Privacy Statement (EU)

This privacy statement was last updated on November 5, 2026 and applies to citizens and legal permanent residents of the European Economic Area and Switzerland, as well as all users of our website and vehicle rental services in accordance with the EU General Data Protection Regulation (GDPR) and the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data (Law 125(I)/2018).

In this privacy statement, we explain what we do with the data we obtain about you via https://geodrive.cy and during the course of providing our car rental services. We recommend you carefully read this statement. In our processing we comply with the requirements of privacy legislation. That means, among other things, that:

• we clearly state the purposes for which we process personal data. We do this by means of this privacy statement;
• we aim to limit our collection of personal data to only the personal data required for legitimate purposes;
• we first request your explicit consent to process your personal data in cases requiring your consent;
• we take appropriate security measures to protect your personal data and also require this from parties that process personal data on our behalf;
• we respect your right to access your personal data or have it corrected or deleted, at your request.

If you have any questions, or want to know exactly what data we keep of you, please contact us.

1. Purpose, data, legal basis and retention period

We collect or receive personal information for a number of purposes connected with our car rental business operations and website functionality, which include the following:

1.1 Contact – Through phone, mail, email and/or webforms

For this purpose (including inquiries submitted via WPForms) we use the following data:

• A first and last name
• Account name or alias
• A home or other physical address, including street name and name of a city or town
• An email address
• A telephone number
• IP Address
• The content of your message or inquiry

The legal basis on which we process these data is:

Performance of a contract or taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), our legitimate interest in responding to customer inquiries (Art. 6(1)(f) GDPR), or upon the provision of your consent (Art. 6(1)(a) GDPR).

Retention period:

We retain correspondence data for as long as necessary to handle your inquiry and for up to 12 months thereafter, unless the inquiry leads to a rental contract, in which case contractual and statutory retention periods apply.

1.2 Vehicle reservations, rental contracts and fleet management

When you book or rent a vehicle from us (including bookings managed via our HQ Rental Software system via geodrive-car-hire-ltd.geodrive.cy), we process the following data:

• First and last name
• Date of birth and age verification details
• Home address and temporary accommodation address in Cyprus
• Email address and telephone number
• Driver's license details (license number, country of issue, date of issue, expiration date, and copies/scans where required for verification)
• National Identity Card or Passport details (for identity verification)
• Booking details (pick-up and drop-off dates, times, locations, flight numbers if airport pick-up is requested, selected vehicle category, and extras)
• Vehicle usage data, condition reports (check-in/check-out records), mileage, and accident or damage reports

Source of data (Art. 14 GDPR): Where you do not provide this data to us directly, we may receive your reservation and contact details from third-party car rental brokers, travel agencies, or affiliate partners through whom you made your booking, or from the primary renter if you are nominated as an additional driver on the rental agreement.

The legal basis on which we process these data is:

Performance of a contract (Art. 6(1)(b) GDPR), compliance with legal obligations under Cyprus road traffic, transport, and tax laws (Art. 6(1)(c) GDPR), and our legitimate interests in protecting our vehicle fleet, verifying driver eligibility, and handling insurance or damage claims (Art. 6(1)(f) GDPR).

Retention period:

We retain contractual and accounting records for 6 years following the end of the calendar year in which the rental took place, in accordance with Cyprus tax and accounting legislation (Assessment and Collection of Taxes Law). Data relevant to potential legal or personal injury claims may be retained up to the statutory limitation period under Cyprus law (up to 10 years for written contract claims).

Statutory and contractual requirement & automated decision-making:

Providing your identification, valid driving license, contact details, and payment information is a statutory and contractual requirement necessary to enter into a vehicle rental agreement in Cyprus. If you do not provide this information, we cannot conclude a rental contract or release a vehicle to you. We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects (Art. 22 GDPR).

1.3 Payments and invoicing

For processing rental deposits, payments, and refunds we use the following data:

• A first and last name
• A home or billing address, including street name and name of a city or town
• An email address
• A telephone number
• Payment card details, billing records, and transaction identifiers
• IP Address

The legal basis on which we process these data is:

Performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations regarding accounting and tax reporting (Art. 6(1)(c) GDPR).

Retention period:

We retain financial and invoicing data for 6 years from the end of the relevant tax year as required by Cyprus tax law.

1.4 Newsletters and marketing communications

For this purpose we use the following data:

• A first and last name
• An email address

The legal basis on which we process these data is:

Upon the provision of your explicit consent (Art. 6(1)(a) GDPR).

Retention period:

We retain this data until you withdraw your consent (unsubscribe) or until the newsletter service is terminated.

1.5 Analytics, advertising, and personalized services

To analyze website usage, measure advertising effectiveness, display customer reviews, and offer personalized products and services, we use the following data:

• Online identifiers (cookie IDs, pixel IDs)
• IP Address (anonymized where configured)
• Device and browser information
• Website interaction, page views, and referral data
• Approximate geolocation data

The legal basis on which we process these data is:

Upon the provision of your consent via our cookie banner (Art. 6(1)(a) GDPR).

Retention period:

We retain this data in accordance with the lifespans of the respective cookies (up to 180 days for your consent record, or until you withdraw your consent).

1.6 Affiliate program management

If you participate in our affiliate or partner program (managed via SliceWP) or visit our website via an affiliate referral link, we process referral identifiers, IP addresses, commission records, and partner contact/payout details.

The legal basis on which we process these data is:

Performance of our partner agreement with affiliates (Art. 6(1)(b) GDPR), our legitimate interest in attributing referrals accurately (Art. 6(1)(f) GDPR), or your consent for tracking cookies (Art. 6(1)(a) GDPR).

Retention period:

Affiliate account and payout records are retained for 6 years in accordance with Cyprus tax requirements.

1.7 Website security and technical administration

To protect our website from malicious activity, spam, and unauthorized access (using security tools including Imunify Security and WP Ghost), we process IP addresses, login attempts, and technical access logs.

The legal basis on which we process these data is:

Our legitimate interest in ensuring network and information security (Art. 6(1)(f) GDPR).

Retention period:

Security logs are retained for up to 90 days unless an incident requires longer retention for investigation.

2. Sharing with other parties and international transfers

We do not sell your personal data to third parties. We only share or disclose your data to service providers (processors) or independent controllers where necessary for the purposes described above:

• Car Rental & Booking System: We use HQ Rental Software (including via our dedicated subdomain geodrive-car-hire-ltd.geodrive.cy and our HQ Car Display & Mobile Hub integration) to manage vehicle availability, reservations, and rental agreements.
• Analytics and Tag Management: We use Google Tag Manager and MonsterInsights (Google Analytics) to understand how visitors interact with our website. Provider privacy policy: https://policies.google.com/privacy.
• Advertising and Social Media: With your consent, we use Meta Pixel (provided by Meta Platforms Ireland Limited) to measure the effectiveness of our advertising and deliver targeted ads. Provider privacy policy: https://www.facebook.com/privacy/policy/.
• Embedded Media, Reviews, and Maps: Our website integrates video content from Vimeo (https://vimeo.com/privacy), interactive maps from Google Maps (https://policies.google.com/privacy), and customer review widgets (via Business Reviews Bundle). Loading these elements may transmit your IP address and browser data to the respective provider.
• Technical Delivery & Email: Certain scripts may be loaded via unpkg.com for technical functionality, system integrations are managed via Agent Connector, and transactional emails are dispatched securely using WP Mail SMTP.
• Insurance Companies, Payment Providers, and Public Authorities: In the context of a vehicle rental, we share necessary data with payment processors to complete transactions, with our motor insurance providers in the event of an accident or claim, and with Cyprus police, municipalities, or traffic authorities in relation to traffic violations, fines, or statutory inquiries.

International Data Transfers: Some of our third-party providers (such as Google, Meta, and Vimeo) are based in or process data in the United States or other countries outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure an adequate level of protection through European Commission adequacy decisions (such as the EU-U.S. Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses (SCCs) pursuant to Article 46 of the GDPR.

3. Cookies

Our website uses cookies and similar technologies. Strictly necessary cookies are placed to ensure the website functions properly, while Preferences, Statistics, and Marketing cookies are only placed with your prior consent in accordance with Art. 5(3) of the ePrivacy Directive and Art. 6(1)(a) GDPR. We manage your consent preferences using our GDPR consent tool, which stores your choice in the first-party cookie malaka_consent for 180 days. You can modify or withdraw your consent at any time via our cookie settings button or by using the settings link below. For more information about the cookies we use, please refer to our Cookie Policy.

Cookie settings

4. Disclosure practices

We disclose personal information if we are required by law or by a court order, in response to a law enforcement agency, to the extent permitted under other provisions of law, to provide information, or for an investigation on a matter related to public safety or road traffic offences.

If our website or organisation is taken over, sold, or involved in a merger or acquisition, your details may be disclosed to our advisers and any prospective purchasers and will be passed on to the new owners.

We have concluded a Data Processing Agreement with Google. Google may not use the analytics data for any other Google services, and the inclusion of full IP addresses is blocked by us.

5. Security

We are committed to the security of personal data. We take appropriate technical and organizational security measures to limit abuse of and unauthorized access to personal data. This ensures that only the necessary persons have access to your data, that access to the data is protected, and that our security measures are regularly reviewed.

6. Third-party websites

This privacy statement does not apply to third-party websites connected by links on our website. We cannot guarantee that these third parties handle your personal data in a reliable or secure manner. We recommend you read the privacy statements of these websites prior to making use of these websites.

7. Amendments to this privacy statement

We reserve the right to make amendments to this privacy statement. It is recommended that you consult this privacy statement regularly in order to be aware of any changes. In addition, we will actively inform you wherever possible.

8. Accessing and modifying your data

If you have any questions or want to know which personal data we have about you, please contact us. Under the GDPR, you have the following rights:

• Right to information: You have the right to know why your personal data is needed, what will happen to it, and how long it will be retained for.
• Right of access (Art. 15 GDPR): You have the right to access your personal data that is known to us.
• Right to rectification and erasure (Art. 16 & 17 GDPR): You have the right to supplement, correct, or have your personal data deleted ("right to be forgotten") whenever you wish, subject to statutory retention obligations.
• Right to restriction of processing (Art. 18 GDPR): You have the right to request that we restrict the processing of your personal data under certain circumstances.
• Right to withdraw consent (Art. 7(3) GDPR): If you give us your consent to process your data, you have the right to revoke that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to data portability (Art. 20 GDPR): You have the right to request all your personal data from the controller in a structured, commonly used, and machine-readable format and transfer it in its entirety to another controller.
• Right to object (Art. 21 GDPR): You may object to the processing of your data based on legitimate interests or for direct marketing purposes. We comply with this, unless there are compelling legitimate grounds for processing.

You can exercise your rights by contacting us directly or by using the request form below. Please make sure to always clearly state who you are, so that we can be certain that we do not modify or delete any data of the wrong person. We will respond to your request within one month of receipt in accordance with Art. 12(3) GDPR.

9. Submitting a complaint

If you are not satisfied with the way in which we handle (a complaint about) the processing of your personal data, you have the right to submit a complaint to the national supervisory authority in Cyprus:

Office of the Commissioner for Personal Data Protection
Kypranoros 15, 1061 Nicosia, Cyprus (P.O. Box 23378, 1682 Nicosia)
Telephone: +357 22818456
Email: commissioner@dataprotection.gov.cy
Website: https://www.dataprotection.gov.cy

10. Contact details

Data Controller:
GeoDrive Car Hire (GeoDrive Car Hire Ltd)
148 Agias Mariana, Menou-Pervolia, 7000 Larnaca, Cyprus
Company Registration No.: ΗΕ 449517
Website: https://geodrive.cy
Email: info@geodrive.cy
Phone number: +357 70002200

Data Protection Officer (DPO): We are not legally required to appoint a Data Protection Officer and have not appointed one. For any questions or requests regarding your personal data, please contact our privacy team at info@geodrive.cy.

Annex

Caching

This site utilizes caching in order to facilitate a faster response time and better user experience. Caching potentially stores a duplicate copy of every web page that is on display on this site. All cache files are temporary, and are never accessed by any third party, except as necessary to obtain technical support from the cache plugin vendor. Cache files expire on a schedule set by the site administrator, but may easily be purged by the admin before their natural expiration, if necessary.

Furthermore, this website may install the following specific cookies (but not limited to):

Controlling cookies:

Most browsing applications accept cookies automatically but at the same time provide control options that allow you to block or delete them. Through your device’s settings, you have the ability to receive a warning about the use of cookies on specific services, or even not to accept cookies.

Some features of the services provided through the website depend on cookies. If you choose to block the cookies, you may lose the ability to sign in or use some of these services as well as your preferences which rely on cookies.

Monitoring Protection: By using Internet Browser Options that exclude the content of third parties, including cookies from any website, you limit the information that the specific third-party websites can collect from you.

You can enable or disable cookies on your web browser application. Most Internet browser applications accept cookies by default, but this can be adjusted. For more details, please consult the Help section of your web browser application.

You can choose to delete cookies at any time. However, you may lose any information that allows you to have quicker and more effective access to the website, including, but not limited to, personalisation settings.

It is recommended that you make sure that your internet browser application is updated and consult its help section and instructions provided by your internet browser application developer if you are not sure how to customise your privacy settings.

Terms and Conditions
Please also visit our Terms and Conditions section establishing the use, disclaimers, and limitations of liability governing the use of our website and vehicle rental services at terms and conditions.