PHENIX Car Rentals

Privacy Policy

Last updated: 2 November 2026

01Introduction

PHENIX Car Rentals respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our website, make a vehicle reservation or enter into a rental agreement.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), applicable Cyprus data protection legislation and other relevant laws.

02Data Controller

The organisation responsible for processing your personal data is:

Legal company name: PHENIX JVT LTD
Trading name: PHENIX Car Rentals
Registration number: HE 331694
VAT number: 10331694P
Registered address: Tombs of the Kings Ave 26, Shop 6, 8046 Paphos, Cyprus
Email: Phenixjvt@gmail.com
Telephone: +357 99 347 083

03Personal Data We Collect

Depending on the services you request, we may collect the following information:

Personal identification information

First and last name.
Date of birth, where required.
Residential or postal address.
Nationality, where necessary for lawful rental eligibility checks.

Contact information

Email address.
Telephone number.
Information you provide when contacting us.

Driving licence and identity information

Driving licence number.
Country of issue.
Date of issue and expiry date.
Driver eligibility and verification details.
Identity document information where necessary for the rental agreement or legal compliance.

Reservation and rental information

Selected vehicle and category.
Pick-up and return locations.
Rental dates and times.
Additional drivers, where applicable.
Booking reference and rental agreement details.
Payment status, security deposits, rental charges and refunds.
Vehicle inspection records and incident information, where applicable.

Technical information

When you use our website, certain technical information may be processed, including IP addresses, browser information, security logs and information required for the operation and security of the website.

We only collect personal data that is reasonably necessary for the relevant purposes.

Booking form details

Driver age and country of residence.
Flight number, where you choose to provide it for airport pick-up.
Special requests you enter in the booking form.

Vehicle location data

Our vehicles are fitted with GPS tracking devices. These record vehicle location, speed and mileage. See section 14 for details.

CCTV images

Our office premises are monitored by CCTV. See section 15 for details.

Sources of personal data

Directly from you, when you book, contact us or collect a vehicle.
From the main renter, when they register an additional driver. The main renter must inform the additional driver of this Privacy Policy.
From booking partners and car rental comparison websites, when you book through them.

04How We Use Your Personal Data

We process personal data for the following purposes:

To receive, review and confirm vehicle reservations.
To verify driver eligibility.
To prepare, enter into and perform rental agreements.
To communicate with customers regarding their bookings.
To arrange vehicle collection, return and customer support.
To administer payments, deposits, refunds and invoices.
To manage insurance-related matters, accidents, claims and disputes.
To comply with accounting, tax and other legal obligations.
To protect our website, prevent fraud and maintain business security.
To send marketing communications only where a valid legal basis exists and applicable electronic marketing rules are satisfied.

To process traffic fines, parking penalties and road charges incurred during the rental, including transferring them to the responsible driver.

05Legal Basis for Processing

Under Article 6 of the GDPR, we rely on the following legal bases as applicable:

Performance of a contract — Article 6(1)(b)

Processing necessary to handle your reservation, prepare the rental agreement and provide the requested rental services.

Compliance with legal obligations — Article 6(1)(c)

Processing necessary to comply with applicable accounting, tax, legal and regulatory requirements.

Legitimate interests — Article 6(1)(f)

Processing necessary for proportionate fraud prevention, website security, customer support, incident management and the establishment, exercise or defence of legal claims, provided such interests are not overridden by your rights.

Consent — Article 6(1)(a)

Where required, processing based on your specific consent, such as optional marketing or non-essential cookies. Consent may be withdrawn at any time without affecting prior lawful processing.

06Information Required for Reservations

Certain information is necessary to process a reservation and prepare a rental agreement.

If you do not provide the required information, we may be unable to confirm the booking or release the vehicle.

We may request driving licence information before collection where reasonably necessary. Original documents may also need to be presented for verification when collecting the vehicle.

Copies of identity documents or driving licences will only be requested or retained where necessary for a specific legitimate purpose and permitted by applicable law.

07Sharing Personal Data

We may share relevant personal data, where necessary, with:

Payment service providers and banks.
Insurance companies and claims handlers.
IT, website hosting and reservation management service providers.
Accountants, auditors and professional advisers.
Roadside assistance or other service providers involved in fulfilling the rental.
Public authorities, law enforcement or regulators where legally required.

We require service providers acting on our behalf to handle personal data securely and in accordance with applicable data protection obligations.

We do not sell personal data to advertisers or data brokers.

Website and email service providers

We use the following providers to run this website and handle booking requests:

Vercel Inc. hosts this website and processes technical data such as IP addresses and server logs.
Resend delivers the emails sent by this website. It processes the recipient’s address and the content of the email, including your booking details.
Google receives and stores booking requests and our correspondence with you in our business mailbox.
Cloudflare, Inc. provides Cloudflare Turnstile to protect the booking form from automated abuse. For this purpose it acts on our behalf. It may also use these signals to improve its bot detection, as described in its Turnstile privacy addendum.

Messaging services

If you contact us via WhatsApp, your messages are also processed by WhatsApp (Meta Platforms Ireland Ltd) under its own privacy policy.

Booking partners

If you book through a partner or comparison website, we exchange the booking details with that partner to fulfil and manage your reservation.

Traffic and law enforcement authorities

We may disclose the driver’s details to the police and other authorities to transfer traffic fines or respond to lawful requests.

08Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this policy.

Retention periods are determined by the type of information, the status of the reservation, applicable legal retention requirements and the need to resolve claims or disputes.

Unconfirmed reservations and enquiries: 12 months from the date of the enquiry.
Confirmed reservations and rental agreements: 6 years after the end of the rental.
Booking request emails in our mailbox follow the periods above: 12 months for unconfirmed requests and 6 years for confirmed rentals.
Email delivery logs held by our email provider: up to 30 days.
Accounting and payment records: retained for the period required by applicable law.
Incident, insurance and legal claim records: retained for the period necessary to manage the relevant claim and applicable limitation periods.
Optional marketing records: retained until consent is withdrawn or another applicable deletion criterion is met.

When personal data is no longer required, it will be securely deleted, anonymised or otherwise handled in accordance with applicable law.

GPS vehicle tracking data: 12 months, unless needed longer for an incident, claim or legal proceedings.
CCTV recordings: 30 days, unless needed longer for an incident or legal proceedings.

09Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage.

Access to personal information is limited to authorised persons and service providers who need it for legitimate business purposes.

We do not store full payment card numbers. Card payments and deposits are processed by our bank or payment service provider, which handles card data according to payment industry security standards.

10International Data Transfers

Some technology or service providers may process information outside the European Economic Area (EEA).

Where personal data is transferred internationally, we will comply with applicable GDPR transfer requirements, including adequacy decisions or appropriate safeguards such as Standard Contractual Clauses where required.

Information about applicable transfer safeguards may be requested using the contact details in this policy.

11Your Data Protection Rights

Subject to applicable law, you may have the right to:

Access your personal data.
Request correction of inaccurate information.
Request deletion of personal data.
Request restriction of processing.
Object to certain processing.
Request data portability where applicable.
Withdraw consent where processing is based on consent.
Lodge a complaint with a competent supervisory authority.

To exercise your rights, contact us using the details provided below.

You may also lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus.

We will respond to your request within one month. Where a request is complex, this may be extended by up to two further months; we will inform you if this happens.

Supervisory authority: Office of the Commissioner for Personal Data Protection
Address: Iasonos 1, 1082 Nicosia, Cyprus
Website: dataprotection.gov.cy

If you live in another EU country, you may also lodge a complaint with the data protection authority in that country.

12Cookies and Website Technologies

We do not currently use advertising or analytics cookies. Your browser temporarily remembers your last car search until you close the tab, so you can return to it. Cloudflare Turnstile runs on the booking page and is strictly necessary for detecting and blocking automated abuse.

Our website may use strictly necessary cookies or similar technologies required for essential functionality and security.

Where optional analytics, advertising or other non-essential tracking technologies are used, we will provide the required information and obtain valid consent before activating them, where legally required.

You may manage your cookie preferences through the controls made available on the website, where applicable, and through your browser settings.

13Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, legal requirements or personal data processing activities.

The latest version will be published on our website with its updated date.

Where required by law, we will provide additional notice of material changes.

14Vehicle Tracking (GPS)

Our vehicles are fitted with GPS tracking devices that record location, speed and mileage.

We use this data to locate a vehicle in case of theft, breakdown or accident, to protect our fleet and to resolve disputes about mileage, fuel, late return or unauthorised use.
We do not use tracking data to monitor your journeys in real time during normal use of the vehicle.
Legal basis: our legitimate interest in protecting our vehicles and property (Article 6(1)(f)).

15CCTV

Our office premises are monitored by CCTV for the safety of customers and staff, and to protect our vehicles and property. Recordings are accessed only by authorised persons and may be shared with the police where required. Legal basis: legitimate interests (Article 6(1)(f)).

16Automated Decision-Making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.

17Children

Our services are intended for persons aged 18 and over. We do not knowingly collect personal data from children.

18Data Protection Officer

We have not appointed a Data Protection Officer, as this is not required for our activities. Questions about data protection can be sent to Phenixjvt@gmail.com.

19Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

Company: PHENIX Car Rentals
Email: Phenixjvt@gmail.com
Telephone: +357 99 347 083
Address: Tombs of the Kings Ave 26, Shop 6, 8046 Paphos, Cyprus