This policy explains what personal data we process when you rent a car from us or write to us, why we process it, and what rights you have. Last updated: 4 September 2026. The Romanian version of this page prevails.
Who processes the data
The controller is TxN Car Rent, operating from Zaharia Stanciu nr. 1, Brasov. You can reach us at 0770 506 112 or Ganju.Georgee@yahoo.com. We are not required to appoint a data protection officer, so questions on this subject come straight to us.
What we collect
- When you book: your name, phone or WhatsApp number, e-mail address if you write by e-mail, and the period you need.
- When you sign the agreement: the details on your ID document and driving licence – name, address, series and number, licence number, categories and date obtained – and a copy or photo of those documents where it is needed to draw up the agreement. We collect the same for the second driver, if there is one.
- About the rental: the period, pickup and return times, the condition of the car at handover and return, the deposit, payment and invoicing details.
- If something goes wrong: details of damage, traffic fines or road tolls relating to the period you had the car.
- If you book online: your name, phone number, e-mail address if you give one, the dates you chose, the language you filled the form in, and optionally your arrival flight or train time. We also record the exact moment you ticked the consent box and the IP address the request came from — the first as proof of consent, the second to stop abusive automated requests.
- If you use the contact form: your name, contact details and message.
- During the rental: the location data of the car, recorded by the GPS device fitted to it. See the dedicated section below.
- When you visit the site: ordinary technical data from server logs, such as IP address and time of access, kept by the hosting provider for security and operation.
Why we process it and on what basis
- To rent you the car – booking, agreement, handover, return and invoice. Basis: performance of the contract and steps before it, art. 6(1)(b) GDPR.
- To comply with the law – invoicing and accounting, keeping documents, and giving the driver’s details to the authorities when we receive a fine for the rental period. Basis: legal obligation, art. 6(1)(c).
- To protect our cars – evidence of condition at handover and return, recovering damage or unpaid amounts. Basis: legitimate interest, art. 6(1)(f).
- If we ask for your consent separately for anything beyond the rental itself. Basis: consent, art. 6(1)(a). We do not send commercial messages without your consent and we have no newsletter.
Who receives the data
We do not sell or rent your data to anyone. We pass it only to:
- the accountant who keeps our tax records;
- the insurance company, if damage needs to be reported;
- public authorities – police, ANPC, ANAF – at their lawful request or when we are required to give the driver’s details for a fine;
- the website hosting provider and the e-mail provider, acting as processors or as their own controllers for the infrastructure used;
- Google, for the reservations calendar: when a booking is confirmed we create an event in our Google Calendar containing your name, phone number and e-mail address, so we know who is coming and when. Google acts as a processor for this service. If you would rather we did not put your booking in the calendar, tell us and we will keep it only in our own records.
- WhatsApp, if you choose to write to us there. The conversation passes through Meta’s service, under their privacy policy. If you would rather avoid that, call us or send an e-mail.
Transfers outside the European Union
We do not ourselves transfer data outside the EU. Three services we use may involve such a transfer: WhatsApp, if you contact us there; Google Fonts, used for the site’s typefaces, which receives the visitor’s IP address when the page loads; and Google Calendar, which receives your name, phone number and e-mail address when a booking is confirmed. These transfers rely on the mechanisms provided by the GDPR for transfers to the United States.
How long we keep it
- Rental agreements and invoices: 10 years, under accounting and tax law.
- Copies of ID documents and licences: only as long as needed for the agreement and for any complaint or fine linked to that rental.
- Booking messages that did not turn into a rental: 12 months at most.
- Messages received through the site form: 12 months at most after our last reply.
GPS tracking of the car
Every car is fitted with a GPS tracking device, active for the whole rental period. We tell you this before you sign, and it is also stated in the rental agreement.
- What data this produces: the position of the car and the history of its movements during the period you rented it.
- Why: so we can protect and recover the car in case of theft, failure to return it on time, or an accident, and so we can send help if you break down.
- When we look: only when one of the situations above arises. During a rental that goes normally we do not check where the car is.
- Legal basis: our legitimate interest in protecting our property, art. 6(1)(f) GDPR. We weighed that interest against your right to privacy and limited the use of the data strictly to the situations above.
- Who has access: only the people who handle rentals, reading the position straight from the device. We use no external monitoring platform and give this data to no one else. We pass it to authorities only at their lawful request, for example in a theft investigation.
- How long we keep it: for the rental period only. Once you bring the car back we keep no movement history, except where a case is already open – theft, accident or dispute – when we keep it until that case is closed.
We do not use location data to score your driving, for marketing, or for automated decisions, and we do not follow your route in real time out of curiosity. You may object to this processing under art. 21 GDPR: write to us, we will consider the request and give you a reasoned answer.
What we do not do
We do not check you against private risk databases and we make no automated decisions about you. We do not process children’s data.
Your rights
You have the right of access to your data, and rights of rectification, erasure, restriction, portability, and objection to processing based on legitimate interest. If you gave us consent, you can withdraw it at any time, as easily as you gave it. Write to Ganju.Georgee@yahoo.com or call us and we will reply within 30 days at most. Some data cannot be deleted before the legal retention period for accounting documents – in that case we will explain why.
If you are unhappy with how we handled it, you can complain to the National Supervisory Authority for Personal Data Processing, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, dataprotection.ro.
Security
Paper documents are kept locked away, and access to electronic files is limited to the people who handle rentals. The site uses a secure HTTPS connection.
Changes
If we change anything in this policy, we update the date at the top of the page. See also the Cookie policy.