Notice under articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003. Last updated: 2 October 2026. This is a translation: in case of discrepancy the Italian version prevails.
1. Data controller
A.C.V. Rent Car S.r.l. (LUX.PL Rent Car brand), Via Vincenzo Merolla 9, 80016 Marano di Napoli (NA), Italy, VAT no. and tax code 10581611216. Privacy email: privacy@luxplrentcar.it · PEC: acvrentcarsrl@pec.it.
2. What data we process
- Contact and identification data: first and last name, email, phone, date of birth;
- Driver data: driving licence number (optional online, required at pick-up), identity document details collected at pick-up;
- Invoicing data, if requested: tax code, company name, VAT number, SDI code or PEC, address;
- Booking data: vehicle, dates, amounts, payment status, change or cancellation requests, notes you send us;
- Payment data: handled directly by Stripe; we only receive the outcome, the amount and a transaction ID, never full card details;
- Browsing data: IP address and technical data needed for the website to work and stay secure (for example to block automated submissions);
- Messages sent via the contact form, email or WhatsApp.
We do not ask for special categories of data (art. 9 GDPR). Please do not enter them in the notes fields.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Managing the booking, payment, rental contract, handover and return; sending confirmation, calendar file, pick-up reminder and service messages | Performance of a contract and pre-contractual steps (art. 6.1.b) |
| Tax, accounting and legal obligations (invoicing, record keeping, communications to authorities where required, handling traffic fines) | Legal obligation (art. 6.1.c) |
| Checking age and driving requirements, preventing fraud and misuse of the website, protecting our rights in case of damage or disputes | Legitimate interest (art. 6.1.f) |
| Asking you for a review after the rental, with the option to object at any time | Legitimate interest (art. 6.1.f) |
| Replying to messages sent through the contact form | Pre-contractual steps at your request (art. 6.1.b) |
| Sending offers and news by email, only if you ticked the box | Consent (art. 6.1.a), which can be withdrawn at any time |
Providing the data marked as required is necessary to book; without it we cannot conclude the rental.
4. Who we share data with
- Stripe Payments Europe Ltd. (payments), as independent controller for payment data;
- website hosting provider: Netsons
- Cloudflare, Inc. for anti-spam protection and security, if enabled;
- Google LLC only if you open the map on the Contact page;
- accountant, legal advisers, insurers and assessors, where necessary;
- public authorities and police, where required by law (for example notifying the driver’s details for fines).
Providers act as processors under a contract pursuant to art. 28 GDPR, except where indicated as independent controllers. Data is not disclosed to the public.
5. Transfers outside the EU
Some providers (for example Stripe, Cloudflare, Google) may process data in the United States. Transfers are based on the EU–US adequacy decision (Data Privacy Framework) for certified companies, or on the European Commission’s standard contractual clauses.
6. How long we keep data
- bookings, contracts, payments and tax documents: 10 years (art. 2220 of the Italian Civil Code and tax law);
- unpaid, expired bookings: automatically deleted after 30 days;
- contact form messages not followed by a booking: 12 months;
- marketing data: until consent is withdrawn;
- technical security data: for as long as strictly necessary.
7. Your rights
You can request access, rectification, erasure, restriction and portability, object to processing based on legitimate interest (articles 15–22 GDPR) and withdraw marketing consent by writing to privacy@luxplrentcar.it. You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
8. Security
The website uses an encrypted connection (HTTPS). Access to data in the management panel is limited to authorised staff. The internal calendar feed contains only the car, the customer’s surname and the booking status.
9. Cookies
For cookies, see the Cookie Policy.