Privacy Policy

Important information and details

Privacy Policy

Effective Date: October 14, 2025

At ERM Rent a Car Ltd. (“Company”, “we”, “us”, “our”), we highly value the privacy and security of our users’ personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the KVKK, GDPR, and Google API Services User Data Policy.



1. Collected Data

We may collect the following types of personal data from our users:


A. Data provided directly by the user

  • Identity information (name, surname, ID or passport number)
  • Contact information (email, phone, address)
  • Driver’s license details
  • Reservation and payment details
  • Invoice and accounting data
  • Vehicle pick-up and return records

B. Data obtained through third-party authentication (Google / Meta / Apple)

  • Basic profile information: name, email address
  • Authentication token (ID token): used solely for authentication purposes
Important: We never request or access Gmail, Google Drive, Google Calendar, or Facebook data.


2. Purposes of Data Use

  • Manage car rental reservations and contracts
  • Process payments and issue invoices
  • Create and authenticate user accounts (Google/Meta/Apple OAuth)
  • Provide customer support
  • Comply with legal obligations
  • Ensure security and prevent fraud
  • Send promotional communications with consent

Note: Third-party authentication data is only used for login and account creation — not for advertising.



3. Data Sharing

User data is never sold or rented. It may only be shared in the following cases:

  • Legal obligation (courts or authorities)
  • Trusted business partners (payment, hosting, communication services)
  • Google / Meta / Apple for OAuth verification only


4. Data Storage and Security

  • All data stored on AWS Frankfurt (EU) secure servers.
  • OAuth tokens used temporarily and deleted after logout.
  • Access protected via TLS/SSL, AES-256, and strict permissions.
  • Security audits and access logs maintained regularly.


5. Data Retention and Deletion

  • OAuth token: Deleted after logout or 30 min inactivity.
  • User accounts: Stored until deleted by user.
  • Records: Kept for 10 years per legal requirements.

When the retention period expires or upon request, data is deleted or anonymized securely.



6. Cookies and Tracking

We use cookies and tracking tools to improve our services and marketing efficiency.

  • Google Analytics
  • Google Ads
  • Meta Pixel (Facebook / Instagram)

Users can disable cookies via browser settings or ad preferences.



7. User Rights

  • Learn whether data is processed
  • Request information or correction
  • Request deletion or anonymization
  • Know third parties who received data
  • Seek compensation for unlawful processing


8. Data Deletion and Account Closure

Users can request data deletion through:



9. Contact

ERM Rent a Car Ltd.
🌐 https://www.ermrentacar.com
✉️ [email protected]
📍 Neo Park AVM, Şht. Orhan Durusoy St. No 11, Kyrenia, Cyprus