This policy explains how we handle your personal data when you visit insidercarrental.com, ask us for a quote, contact us, book a car, or rent and drive one of our vehicles.
1. Data controller
- •Globcar Oy, trading as Insider Car Rental (Business ID 3565603-4), Korkalonkatu 31-33, 96200 Rovaniemi, Finland, info@insidercarrental.com.
- •Globcar Oy is the controller of renters' and website visitors' personal data. Send any privacy question or request to info@insidercarrental.com.
2. What data we collect and where it comes from
From you, when you book or ask for a quote
- •Name, email address and phone number.
- •Rental details: pick-up and return dates, times and places, vehicle class, protection package, extras, discount code and price.
- •The driver's age, which decides which cars can be rented and whether the young driver fee applies (drivers aged 18 to 25). We do not ask for a date of birth online.
- •Optional driver details: driving licence number and expiry date, street address, postcode, city and country. You may leave these empty and give them at the rental desk.
- •Any message or notes you choose to write.
From you, when you use the contact form
Name, email address, phone number, your message and the rental dates you mention.
At the rental desk
We check the driving licence and an identity document (passport or national ID card) of every driver. We record the details needed for the rental agreement, such as name, date of birth, address, driving licence number, issuing country and expiry date, and we take a copy of the driving licence and of the identity document's photo page. We use the copies to verify your identity, to prevent fraud, and to give your details to authorities or insurers when the law requires it or when you are involved in a traffic accident, damage case or criminal investigation relating to the rental. We do not copy information we do not need. We also record the card used for the security deposit (through the payment provider, without the full card number) and take photos of the vehicle's condition at pick-up and return.
From your messages
If you contact us by email, WhatsApp or another channel, we process the details you choose to share, such as your name, contact details, travel details and copies of documents. We move the details needed for your rental to our reservation system and delete document copies from the message.
From payment providers
Confirmation that a payment succeeded or failed, the amount and a transaction reference. We never see or store your full card number.
From the vehicle
Telematics data, see section 9.
From authorities and third parties
Notices of parking fines, traffic penalties, tolls and damage claims that relate to a rental, and information from insurers and the owner of the vehicle in damage, theft and accident cases.
Automatically, when you browse the website
Technical data such as IP address, browser type, pages visited and the time of the visit, and data collected by cookies (see section 8). The IP address is also used to limit repeated form submissions.
Important: Please do not put health information or other sensitive data in free-text fields.
3. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Answering quote requests and enquiries, creating and managing your booking, taking payment, sending confirmations, handing over and receiving the car | Performance of a contract, or steps taken at your request before entering into one |
| Checking the driving licence and identity of every driver | Contract, our legitimate interest in preventing fraud and identifying the person responsible for the vehicle, and legal obligation where the law requires us to check the right to drive or to give information to authorities |
| Bookkeeping and tax records | Legal obligation (Finnish Accounting Act and Act on Assessment Procedure) |
| Giving the driver's details to authorities for traffic fines | Legal obligation |
| Handling damage, theft, fines, tolls and insurance claims | Contract, legal obligation and our legitimate interest in protecting our vehicles and property |
| Vehicle telematics (section 9) | Our legitimate interest in locating and protecting the vehicle and handling damage, theft, fines and maintenance, the rental contract, and legal obligation where it applies |
| Customer service by email, WhatsApp and other channels | Contract and our legitimate interest in answering you |
| Keeping the website and booking system secure, preventing spam and abuse, and fixing errors | Legitimate interest |
| Measuring how the website is used, advertising cookies, and sending hashed contact details to Google to measure ad conversions | Your consent, which you can withdraw at any time |
Where we rely on legitimate interest, we have weighed it against your rights. You can object at any time (see section 7).
If you do not give the details needed for a booking (name, email address and a working phone number), we cannot take the booking. Driver details you leave empty online must be given at the rental desk before the car is handed over.
4. Who we share data with
We share only the data each recipient needs.
Service providers who process data on our behalf
- •HQ Rental Software, our reservation and rental management system. Booking, customer and driver details, and copies of driving licences and identity documents, are stored there.
- •Stripe, which processes card payments on a secure payment page. Card details go directly to Stripe. Stripe also acts as an independent controller for its own fraud prevention.
- •Resend, which sends emails from the website, such as quote and contact form confirmations.
- •Supabase, which stores quote requests and contact form messages.
- •Vercel, which hosts the website and its server functions.
- •Google: Google Workspace hosts our email. With your consent, Google Tag Manager loads Google Analytics and Google Ads.
- •Cookiebot (Usercentrics), which records your cookie choices.
- •Elfsight, which displays our Google reviews on the website, only with your consent.
- •Cloudflare, which delivers the video on the home page, only with your consent.
- •WhatsApp Business (Meta), if you message us on WhatsApp.
- •The provider of the telematics system in the vehicle.
- •Our accounting and IT service providers, where their work requires it.
Other recipients, only when necessary
- •The owner of the vehicle, insurers and authorities, for the purposes in section 9 and in damage, theft and accident cases.
- •Authorities that issue traffic fines, when the law requires us to give the driver's details.
- •Debt collection agencies, lawyers or courts, if an amount we claim is not paid.
If you contact us through WhatsApp, WhatsApp (Meta) also handles the conversation under its own privacy policy. We do not sell your personal data.
5. Transfers outside the EEA
- •Some of our service providers are based in the United States or may process data outside the European Economic Area, including Stripe, Resend, Supabase, Vercel, Google, Cloudflare and Meta (WhatsApp). The website's server functions run in Stockholm, Sweden.
- •When data leaves the EEA, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.
6. How long we keep data
| Data | Retention |
|---|---|
| Rental agreements, invoices and payment records | Six years from the end of the calendar year in which the financial year ended, as required by the Finnish Accounting Act and the Act on Assessment Procedure |
| Other booking and customer details that are not accounting records, such as phone number, address and notes | Three years from the end of the rental, to cover claims within the general Finnish limitation period |
| Copies of driving licences and identity documents | Deleted at the latest six months after the car is returned, because notices of traffic fines, tolls and parking charges can arrive up to six months later. Kept longer only if a damage, theft, accident, fine or criminal case relating to the rental is still open. |
| Telematics data | Up to six months after the rental ends or, if a damage, theft, accident or fine case is open, until it is closed |
| Records of damage, accidents, fines and claims | Until the matter is closed and the limitation period (normally three years) has ended, and as accounting records where they include payments |
| Messages by email, WhatsApp and other channels about a booking | Three years from the end of the rental |
| Quote requests, contact form messages and other messages that do not lead to a booking | 12 months from the last contact |
| Payment session cookies | Two hours (payment in progress) and 24 hours (payment receipt) |
| Counters that limit repeated form submissions | Up to 24 hours |
| Analytics and advertising cookies | As shown in the cookie settings, at most 13 months |
How we delete data
Our reservation system (HQ Rental Software) holds booking, customer and driver details. Each month we delete copies of driving licences and identity documents whose retention period has ended. Each year we erase or anonymise customer details, and delete emails and chat messages, whose retention period has ended. We keep only what we still need, such as the accounting records the law requires us to keep, and delete it when its retention period ends. Deleted data may remain in our service providers' encrypted backups for a limited time before it is overwritten.
If you ask us to erase your data
We delete everything we are not required to keep. We tell you what we must keep, for example accounting records, and for how long.
7. Your rights
Under the GDPR you have the right to:
- •access the personal data we hold about you and get a copy;
- •have inaccurate or incomplete data corrected;
- •have your data erased, unless we must keep it, for example for bookkeeping;
- •restrict processing in certain situations;
- •receive data you gave us in a machine-readable format (data portability);
- •object to processing based on our legitimate interest;
- •withdraw your consent at any time, for example to analytics and advertising cookies. This does not affect the lawfulness of processing before the withdrawal.
Send requests to info@insidercarrental.com. We may need to confirm your identity first. We answer within one month, which can be extended by two months for complex requests.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).
9. Vehicle telematics
- •Vehicles may be fitted with a telematics system that records location, mileage, driving behaviour and technical status. The data is used to locate the vehicle, to handle damage, theft, fines and maintenance, and to meet legal obligations.
- •Data is shared with the owner of the vehicle, insurers or authorities only when necessary for these purposes and in accordance with the GDPR.
- •We do not use telematics data to follow your journey for any other purpose.
10. Automated decision-making
- •We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
- •The website checks automatically which vehicle classes are available for the driver's age and adds the young driver fee where the rental terms charge it (drivers aged 18 to 25). These are the published rental rules, applied the same way to everyone.
11. Security
- •Data is sent over encrypted connections (HTTPS).
- •Access to personal data, and especially to copies of identity documents, is limited to the people who need it for their work.
- •Service providers that process data on our behalf are bound by data processing agreements.
12. Changes to this policy
- •We may update this policy when our services or the law change. The date at the top of this page shows the latest version.
- •See also our Terms and Conditions.
Questions About Your Data?
If you have a question about your personal data or want to use your rights, please contact us.
