Privacy Policy

The controller, and where to find it

carhireheraklion.com is run by Heraklion Drive from Leoforos Ikarou 45 in Nea Alikarnassos, 71601 Heraklion, Greece, and that company is the controller of the personal data this notice describes. Greece belongs to the European Union, so the General Data Protection Regulation applies to this site directly, with the Greek law that gives it effect alongside. Anything in this notice that is unclear can be raised at [email protected].

What a search leaves with us

A comparison needs to know about the trip, not about you. Running a search here stores the collection point you pick, whether that is the airport terminal at Nea Alikarnassos, the ferry port or a hotel anywhere on Crete, together with the dates and times, the driver age if you enter one, and the filters you switch on: an automatic gearbox, a supplier that takes a debit card, a car delivered to where you are staying. They describe a journey rather than a person, and they are discarded once the results are on screen.

You give us more only by choosing to. Writing through the contact form or leaving a review means we receive your name, your email address, a phone number if you add one and the message itself. There is no account to create, so nothing accumulates from one visit to the next.

What stays with the rental company

Payment happens on the supplier's side of the booking, never on this website, which keeps the most sensitive data away from us. Your card number, its expiry and its security code go into the rental company's own reservation window or onto a terminal at the counter; we hold no copy. The same is true of your driving licence, your passport or identity card, and the villa or hotel address a delivered car should be brought to. The company that hands over the keys checks those under its own privacy notice, because its contract and its insurer require it.

Logs, cookies and measurement

Each request to our server is recorded as one line in a log: the IP address it arrived from, the browser identifier, the page it asked for and the moment it did so. We also read aggregate traffic figures that show which guides are opened and where visitors stop, never an individual's path. Cookies have a page of their own.

Read the Cookie Policy

The legal ground for each use

Passing your request to the supplier you chose is processing you asked for, as the step before a contract with that supplier. Running the site, keeping bots out of the forms and measuring which pages earn their place are legitimate interests of ours, each weighed against your interest in being left alone. Optional cookies run on consent, which can be taken back at any time. Where Greek or European law obliges us to retain or disclose something, that obligation is the basis on its own.

Your rights under the GDPR

These rights travel with you, and none of them depends on where you live:

• Access: a copy of the personal data we hold about you, and how it is used
• Rectification: correction of anything wrong and completion of anything missing
• Erasure: deletion where there is no longer a good reason to keep the data
• Restriction: a pause on processing while its accuracy or its grounds are in dispute
• Portability: what you gave us, returned in a machine readable format or sent to another provider
• Objection: to any processing we justify by a legitimate interest of our own
• Withdrawal of consent: at any moment, without touching what was done lawfully before it
• Complaint: to a supervisory authority, whether or not you have also written to us

Send a request to [email protected]. We reply within one month and charge nothing for it. The supervisory authority for Greece is the Hellenic Data Protection Authority, the HDPA, in Athens, and you are equally free to complain to the authority of the EU country in which you live or work.

Who else receives it, and where it is processed

The company you picked receives your request, because only it can put a car aside for you. The search itself, and the reservation window that opens from it, run on LocalRent, which acts as our processor on our instructions. A hosting provider stores the site and an email provider carries our correspondence. A public body receives data only when the law compels it. We sell nothing and pass nothing to anyone for marketing of their own.

Processing stays inside the European Economic Area where we can arrange it; a transfer outside it rests on a European Commission adequacy decision or on the Commission's standard contractual clauses.

How long anything is kept

When this notice changes

We revise this notice when the site changes shape, when a provider behind it is replaced, or when the law moves on. The date beneath the title identifies the version you are reading.