Privacy Policy

This policy explains how we handle personal data when you book or rent a car from us, contact us, or use lemnoscarrental.com. It is written to meet the EU General Data Protection Regulation (GDPR) and Greek Law 4624/2019.

1. Who is responsible

The controller of your data is Vasileios Chletsos, son of Antonios, trading as Lemnos Car Rental, Moudros 81401, Lemnos, Greece, VAT number (ΑΦΜ) 056450454. For anything about your data, write to bookings@lemnoscarrental.com. As a small business we have not appointed a Data Protection Officer; the owner deals with every request personally.

2. What we collect

Booking details: name, email, phone, country, date of birth, pick-up and return details, and anything you add, such as a flight number, holiday address or request.
Drivers: for every driver, the name, date of birth and driving licence details (number, issuing country, validity) entered on the rental agreement. We look at your passport or identity card but do not keep a copy.
The rental itself: photographs of the car, odometer and fuel readings at pick-up and return, your signature on the rental agreement, damage and accident reports, fines linked to the rental.
Payments: amounts, outcomes, refunds and Stripe payment references. We never receive your full card number.
Your account: your email address and the one-time codes we send you to sign in.
Correspondence: emails and messages you send us.
Technical data: the IP address and browser details our hosting provider logs when you visit, and anonymous visit counts.

3. Why we use it, and the legal basis

Purpose	Legal basis (GDPR Article 6)
Taking and managing your booking, handing over and collecting the car, the deposit, damage handling	Performance of the contract, 6(1)(b)
Invoices, accounting and tax records; reporting rentals to the Independent Authority for Public Revenue (AADE), including the digital client register (Ψηφιακό Πελατολόγιο); answering the police, courts and other authorities	Legal obligation, 6(1)(c)
Recovering unpaid amounts, defending claims, preventing fraud, keeping the site secure	Our legitimate interests, 6(1)(f)
Analytics cookies and marketing emails, if you choose them	Your consent, 6(1)(a)

The booking and driver details are needed to rent you a car; without them we cannot enter into the contract. We do not make decisions about you by purely automated means.

4. Who receives it

We use a small number of providers who process data on our instructions under data processing agreements:

Stripe (Stripe Payments Europe Ltd, Ireland): card payments, deposits and invoices.
Supabase: our database and file storage, on servers in Ireland.
Vercel: hosting of this website.
Resend: sending booking emails.
Cloudflare: our domain and the forwarding of emails sent to our address.
Google: our mailbox, where your emails to us arrive.

We also share data where needed with our accountant, our insurer, AADE, and the police, courts or other public authorities when the law requires it or a claim makes it necessary. We do not sell your data or share it for anyone else's advertising.

5. Transfers outside the EU

Some of these providers are based in the United States or may access data from there. Such transfers rely on the EU-U.S. Data Privacy Framework, where the provider is certified, or on the European Commission's standard contractual clauses.

6. How long we keep it

Contract, invoice and payment records: for as long as Greek tax and accounting law requires, at least five years from the end of the tax year, and longer while a tax audit or legal claim is open.
Photographs, readings and signatures from pick-up and return: 12 months after the rental ends, or until any claim about the rental is settled.
Your account and correspondence: until you ask us to delete them, or two years after your last rental, whichever is sooner, unless they belong in the records above.
Server logs: a few weeks.

7. Your rights

You may ask us for access to your data, a copy in a portable format, correction, deletion, restriction of use, and you may object to uses based on our legitimate interests. Where we rely on your consent you may withdraw it at any time, without affecting the rental. Write to bookings@lemnoscarrental.com. We reply within one month, which the GDPR lets us extend by two further months for complex requests. We may need to check your identity first.

If you are not satisfied, you may complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, www.dpa.gr, or to the authority of the EU country where you live.

8. Cookies

The site uses only the cookies it needs to work: keeping you signed in, remembering your language and theme, and remembering your cookie choice. Analytics cookies are set only if you accept them in the cookie banner, and you can change your choice at any time. We count visits with Vercel Web Analytics, which sets no cookies and stores nothing on your device.

9. Security

Data travels encrypted (HTTPS). Only named staff with their own accounts can open the staff system, each with access only to what their role needs. Card data stays with Stripe.

10. Children

Our services are for adults, and we do not knowingly collect data about children.

11. Changes

We publish any change to this policy on this page. Last updated: 19 October 2026.

1. Who is responsible

2. What we collect

Booking details: name, email, phone, country, date of birth, pick-up and return details, and anything you add, such as a flight number, holiday address or request.

Drivers: for every driver, the name, date of birth and driving licence details (number, issuing country, validity) entered on the rental agreement. We look at your passport or identity card but do not keep a copy.

The rental itself: photographs of the car, odometer and fuel readings at pick-up and return, your signature on the rental agreement, damage and accident reports, fines linked to the rental.

Payments: amounts, outcomes, refunds and Stripe payment references. We never receive your full card number.

Your account: your email address and the one-time codes we send you to sign in.

Correspondence: emails and messages you send us.

Technical data: the IP address and browser details our hosting provider logs when you visit, and anonymous visit counts.

3. Why we use it, and the legal basis

Purpose

Legal basis (GDPR Article 6)

Taking and managing your booking, handing over and collecting the car, the deposit, damage handling

Performance of the contract, 6(1)(b)

Invoices, accounting and tax records; reporting rentals to the Independent Authority for Public Revenue (AADE), including the digital client register (Ψηφιακό Πελατολόγιο); answering the police, courts and other authorities

Legal obligation, 6(1)(c)

Recovering unpaid amounts, defending claims, preventing fraud, keeping the site secure

Our legitimate interests, 6(1)(f)

Analytics cookies and marketing emails, if you choose them

Your consent, 6(1)(a)

The booking and driver details are needed to rent you a car; without them we cannot enter into the contract. We do not make decisions about you by purely automated means.

4. Who receives it

We use a small number of providers who process data on our instructions under data processing agreements:

Stripe (Stripe Payments Europe Ltd, Ireland): card payments, deposits and invoices.

Supabase: our database and file storage, on servers in Ireland.

Vercel: hosting of this website.

Resend: sending booking emails.

Cloudflare: our domain and the forwarding of emails sent to our address.

Google: our mailbox, where your emails to us arrive.

6. How long we keep it

Contract, invoice and payment records: for as long as Greek tax and accounting law requires, at least five years from the end of the tax year, and longer while a tax audit or legal claim is open.

Photographs, readings and signatures from pick-up and return: 12 months after the rental ends, or until any claim about the rental is settled.

Your account and correspondence: until you ask us to delete them, or two years after your last rental, whichever is sooner, unless they belong in the records above.

Server logs: a few weeks.

7. Your rights

8. Cookies