1. Data Controller

Autocreta, with registered office at Kokkini Hani 71500, Heraklion, Crete, Greece, acts as the Data Controller of the personal data collected in the context of providing vehicle rental services.

Processing is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and applicable Greek data protection legislation.

2. Categories of Personal Data Collected

When submitting a booking, requesting a quotation or entering into a rental agreement, we may collect:

  • Full name

  • Residential address

  • Contact telephone number

  • Email address

  • Tax Identification Number (where required)

  • Driving licence number

  • Identity card or passport number

  • Flight or ferry details (where applicable)

  • Hotel details (for hotel deliveries)

  • Booking-related information (vehicle category, dates, times, etc.)

We collect only the data necessary for the provision of our services.

3. Purpose of Processing

Personal data is processed exclusively for:

  • The conclusion and performance of the rental agreement

  • Booking management and confirmation

  • Communication with the customer

  • Customer service and complaint handling

  • Compliance with legal and tax obligations

  • Improvement of our services

4. Legal Basis for Processing

Processing is based on:

  • Performance of a contract (Article 6(1)(b) GDPR)

  • Compliance with a legal obligation (Article 6(1)(c) GDPR)

  • Legitimate interests of the company (Article 6(1)(f) GDPR), particularly for security, fraud prevention and service improvement purposes

Personal data is not disclosed to third parties unless required by law, necessary for contract performance, or requested by competent authorities.

5. Data Retention

Personal data is retained for as long as necessary to fulfil the purposes of processing and comply with legal obligations.

In accordance with Greek tax and accounting legislation, relevant data may be retained for up to seven (7) years following the end of the rental agreement.

After this period, data is securely deleted or destroyed.

6. Technical & Organisational Security Measures

The company implements appropriate technical and organisational measures to safeguard personal data, including:

  • Secure servers

  • SSL encryption

  • Restricted access to authorised personnel

  • Internal data protection policies

7. GPS & Fleet Management Systems

The company’s vehicles may be equipped with GPS tracking and fleet management systems for the purpose of vehicle protection, theft prevention, management of technical incidents, and ensuring compliance with the rental terms.

Activation or use of location data may occur particularly in cases of violation of the rental terms, including but not limited to unauthorized transfer of the vehicle outside Crete, unauthorized use, or delay in vehicle return.

Location data are not used for continuous or personal monitoring of the renter, but exclusively for safety reasons, protection of the company’s property, and the company’s legitimate business interests.

In the event of a criminal offense or upon lawful request, relevant data may be disclosed to competent judicial or administrative authorities in accordance with applicable legislation.

Data processing is carried out in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Greek data protection laws.

8. Data Subject Rights

Customers have the right to:

  • Access their personal data

  • Request rectification of inaccurate data

  • Request erasure (where applicable)

  • Restrict processing

  • Object to processing

  • Lodge a complaint with the Hellenic Data Protection Authority

9. Policy Updates

This Privacy Policy may be updated to reflect legal or operational changes. The latest version will always be available on our official website.

10. Contact Information

For any questions regarding the processing of your personal data, please contact:

Email: info@autocreta.gr
Mob: +30 6977574699