Privacy policy

The data controller is GC Auto S.r.l., registered office Via Sempione, 18, 21010 Arsago Seprio (VA), VAT no. IT11286710964. For any matter concerning your data you can write to info@gcauto.it or call +39 0331 808330.

• Identification and contact data: first name, surname, date of birth, email, phone number, preferred language.
• Identity document and driving licence (front/back images, number, expiry, issuing authority) of the driver and of any additional drivers.
• Booking and contract data: vehicle, dates, pick-up and drop-off locations, delivery address, selected extras, prices, mileage, vehicle condition at handover and return (reports, photos and videos).
• Payment data: amounts, chosen method, outcome and transaction references. Card details are processed exclusively by Viva.com on its secure payment page and never pass through our systems.
• Billing data (address, tax code or VAT number) and, where requested, the electronic invoice.
• Communications with us: emails, WhatsApp messages, quote and contact requests, reviews left after the rental.
• Technical browsing data: IP address, browser and device identifiers, date and time of requests (security and anti-abuse logs).
• Location data of the rented vehicle (GPS telematics), processed for the vehicle's safety, recovery in case of theft and verification of compliance with the contract.

• Managing the booking and the rental contract: quote, confirmation, handover, return, payments, deposit, support (performance of the contract – Art. 6(1)(b) GDPR).
• Complying with legal obligations: invoicing and tax record-keeping, mandatory communication of the driver's and contract data to the Public Security Authorities through the C.A.R.G.O.S. system of the Italian State Police, handling of traffic fines and requests from authorities (Art. 6(1)(c) GDPR).
• Protecting our rights and vehicles: fraud and abuse prevention, handling of damage, claims and fines, debt recovery, vehicle location (legitimate interest – Art. 6(1)(f) GDPR).
• Sending you service communications about your booking (confirmation, pick-up and return reminders, changes, invoices) and, only with your consent, offers and commercial reminders by email (consent – Art. 6(1)(a) GDPR, which you can withdraw at any time).
• Measuring and improving the website with analytics and marketing tools, active only with the consent given through the cookie banner (Art. 6(1)(a) GDPR).

Providing your contact details, identity document and driving licence is necessary to conclude the rental contract: without them we cannot hand over the vehicle. Consent to commercial communications and analytics cookies is optional and does not affect your booking.

Data is processed by our authorised staff and by providers acting as data processors (Art. 28 GDPR) or as independent controllers where required by law:

• Viva.com for online card payments: it receives the data needed for the transaction and processes card details independently, under its own privacy policy.
• Italian State Police – C.A.R.G.O.S. system: mandatory communication of the driver's and rental data required by public security regulations.
• Application hosting and database: Vercel and Neon, with data stored in the European Union (Frankfurt).
• Storage of documents, photos and videos of handover reports: Bunny.net, with storage in the European Union.
• Email delivery provider for service communications and, with your consent, commercial ones.
• Analytics and marketing tools (Google Analytics, Meta Pixel) only if you accepted the corresponding cookies; address geocoding service (OpenStreetMap/Nominatim) to calculate delivery fees.
• Insurance companies, loss adjusters, lawyers, judicial and administrative authorities, bodies issuing traffic fines and debt collection companies, where necessary to handle claims, fines or disputes.

Data is stored in the European Union. Should a provider (for example analytics or marketing tools) transfer data outside the EU, this takes place on the basis of European Commission adequacy decisions or standard contractual clauses, with the safeguards set out in Articles 44 et seq. of the GDPR.

• Rental contracts, invoices and accounting documents: 10 years from the end of the relationship, as required by civil and tax law.
• Copies of identity documents and driving licences, handover and return reports with photos and videos: 24 months after the end of the rental, unless disputes, claims, fines or proceedings are pending, for as long as needed to settle them.
• Data for commercial communications: until you withdraw consent, which you can do from the link in every email or by writing to us.
• Technical and security logs and vehicle location data: for the time strictly necessary (normally no longer than 6 months), unless needed to protect our rights in case of abuse or disputes; unconfirmed quotes and contact requests: up to 12 months.

You have the right to access your data, have it rectified or erased, restrict or object to its processing, receive it in a structured format (portability) and withdraw any consent at any time, without affecting the lawfulness of previous processing (Articles 15–22 GDPR). To exercise them write to info@gcauto.it: we reply within one month of your request.

If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante) or bring an action before the courts.

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), restricted and logged access to the management system, signed and expiring personal links for the customer area, providers storing data in the European Union, backups and regular updates. Card details are never stored on our systems.