Privacy Policy

(Last updated: 2025)
This Privacy Policy explains how Flagman Rent Car (the “Company”, “we”, “us”, “our”) collects, uses, stores, and protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the laws of the Republic of Cyprus.

1. DATA CONTROLLER
The data controller is the company operating under the Flagman Rent Car brand.
Contact details are available on the Company’s website.
2. PERSONAL DATA WE COLLECT
We may collect and process the following categories of personal data:
full name, date of birth, nationality;
contact details (phone number, email address);
identification documents (passport or ID card);
driving licence details;
booking and rental information;
payment and deposit-related information;
communication records;
vehicle usage data, including GPS/location data where applicable.
We do not collect or process health-related or other special category data, unless such information is voluntarily provided by the customer for a specific, lawful purpose and with explicit consent.
3. PURPOSES AND LEGAL BASIS OF PROCESSING
We process personal data for the following purposes:
to conclude and perform the vehicle rental agreement;
to verify identity and driving eligibility;
to manage bookings, payments, deposits, and refunds;
to provide customer support and communicate rental-related information;
to manage vehicle safety, security, and fleet operations;
to investigate accidents, incidents, or contract violations;
to comply with legal, regulatory, and insurance requirements.
Legal bases for processing include:
performance of a contract (Article 6(1)(b) GDPR);
compliance with legal obligations (Article 6(1)(c) GDPR);
legitimate interests of the Company (Article 6(1)(f) GDPR).
4. GPS AND LOCATION DATA
Rented vehicles may be equipped with GPS or telematics systems.
GPS and location data may be processed for legitimate business purposes, including:
vehicle security and theft prevention;
accident or incident investigation;
contract compliance and misuse prevention;
recovery of the vehicle in case of breach of the rental agreement.
GPS data is not used for continuous monitoring unrelated to the rental and is processed in accordance with applicable data protection laws.
5. DATA SHARING AND DISCLOSURE
Personal data may be disclosed to:
insurance companies;
payment service providers and banks;
law enforcement or public authorities, where required by law;
legal or professional advisors;
IT and system providers supporting booking and fleet management systems.
Data is shared only to the extent necessary and subject to appropriate safeguards.
6. DATA RETENTION
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, including contractual, legal, accounting, and dispute-resolution obligations.
Unless a longer retention period is required by law, rental-related data is generally retained for up to three (3) years after completion of the rental.
7. DATA SECURITY
We implement appropriate technical and organisational measures to protect personal data against unauthorized access, loss, misuse, or disclosure.
8. DATA SUBJECT RIGHTS
Under applicable data protection laws, you have the right to:
access your personal data;
request rectification or erasure;
restrict or object to processing;
request data portability, where applicable;
lodge a complaint with the competent data protection authority.
Requests may be submitted using the contact details available on our website.
9. ADDITIONAL SERVICES AND EQUIPMENT
Personal data related to optional additional equipment or services (including but not limited to additional drivers, young driver surcharge, Wi-Fi devices, SUP boards, or other ancillary services) is processed solely for the purpose of providing such services and managing related charges or liabilities.

10. CHANGES TO THIS PRIVACY POLICY
We reserve the right to update this Privacy Policy from time to time.
The latest version will always be published on our website.
11. CONTACT
For questions regarding this Privacy Policy or personal data processing, please contact us using the contact details provided on our website.

We care about your privacy. We aim to ensure that your personal data is secured by managing it in accordance with the provisions of the new EU Regulation implemented on 25th of May 2018 – “General Data Protection Regulation” or often referred to as “GDPR”.