Privacy Policy

Last updated: July 2026

Drive Time respects your privacy and is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the applicable Greek data protection legislation and all relevant European and national rules on the protection of personal data.

This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website, contact us, request a quote, make a reservation or use our car rental services.

1. Who we are

For the purposes of this Privacy Policy, the Data Controller is:

Drive Time
El. Venizelou 125, Gazi, Heraklion, Crete, 714 14, Greece
Telephone: +30 2811 815348
Mobile: +30 6932 5414 08
Mobile: +30 6932 5412 62
Email: info@drive-time.gr

For any question regarding this Privacy Policy or the processing of your personal data, you may contact us at the above email address.

2. What personal data means

“Personal data” means any information that identifies you or can identify you directly or indirectly. This may include your name, contact details, identification details, booking details, driving licence information, payment-related information, IP address or any other information connected with your reservation or rental.

“Processing” means any operation performed on personal data, such as collection, recording, storage, use, transmission, deletion or destruction.

3. What personal data we collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

3.1 Identification and driver details

We may collect your full name, date of birth, nationality, identity card or passport details, driving licence details, tax/VAT details where required for invoicing, and any information necessary to confirm that you are legally allowed to rent and drive a vehicle.

3.2 Contact details

We may collect your email address, telephone number, mobile number, postal address and any other contact information you provide when communicating with us or making a reservation.

3.3 Reservation and rental details

We may collect information related to your booking or rental, such as pick-up and drop-off dates and locations, vehicle category, selected services, additional drivers, rental duration, special requests, reservation history, rental agreement details and communication regarding your booking.

3.4 Payment and transaction information

We may process payment-related information necessary to complete your booking, issue invoices or receipts and manage payments. Where online payments are available, payment card details are processed securely by the relevant payment service provider. Drive Time does not store full credit or debit card numbers unless this is strictly required by law or by the payment provider’s secure procedure.

3.5 Communication data

When you contact us by email, phone, website form or other communication channel, we may process the content of your message and any information required to respond to your request.

3.6 Website and technical data

When you visit our website, we may collect technical data such as IP address, browser type, device information, pages visited, date and time of visit and cookie-related information, depending on your cookie choices and the technologies used on our website.

4. How we collect your personal data

We collect personal data directly from you when you:

• request information or a quote;
• make or modify a reservation;
• complete a rental agreement;
• contact us through the website, by email, by telephone or through social media;
• provide your driving licence, identity or invoicing details;
• subscribe to updates or marketing communication, where available;
• browse our website and accept cookies or similar technologies.

We may also receive personal data from third parties when this is necessary for the rental service, such as booking platforms, travel agencies, payment providers, insurance partners, roadside assistance providers or other partners involved in your reservation or rental.

5. Why we process your personal data

We process your personal data for the following purposes:

5.1 To manage reservations and provide car rental services

We process your data in order to confirm availability, complete your reservation, prepare the rental agreement, deliver and receive the vehicle, provide support during the rental period and manage any changes, cancellations or special requests.

5.2 To verify driver eligibility

We process identification and driving licence data in order to confirm that the driver meets the legal and contractual requirements for renting and driving a vehicle.

5.3 To process payments and issue legal documents

We process payment and invoicing data in order to receive payments, issue receipts or invoices, manage deposits, refunds or charges and comply with tax and accounting obligations.

5.4 To communicate with you

We use your contact details to respond to your questions, send reservation confirmations, provide rental information, notify you about changes to your booking and handle customer support requests.

5.5 To comply with legal obligations

We may process your data to comply with obligations arising from tax, accounting, insurance, road traffic, consumer protection or other applicable laws and regulations.

5.6 To protect our legal rights and business interests

We may process your data where necessary to manage claims, unpaid amounts, damages, traffic fines, insurance matters, fraud prevention, dispute resolution or the protection of our legal rights.

5.7 To improve our website and services

We may use limited technical and statistical information to improve the functionality, security and performance of our website and services.

5.8 To send marketing communication, only where permitted

If you have given your consent or where permitted by law, we may send you information about offers, services or updates related to Drive Time. You may withdraw your consent or unsubscribe at any time.

6. Legal basis for processing

We process your personal data only when there is a valid legal basis under GDPR. Depending on the purpose, the legal basis may be:

• Performance of a contract, when processing is necessary to manage your reservation, rental agreement, payment and related services.
• Legal obligation, when processing is required for tax, accounting, insurance, road traffic or other legal compliance purposes.
• Legitimate interest, when processing is necessary for customer service, fraud prevention, legal claims, debt management, vehicle protection, service improvement or business security, provided that your rights do not override our interests.
• Consent, where required, for example for certain marketing communications or non-essential cookies.

Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Who may receive your personal data

We do not sell your personal data.

Where necessary for the purposes described in this Privacy Policy, your personal data may be shared with:

• authorised employees or representatives of Drive Time;
• booking platforms or travel agencies involved in your reservation;
• payment service providers and banks;
• accountants, tax consultants or auditors;
• insurance companies and insurance intermediaries;
• roadside assistance providers;
• vehicle maintenance, repair or replacement partners;
• IT, hosting, website, email and technical support providers;
• legal advisors or debt collection partners, where necessary;
• public authorities, courts, police, tax authorities or other competent bodies, where required by law.

All third-party service providers are required to process personal data only for the purposes for which they are engaged and to apply appropriate confidentiality and security measures.

8. International transfers

As a rule, we aim to process and store your personal data within the European Economic Area. If, in limited cases, personal data is transferred outside the European Economic Area through service providers, booking systems, cloud services or technical tools, such transfer will take place only where appropriate safeguards are in place, in accordance with GDPR requirements.

9. How long we keep your personal data

We keep your personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law.

In general:

• reservation and rental agreement data is kept for as long as necessary for contractual, tax, accounting, insurance and legal claim purposes;
• invoicing and accounting data is kept for the period required by Greek tax and accounting legislation;
• communication data is kept for as long as necessary to handle your request and for a reasonable period afterwards;
• marketing consent data is kept until you withdraw your consent or unsubscribe;
• technical and cookie data is kept according to the cookie settings and retention periods described in our Cookie Policy or cookie banner.

When personal data is no longer required, it is securely deleted or anonymised.

10. Cookies and similar technologies

Our website may use cookies and similar technologies to ensure proper website operation, improve user experience, analyse website traffic and, where applicable, support advertising or remarketing activities.

Strictly necessary cookies may be used without your prior consent, as they are required for the website to function properly.

Non-essential cookies, such as analytics, advertising or third-party cookies, are used only where required consent has been obtained through the cookie banner or cookie settings.

You can manage or withdraw your cookie consent at any time through the cookie settings available on our website.

For more information, please refer to our Cookie Policy, where available.

11. How we protect your personal data

We apply appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, misuse, alteration, disclosure or destruction.

These measures may include access control, secure systems, confidentiality obligations, data minimisation, secure communication procedures and regular review of our practices.

Although no online service can guarantee absolute security, we take all reasonable steps to protect your personal data.

12. Your rights under GDPR

Subject to the conditions provided by law, you have the following rights:

Right of access

You have the right to request confirmation as to whether we process your personal data and to receive a copy of the personal data we hold about you.

Right to rectification

You have the right to request correction of inaccurate or incomplete personal data.

Right to erasure

You have the right to request deletion of your personal data where it is no longer necessary, where you have withdrawn consent, or where there is no lawful reason for us to continue processing it.

Right to restriction of processing

You have the right to request restriction of processing in certain cases, for example while the accuracy of your data is being verified.

Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request to receive your data in a structured, commonly used and machine-readable format.

Right to object

You have the right to object to processing based on our legitimate interests. You also have the right to object at any time to processing for direct marketing purposes.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

13. How to exercise your rights

To exercise your rights, you may contact us by email at:

info@drive-time.gr

or by post at:

Drive Time
El. Venizelou 125, Gazi, Heraklion, Crete, 714 14, Greece

Please include enough information to allow us to identify you and process your request.

We will respond to your request without undue delay and in any case within one month from receipt of the request. If the request is complex or if we receive a large number of requests, this period may be extended by up to two additional months, in accordance with GDPR.

In cases of manifestly unfounded or excessive requests, we may refuse to act on the request or charge a reasonable fee, as permitted by law.

14. Right to lodge a complaint

If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Greece, the competent authority is:

Hellenic Data Protection Authority
Kifisias 1-3, 115 23 Athens, Greece
Telephone: +30 210 6475600
Website: www.dpa.gr
Email: contact@dpa.gr

We would appreciate the opportunity to address any concern before you contact the Authority, so you may contact us first at info@drive-time.gr.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time in order to reflect legal, technical or business changes.

Any updated version will be published on our website with a revised “Last updated” date. We encourage you to review this Privacy Policy periodically in order to stay informed about how we protect your personal data.