.

The user may withdraw such consent at any time.

19. CHANGES TO THE PRIVACY POLICY

SECRET RENT A CAR may update this Privacy Policy where necessary due to:

legal changes;

• changes to its services;
• the addition of new service providers;
• technological changes;
• new data processing activities.

The current version will be available on the website at all times.

SECRET RENT A CAR S.L.

Tax ID (CIF): B72450174

Avenida de Gran Canaria 20

Playa del Inglés – Maspalomas

35100 Las Palmas, Spain

Tel./WhatsApp: +34 641 328 403

Email: secretrentacar@gmail.com

Website: www.secretrentacar.es

SECRET RENT A CAR S.L. • Privacy Policy • September 2026