Privacy policy

• When you book: your name, email address, phone number, optional message, and the car, period and pickup and return locations you chose.
• Through the contact form: your name, email address, phone number (optional) and message.
• At pickup, for the rental agreement: the identity document and driving licence details of the driver and of any additional driver.
• Card details are entered and processed exclusively by NETOPIA Payments; Covareli does not receive or store them.
• Technical server logs (IP address, date and time of access), for security.

• Managing the booking, the payment and the rental — performance of a contract (art. 6(1)(b) GDPR).
• Issuing invoices and keeping accounting records — compliance with legal obligations (art. 6(1)(c) GDPR).
• Replying to messages sent through the contact form and keeping the website secure — our legitimate interest (art. 6(1)(f) GDPR).

We do not sell your data. We share it only as far as necessary with:

• NETOPIA Payments (NETOPIA Financial Services S.A.), to process the payment.
• Our email service provider, through which we send confirmations and receive notifications about bookings and messages.
• Our website hosting provider.
• OpenStreetMap, which provides the map on the Contact page; when the map is displayed, your browser sends your IP address to OpenStreetMap's servers.
• NETOPIA, whose servers serve the NETOPIA logo shown on the website; those servers also receive your IP address.
• Public authorities, where the law requires it.

We do not intentionally transfer personal data outside the European Economic Area, except for the IP address sent when the OpenStreetMap map is displayed on the contact page (OpenStreetMap Foundation, United Kingdom — a country for which the European Commission has adopted an adequacy decision).

• Paid bookings and related documents: 10 years, as required by accounting law.
• Rental agreement data: for the period required by accounting and tax law (10 years).
• Unpaid bookings and contact form messages: at most 1 year.
• Technical server logs: at most 90 days.

Under the GDPR, you have the following rights:

• the right of access to your data;
• the right to rectification of inaccurate data;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing based on legitimate interest;
• the right to withdraw your consent at any time, where processing is based on consent.

To exercise your rights, email us at office@covareli.ro. We reply within one month of receiving your request.

If you believe we process your data unlawfully, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

The website uses an encrypted connection (HTTPS), and access to booking data is restricted to Covareli's administrators.

We may update this policy; the current version is published on this page with its last-updated date. Details about cookies are in our Cookie policy.