Data and Privacy Protection

Version: 1.0

Last updated: April 2026.

1. INTRODUCTION AND SCOPE

This Data and Privacy Protection notice explains how personal data may be processed in connection with the relevant CARWIZ market website, reservations, rentals, customer communications, business operations, and related support, administrative, technical, reporting, security, and compliance activities.

This notice is intended for website users, customers, drivers, bookers, business contacts, and other individuals whose personal data may be processed in connection with the relevant market operations.

This notice should be read together with any other privacy information provided in a specific context, including during reservations, rentals, customer support interactions, marketing activities, or other data collection points.

2. WHO WE ARE

For the purposes described in this notice, personal data may be processed by the relevant Local Operator and, where applicable, by CARWIZ International d.o.o., Slavonska avenija 26/9, 10000 Zagreb, Croatia, e-mail: privacy@carwiz.rent, website: www.carwiz.rent.

For the purposes of this notice:

“CARWIZ International” means CARWIZ International d.o.o., as identified above.

“Central Platform” means the central CARWIZ digital and administrative environment, including the relevant central website environment, shared reservation related systems, central CMS, reporting dashboard, shared analytics, shared advertising and tracking infrastructure, related central administrative systems, and related technical, security, record keeping, monitoring, and oversight processing.

“Local Operator” means the relevant local CARWIZ market entity, franchise partner, affiliate partner, branch, rental operator, or other locally responsible market operator identified in section 12 of this notice.

The specific details of the relevant Local Operator are provided in section 12 of this notice.

3. JOINT CONTROLLERSHIP SUMMARY

Where appropriate in relation to the relevant market website, reservations, shared systems, reporting, analytics, advertising, tracking, brand governance, customer journey management, operational oversight, and related administrative or technical activities, the Local Operator and CARWIZ International may act as joint controllers of personal data.

This means that the Local Operator and CARWIZ International may jointly determine certain purposes and means of processing, while other processing activities may remain primarily under the responsibility of the Local Operator alone or, where relevant, under the responsibility of CARWIZ International alone.

In general, the Local Operator is responsible for local rental operations, local customer handling, reservation fulfilment, local payment handling, local support, claims, fines, damages, disputes, and compliance with local legal obligations connected to its own market operations.

In general, CARWIZ International is responsible for central brand governance, shared digital infrastructure, central reporting, central oversight, shared analytics, shared advertising and tracking infrastructure, technical administration, security, monitoring, and related central support and compliance functions.

Where a Local Operator independently implements or engages its own marketing, advertising, analytics, remarketing, tracking technologies, third party marketing tools, or external marketing or advertising service providers for its own market website or local operations, responsibility for that processing, including the relevant legal basis, transparency, consent management where required, and vendor relationships, normally sits with the Local Operator, unless the relevant activity is expressly implemented, managed, or jointly governed through the CARWIZ central setup.

The detailed allocation of responsibilities may be governed by a separate arrangement between the relevant parties. The essence of that allocation is reflected in this notice.

Data subjects may contact either the Local Operator or CARWIZ International in relation to applicable processing activities. For convenience and coordination purposes, privacy related requests may also be sent to privacy@carwiz.rent.

4. CATEGORIES OF PERSONAL DATA WE MAY PROCESS

Depending on the relationship, context, and applicable services, we may process the following categories of personal data:

1. a) Identification data, such as name, surname, title, date of birth, nationality, or other identification details where relevant.
2. b) Contact data, such as e-mail address, telephone number, billing address, residence address, or other correspondence details.
3. c) Reservation and rental data, such as reservation number, booking details, rental dates, pick up and return information, selected vehicle category, rental location, optional services, rental documentation, and related operational data.
4. d) Payment related data, such as payment amount, currency, payment status, payment method category, and whether payment was made online or offline.

For the avoidance of doubt, payment card details are generally processed within the relevant payment service provider environment and are not intended to be stored in the Central Platform merely because payment status or payment method information may be visible there.

1. e) Driver and compliance related data, such as driving licence information, age verification data, accident related information, claims information, fines related information, or other data relevant to legal or contractual requirements.
2. f) Customer service and communication data, such as inquiries, complaints, feedback, call notes, support history, and related correspondence.
3. g) Technical and usage data, such as IP address, device information, browser information, operating system, language preferences, website interaction data, cookie identifiers, log data, and similar technical information.
4. h) Marketing and analytics data, such as campaign source, consent status, audience or attribution related data, analytics data, advertising interaction data, and related reporting information.
5. i) Business and administrative data, such as invoicing data, transaction references, internal notes, fraud prevention related flags, audit trail information, and other records necessary for business operations, compliance, or dispute handling.
6. j) Other data that you voluntarily provide to us or that is otherwise lawfully obtained in the relevant context.

5. PURPOSES AND LEGAL BASES OF PROCESSING

We may process personal data for the following purposes, as applicable:

1. a) to respond to inquiries, provide information, and communicate with you before, during, or after a reservation or rental,
2. b) to create, manage, confirm, modify, administer, and document reservations and rentals,
3. c) to verify identity, eligibility, age, driving-related conditions, payment status, and other conditions relevant to reservations or rentals,
4. d) to process payments, deposits, billing, refunds, accounting records, and related financial administration,
5. e) to provide customer support, complaint handling, claim management, damage handling, fine handling, dispute resolution, and related case management,
6. f) to operate, maintain, secure, monitor, support, and improve websites, systems, reservations-related processes, shared tools, analytics, reporting, and related business infrastructure,
7. g) to carry out internal reporting, operational oversight, business planning, audit support, fraud prevention, brand governance, and related administrative management,
8. h) to carry out analytics, attribution, audience measurement, marketing effectiveness review, campaign management, and related advertising or tracking activities, where permitted,
9. i) to send marketing communications or carry out other promotional activities, where permitted,
10. j) to comply with legal, regulatory, tax, accounting, consumer protection, law enforcement, court, or other mandatory obligations,
11. k) to establish, exercise, or defend legal claims.

Depending on the relevant processing activity, the applicable legal basis may be one or more of the following:

1. a) taking steps prior to entering into a contract,
2. b) performance of a contract,
3. c) compliance with a legal obligation,
4. d) consent, where consent is required under applicable law,
5. e) legitimate interests pursued by the relevant controller or controllers, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

Where legitimate interests are relied upon, those interests may include the efficient operation of reservation and rental services, customer management, fraud prevention, operational oversight, business reporting, website and system security, responsible marketing, network governance, and the protection of legal and commercial interests.

Where consent is the legal basis for processing, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. SOURCES OF PERSONAL DATA

We may collect personal data:

1. a) directly from you,
2. b) from the person making a reservation or rental on your behalf,
3. c) from the relevant Local Operator,
4. d) from CARWIZ International,
5. e) from payment service providers, reservation tools, website tools, analytics tools, advertising platforms, or other service providers,
6. f) from insurers, roadside assistance providers, claims handlers, legal advisers, or similar relevant parties,
7. g) from public authorities, courts, regulators, or law enforcement bodies,
8. h) from publicly available sources where lawful and relevant,
9. i) from other lawful sources connected with the relevant reservation, rental, customer relationship, or business operation.

7. RECIPIENTS AND CATEGORIES OF RECIPIENTS

Personal data may be shared, where relevant and lawful, with:

1. a) the relevant Local Operator,
2. b) CARWIZ International,
3. c) other entities within the CARWIZ network where relevant to the service or processing context,
4. d) payment service providers,
5. e) IT, hosting, maintenance, CMS, analytics, advertising, communication, support, security, and other technology service providers,
6. f) accountants, auditors, tax advisers, legal advisers, and other professional advisers,
7. g) insurers, roadside assistance providers, claims handlers, debt collection providers, and similar operational partners where relevant,
8. h) public authorities, regulators, courts, law enforcement bodies, or other third parties where required by law or necessary for legal protection,
9. i) other recipients where you have given instructions, where disclosure is necessary for the performance of a contract, or where disclosure is otherwise lawful.

Where personal data is processed on behalf of a controller by a service provider, appropriate contractual and organisational safeguards are expected to apply.

8. INTERNATIONAL DATA TRANSFERS

Where personal data is transferred outside the European Economic Area, such transfers will be carried out only where lawful and subject to appropriate safeguards.

Depending on the circumstances, this may include:

1. a) a decision that the destination country ensures an adequate level of protection,
2. b) appropriate contractual safeguards,
3. c) a transfer that is otherwise permitted under applicable data protection law.

You may contact us if you would like further information about applicable transfer safeguards in a relevant case.

9. DATA RETENTION

Personal data is retained only for as long as necessary for the purposes for which it was collected or otherwise lawfully processed, including for the fulfilment of contractual obligations, the management of reservations and rentals, customer support, claims and dispute handling, accounting and tax compliance, legal and regulatory compliance, protection of legal rights, fraud prevention, security, audit requirements, and legitimate business administration.

Retention periods may vary depending on the type of data, the applicable legal basis, the relevant market, the operational context, and legal or regulatory requirements.

Where data is no longer required, it will be deleted, anonymised, or otherwise appropriately handled in accordance with applicable legal and operational requirements.

Additional market specific retention information may be provided in section 12 where relevant.

10. RIGHTS OF DATA SUBJECTS

Subject to the conditions and limitations under applicable law, data subjects may have the right to:

1. a) request access to personal data,
2. b) request rectification of inaccurate or incomplete personal data,
3. c) request erasure of personal data,
4. d) request restriction of processing,
5. e) object to processing in certain circumstances,
6. f) request data portability where applicable,
7. g) withdraw consent at any time where consent is the legal basis,
8. h) lodge a complaint with a competent supervisory authority.

Where a request relates primarily to local market operations, local reservation fulfilment, local rental documentation, local payments, local claims, or other primarily local processing, the request should normally be directed to the relevant Local Operator.

Where a request relates to the Central Platform, shared reservation-related systems, central CMS, reporting dashboard, shared analytics, shared advertising and tracking infrastructure, technical logs, security, or other related central processing, the request may be addressed to CARWIZ International.

For convenience and coordination purposes, privacy-related requests may also be sent to privacy@carwiz.rent.

11. HOW TO CONTACT US

For privacy related questions or requests concerning central or shared CARWIZ processing activities, you may contact:

CARWIZ International d.o.o.

Slavonska avenija 26/9

10000 Zagreb

Croatia

E-mail: privacy@carwiz.rent

Website: www.carwiz.rent

For matters concerning local market operations or where local law requires direct local contact details, please also refer to section 12 of this notice.

12. MARKET SPECIFICS

12.1 Local Operator details

ABmobil rent d.o.o.

Ulica Roberta Frangeša-Mihanovića 9, 10000 Zagreb, Hrvatska

MB: 05518393

OIB: 05497691000

privacy@carwiz.rent

12.2 Competent supervisory authority

Direktor: Borko Ribić

info@carwiz.hr

13. CHANGES TO THIS NOTICE

We may update this notice from time to time to reflect legal, regulatory, operational, technical, or organisational changes.

The latest version will be made available through the relevant website or other appropriate channel.