Legal
Privacy Policy
This policy explains what personal data we collect when you rent a BlackRent car or contact us, why we use it, who we share it with, how long we keep it and what rights you have under Regulation (EU) 2016/679 (GDPR). We have kept it as simple as possible; if anything is unclear, just ask us.
This is a translation of the Romanian original (Politica de confidențialitate). If the two versions differ, the Romanian version prevails.
Last updated: 24 September 2026
The controller of your data is HOMI MARCOS 96 S.R.L. (brand BlackRent), tax identification number (CUI) RO39848830, Trade Register number J12/3560/2020, registered office at Sat Florești, Comuna Florești, Str. Eroilor nr. 380B, et. 3, ap. 22, jud. Cluj, postal code 407280, Romania. For any question about your data: contact@blackrent.ro or +40 767 894 022. We have not appointed a data protection officer (DPO), so please write to us directly.
1. In short
- We collect only the data needed for the booking and the rental.
- Card details are processed exclusively by Stripe; we never see or store them.
- We send no newsletters or offers, we do not profile you and we do not sell data to anyone. After the rental you receive a single email asking you to leave us a review.
- The public website uses no cookies, no third-party analytics and no tracking pixels; we only count, in aggregate and without personal data, where visits come from (see our Cookie Policy).
2. What data we collect
When you make a booking
- your name, email address and phone number;
- the delivery and return address (or the airport) and, optionally, your flight number;
- any notes you choose to write to us;
- booking details: dates and times, amounts paid, booking code (BR-XXXXXX) and payment status;
- the IP address from which the booking request was sent, to prevent abuse;
- the source that brought you to the website (for example Google, Instagram or a link on a flyer), if known.
The data in the booking form is needed to conclude and perform the contract; without it we cannot make the booking. The flight number and notes are optional.
Payment
Online payment takes place on Stripe’s secure payment page. You enter your card details directly with Stripe, and they are processed exclusively by Stripe. We only receive the payment confirmation and transaction information such as the amount, date and payment status.
At pick-up
We check your ID card (or passport) and driving licence, and those of any additional drivers. If we need to keep a copy of a document, we will tell you and keep it only as long as necessary.
When you contact us
If you email us, message us on WhatsApp or call us, we use the data from the conversation (for example your phone number and the content of your messages) to reply to you.
Technical data
As with any website, the hosting server may automatically record technical data in its access logs, such as IP address, date and time of access and browser type, for the security and operation of the website.
3. Why we use the data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Booking, payment, delivery and return of the car, checking the drivers, communicating with you about the booking (including the confirmation call) and answering your questions before you book | Performance of the contract or steps taken at your request before entering into it — Art. 6(1)(b) |
| Invoicing, accounting and tax records, replies to requests from authorities | Legal obligation — Art. 6(1)(c) |
| A single email after the rental ends, asking you to leave us a Google review; learning which channels bring us customers (the booking source and aggregate statistics with no personal data) | Our legitimate interest in improving our service and knowing which promotion works — Art. 6(1)(f). You can object at any time by replying to the email. |
| Website security, prevention of fraud and abuse (including via the IP address), defending our rights in a complaint or dispute | Our legitimate interest — Art. 6(1)(f) |
We send you no newsletters or offers, we do not profile you and we do not take decisions based solely on automated processing that produce legal effects for you.
4. Who we share the data with
- OVHcloud (France, EU) — website and email hosting.
- Stripe Payments Europe, Limited (Ireland) — card payment processing. For certain purposes of its own, such as fraud prevention and legal compliance, Stripe acts as an independent controller, under its privacy policy.
- WhatsApp (Meta) — only if you choose to contact us on WhatsApp; WhatsApp’s own privacy policy then also applies.
- Our accountant — for accounting and tax records.
- Public authorities (for example the police, courts or tax authorities) — only when the law requires it, for example to identify the driver for a fine incurred during the rental.
We do not sell or rent your data to anyone.
5. Transfers outside the European Economic Area
The website and email are hosted in the EU. Stripe and, if you use WhatsApp, Meta may transfer some data outside the European Economic Area, including to the United States. According to the information published by Stripe, such transfers rely on safeguards provided by the GDPR, such as the EU–US Data Privacy Framework or standard contractual clauses approved by the European Commission.
6. How long we keep the data
- Paid bookings and billing data: 5 years, counted from 1 July of the year following the end of the financial year in which the documents were drawn up (Article 25 of Romanian Accounting Law No. 82/1991).
- Unfinished or unpaid booking attempts: deleted after 90 days.
- Emails and messages: as long as needed for the booking and any complaints.
- IP address of the booking request: kept for at most 6 months, then automatically deleted from the booking.
- If a complaint or dispute arises, we may keep the relevant data until it is finally resolved.
7. Your rights
You have the right to:
- find out what data we hold about you and get a copy (right of access);
- have incorrect data corrected (rectification);
- have your data erased, except data we must keep by law, such as accounting documents;
- ask us to restrict processing;
- receive the data you gave us in a structured format so you can pass it to another controller (portability);
- object to processing based on our legitimate interest;
- lodge a complaint with the Romanian data protection authority, ANSPDCP: www.dataprotection.ro.
To exercise your rights, write to contact@blackrent.ro. We reply within one month of receiving your request. We may ask for additional information only to confirm that the request comes from you.
8. How we protect the data
We take reasonable technical and organisational measures to protect the data: access to bookings is restricted to BlackRent staff and protected by a password, and card payments are handled exclusively by Stripe.
9. Changes to this policy
We may update this policy when the way we work or the law changes. The date of the last update is shown at the top of this page. The rental conditions are in our Terms & Conditions.