Skip to content

Privacy policy

Last updated:

This policy explains what personal data Safe Rentals Cars collects through this website (www.safe-rentalcars.com), what we use it for, who else handles it, how long we keep it and what rights you have.

We process personal data in line with the applicable Albanian personal data protection law and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

Safe Rentals Cars is responsible for (the “controller” of) the personal data described in this policy.

  • Legal name: SafeRentals SHPK

You can reach us here:

2. What we collect and why

We collect only what we need for the purposes below. We do not sell personal data, we do not use it for advertising, and we do not make decisions about you by automated means alone.

Booking requests

When you send a booking request from a car’s page, we receive:

  • your name and phone number and, if you give one, your e-mail address;
  • the pick-up point, the pick-up and return dates and, if you give them, the times;
  • the car you chose;
  • if you are signed in to a customer account, a link between the request and your account.

The request is saved in our booking system as a pending request, together with the estimated price shown to you (including the pick-up point’s fee, where it has one), and our team is told about it by e-mail. We use it to check that the car is free, to contact you by phone or WhatsApp to confirm it, and to prepare your rental. Your name and phone number are required: without them we cannot answer your request. The e-mail address is optional: if you give one, we send you an e-mail confirming that we received the request, with its reference and details, and another when we confirm or cancel the booking, and we may use it to reach you about this booking; we do not use it for newsletters or advertising. The legal basis is taking the steps you ask for before a rental contract is made, and then carrying out that contract.

Bookings made by phone, WhatsApp or in person

If you book with us directly, our staff enter the same details in the booking system and may add internal notes, for example how the booking was arranged. The purpose and the legal basis are the same as for a request sent online.

WhatsApp messages

The WhatsApp button on a car’s page opens WhatsApp on your device with a message that already contains the details from the booking form: your name, phone number, pick-up point, dates and the car. Nothing is sent until you send the message yourself. Messages and calls you exchange with us on WhatsApp are handled by WhatsApp under its own privacy policy; we use them to answer you and to arrange your rental.

Customer account (optional)

You can book without an account. If you create one, we store your name, e-mail address and phone number, your password in a hashed form that cannot be turned back into the password, the date the account was created and when you last signed in. Requests you send while signed in are linked to your account and listed on your account page. Our staff can also open an account for you, for example when you book by phone or at our office. We use this data to let you sign in, to fill in the booking form for you and to show you your requests. We also send you e-mails about the account itself, and nothing else: a welcome e-mail with a link to choose your password when our staff open the account for you, and a link to reset your password when you ask for one on the sign-in page or ask our staff to send it. These links work only once and expire (the welcome link after 72 hours, the reset link after 1 hour); they never contain your password, and we never send passwords by e-mail. The legal basis is providing the account you asked for.

Contact form

The form on our contact page sends us your first and last name, e-mail address, phone number (optional) and your message by e-mail. It is not saved in the booking system. We use it to answer you. The legal basis is our legitimate interest in replying to people who write to us, or the steps you ask for before a rental.

When you collect the car

When you collect a car, we check the documents listed in our rental terms: your driving licence, your passport or ID card and a credit or debit card in your name.

We take a copy of your driving licence and keep it with the rental agreement. We need it to carry out the rental contract, to establish who was responsible for the car if it is damaged or a claim arises, and to give the driver’s details to the police or other authorities when a traffic fine or another legal obligation requires it. The legal basis is carrying out the rental contract and complying with our legal obligations.

We also take a security deposit, as described in the rental terms.

This happens in person, not through this website. The website never asks for card details and takes no payments.

Technical data

When you visit the website, your browser sends technical data such as your IP address, the type of browser and device, the page requested and the time. Our server and Cloudflare (see Who receives your data) use it to deliver the pages and images and to protect the website against abuse, and it may be kept for a short time in their logs. The legal basis is our legitimate interest in running a secure, working website.

We use no analytics, advertising or social-media tracking, and no embedded social-media content. The fonts are served from our own website, so no font provider sees your visit.

3. Cookies

We use only the cookies the website needs to work. None of them is used for statistics or advertising, so we do not show a cookie banner.

  • NEXT_LOCALE remembers the language you choose. It is set only when you pick a language, and it lasts one year. Until then the site uses the language your browser asks for, if we have it, and English otherwise.
  • authjs.session-token (__Secure-authjs.session-token on the secure site) keeps you signed in to your customer account. It is set when you sign in and removed when you sign out; otherwise it expires after 30 days without use.
  • Other authjs.* cookies are short-lived security cookies the sign-in system may set while you sign in, for example to protect the form against forged requests.
  • Cloudflare may set a security cookie (such as __cf_bm) when it needs to tell people apart from automated traffic.

You can delete cookies in your browser settings. Without the language cookie the site is shown in English; without the session cookie you cannot stay signed in.

4. Who receives your data

Your data is seen by our team and by the following, only as far as each of them needs it:

  • Our web developer, who runs the server that hosts the website, the booking system and its database, and the mail server that sends our booking and contact notifications, the e-mails confirming a booking request and the account e-mails (welcome and password reset). The developer acts on our instructions.
  • Cloudflare, which delivers the website and its images and protects them against attacks. Every visit passes through Cloudflare.
  • WhatsApp and phone operators, when you choose to contact us that way.
  • Public authorities, when the law requires us to share data.

We do not sell or rent personal data to anyone.

5. Data outside Albania

Cloudflare operates worldwide, so the data it handles may be processed outside Albania, including in the European Union and the United States. In its data-processing terms, Cloudflare sets out the safeguards it applies to such transfers, such as standard contractual clauses.

6. How long we keep your data

We keep personal data only as long as we need it for the purposes above:

  • Booking requests and bookings: as long as needed to handle the booking and any questions or claims about it, and as long as Albanian accounting and tax law requires.
  • Copies of driving licences: for as long as needed for the rental and as required by law.
  • Customer accounts: until you ask us to delete the account. Bookings linked to a deleted account are kept, without the link, for the period above.
  • Contact messages and booking notifications in our mailbox: as long as needed to answer you and follow up.
  • Technical logs: for the short periods set by our server and by Cloudflare.

7. Your rights

Under the applicable data protection law, you have the right to:

  • ask whether we hold data about you and get a copy of it;
  • have incorrect data corrected; you can change your name and phone number yourself on your account page;
  • have your data deleted, for example your customer account;
  • restrict or object to how we use your data, in particular where we rely on our legitimate interest;
  • receive the data you gave us in a common electronic format;
  • withdraw, at any time, any consent you have given us.

To use these rights, write to [email protected] or call +355 68 477 7704. We may need to confirm who you are before we answer, and we reply within the time limits the law sets.

Some data must be kept even if you ask us to delete it, for example where accounting or tax law requires it.

If you think we have not handled your data properly, you can complain to the Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale) at idp.al. We would be grateful for the chance to answer your concerns first.

8. How we protect your data

The website is served only over an encrypted connection (HTTPS). Passwords are stored hashed, never in readable form. Only our staff, each signing in with their own account, can open the booking system, and what each person can do there depends on their role.

9. Changes to this policy

If the way we handle data changes, for example if we start a newsletter, we will update this policy and the date at the top of this page.

10. Contact

Questions about this policy or about your data can be sent to us:

You can also use our contact page.