Privacy Policy & Data Protection (GDPR)

Official privacy notice published by the website operator.

Last updated: 15 August 2026

Data Controller

This Privacy Policy describes how the personal data of users who visit and use the ECT Rent website, available at:

https://ect-rent.it/

are processed.

The Data Controller is:

Ect-Download di Castiglione Antonino

VAT No.: 02704200811

Tax Code: CSTNNN90M24D423Y

Registered office: Via San Vito 24, 91019 Valderice (TP), Italy

For any request relating to the processing of personal data or to exercise the rights provided for under Regulation (EU) 2016/679, the Data Controller may be contacted at:

Email: privacy@ect-rent.it

The Data Controller has not currently appointed a Data Protection Officer (DPO), as the relevant requirements do not appear to apply on the basis of the information currently available.

Applicable legislation

This notice is provided pursuant to Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR), Legislative Decree No. 196/2003 – Italian Personal Data Protection Code, as amended by Legislative Decree No. 101/2018, as well as any other applicable legislation concerning the protection of personal data.

This notice has been prepared in accordance with the principles of transparency, fairness, lawfulness, data minimisation and purpose limitation established by applicable legislation.

The Italian Data Protection Authority requires information relating to personal data processing to be provided in a concise, transparent, intelligible and easily accessible form.

Personal data processed

Through the ECT Rent website, different categories of personal data may be processed depending on the services used by the user.

3.1 Identification and personal data

The following data may be processed:

first name;
surname;
date of birth, when provided;
tax code, where required;
nationality;
any additional data necessary for managing the contractual relationship.

The date of birth may be optional during certain stages of the online process, unless its collection is necessary for specific contractual or legal requirements.

3.2 Contact details

The following data may be processed:

telephone number;
email address;
residential or domicile address;
any other contact details voluntarily provided by the user.

3.3 Driving licence and identification document data

In connection with the management of the rental service, data contained in documents required to verify the user's identity and eligibility to drive may be processed, including, where required:

driving licence details;
driving licence number;
category;
issue date;
expiry date;
issuing authority;
data contained in identification documents;
copies or scans of documents that may be uploaded or otherwise collected.

Such data are processed only to the extent necessary for managing the rental relationship, verifying the driver's eligibility and complying with applicable obligations.

Booking and rental data

In order to allow the booking and management of the car rental service, the following data may be processed:

pick-up date and time;
return date and time;
pick-up location;
return location;
selected vehicle;
vehicle registration number;
selected additional services;
rental financial terms;
booking amounts;
advance payments;
security deposits;
payments;
any outstanding balances;
payment method;
communications relating to the booking;
notes necessary for managing the contractual relationship.

These data are necessary to allow the execution of the booking and the subsequent rental agreement.

Payment data

ECT Rent allows bookings to be paid using various methods, including, where available:

online payment through Stripe;
bank transfer;
payments manually recorded by the operator.

ECT Rent processes the data required for the accounting and administrative management of payments.

When Stripe is used, online payment is processed through Stripe's payment infrastructure.

ECT Rent does not directly collect or store complete payment card details in its own database.

Card data are processed in accordance with Stripe's procedures as part of its payment service.

Communications and customer support data

When the user contacts ECT Rent through:

email;
telephone;
WhatsApp;
contact forms;
other communication channels made available by the company,

the data provided by the user and the information contained in the communications may be processed.

Such data are used to:

respond to requests;
provide assistance;
manage booking requests;
manage changes or cancellations;
provide information about services;
manage complaints or disputes.

Review data

ECT Rent provides a section dedicated to customer reviews and testimonials.

When a customer provides a review, the following data may be processed:

name or name provided;
review text;
rating;
language;
country, where applicable;
any additional information voluntarily provided.

The review may be published on the website in accordance with the procedures established by the company.

A review may be published on the website only in accordance with the applicable procedure and, where necessary, on the basis of the data subject's consent.

Browsing data

The IT systems and software procedures used to operate the website may acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols.

Such data may include, by way of example:

IP address;
technical information relating to the device;
browser used;
operating system;
connection information;
date and time of the request;
requested resources;
information necessary for the security and proper functioning of the services.

Such information may be used to:

ensure the proper functioning of the website;
ensure security;
prevent abuse and fraudulent activities;
diagnose technical problems;
manage access to services.

An IP address is information that may make a natural person identifiable and must therefore be processed in accordance with applicable legislation.

Purposes of processing

Personal data are processed for the following purposes.

A. Booking management

For:

receiving and managing booking requests;
checking vehicle availability;
confirming bookings;
managing changes and cancellations;
organising pick-up and return.

Legal basis: performance of pre-contractual measures and of the contract, pursuant to Article 6(1)(b) GDPR.

B. Performance of the rental agreement

For:

managing the contractual relationship;
identifying the driver;
verifying driving requirements;
managing the vehicle;
managing obligations and liabilities arising from the rental;
managing return and closure of the rental agreement.

Legal basis: performance of the contract, Article 6(1)(b) GDPR.

C. Payment management

For:

verifying amounts due;
recording payments and advance payments;
managing security deposits;
recording payments through Stripe;
managing payments by bank transfer;
managing the accounting aspects of the relationship.

Legal basis: performance of the contract and compliance with legal obligations, Article 6(1)(b) and (c) GDPR.

D. Tax and accounting obligations

To comply with obligations under tax, accounting and administrative legislation.

Legal basis: compliance with a legal obligation, Article 6(1)(c) GDPR.

E. Management of user requests

To respond to requests for information, assistance and communications sent by the user.

Legal basis: performance of pre-contractual measures, performance of the contract or legitimate interest, depending on the nature of the request.

F. IT security

For:

protecting the website;
preventing unauthorised access;
preventing fraud;
detecting abnormal activities;
ensuring the security of the infrastructure.

Legal basis: the Data Controller's legitimate interest in the security of its systems and services, Article 6(1)(f) GDPR.

G. Dispute management and protection of rights

Data may be processed in order to:

establish;
exercise;
defend

a right of the Data Controller in judicial or out-of-court proceedings.

Legal basis: legitimate interest of the Data Controller and, where applicable, the establishment, exercise or defence of legal claims.

Provision of data

The provision of personal data may be:

Mandatory

When the data are necessary to:

make a booking;
enter into or perform the rental agreement;
identify the driver;
make a payment;
comply with legal obligations.

Failure to provide the required data may prevent ECT Rent from providing the requested service.

Optional

Certain data may be provided voluntarily and are not essential for the conclusion of the contract.

Failure to provide such data does not normally affect the user's ability to use the main services of the website.

Methods of processing

Personal data may be processed using:

electronic tools;
IT systems;
telematic systems;
paper-based means.

Processing is carried out in accordance with the principles of fairness, lawfulness, transparency, data minimisation, accuracy, purpose limitation and security.

The Data Controller adopts appropriate technical and organisational measures in relation to the risks arising from the processing.

Supabase database and infrastructure

ECT Rent uses Supabase as a technological infrastructure for the management of the database, storage and certain technical services of the platform.

Booking and customer data may therefore be stored and managed through the technological infrastructure used by ECT Rent.

Supabase is used as technological infrastructure and not as a customer authentication service for the public website.

Customers are not required to create an account in order to make a booking.

Authenticated access to the administration area is reserved for authorised users.

Identification documents

Where necessary for the management of the rental service, ECT Rent may collect and retain copies of or information contained in identification documents and driving licences.

The processing is carried out solely for purposes connected with:

identification of the driver;
verification of driving requirements;
management of the rental agreement;
compliance with applicable obligations;
protection of the Data Controller's rights.

The documents are not used for marketing or profiling purposes.

Data relating to fines and traffic offences

In connection with fleet management and rental relationships, ECT Rent may process information relating to penalties, fines and offences associated with a vehicle during the period in which it was made available to the customer.

Such information may include:

date and time of the offence;
place of the offence;
vehicle registration number;
data relating to the associated booking;
details of the identified driver;
amount of the penalty;
any reduced amount;
issuing authority;
documentation relating to the penalty.

The processing is carried out solely for the management of the penalty, obligations arising from the rental agreement and the exercise or protection of the Data Controller's rights.

Disclosure of data to third parties

Personal data may be disclosed, within the scope of their respective responsibilities and for the purposes described above, to:

authorised ECT Rent personnel;
appointed consultants and professionals;
accountants and tax advisers;
banks and payment intermediaries;
IT service providers;
technology infrastructure providers;
hosting, database and storage providers;
Stripe for the processing of online payments;
public and administrative authorities where required by law;
law enforcement authorities or judicial authorities where legally required;
parties responsible for dispute management or protection of rights.

Personal data are not sold or transferred to third parties for advertising profiling purposes.

Data Processors

Where external parties process personal data on behalf of ECT Rent and the conditions set out in Article 28 GDPR are met, the relationship is governed by an appropriate agreement or other instrument provided for under applicable legislation.

Providers are selected taking into account the guarantees they offer in relation to the protection of personal data and processing security.

Stripe

ECT Rent uses Stripe for online payments.

During the payment process, the user may be redirected to the Stripe Checkout platform.

Stripe processes the data necessary to execute the payment in accordance with its own procedures and privacy notices.

ECT Rent does not store complete payment card details in its own database.

For more information about the processing carried out by Stripe, users may consult Stripe's privacy documentation and terms of service.

Google Fonts

The website uses Google Fonts to display typefaces.

Loading fonts may involve the communication of technical information to the service provider, including information relating to the IP address of the device used.

For further information about the processing carried out by Google, users may consult Google's privacy policy.

ECT Rent does not use Google Fonts for profiling or behavioural advertising purposes.

Further information about the use of Google Fonts is also provided in ECT Rent's Cookie Policy.

Google Maps and external services

The website may contain links to Google Maps to help users locate offices and vehicle pick-up and return locations.

The current implementation uses simple external links and does not integrate Google Maps through an SDK or iframe in the frontend.

When the user accesses the external service, data processing is governed by the relevant provider's privacy policy.

Similarly, the website may contain links to WhatsApp to allow users to contact ECT Rent.

Transfers to countries outside the European Economic Area

Some technology providers used by ECT Rent may carry out processing activities or transfers of data outside the European Economic Area.

Where applicable, such transfers are carried out in accordance with the conditions set out in the GDPR and through the safeguards provided for by applicable legislation, including:

adequacy decisions adopted by the European Commission;
Standard Contractual Clauses;
other safeguards provided for under applicable legislation.

For specific information about transfers carried out by individual providers, reference should be made to their respective privacy policies.

Data retention period

ECT Rent retains personal data for no longer than is necessary to achieve the purposes for which they were collected, taking into account contractual, tax, accounting and administrative obligations and any applicable limitation periods.

In particular:

Booking and contract data

These data are retained for the period necessary to manage the contractual relationship and, subsequently, for the period required by law and for the protection of the Data Controller's rights.

Accounting and tax data

These data are retained for the periods required by applicable legislation.

Identification documents and driving licence

These data are retained for the period necessary for the purposes for which they were collected and for any legal obligations or requirements relating to the protection of the Data Controller's rights.

Communications and support requests

These are retained for the period necessary to manage the request and, subsequently, for the time necessary to protect the Data Controller's rights, where applicable.

Technical and security data

These are retained for the period necessary to ensure security, system operation and technical management, in accordance with the principles of data minimisation and proportionality.

Specific retention periods may vary according to the nature of the data and the purpose of processing.

Automated decision-making and profiling

ECT Rent does not carry out profiling of users for advertising purposes.

The website does not use systems for:

behavioural advertising;
automated commercial profiling;
automated customer scoring.

The IT procedures used to check vehicle availability, calculate prices, manage bookings or process payments are operational functions of the service and do not constitute automated decision-making processes intended to produce legal effects or similarly significant effects on the data subject, unless the service is modified in the future.

Minors

ECT Rent's services are not specifically intended for minors.

The booking procedure requires data necessary for entering into and managing the rental relationship and for verifying the requirements applicable to the driver.

If ECT Rent becomes aware that it has collected personal data relating to a minor without the conditions required by law being met, it will take appropriate measures in relation to the circumstances.

Data security

ECT Rent adopts appropriate technical and organisational measures to protect personal data against:

unauthorised access;
loss;
destruction;
alteration;
unauthorised disclosure;
unlawful processing.

Access to administrative data is restricted to authorised users according to their respective roles.

Personal data breaches

If a personal data breach occurs, ECT Rent will assess the situation and carry out the obligations required under applicable legislation.

Where the relevant conditions are met, the Data Controller will notify the breach to the competent supervisory authority within the time limits provided by law and, where required, will also inform the affected data subjects.

Rights of the data subject

The data subject may exercise, where applicable, the rights recognised under Articles 15 to 22 of the GDPR.

In particular, the data subject may request:

Right of access

To obtain confirmation as to whether or not personal data concerning them are being processed and to receive a copy of such data.

Right to rectification

To obtain correction of inaccurate personal data or completion of incomplete data.

Right to erasure

To obtain the erasure of personal data in the cases provided for by applicable legislation.

Right to restriction

To obtain restriction of processing in the cases provided for under the GDPR.

Right to object

To object to processing in the cases provided for by applicable legislation, in particular where the processing is based on legitimate interest.

Right to data portability

To receive personal data provided to the Data Controller in a structured, commonly used and machine-readable format in the cases provided for under Article 20 GDPR.

Right to withdraw consent

Where processing is based on consent, the data subject may withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

The Italian Data Protection Authority confirms that, where consent constitutes the legal basis for processing, it must be freely given, specific, informed and capable of being withdrawn.

How to exercise your rights

To exercise your rights, you may submit a request to:

Ect-Download di Castiglione Antonino

Via San Vito 24

91019 Valderice (TP), Italy

Email: privacy@ect-rent.it

The request may be submitted without any particular formalities.

The Data Controller will respond without undue delay and, as a general rule, within one month of receiving the request.

Where the request is particularly complex or a large number of requests have been received, this period may be extended in accordance with the GDPR, provided that the data subject is informed of the extension and the reasons for it.

Complaint to the Supervisory Authority

If the data subject believes that the processing of their personal data is carried out in breach of applicable legislation, they have the right to lodge a complaint with the competent supervisory authority.

For Italy:

Italian Data Protection Authority

(Garante per la protezione dei dati personali)

The Authority provides information and tools to data subjects for exercising their rights and submitting complaints and reports.

Relationship with the Cookie Policy

This Privacy Policy should be read together with ECT Rent's Cookie Policy, which describes the use of cookies and similar technologies on the website.

The Cookie Policy contains specific information relating, among other things, to:

technical tools;
Google Fonts;
external services;
Stripe;
links to Google Maps;
links to WhatsApp;
any other technologies used on the website.

Updates to this Privacy Policy

This Privacy Policy may be amended or updated over time in order to:

comply with changes in legislation;
implement guidance issued by competent authorities;
reflect changes in the services offered;
update data processing methods;
introduce new services or technologies;
reflect organisational or technical changes.

The updated version will be published on this page together with the relevant date of update.

Data Controller contact details

Ect-Download di Castiglione Antonino

VAT No.: 02704200811

Tax Code: CSTNNN90M24D423Y

Registered office: Via San Vito 24, 91019 Valderice (TP), Italy

Email: privacy@ect-rent.it

---

Fraud Blocker — prevention of advertising fraud and abnormal traffic

ECT-Rent uses the Fraud Blocker service on the public areas of the website to detect and prevent automated traffic, bots, fraudulent clicks and other abnormal activities that may compromise the security of the service or the effectiveness of advertising campaigns.

Fraud Blocker operates on the public pages of the website and is excluded from the restricted administration area.

The service may process technical information relating to the connection, browser and device, including, by way of example, IP address, browser and operating system characteristics, screen resolution, WebGL information, hardware characteristics, detectable fonts and plugins, technical fingerprinting signals, technical visitor identifiers, traffic source and campaign parameters.

Such information may be combined by the provider in order to identify abnormal behaviour and assign a risk level or fraud score to the visit.

Fraud Blocker states that its detection system does not require the use of cookies for these purposes. However, the absence of cookies does not exclude the processing of data or technical device identifiers.

The service is used for security purposes, fraud prevention and protection of the integrity of the service and advertising campaigns. The appropriate qualification of the legal basis and the applicability of the rules set out in Article 122 of the Italian Privacy Code to fingerprinting techniques are subject to assessment under the applicable legislation.