Privacy policy

This policy explains what personal data Olympian Car Rental collects when you use our website, book a car and sign the rental agreement, why we need it, who else receives it, how long we keep it and what rights you have. It is written to meet Article 13 of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek Law 4624/2019.

1. Who we are

The controller of your personal data is:

• Olympian Car Rental
• Kos, Greece
• Phone / WhatsApp: +30 697 828 2619
• Email: info@olympianrentals.gr

We are a small, owner-run car rental business on Kos. We have not appointed a Data Protection Officer because the law does not require one for a business of our size and activity. For any privacy question, write to info@olympianrentals.gr or message us on +30 697 828 2619.

2. What we collect, and why

We only ask for what we need to rent you a car. We do not take card details online, we do not ask for your date of birth, we do not take copies of your driving licence or ID, and we do not run analytics, advertising or tracking tools on the website.

2.1 When you book on the website

Please do not write sensitive information (for example health data) in the notes field.

While you fill in the form, your entries are kept only in your own browser (see section 8) so they survive a page refresh. They reach us only when you press the booking button.

To protect the booking form from abuse, our server briefly reads your IP address to limit repeated attempts. This counter lives only in the server's short-term memory and is not saved with your booking. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f)).

2.2 When we hand over the car

We write down the licence and ID numbers ourselves at handover. We do not take photos, scans or copies of your driving licence, passport or ID card, and the website has no field for uploading them.

2.3 When you sign the rental agreement

You sign on your phone (or ours) through a private one-time link that expires after 24 hours. We record:

• the name you type,
• your handwritten signature (as an image),
• the date and time of signing,
• the IP address and the browser/device description (user agent) of the device you signed on,
• the version of the rental terms you accepted.

We use these to prove that you agreed to the rental terms, and for nothing else. Legal basis: contract, and our legitimate interest in being able to prove the agreement if there is a dispute (Art. 6(1)(f)).

2.4 When you return the car and pay

We record the return date and time, kilometres, fuel, any extra charges (for example refuelling, late return, cleaning, damage or a traffic fine admin fee) with a short note, the payment method (cash or card at handover), the amount paid and the name of the staff member who collected it. Payment is made in person on delivery; card payments are handled by the card terminal provider, not by our website.

Legal bases: contract; legal obligation (Art. 6(1)(c)) to keep accounting and tax records and to issue receipts under Greek tax law; legitimate interest in claiming amounts owed for damage, fuel or fines.

2.5 When you contact us

If you email us or tap a WhatsApp link, we receive whatever you send us (name, number or address, message). We use it to answer you and, if you book, as part of your booking. Legal basis: steps you ask us to take before a contract, or the contract itself; otherwise our legitimate interest in answering enquiries.

2.6 Choosing the delivery and return place

To tell us where to deliver and collect the car, you can choose:

• Kos airport or Kos port;
• a hotel from our list of hotel names;
• "Use my location": only if you tap this button, your browser asks your permission. If you allow it, your browser gives us your current coordinates, which are sent only to our own server and saved with your booking. The website itself uses no third-party map or address service. We do not track your location. You can refuse or withdraw this permission at any time in your browser settings;
• a free-text field where you can type an address or directions.

To find the delivery or return point, the owner may open the saved coordinates or address in Google Maps on the owner's own phone or computer; this sends the coordinates to Google.

Legal basis: steps you ask us to take before a contract and the performance of the contract (Art. 6(1)(b)). For "Use my location", your browser also asks your permission before sharing your location.

2.7 Staff login

Our own staff log in to the admin area with an email and password. This concerns only our staff, not customers.

3. Who receives your data

We do not sell your data and we do not share it for marketing. We share it only as follows.

Service providers who process data on our behalf (processors, under a data processing agreement):

Independent third parties (they decide themselves how they use the data, under their own privacy policies):

4. Transfers outside the European Economic Area

• Vercel (USA): Vercel is certified under the EU-US Data Privacy Framework, and its data processing agreement also contains the European Commission's Standard Contractual Clauses (SCCs).
• Supabase: our data is stored in Ireland. Where Supabase or its sub-processors access it from outside the EEA, this is covered by the Standard Contractual Clauses in Supabase's data processing agreement.
• Google (Google Maps): when the owner opens a delivery point in Google Maps, Google may transfer the coordinates to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.
• WhatsApp / Meta: if you choose WhatsApp, Meta may transfer data to the USA under its own safeguards (EU-US Data Privacy Framework / SCCs).

You can ask us for a copy of the safeguards that apply.

5. How long we keep your data

When a period ends we delete the data or make it anonymous. At present we do this by hand: the website does not yet delete data automatically, so we review our records regularly and delete what is due.

6. Is giving us your data required?

Name, email, phone, age band, the licence confirmation and the trip details are needed to make a booking. The licence and ID details and the signature are needed to hand over the car. Without them we cannot rent you a car. Everything marked "No" in section 2.1 is optional.

7. Your rights

You have the right to:

• access the data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• have your data deleted, when we no longer need it or have no legal reason to keep it (we cannot delete records that tax law requires us to keep);
• restrict our use of your data in certain cases, for example while we check a correction;
• data portability: receive the data you gave us for the booking in a common electronic format;
• object at any time, on grounds relating to your situation, to use of your data based on our legitimate interest;
• withdraw your permission for location access at any time in your browser.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The booking system applies fixed rules (for example, it does not accept drivers under 19 and adds the young driver fee for ages 19–20); if you think a rule was applied wrongly, contact us and we will check it personally.

To use your rights, write to info@olympianrentals.gr or message +30 697 828 2619. We may ask you to confirm your identity. We will answer within one month; in complex cases this may be extended by up to two more months, and we will tell you why.

8. Cookies and browser storage

We use only what is strictly necessary for the site to work or that you have asked for. We use no analytics, advertising, social media pixels or other tracking, and no third-party cookies. Fonts are served from our own website. For this reason we do not show a cookie consent banner.

Session storage stays in your browser and is not sent to us. You can delete cookies and site data at any time in your browser settings; the site will still work, but it may forget your language.

If we ever add analytics or similar tools, we will ask for your consent first and update this policy.

9. Security

The database and photo storage are private: only our logged-in staff can see bookings, agreements, photos and signatures. Signing links are random, used once and expire after 24 hours. Connections to the site are encrypted (HTTPS).

10. Complaints

If you think we have mishandled your data, please tell us first so we can put it right. You also have the right to complain to the Greek supervisory authority:

Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) Kifisias 1–3, 115 23 Athens, Greece · www.dpa.gr

If you live in another EU country, you can also complain to the authority there.

11. Changes

If we change this policy we will publish the new version on this page with a new date. If a change affects a booking you have already made, we will tell you.