Privacy Policy

Who controls your personal data

A rental location, fleet provider or other company identified in your booking confirmation or rental agreement may also process your data as an independent controller where it determines how and why your data is used for vehicle delivery, the rental agreement, deposits, damage handling, fines or legal compliance. Where this applies, that provider is responsible for its own processing activities.

Personal data we collect

Depending on how you use the website and our services, we may collect:

• Identity and eligibility data: name, surname, date of birth, nationality or country, identity/passport number and issuing country.
• Driving-licence data: licence number, issuing country, issue date and expiry date.
• Contact data: email address, telephone number, postal address, city, postcode and country.
• Booking and travel data: pick-up and return location, dates and times, flight or arrival details where provided, vehicle group, selected extras, driver age and promotional code.
• Rental and vehicle data: rental agreement, named drivers, vehicle condition, mileage, fuel level, damage records, photographs, accident or roadside-assistance information, fines and related correspondence.
• Payment and guarantee data: payment status, amount, transaction reference and security-deposit or pre-authorisation information. Full card details are normally handled by the relevant payment or card-service provider and should not be stored by MODOO unless expressly required and lawfully processed.
• Communications: emails, messages, requests, complaints, call notes and customer-service history.
• Technical data: IP address, browser and device information, timestamps, security logs, pages visited and cookie or consent preferences.

Why we use your data

Which information is required

Information marked as required in the booking form is needed to process your reservation or comply with rental and legal requirements. If you do not provide it, we may be unable to confirm the booking, release the vehicle or provide part of the requested service.

Optional information should only be provided where relevant. Please do not send special-category information—such as health data—or copies of documents unless we specifically request them through an appropriate channel and explain why they are needed.

Who may receive your data

We disclose only the information reasonably required for the relevant purpose. Recipients may include:

• the rental station, vehicle owner, fleet provider or contractual rental company handling your reservation;
• booking platforms, brokers or travel partners through which the reservation was made;
• website hosting, booking-system, IT support, email and communications providers acting under appropriate instructions;
• banks, payment processors, card-service providers and fraud-prevention services;
• insurers, claims handlers, roadside-assistance providers, repairers and professional advisers;
• police, courts, tax authorities, municipalities, traffic or parking authorities and other public bodies where disclosure is legally required or necessary for legal claims.

Service providers acting on our behalf must process personal data only for agreed purposes and with appropriate confidentiality and security obligations.

International data transfers

Some technology or booking providers may process data outside the European Economic Area. Where personal data is transferred to a country that has not been recognised as providing adequate protection, we use an available lawful safeguard, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.

You may contact us for further information about safeguards relevant to your data.

How long we keep your data

We keep personal data only for as long as necessary for the purpose for which it was collected, including:

• Booking, rental, payment and invoice records: for the period required by applicable tax, accounting, commercial and limitation laws.
• Damage, accident, fine, complaint and dispute records: until the matter is closed and for the period needed to establish, exercise or defend legal claims.
• Uncompleted enquiries: for a reasonable customer-service period, unless a longer period is required for security, fraud prevention or a legal claim.
• Marketing data: until you withdraw consent, unsubscribe or the data is no longer relevant, subject to keeping a minimal suppression record so we respect your choice.
• Technical and security logs: for a limited security and troubleshooting period, unless an incident requires longer retention.

When retention is no longer justified, data is deleted, anonymised or securely isolated until deletion is possible.

Cookies and similar technologies

Strictly necessary cookies or local-storage technologies may be used to operate the website, maintain security, remember consent choices and support the booking process. These do not require consent where they are genuinely necessary for the service requested.

Analytics, advertising, personalisation or other non-essential technologies must remain disabled until you choose to accept the relevant category through the cookie-consent tool. You can reject non-essential cookies and change or withdraw your choice later through the website’s cookie settings.

How we protect your data

We use technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, access, disclosure or destruction. Measures may include access controls, encrypted transmission, backups, logging, staff confidentiality and restricted access based on business need.

No online system is risk-free. Please use trusted devices and networks, protect your email account and do not send card details or document copies through unrequested or insecure channels.

Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may request:

• access to your personal data and a copy of it;
• correction of inaccurate or incomplete data;
• deletion of data that is no longer needed or is unlawfully processed;
• restriction of processing in specified circumstances;
• portability of data you provided where processing is automated and based on consent or contract;
• objection to processing based on legitimate interests;
• withdrawal of consent at any time, without affecting earlier lawful processing;
• an end to direct marketing at any time.

To exercise a right, email reservations@modoo-travel.com and state that your request concerns personal data. We may ask for reasonable identity verification before disclosing or changing information. We normally respond within one month, subject to any lawful extension for complex or multiple requests.

Automated decisions and children

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Availability, pricing and eligibility rules may be applied automatically, but a booking remains subject to the applicable rental conditions and confirmation process.

Our vehicle-rental services are intended for adults who meet the stated driving-age and licence requirements. The booking service is not directed at children.

Contact, complaints and Policy changes

Questions, privacy requests and complaints can be sent to reservations@modoo-travel.com. Please do not include unnecessary identity documents or payment-card information in your first message.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority or, where applicable, the supervisory authority in the EU/EEA country of your residence or work.

We may update this Policy when our services, providers or legal obligations change. The latest version will be published on this page with a revised “Last updated” date.