Privacy Policy | Marbella Luxury Car Rental

The controller of your personal data is Marbella Luxury Car Rental, the brand operating marbellaluxurycarrental.es and serving clients across Marbella, from Puerto Banús to La Zagaleta. We do not publish a company registration number or a street address on this site; if you need either for a contract or invoice, ask us at [email protected] and we will provide them directly.

For anything related to this policy, your data, or a booking, that same email address is your single point of contact.

We collect information in a few simple ways:

• Through the enquiry form: your name, email, phone number if you give it, the car you're interested in if you choose one, pick-up and drop-off dates, your flight number if you use the airport delivery form, and any message you write. The form also quietly sends us the page you were on and the page that referred you there, so we understand what you were looking at.
• Through email, phone or WhatsApp, when you contact us directly: whatever you choose to tell us.
• From a WhatsApp click: when you tap a WhatsApp button on the site, we record the page URL, the referring page, the language of the site, and the prefilled message text before WhatsApp opens. The conversation that follows happens inside WhatsApp itself, under Meta's own privacy policy, not ours.
• Automatically, through standard server logs: IP address, time of the request, the page requested, and browser type.

If you go on to confirm a rental, we also need to see your driving licence and ID at handover. We ask for these because we are legally required to verify who is driving the vehicle and to confirm their eligibility to drive, and because it protects both you and the car in case of an incident.

We use your data for these purposes, each resting on a specific legal basis under the GDPR:

• To reply to your enquiry and prepare a written quote: this is a pre-contractual step at your request, taken before any contract exists.
• To confirm, manage and deliver a booking, including sharing driver details with the person who will hand over or drive the car: this is necessary to perform the rental contract once it's confirmed in writing.
• To keep server logs and spot misuse or security incidents: this rests on our legitimate interest in keeping the site and our business safe, which does not override your own rights.
• To keep booking and invoicing records: this is a legal obligation, since tax and accounting law requires us to retain certain records.

We never use your data to make automated decisions about you, and we do not sell it. We only send marketing emails if you specifically ask us to.

Your data stays within a small, defined circle:

• Our own team, who handle enquiries and bookings using an internal messaging tool so we can reply quickly.
• The captain, driver or person carrying out the service, when a booking is confirmed, so the handover or chauffeur service can actually take place.
• Our hosting provider, which stores the static website and the server logs needed for security; we don't name the provider here, but it processes data only on our instructions.
• Google, through Google Fonts, which can see the visitor's IP address when a page loads, purely to display the site's typefaces.
• jsDelivr, the content delivery network that serves the intl-tel-input library used by the phone-number field in our forms.
• WhatsApp (Meta), if you choose to start a conversation with us there; that exchange is governed by WhatsApp's own privacy policy, not this one.

None of these third parties sets cookies on our behalf, and we don't hand your data to anyone outside this list.

Our own processing takes place within the EU. Google Fonts and jsDelivr are large international services that may process requests through infrastructure located outside the European Economic Area as part of how content delivery networks work globally. If you start a WhatsApp conversation, that exchange runs on Meta's infrastructure under Meta's own international transfer arrangements, which you can review in WhatsApp's privacy policy. We do not otherwise transfer your personal data outside the EU.

If your enquiry doesn't turn into a booking, we delete it after 24 months. If you do book with us, we keep the related records for as long as Spanish tax and accounting law requires us to. Server logs are kept only for a short period, long enough to be useful for security purposes. The two browser storage entries described below disappear on their own: one when you close the tab, the other once you've dismissed the cookie notice (and even then, it holds no contact details).

We don't run analytics, advertising or social-media tracking on this site, and the site itself doesn't set any cookies. Two small pieces of browser storage are used purely for convenience: a local-storage entry remembers that you've closed the cookie notice, and a session-storage entry remembers which car you clicked on so the enquiry form can be prefilled for you; it's deleted as soon as you close the tab or send the form. Neither one contains your name, email or phone number.

Server logs and booking records are stored within systems that are only accessible to the people who need them to run Marbella Luxury Car Rental.

Under the GDPR and Spanish Organic Law 3/2018 (LOPDGDD), you can ask us to:

• Access the personal data we hold about you.
• Correct it if it's inaccurate or incomplete.
• Delete it, where there's no legal reason for us to keep it.
• Restrict or object to certain processing, including processing based on our legitimate interest.
• Receive the data you gave us in a portable format.
• Withdraw consent at any time, for anything we process based on it, such as marketing emails you previously asked for.

To exercise any of these, email [email protected]. We will respond within one month, and we may ask you to confirm your identity first, simply to make sure we're not handing your data to the wrong person. If you're ever unhappy with how we've handled your data, you also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

Our services are aimed at adults who are old enough to hold a driving licence, and we don't knowingly collect personal data from children. If you believe a child has sent us data, contact [email protected] and we will delete it.

We may update this policy if our practices, our tools, or the law change. The version published on marbellaluxurycarrental.es is always the current one, and we encourage you to check back if you're sending us data regularly.