This policy explains what RoadStar Cars Rent does with information about you, why, and what you can require of us. It is written to be read rather than to be survived, and it describes what this website and this business actually do — not what a template says they might.
Who is responsible
The data controller is the business that operates RoadStar Cars Rent, at Calle de Carolina Álvarez 37, 46023 Valencia, Spain. You can reach us about anything in this policy at info@roadstar-rent.es, on +34 611 000 960, or at the address above.
We have not appointed a Data Protection Officer. We are not required to: we are a small vehicle-rental business, monitoring people is not our core activity, and we process no special categories of data. Write to the address above and you reach the people who decide.
What we hold, and why
When you browse
Nothing that identifies you is stored by us from browsing alone unless you agree to it. This site sets no advertising cookies and loads no fonts, scripts, maps or video from anyone else's servers.
Analytics is the one exception, and it is your choice. If you accept it, Google Analytics tells us which pages are used and which are abandoned. If you refuse — or simply ignore the question — the Google script is never sent to your browser at all, so nothing about your visit reaches Google. You can change your mind from "Cookie settings" in the footer of any page, and turning it off deletes what it left behind. The cookie policy names every cookie and explains exactly how the choice works.
Our server keeps ordinary web-server logs, which include your IP address, for a short period. That is how a server is kept secure and working; it is not used to build a picture of you.
When you ask the assistant a question
The question you type is stored, together with the page you asked it on. Your IP address is not stored: it is used for a few seconds, in memory, to stop one machine flooding the box, and it is never written down. We read the questions to find out what this website fails to explain.
When you reserve a vehicle
We ask for, and keep:
- your first name and surname, your email address and your telephone number;
- the driver's date of birth. We ask for the date rather than the age of the driver because the age that matters is the age on the day you collect the vehicle, and a number typed weeks earlier is not that. Bookings taken before 21 August 2026 hold the age we were given at the time instead, and it is erased on the same schedule as everything else here;
- your home address — street, number, apartment, postal code, city and country;
- the type and number of the identity document you will bring: D.N.I., N.I.E. or passport;
- the vehicle, the dates, where you collect and return it, and — if you asked us to bring it to you — the address to bring it to;
- anything you chose to add in the notes box;
- the language you were reading this site in when you booked, so that what we send you afterwards is in the same one;
- what the rental costs and what has been paid.
If you choose to send photographs of your driving licence and your identity document, we keep those too. Sending them is optional and the form says so; it exists because it lets us write the contract before you arrive instead of at the roadside. They are stored outside the part of the server that publishes files, and can be opened only from inside our own administration, after logging in. There is no web address that reaches them.
At handover we also record the marital status the rental contract states, the odometer reading, and the mileage allowance agreed.
Our legal basis for each of these
| What | Why | Legal basis |
|---|---|---|
| Name, contact details, the driver's date of birth, the vehicle and the dates | To hold the vehicle, to reach you about the handover, and to perform the rental agreement | Performance of a contract, or steps taken at your request before entering one — Art. 6(1)(b) |
| Home address, document type and number | A Spanish vehicle-rental contract identifies the hirer. We cannot issue one without these. | Performance of a contract — Art. 6(1)(b); and legal obligation where the authorities require the hirer of a vehicle to be identifiable — Art. 6(1)(c) |
| Photographs of your licence and identity document | To prepare the contract in advance, and to check the driver holds a valid licence | Your consent — Art. 6(1)(a). You may refuse and still rent; you show the originals at handover instead. You can withdraw consent at any time and we delete them. |
| Invoices and the accounting record of what you paid | Spanish tax and commercial law require a business to keep its books | Legal obligation — Art. 6(1)(c) |
| Questions typed into the assistant | To find out what this website fails to explain | Our legitimate interest in a website that answers people — Art. 6(1)(f). The questions are not linked to you. |
| Server logs | Security and keeping the service running | Our legitimate interest in a service that stays up and is not attacked — Art. 6(1)(f) |
| Google Analytics, if you agree to it | To see which pages are used and which are abandoned, so the site can be improved | Your consent — Art. 6(1)(a). Refusing costs you nothing: the site works identically. You can withdraw at any time from the footer of any page. |
| Traffic fines, tolls and damage after a rental | To identify the driver to the authority that asks, and to recover what is owed | Legal obligation — Art. 6(1)(c); and our legitimate interest in recovering costs — Art. 6(1)(f) |
Where the basis is a contract or a legal obligation, giving us the information is a condition of renting a vehicle: without it we cannot write the agreement, and we will not be able to complete the booking. Where the basis is consent — only the document photographs — refusing costs you nothing but a few minutes at handover.
Automated decisions
We make none. Prices, discounts and the availability of a vehicle are worked out by rules the owner sets and can explain; no profile is built about you, and nothing about you is decided by a machine without a person involved.
Who else sees it
Your information is not sold, and it is not shared for anyone's marketing.
- Our hosting provider operates the server this site runs on, and can technically reach the data stored on it.
- Cloudflare, Inc. sits in front of the website, ends the secure connection and filters attacks. It necessarily sees the IP address of every visitor. Cloudflare acts on our instructions as a processor and transfers to the United States are covered by the European Commission's standard contractual clauses and Cloudflare's certification under the EU–US Data Privacy Framework.
- Our accountant and, when required, the Spanish tax authority receive the invoicing records that law requires us to keep.
- The police, the Guardia Civil, the DGT or a court, where we are legally obliged to say who was driving one of our vehicles — after a traffic offence, for instance.
- Our insurer, if there is a claim on a rental.
- Google Ireland Limited, but only if you accepted analytics. It then receives the pages you looked at and a random identifier for your browser. We have switched off Google's advertising features and its cross-site signals, and IP addresses are truncated before storage. Google acts as our processor, and transfers to the United States are covered by the European Commission's standard contractual clauses and Google's certification under the EU–US Data Privacy Framework.
- SumUp Limited, an electronic money institution authorised in Ireland, but only if you choose to pay online by card. It receives your booking reference, the amount and the currency, and nothing else — not your name, your address, your telephone number or your documents. Your card details go straight from your browser to SumUp on their own page: they never reach us, and we could not keep them if we wanted to. SumUp decides for itself how it handles the payment, and its own privacy notice covers what it does with your card.
How long we keep it
| What | How long | Why that long |
|---|---|---|
| Photographs of your licence and identity document | 30 days after the vehicle comes back, then deleted automatically | They exist to prepare the contract. Once the rental is over there is no reason to hold a copy of your passport, so we do not. |
| The booking and the contract details | Six years after the rental ends, then the personal parts are erased and only the anonymous record of the rental remains | Spanish commercial law requires business records to be kept for six years, and tax law allows four. We keep to the longer one and then stop. |
| Invoices | Six years | The same obligation |
| Questions asked of the assistant | Until the website answers them, and no more than two years | They are not linked to you and are only useful while the gap they show is still there |
| Analytics, if you agreed to it | Up to two years in your browser; Google keeps the measurements for 14 months | Withdraw consent and the cookies are deleted straight away |
| Web-server logs | Rotated regularly and kept for weeks, not years | They are for spotting an attack, which is a question about now |
| A data protection request you make to us | Three years after we answer it | It is our evidence that we answered you |
Deletion is not a promise we keep by hand: a scheduled job removes the document photographs and anonymises expired bookings, and it runs whether or not anyone remembers.
What you can require of us
Under the GDPR you have the right to:
- see what we hold about you, and get a copy (Art. 15);
- have it corrected if it is wrong (Art. 16);
- have it erased (Art. 17) — though where the law requires us to keep a rental record we will say so, and erase what is not covered;
- restrict what we do with it while a dispute is sorted out (Art. 18);
- receive it in a portable form (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw consent for the document photographs at any time, without affecting what was lawful before you did (Art. 7(3)).
The quickest route is the data request form, which asks for your booking reference and the email address on that booking so we know it is you. You can also simply write to info@roadstar-rent.es. Either way we answer within one month, free of charge.
If we get it wrong
Tell us first — most things are a misunderstanding and we would rather fix it. If you are not satisfied, you have the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, at C/ Jorge Juan 6, 28001 Madrid, or at www.aepd.es. If you live in another EU country you may complain to your own authority instead.
How it is kept
The whole site is served over an encrypted connection, which is enforced rather than offered. Our administration is behind a password and is not reachable without one. Photographs of identity documents are stored outside the directory the web server publishes, so no address reaches them; they can only be opened from inside the administration after logging in, and they are never displayed in a page. The site loads no third-party code, which is the most common way a website leaks its visitors.
No system is perfect. If a breach ever puts your rights at risk we will tell the AEPD within 72 hours and tell you without undue delay, as Articles 33 and 34 require.
Children
This service is not for children. A driver must hold a licence and meet the minimum age for the vehicle, which is 21 or older across our fleet, so we do not knowingly hold information about anyone under 18.
Changes to this policy
When this policy changes we publish a new version with a new date, and the old one is kept. If you made a booking, the version you were shown when you made it is the one you agreed to, and we can still produce it.
Version 2026-09-07, in force since 7 September 2026. Earlier versions are kept, so a booking can always be shown the wording it was made under.