Privacy Policy
Contents
1. Data Controller
Company: Orlando Rent A Car S.A.
Tax ID (NIF): A35110550
Address: Avda. Tirajana, 23 — 35100 Playa del Inglés, Gran Canaria, Spain
Contact email: direccion@orlandorc.com
Website: www.orlandorc.com
2. Applicable Regulations
This privacy policy is governed by the following data protection regulations currently in force:
- General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016.
- Spanish Organic Law on Data Protection and Digital Rights (LOPDGDD) — Organic Law 3/2018, of December 5.
- Spanish Law on Information Society Services and Electronic Commerce (LSSICE) — Law 34/2002, of July 11.
3. Personal Data We Collect
We collect personal data through the following channels:
Contact form
- Email address
- Message content
Vehicle reservation
- Full name
- Phone number
- Email address
- Flight number (optional, for airport pick-ups)
Invoicing
- Name or company name
- Tax ID (NIF / CIF)
- Billing address
Browsing data
- IP address
- Cookies and similar technologies (see our Cookie Policy)
4. Purpose and Legal Basis for Processing
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Vehicle reservation management | Performance of a contract (Art. 6.1.b) |
| Responding to contact form enquiries | Consent of the data subject (Art. 6.1.a) |
| Issuing invoices and tax compliance | Compliance with a legal obligation (Art. 6.1.c) |
| Website security (spam and abuse protection) | Legitimate interest of the controller (Art. 6.1.f) |
| Affiliate marketing and conversion tracking | Consent of the data subject (Art. 6.1.a) |
5. Data Retention Period
Personal data will be retained for a maximum period of 5 years from the last interaction or the end of the contractual relationship, in compliance with Spanish tax and commercial obligations. After this period, data will be securely deleted or anonymised.
6. Data Recipients
Your personal data may be shared with the following third parties, exclusively for the stated purposes:
| Recipient | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Secure payment processing | USA (Standard Contractual Clauses) |
| Karve RentaCar | Fleet and reservation management | Spain / EU |
| Affilired | Affiliate marketing | Spain / EU |
| Google LLC (reCAPTCHA) | Spam and abuse protection | USA (Standard Contractual Clauses) |
Your personal data will not be sold or shared with third parties for purposes other than those described above.
7. International Data Transfers
Some of the providers mentioned above are based outside the European Economic Area (EEA). In such cases, data transfers are carried out under Standard Contractual Clauses approved by the European Commission (Art. 46.2.c GDPR), ensuring an adequate level of protection for your personal data.
8. Your Rights
Under the GDPR and the LOPDGDD, you have the right to:
- Access: request information about the personal data we process about you.
- Rectification: request the correction of inaccurate or incomplete data.
- Erasure ("right to be forgotten"): request the deletion of your data when it is no longer necessary for the purpose for which it was collected.
- Restriction of processing: request that we restrict the processing of your data in certain circumstances.
- Data portability: receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
- Objection: object to the processing of your data on grounds relating to your particular situation.
How to exercise your rights
You may exercise any of these rights by sending a request to:
- Email: direccion@orlandorc.com (with the subject line "Data Protection")
- Post: Orlando Rent A Car S.A. — Avda. Tirajana, 23 — 35100 Playa del Inglés, Gran Canaria, Spain
You must include a copy of your ID or equivalent identification document with your request.
Complaint to a supervisory authority
If you believe that the processing of your data infringes current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Website: www.aepd.es
- C/ Jorge Juan, 6 — 28001 Madrid, Spain
9. Security Measures
Orlando Rent A Car S.A. has implemented the necessary technical and organisational measures to ensure the security and integrity of your personal data, as well as to prevent its loss, alteration, unauthorised processing or access, taking into account the state of technology, the nature of the data and the risks to which it is exposed. These measures include: data encryption in transit (HTTPS/TLS), role-based access control, CSRF attack protection, IP-based rate limiting and input validation.
10. Minors
Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from minors under 16. If you are a parent or guardian and become aware that your child has provided us with personal data, please contact us so we can proceed with its deletion.
11. Intellectual Property
The entirety of this website — text, images, trademarks, logos, software files, colour combinations, structure and presentation of content — is protected by Spanish and international Intellectual and Industrial Property laws. The reproduction, distribution, public communication or transformation, in whole or in part, without the express written authorisation of Orlando Rent A Car S.A. is strictly prohibited. Access to this website does not imply any waiver, transfer or assignment of these rights.
12. Changes to This Policy
Orlando Rent A Car S.A. reserves the right to modify this privacy policy to adapt it to legislative or case-law developments. Changes will be published on this page with an updated "last updated" date. We recommend reviewing it periodically.
13. Applicable Law and Jurisdiction
Any dispute arising from this privacy policy shall be subject to the courts of Las Palmas de Gran Canaria, and Spanish law shall apply.