Privacy Policy

Last updated: 1 January 2025

1. Introduction and Scope

Malagorent ("we", "us", "our") operates a car rental service based in Малага, Andalusia, Spain. This Privacy Policy explains how we collect, use, store, and share personal information when you visit our website at malagorent.com, make a booking, contact our team, or otherwise interact with our services.

This policy applies to all customers and website visitors who rent a car in Малага through our platform, including bookings made for pickup at Малага-Costa del Sol Airport (AGP), our city centre desk near the Малага Park area, the port, or any hotel delivery location across Andalusia.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation - GDPR), Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and any other applicable data protection legislation in force in Spain and the European Union.

By using our website or services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.

2. Data Controller

The data controller responsible for your personal information is:

• Trading name: Malagorent
• Registered address: Малага, Andalusia, Spain
• Contact email: info@malagorent.com
• Contact phone: +34 624 258 713

For all data protection enquiries, including requests to exercise your rights, please contact us at the email address above.

3. Information We Collect

3.1 Personal Identification Data

When you make a booking or enquiry with us, we collect personal details including your full name, email address, telephone number, home address, date of birth, nationality, and driving licence number and expiry date. For bookings involving additional drivers, we collect the same identification information for each named driver on the rental agreement.

3.2 Booking and Rental Data

We collect information related to your car hire, including your pickup and drop-off locations (such as Малага Airport, city centre, or Малага Park), rental dates and times, vehicle category selected, extras requested (child seats, GPS, insurance upgrades), one-way rental destinations within Andalusia or beyond, and any special requests or notes provided at booking.

3.3 Payment Information

We do not store full payment card details on our own servers. Payment transactions are handled by trusted third-party payment processors who are PCI-DSS compliant. We may retain limited transaction reference data such as the last four digits of a card, transaction ID, and payment status for accounting and customer service purposes. Our no-deposit booking model means many customers complete their reservation without any upfront card charge - however, basic card verification data may still be processed at the time of pickup.

3.4 Browsing and Technical Data

When you visit malagorent.com, we automatically collect certain technical information including your IP address, browser type and version, operating system, device type, referring URLs, pages visited on our site, time and date of access, and session duration. This data is collected through server logs and cookies as described in our Cookie Use policy.

3.5 Location Data

If you permit your browser or device to share location information, we may use this to suggest the nearest pickup location to you - for example, whether the Малага Airport desk or the Малага Park city centre location is most convenient. You can disable location sharing in your browser settings at any time without affecting your ability to make a booking.

3.6 Communications Data

If you contact us by email, telephone, or through any contact form on our website, we retain records of that correspondence including the content of messages, timestamps, and any attachments. This applies to support requests, complaints, booking amendments, and general enquiries about renting a car in Малага.

4. How We Use Your Information

4.1 Processing Your Booking

The primary purpose for which we use your personal data is to fulfil your car rental booking. This includes confirming your reservation, preparing the rental agreement, verifying your driving licence, arranging vehicle pickup at your chosen Малага location, and processing any changes or cancellations you request. The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR).

4.2 Customer Support

We use your contact details and booking data to provide customer support before, during, and after your rental period. This includes responding to enquiries about your hire car in Малага, handling complaints or damage disputes, and assisting with roadside issues during your trip around Andalusia. The legal basis is our legitimate interest in delivering quality service and fulfilling our contractual obligations.

4.3 Improving Our Services

We analyse aggregated and anonymised data about how customers use our website and booking platform to improve our services, fix technical issues, develop new features, and refine the vehicle categories we offer in Малага. This processing is based on our legitimate interests in operating and improving a competitive car rental business.

4.4 Marketing Communications

If you have given explicit consent, we may send you promotional emails about car hire deals in Малага, seasonal offers, and travel tips for Andalusia. You may withdraw your consent at any time by clicking the unsubscribe link in any marketing email or by contacting us directly at info@malagorent.com. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

4.5 Legal and Regulatory Compliance

We process personal data where necessary to comply with legal obligations under Spanish and European Union law, including tax and accounting requirements, obligations to insurance regulators, and cooperation with law enforcement or judicial authorities where required by law. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR).

4.6 Fraud Prevention and Security

We use certain data, including booking patterns, IP addresses, and payment verification signals, to detect and prevent fraudulent bookings, identity theft, and misuse of our services. This processing is based on our legitimate interests in protecting our business and our customers.

5. Data Sharing with Third Parties

5.1 Payment Processors

We share necessary payment data with our third-party payment processing partners to handle card verification and transaction processing. These partners operate under their own privacy policies and are required to maintain appropriate security standards.

5.2 Insurance Providers

Where you purchase insurance as part of your car hire in Малага - including collision damage waiver, theft protection, or supplemental liability cover - we share relevant booking and driver information with our insurance partners to underwrite and administer your policy.

5.3 Booking Platform Integrators

Our booking system is supported by third-party technology integrators who may process your data on our behalf as data processors. These integrators are bound by data processing agreements that require them to handle your information only in accordance with our instructions and applicable law.

5.4 Legal Authorities

We may disclose personal information to Spanish law enforcement, the Agencia Espanola de Proteccion de Datos (AEPD), courts, or other public authorities when required to do so by law or when we believe disclosure is necessary to protect the rights, property, or safety of our business, customers, or third parties.

5.5 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Booking and contract records: 6 years from the date of the rental, in line with Spanish commercial law requirements.
• Financial and tax records: 5 years from the end of the relevant tax year, as required by Spanish tax legislation.
• Customer support communications: 2 years from the date of the last interaction, unless a dispute remains open.
• Marketing consent records: until you withdraw consent, plus an additional 3 years for compliance records.
• Website browsing and technical data: typically 13 months, in line with standard cookie retention practices.
• Insurance claim records: up to 10 years where claims are involved, in accordance with insurer requirements.

When retention periods expire, personal data is securely deleted or anonymised in accordance with our internal data lifecycle procedures.

7. Your Rights Under GDPR and Spanish Law

As a data subject under the GDPR and Spain's LOPDGDD, you have the following rights in relation to your personal information:

7.1 Right of Access

You have the right to request a copy of the personal data we hold about you, along with information about how it is used, where it came from, and with whom it has been shared.

7.2 Right to Rectification

If any personal data we hold is inaccurate or incomplete, you have the right to request that we correct or complete it. This is particularly important for driving licence data and contact details used in your rental agreement.

7.3 Right to Erasure

You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been unlawfully processed. This right is subject to certain exceptions, including our legal obligation to retain financial and contract records.

7.4 Right to Data Portability

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

7.5 Right to Object

You have the right to object to the processing of your personal data where that processing is based on our legitimate interests. You may also object at any time to processing for direct marketing purposes, including profiling related to direct marketing.

7.6 Right to Restriction of Processing

You may request that we restrict the processing of your personal data in certain circumstances, for example while a dispute about the accuracy of your data is being resolved.

7.7 Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Spanish data protection supervisory authority, the Agencia Espanola de Proteccion de Datos (AEPD), at www.aepd.es. You also retain the right to seek a judicial remedy.

To exercise any of the rights above, please contact us at info@malagorent.com. We will respond to verified requests within 30 days, and may extend this by a further two months in cases of complexity or volume, with notice to you.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include encryption of data in transit using TLS (Transport Layer Security), access controls limiting data access to authorised staff who need it to perform their duties, regular security assessments of our website and internal systems, staff training on data protection obligations, and secure deletion procedures for data that has reached the end of its retention period.

While we take data security seriously, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to promptly notifying affected individuals and the AEPD in the event of a data breach that poses a risk to your rights and freedoms, in accordance with our obligations under Article 33 and 34 of the GDPR.

9. International Data Transfers

We primarily process and store personal data within the European Economic Area (EEA). Where any data transfer to a country outside the EEA is necessary - for example, through the use of certain technology service providers - we ensure that adequate safeguards are in place, such as the use of Standard Contractual Clauses approved by the European Commission, to protect your personal information to the same standard as within the EEA.

10. Children's Privacy

Our car rental services are intended for adults who hold a valid driving licence. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us at info@malagorent.com and we will take steps to delete that information promptly.

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will post the updated policy on this page with a revised "Last updated" date. We encourage you to review this page periodically. Where changes are significant, we may also notify you directly by email if we hold your contact details.

Your continued use of our website or services after a policy update constitutes your acknowledgement of the updated terms. If you do not agree with the updated policy, you should stop using our services and contact us to request deletion of your data where applicable.

12. Contact Us About Privacy

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how we handle your personal information in connection with car hire in Малага, please get in touch with us:

• Email: info@malagorent.com
• Address: Малага, Andalusia, Spain
• Phone: +34 624 258 713 (Mon-Fri, standard business hours)

We aim to respond to all privacy-related enquiries promptly and no later than within 30 calendar days.