Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how krakowcarrental.com ("we", "us", or "our") collects, processes, stores, and protects personal data in connection with our vehicle rental comparison and booking service based in Kraków, Lesser Poland Voivodeship, Poland.

This policy applies to all visitors and users of our website at krakowcarrental.com, as well as to any individuals who submit an enquiry, complete a booking, or otherwise interact with our services. It covers data collected online, by email, and by telephone.

We are committed to handling your personal data responsibly and in full compliance with applicable European Union data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Polish Act on Personal Data Protection of 10 May 2018. Where you are located outside the European Economic Area, we still apply the same high standards described in this policy.

By using our website or submitting a booking enquiry, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

Kraków Car Rental
Kraków, Lesser Poland Voivodeship, Poland
Email: [email protected]
Phone: +1 (706) 888-5783

If you have any questions about how your data is processed or wish to exercise your rights, please contact us using the details above.

3. Information We Collect

We collect the following categories of personal data depending on how you interact with our service:

3.1 Personal Identification Data

• Full name
• Email address
• Phone number
• Driver's license number and issuing country
• Date of birth (where required by a rental supplier to verify age eligibility)
• Nationality and passport or ID number (where required by local regulations)

3.2 Booking and Rental Data

• Pickup and drop-off location (e.g., Kraków-Balice Airport (KRK), Kraków Główny railway station, Old Town hotel delivery)
• Rental dates, times, and duration
• Vehicle category selected (economy, automatic, SUV, 7-seater, hybrid)
• Optional extras requested (child seat, GPS, additional driver)
• One-way drop-off destination (e.g., Warsaw, Wrocław, Katowice)
• Booking reference numbers and confirmation status

3.3 Payment Information

We do not store full payment card details on our servers. Payment transactions are handled entirely by trusted third-party payment processors who comply with PCI DSS standards. We may retain a record of the transaction reference, amount, currency, and outcome for accounting and dispute-resolution purposes.

3.4 Browsing and Technical Data

• IP address and approximate geographic location
• Browser type and version
• Operating system and device type
• Pages visited, time spent on each page, and referral source
• Cookie identifiers and session tokens (see our Cookies Policy for full details)

3.5 Communications Data

• Content of emails and messages sent to our support address
• Records of telephone interactions where calls are logged for quality purposes

4. How We Use Your Data

We process your personal data for the following purposes and on the following legal bases under the GDPR:

4.1 Processing Bookings (Contractual Necessity)

To fulfil a vehicle rental booking or enquiry, we must process your identification details, booking preferences, and contact information. Without this data we cannot connect you with a rental supplier or confirm your reservation.

4.2 Customer Support (Contractual Necessity and Legitimate Interest)

We use your contact details and booking data to respond to support requests, resolve disputes, manage cancellations, and assist with modifications to your rental arrangement.

4.3 Service Improvement (Legitimate Interest)

Aggregated and anonymised browsing and usage data helps us improve the functionality, speed, and relevance of our website. This includes understanding which vehicle categories are most searched, which pickup locations (such as KRK Airport or the Kazimierz district) are most popular, and where users encounter difficulties in the booking flow.

4.4 Marketing Communications (Consent)

If you have opted in to receive marketing communications, we may send you information about promotional rental rates, seasonal deals for travel around Lesser Poland, or updates to our service. You may withdraw consent at any time by clicking the unsubscribe link in any email or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4.5 Legal Compliance (Legal Obligation)

We may process and retain data as required by Polish law, EU regulations, tax authorities, or court orders. This includes maintaining booking records for the statutory retention period applicable in Poland.

4.6 Fraud Prevention and Security (Legitimate Interest)

We monitor interactions and booking patterns to detect and prevent fraudulent activity, protect our customers, and maintain the integrity of the booking platform.

5. Data Sharing with Third Parties

We do not sell your personal data. We share your data only with the following categories of trusted partners, and only to the extent necessary to deliver our services:

5.1 Vehicle Rental Suppliers

When you complete a booking, we transmit your name, contact details, driver's license information, and booking preferences to the relevant rental supplier so they can prepare your vehicle and verify your identity at pickup.

5.2 Payment Processors

Payment data is passed securely to our certified payment processing partners. These processors operate under strict data protection agreements and PCI DSS compliance frameworks.

5.3 Insurance Providers

Where you select additional insurance coverage, the relevant data needed to administer your policy (booking details, driver information, vehicle category) may be shared with the insurance underwriter.

5.4 Technology and Booking Integration Partners

We work with booking engine providers and API integration partners to surface vehicle availability and pricing. These partners process data only on our behalf and under written data processing agreements.

5.5 Analytics and Performance Tools

We use analytics tools to understand how our website is used. Where these tools process personal data, we ensure appropriate safeguards are in place, including standard contractual clauses for transfers outside the EEA.

5.6 Legal Authorities

We may disclose personal data to Polish law enforcement, regulatory authorities, or courts when required to do so by law or in response to valid legal process.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by law. The following indicative retention periods apply:

• Booking records and identification data: retained for 5 years from the date of the rental, in line with Polish civil law obligations for contractual records.
• Financial and payment transaction records: retained for 5 years from the end of the financial year in which the transaction occurred, as required by Polish accounting law.
• Customer support correspondence: retained for 2 years from the date of the last interaction, unless a longer period is required for dispute resolution.
• Marketing consent records: retained until consent is withdrawn, plus 1 year to demonstrate compliance.
• Browsing and analytics data: retained in aggregated or anonymised form indefinitely; identifiable browsing logs are deleted after 13 months.

When data is no longer required, it is securely deleted or anonymised in accordance with our internal data disposal procedures.

7. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights with respect to your personal data:

7.1 Right of Access

You may request a copy of the personal data we hold about you, together with information about how it is processed.

7.2 Right to Rectification

You may ask us to correct any inaccurate or incomplete personal data we hold about you.

7.3 Right to Erasure

You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where we have no other lawful basis for retaining it. This right is subject to exceptions for legal compliance and legitimate interests.

7.4 Right to Data Portability

Where processing is based on your consent or on a contract, you may request that we provide your personal data in a structured, commonly used, machine-readable format so it can be transferred to another controller.

7.5 Right to Object

You may object to processing carried out on the basis of our legitimate interests at any time. You also have an unconditional right to object to processing of your data for direct marketing purposes.

7.6 Right to Restrict Processing

You may request that we limit the processing of your data in certain circumstances, for example while we investigate a challenge to the accuracy of the data.

7.7 Right to Lodge a Complaint

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Polish supervisory authority: the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych, UODO), based in Warsaw, Poland. Further information is available at uodo.gov.pl.

To exercise any of the above rights, please contact us at [email protected]. We will respond within 30 days of receiving your verified request.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• HTTPS encryption for all data transmitted between your browser and our servers
• Access controls limiting staff access to personal data on a need-to-know basis
• Regular security assessments and vulnerability testing of our platform
• Data processing agreements with all third-party suppliers who handle personal data on our behalf
• Secure deletion procedures when data reaches the end of its retention period

While we take all reasonable precautions, no method of internet transmission is completely secure. If you suspect your data has been compromised, please contact us immediately at [email protected].

9. International Data Transfers

Where personal data is transferred to countries outside the European Economic Area (for example, to technology partners operating globally), we ensure that such transfers are protected by appropriate safeguards, including standard contractual clauses approved by the European Commission or equivalent mechanisms recognised under GDPR Chapter V.

10. Cookies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse traffic, and support our booking functionality. For a full explanation of the cookies we use and how to control them, please read our Cookies Policy.

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, applicable law, or best practice. When we make material changes, we will update the effective date shown at the top of this page and, where appropriate, notify users by email or by a prominent notice on the website. We encourage you to review this policy periodically.

Continued use of our website after any changes are posted constitutes your acceptance of the updated policy.

12. Contact for Privacy Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the personal data we hold about you, please contact our privacy team:

Kraków Car Rental - Privacy Enquiries
Kraków, Lesser Poland Voivodeship, Poland
Email: [email protected]
Phone: +1 (706) 888-5783

This Privacy Policy was last reviewed and updated in 2025. It applies to all personal data processed by krakowcarrental.com in connection with vehicle rental bookings and enquiries relating to Kraków and the Lesser Poland Voivodeship region.