1. Who we are
The data controller is Drive Quest Car Rental, operating through DriveQuest.gr, based in Chania, Crete, Greece (“DriveQuest”, “we”, “us”). We decide why and how personal data is processed for our website, enquiries, reservations and rental services.
2. Scope of this policy
This policy applies to personal data processed through DriveQuest.gr, our booking and contact forms, telephone, email, WhatsApp, rental agreements, vehicle collection and return, incident reports, customer support and related rental operations. Third-party websites and services have their own privacy notices.
3. Personal data we collect
Information you provide
- Identity and eligibility details, such as name, date of birth, nationality, identity/passport information and driving-licence information.
- Contact details, such as email address, telephone/WhatsApp number, postal address, country, city and postcode.
- Reservation and rental details, including dates, times, locations, vehicle category, insurance plan, extras, additional drivers, flight/arrival information, passengers and luggage.
- Payment and transaction information. Card details, where an online payment provider is used, are processed by that provider; DriveQuest generally receives payment status and transaction references rather than full card details.
- Communications, support requests, feedback, comments and incident-report information, including information needed to manage accidents, damage, roadside assistance or claims.
Information collected automatically
- Device, browser, approximate location derived from IP address, page activity, referral source, security logs and booking-session information.
- Cookie choices and information generated by analytics, advertising, maps, reviews, anti-spam and similar technologies, where enabled and permitted.
Please provide personal data about another driver or passenger only when you are authorised to do so and they have been informed about this policy.
4. Why we use personal data and our legal bases
- Steps before a contract and performance of a contract: to answer rental requests, check availability, create and manage reservations, prepare rental agreements, deliver and collect vehicles, take payment and provide customer support.
- Legal obligations: to comply with tax, accounting, insurance, road-traffic, identity-verification and other legal requirements, and to respond to competent authorities where required.
- Legitimate interests: to protect vehicles and customers, prevent fraud and misuse, maintain security, improve service, manage complaints, accidents and legal claims, and keep appropriate business records. We balance these interests against your rights.
- Consent: for optional analytics or advertising cookies, direct marketing where consent is required, and any other processing for which we specifically ask permission. Consent may be withdrawn at any time without affecting earlier lawful processing.
- Vital interests: exceptionally, where processing is necessary to protect someone’s life or physical safety during an emergency.
Where information is necessary for a reservation, rental agreement or legal requirement, failure to provide it may mean that we cannot complete the booking or provide the rental service.
5. Who may receive personal data
We disclose only what is reasonably necessary to recipients such as:
- Website hosting, booking-system, form, email, IT, security and customer-support providers acting on our instructions.
- Payment service providers, banks and financial institutions used to process or verify transactions.
- Insurers, roadside-assistance providers, repairers, assessors and professional advisers where needed for an incident, damage or claim.
- Accountants, auditors, legal advisers and public authorities where disclosure is legally required or necessary to establish, exercise or defend legal claims.
- Google services used on the site, including analytics/tag-management, advertising, Maps and reCAPTCHA, where enabled; Trustindex for review display; and Meta/WhatsApp when you choose to contact us through WhatsApp.
We do not sell personal data. Service providers may process data only for agreed purposes and subject to appropriate contractual and security obligations.
6. International data transfers
Some technology providers may process data outside the European Economic Area. When this happens, we rely on an applicable European Commission adequacy decision, approved Standard Contractual Clauses or another lawful safeguard, together with supplementary measures where appropriate. You may contact us for information about the safeguards relevant to your data.
7. How long we keep data
We keep personal data only for as long as needed for the purpose for which it was collected and to meet legal, accounting, insurance and claim requirements. In particular:
- Rental, booking, invoice and transaction records are retained for the periods required by applicable tax, accounting and transport laws.
- General enquiries and support communications are normally retained for up to 24 months, unless they become part of a reservation, complaint or legal matter.
- Incident, damage and claim records are retained until the matter is resolved and any applicable legal limitation period has expired.
- Technical and security logs are retained for a limited period appropriate to security and troubleshooting, unless an incident requires longer retention.
- Consent records and cookie choices may be kept for as long as necessary to demonstrate compliance. Data used on the basis of consent is stopped when consent is withdrawn, unless another lawful basis requires retention.
When data is no longer needed, it is deleted, anonymised or securely isolated from further use.
9. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, unauthorised access, disclosure or destruction. No internet transmission or storage system is completely risk-free, but access is limited according to operational need and safeguards are reviewed when appropriate.
10. Your data-protection rights
Subject to the conditions of the GDPR, you may request access to your data, correction of inaccurate data, deletion, restriction, portability, or object to processing based on legitimate interests or direct marketing. You may withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. DriveQuest does not normally use such automated decision-making.
To exercise a right, email info@drivequest.gr. We may need to verify your identity and will respond within the period required by law.
You may also lodge a complaint with the Hellenic Data Protection Authority or the supervisory authority of your habitual residence, workplace or the place of the alleged infringement.
11. Children
Our vehicle-rental services are not directed to children. We do not knowingly collect children’s personal data through the website except where information is lawfully provided by an adult for a necessary rental extra or safety requirement.
12. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The current version and its update date will be published on this page. Material changes may also be highlighted through the website or another appropriate channel.
13. Privacy contact
For questions, requests or concerns about this policy or the use of your personal data, contact DriveQuest at: