Privacy notice

1. Controller

Controller: Trade Rent A Car Kft. (Trade Rent A Car Korlátolt Felelősségű Társaság), operator of Trade Rent.

Registered seat: 2230 Gyömrő, Dózsa György út 137. Tax no.: 33130934-2-13. Company reg. no.: 13-09-249387.

Contact: rent@traderent.hu, +36 70 321 7800.

2. What we process

At booking: name, phone, email, address, pick-up and return dates and times, car, handover option, extra driver's name, notes.

At handover and at the desk: driving licence number and photo, the contract, the signature, booking status, fee, deposit, odometer and fuel level at handover and return, and photos of damage to the vehicle.

For online payment: payment ID, amount, currency and status. Card details are handled by Teya; we never see or store them.

GPS data: the HolAzAutó tracker installed in the rental cars records the vehicle's position, distance driven, speed and fuel level. During the rental this data can be linked to the renter.

Communication: email and WhatsApp messages exchanged with us.

3. Purpose and legal basis

Performing the booking and the rental contract, billing (including km and fuel), contact — GDPR Art. 6(1)(b) (contract).

Invoicing and keeping accounting records — GDPR Art. 6(1)(c) (legal obligation).

GPS tracking for asset protection (detecting theft or unauthorised use) and to check compliance with the contract (e.g. speed limit, permitted countries) — GDPR Art. 6(1)(f) (Trade Rent's legitimate interest). You may object; we assess each objection individually.

Enforcing claims (damage, fines, unpaid fees) — GDPR Art. 6(1)(f) (legitimate interest).

We do not sell data or profile you for ads.

4. Processors

Teya (Teya Hungary Zrt., 1024 Budapest, Lövőház utca 39., Hungary) — online card payments.

Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) — hosting of the website and application (servers: Frankfurt, EU).

Neon (Neon LLC, part of Databricks, Inc., USA) — database service (bookings, contracts, photos).

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — Google Workspace: sending and receiving email (confirmation emails are sent from Trade Rent's Google Workspace mailbox), Google Drive (contracts, documents and damage photos), Google Calendar (booking schedule).

Mobile LBS Kft. (HolAzAutó; 7625 Pécs, István utca 7. 1. em. 6., Hungary, company reg. no. 02-09-078039) — GPS tracking of the rental cars (position, km, speed, fuel level).

Processors may only use the data on Trade Rent's instructions and for the purposes above.

5. Transfers outside the EEA

Vercel and Neon are based in the USA; Google's processing may also involve servers outside the EEA. Transfers rely on the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

6. Retention

Invoices and contract data used as accounting records: 8 years under the Hungarian Accounting Act.

Other contract data: until claims under the contract become time-barred (general limitation period: 5 years).

GPS data, licence and damage photos: [TODO – retention period to be set by the owner].

Unused quote requests: 1 year.

7. Cookies

Necessary: your language and cookie choice are stored in your browser (localStorage, “tr-lang” and “tr-consent”). Interest in cars is measured with anonymous, aggregated counters without personal data.

Campaign source: if you arrive from an ad or campaign link (utm_* parameters or a Facebook/Google click id), the source of that first arrival is kept in your browser's session storage (“tr-attr”, sessionStorage) and, when you book, only the source category (e.g. google, facebook) is recorded with the booking. Click-id values are not stored; the entry is deleted when you close the tab. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — knowing where bookings come from.

Google Analytics 4 (statistics): we measure how the website is used (pages viewed, booking steps, value and car type of a completed booking) with Google Analytics 4 (G-N3XKZXQ7GP, Google Ireland Ltd.) to see what works well on the site. Analytics cookies (e.g. _ga, _ga_*) are only set if you click “Accept” in the cookie bar (Consent Mode v2, analytics_storage denied by default); GA4 does not store IP addresses. Legal basis: consent (GDPR Art. 6(1)(a)), withdrawable via “Cookie settings” in the footer. Retention: up to 14 months. Details: policies.google.com/privacy.

Google Ads (marketing): we measure our ads (e.g. a completed online booking as a conversion) with the Google Ads tag (gtag.js, Google Ireland Ltd.). Advertising/measurement cookies (e.g. _gcl_au, IDE) are only set if you click “Accept” in the cookie bar (Google Consent Mode v2; default: denied). Legal basis: consent (GDPR Art. 6(1)(a)). If you decline, Google only receives cookieless, aggregated signals. You can withdraw consent at any time via “Cookie settings” in the footer. Data may be transferred outside the EEA (USA) under Google’s standard contractual clauses; details: policies.google.com/technologies/ads.

Meta Pixel (marketing): we measure our Facebook and Instagram ads with the Meta Pixel (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland): pages viewed, car page views (car and daily price), booking started, pay-on-site booking submitted and completed online payment (booking code, amount, currency). The Pixel script and its cookies (e.g. _fbp, _fbc) are only loaded if you click “Accept” in the cookie bar; until then Meta receives no data. Legal basis: consent (GDPR Art. 6(1)(a)), withdrawable at any time via “Cookie settings” in the footer — on withdrawal the Pixel stops sending and the Meta cookies are deleted. We are joint controllers with Meta for this measurement (GDPR Art. 26). Data may be transferred outside the EEA (USA) under the EU–US Data Privacy Framework and/or standard contractual clauses. Retention: the _fbp cookie up to 90 days. Details: facebook.com/privacy/policy.

8. Your rights

Access, rectification, erasure, restriction, portability, objection (to processing based on legitimate interest) — write to the email above. We reply within one month.

Complaint: Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., ugyfelszolgalat@naih.hu. You may also go to court.