- Who is responsible
The controller for the processing of personal data on carenzzo.com and all its language versions (the „Website”) is:
- Carenzzo LLC, Ukraine, registered under 357865, Ukraine E-mail: support@carenzzo.com
Carenzzo operates a comparison service for car rental. We are not a car rental company and are not a party to any rental agreement.
- Contacting us about your data
You can reach us on all matters relating to the processing of your personal data at support@carenzzo.com. We answer in English and Russian.
- Data we process
3.1 Server log data When you open the Website, our hosting provider automatically records: IP address, date and time of the request, the page requested, referring URL, browser type and version, operating system, and the amount of data transferred. Purpose: delivering the Website, ensuring stability and security, detecting abuse. Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the Website. Retention: 90 days, then deleted or anonymised.
3.2 Search parameters When you use the search function you enter a pick-up location, dates, times and, where applicable, driver age. These parameters are transmitted to our partner Localrent in order to retrieve offers. They are not linked to your identity by us. Legal basis: Article 6(1)(b) GDPR, performance of a service you request, and Article 6(1)(f) GDPR.
3.3 Contact If you write to us at support@carenzzo.com or use a contact form, we process your e-mail address, your message and any information you include in it, in order to answer you. Legal basis: Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR where your enquiry relates to a booking. Retention: general enquiries are deleted 6 months after the matter is closed. Correspondence relating to a specific booking or a complaint is kept for 3 years from the end of the year in which the matter was closed, to allow us to establish or defend legal claims.
3.4 Analytics and advertising Described in section 5. Where you arrive at the Website through one of our advertisements, the link contains a click identifier assigned by Google, which allows the visit to be attributed to the campaign.
We do not process special categories of data (Article 9 GDPR) and do not ask you to provide any.
- Cookies and similar technologies
4.1 Cookies are small files stored on your device. Similar technologies include local storage and pixels; where this policy refers to cookies, these are included.
4.2 Strictly necessary cookies are used to operate the Website and to store your cookie preference. Legal basis: Article 6(1)(f) GDPR and, for storage on your device, the national implementation of Article 5(3) of Directive 2002/58/EC.
4.3 Analytics and advertising cookies are currently set when the Website is opened. We are implementing consent-based loading of these services. Until this is in place, you can prevent or delete these cookies through your browser settings.
4.4 You can withdraw a consent you have given at any time with effect for the future, via {consent_settings_link}. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
4.5 A current list of the cookies used, including their provider, purpose and duration, is available in the cookie settings, which you can open at any time via {consent_settings_link}.
- Google services
5.1 Google Tag Manager We use Google Tag Manager to manage the scripts described below. Google Tag Manager does not itself store personal data in cookies, but loads the tags that do, and processes your IP address in doing so.
5.2 Google Analytics 4 Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Google Analytics 4 to understand how the Website is used: pages viewed, searches started, offers viewed and bookings initiated. IP addresses are shortened by Google before storage. Legal basis: Article 6(1)(a) GDPR.
5.3 Google Ads Provider: Google Ireland Limited. We do not use conversion tracking or advertising tags on the Website. Our Google Analytics property is linked to our Google Ads account, which allows audiences derived from Website usage to be used for advertising purposes and allows visits to be associated with our advertising campaigns. Legal basis: Article 6(1)(a) GDPR.
5.4 Transfers to Google in the United States Google may transfer data to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection. In addition, Standard Contractual Clauses are in place.
Google privacy policy: policies.google.com/privacy
- Booking with our partner
6.1 The offers shown on the Website are provided by Localrent, operated by Renot Software OÜ, registration number 12352497, Kadaka tee 137-65, Mustamäe district, 12915 Tallinn, Estonia. The booking process and payment are carried out by Localrent and by the rental company you select.
6.2 When you start a booking, the data you enter – name, contact details, driving licence details, flight number where requested – is processed by Localrent as an independent controller under its own privacy policy. We do not receive this data.
6.3 Payment is processed in an environment operated by Localrent and its payment service provider. We do not receive, see or store your payment card details.
6.4 We receive from Localrent aggregated statistical information about bookings attributed to us, for the purpose of commission settlement. This information does not identify you.
6.5 Localrent uses its own analytics, advertising and session recording tools within the booking widget, under its own privacy policy. We do not receive data from these tools.
6.6 Localrent privacy policy: www.localrent.com/en/policy/
- Hosting
The Website is hosted by Hosting Ukraine LLC, Ukraine, Kyiv, Mashinobudivna 35a. The provider processes data on our behalf as a processor under a data processing agreement pursuant to Article 28 GDPR. Servers are located in Ukraine
- Where your data is processed
8.1 We are established in Ukraine. Data you provide to us directly, and data our processors handle on our instructions, may be processed in Ukraine.
8.2 Ukraine is not the subject of an adequacy decision of the European Commission. We apply appropriate safeguards: access to data is limited to what is necessary, connections are encrypted, and our processors are bound by Article 28 agreements.
8.3 Ukrainian law on the protection of personal data applies to us in addition to the GDPR. Where the two differ, we apply the standard that gives you more protection.
- Your rights
You have the right to:
- obtain confirmation whether we process your data, and access to it (Article 15 GDPR);
- have inaccurate data corrected (Article 16 GDPR);
- have your data erased (Article 17 GDPR);
- restrict processing (Article 18 GDPR);
- receive your data in a portable format (Article 20 GDPR);
- object to processing based on legitimate interest, on grounds relating to your particular situation, and to object at any time to processing for direct marketing (Article 21 GDPR);
- withdraw consent at any time (Article 7(3) GDPR).
To exercise these rights, contact us at support@carenzzo.com. We respond within one month.
We do not carry out automated decision-making producing legal effects concerning you, within the meaning of Article 22 GDPR.
- Right to complain
A list of the supervisory authorities of the EU and EEA Member States is
available from the European Data Protection Board:
edpb.europa.eu/about-edpb/about-edpb/members_en
Users in the United Kingdom may contact the Information Commissioner’s
Office, ico.org.uk
- Children
The Website is not directed at children. Car rental requires a minimum age set by the rental companies. We do not knowingly process data of persons under 16.
- Is providing data required
Providing personal data is not required by law or by contract. You can browse the Website without using the search function. Without the search parameters described in 3.2 we cannot show you offers.
- Changes
We may update this policy to reflect changes in our processing or in the law. The current version is the one published here, with the date shown at the top.