Who is responsible for your data
The data controller is TECHNIC ONE d.o.o., Marina Frapa, Lapadska obala 21a, 20000 Dubrovnik, Croatia, VAT number HR63056167991, which operates Dubrovnik Car Rent. For any privacy question or request, write to info@dubrovnikcarrent.com.
What we collect and why
When you ask for a price or book a car with a driver through the form, by email, by phone or on WhatsApp, we collect what you give us: your name, email address, phone number, the pick-up and drop-off places, the date and time, the number of passengers, the flight number, children’s ages for child seats and anything you write in the message. We use this data to price, confirm and carry out the booking, and to contact you about it. The legal basis is taking steps at your request before entering into a contract and then performing that contract (Article 6(1)(b) GDPR).
Where the booking form offers address search, the text you type into the pick-up and destination fields goes to our server, which sends it to Google Maps Platform, provided by Google Cloud EMEA Limited (Dublin, Ireland): Google suggests matching places and measures the driving distance we use for the price. Your browser does not connect to Google for this, and we never send Google your name, email address or phone number. Google processes this data as an independent controller, under the Google Maps Platform terms and the Google Privacy Policy. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).
When you pay online, the payment is made on Stripe’s checkout page: your card details go to Stripe and never to us. We receive your name, email address, phone number, the trip details you entered and the payment status, and use them to send your e-ticket and carry out the booking (Article 6(1)(b) GDPR). Stripe processes the payment under its own privacy policy. If you accepted analytics and advertising cookies on this site, we also report the completed purchase to Google and Meta to measure our advertising: its value, the booking id and a hashed (irreversibly scrambled) form of your email address and phone number. The legal basis is your consent (Article 6(1)(a) GDPR); if you declined cookies, nothing about your purchase is reported.
If you ask for the arrival cheat sheet, we use your email address to send you that one email and to tell our booking office about the request (Article 6(1)(b) GDPR). We do not add the address to a mailing list or send you marketing.
After a paid booking we may email you to ask how it went, with a link to rate it and to leave a public review on Google if you wish: at most two emails per booking (one request and, a few days later, one reminder) and no more than one request a year to the same address. The link carries your email address, first name, route and travel date in signed form; when you open it, the page checks the link with our own server before showing any of them, and then removes them from the address bar. If you rate the ride and write to us through that page, your rating and message reach our booking office by email; if you open the Google review link, we record that you replied, so that no reminder follows. Every email carries an unsubscribe link; once you unsubscribe, we keep a record of it for good, so that you are never asked again. To run this we keep short records in our hosting provider’s storage: the booking id with the date of each email, and, for replies, the yearly limit and unsubscribes, a keyed hash of your email address — never the address itself. The legal basis is our legitimate interest in hearing from our guests (Article 6(1)(f) GDPR), and you can object at any time.
With a request or booking we also record the page you sent it from and, where available, how you reached the site: the referring website, campaign tags in the link (UTM parameters), an advertising click identifier, and whether you arrived from an AI assistant. This information is kept in your browser’s session storage during your visit and is sent to us only if you submit the form. We use it to understand which channels bring enquiries. The legal basis is our legitimate interest in measuring our marketing (Article 6(1)(f) GDPR).
To keep the form free of spam we use a hidden field that real visitors never fill in and, where enabled, Google reCAPTCHA, which analyses the interaction with the form and is subject to Google’s privacy policy. The legal basis is our legitimate interest in protecting the service.
Invoices and accounting records are kept as Croatian tax and accounting law requires (Article 6(1)(c) GDPR).
Cookies and analytics
The site works without cookies. Analytics and advertising tags (Google Analytics 4, Google Ads, the Meta pixel, Microsoft Clarity and Hotjar) load only if you accept them in the cookie notice, and they stay off if you decline. The review and unsubscribe pages, which may show your name or email address, load no analytics or advertising tags at all. Your choice is stored in your browser so the notice is not shown again; you can change it by clearing the site data in your browser.
We may also use cookieless statistics (Cloudflare Web Analytics or Ahrefs Web Analytics), which count page views without cookies and without building a profile of you.
Who processes data for us
- Cloudflare, Inc. hosts the website and protects it from attacks. It processes technical data such as IP addresses.
- Mailgun (Sinch) delivers the emails generated by the form, e-tickets and review requests, using its EU region.
- Stripe processes online payments and refunds where online booking is offered.
- Google Ireland Ltd. provides analytics, advertising measurement and reCAPTCHA where these are enabled and, for analytics and advertising, only with your consent.
- Google Cloud EMEA Limited provides Google Maps Platform, where the booking form offers address search; it receives the text typed into the address fields as an independent controller, as explained above.
- Meta Platforms Ireland Ltd. provides advertising measurement (the Meta pixel and, for completed online payments, the Conversions API), only with your consent.
- Microsoft provides Clarity session statistics, only with your consent.
- Hotjar Ltd. provides heatmaps and session recordings of how the site is used, only with your consent.
- WhatsApp (Meta) carries the messages you choose to send us there.
Where these providers transfer data outside the European Economic Area, they do so under the European Commission’s standard contractual clauses or an adequacy decision. We do not sell personal data.
How long we keep it
Requests that do not lead to a booking are deleted within 12 months. For review emails, the record of which bookings were asked is kept by booking id for up to 600 days, so that no booking is asked twice; the records keyed by a hash of your email address expire after a year (a reply after two months), except unsubscribes, which are kept permanently so that we never write to that address again. Booking correspondence is kept for as long as needed to carry out the booking and deal with any follow-up, and accounting records for the period the law requires.
Your rights
You can ask us for a copy of your data, ask us to correct or delete it, ask us to restrict or stop a use of it, and ask for it in a portable format. Where processing is based on consent you can withdraw that consent at any time. Write to info@dubrovnikcarrent.com and we answer within one month.
You also have the right to complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, or to the data protection authority in your own country.
Changes
If this policy changes, the date at the top of the page changes with it. Related documents: the terms of service, the cancellation policy and the contact page.