Privacy Policy

The controller of the personal data of Renters, authorised drivers and website users is A&A Corporation, ul. Ruczaj 89, 02-997 Warsaw, Poland.

For all matters concerning the processing of personal data you may contact us by e-mail at kontakt@aacorporation.pl, by telephone on +48 884 762 950, or in writing at the controller's registered office.

The controller has not appointed a data protection officer; requests are handled through the contact details above.

Data comes directly from the data subject — through the booking form, e-mail correspondence, a telephone call or the rental agreement.

Where the data was provided by someone else (e.g. an employer booking the rental, an attorney, or a Renter naming an additional driver), the controller receives identification and contact data and driving entitlement data from that person.

When you book on the website we collect: first and last name, e-mail address, telephone number, date of birth, address (street, postcode, city), driving licence number and the reservation details (dates, pickup location, selected vehicle and extras).

When the rental agreement is concluded and the vehicle is handed over we additionally collect the data required for the agreement: identity document type and number, PESEL number or its equivalent, driving licence details and, for companies, registration data and the details of the representative.

The website does not accept online payments and does not collect payment card data. Payment is made by bank transfer or at handover; we receive settlement data only to the extent resulting from the transfer or from a card transaction processed by a payment terminal.

During the rental we process the location data of the rented vehicle from the fitted GPS device, including the route travelled and mileage.

Handling reservations, concluding and performing the rental agreement and contacting you about a reservation — art. 6(1)(b) GDPR.

Issuing and retaining invoices and accounting records, meeting tax obligations and the obligation to identify to the authorities the person entrusted with the vehicle — art. 6(1)(c) GDPR.

Establishing, pursuing and defending claims, including settling damage and breach fees — art. 6(1)(f) GDPR.

Protection of the vehicle and property, fleet security, prevention of misuse, locating and recovering the vehicle in the event of theft, handling incidents and damage, and verifying material breaches of the agreement (GPS/telematics data) — art. 6(1)(f) GDPR, to the extent necessary and proportionate.

Handling complaints and correspondence — art. 6(1)(f) GDPR.

Sending commercial information and marketing our own services — solely on the basis of separate consent, art. 6(1)(a) GDPR in connection with electronic services and telecommunications law.

Providing the data in the booking form and when concluding the agreement is voluntary but necessary to handle the reservation and conclude the rental agreement. Without it the service cannot be provided.

Providing data for marketing purposes is entirely voluntary and does not affect your ability to use our services.

Consent to marketing and to receiving commercial information may be withdrawn at any time by contacting the controller. Withdrawal does not affect the lawfulness of processing carried out before it.

Data may be disclosed or entrusted to: the controller's staff and associates; IT and hosting providers; the e-mail delivery provider; insurers and claims handlers; accounting and legal service providers; debt collection providers in the event of unpaid amounts; and public authorities entitled under the law (including the Police and tax authorities).

Data is entrusted only to the extent necessary to provide the service and on the basis of data processing agreements.

The website infrastructure and the reservation database are hosted on servers located within the European Economic Area.

For sending reservation e-mails we use a mail delivery provider that may also process data outside the European Economic Area.

Any such transfer takes place solely on the basis of the mechanisms provided for in Chapter V GDPR — standard contractual clauses approved by the European Commission or an adequacy decision — together with additional safeguards.

A copy of the safeguards applied is available on request from the controller.

Data from a reservation that did not result in an agreement — for as long as needed to handle the enquiry, no longer than 12 months.

Data relating to a rental agreement — for the term of the agreement and then until the limitation period for claims under it expires.

Accounting and tax records — for the period required by law, as a rule 5 years from the end of the tax year.

Vehicle location data — for the rental period and a short period afterwards, as needed to settle the rental and any incidents, after which it is deleted.

Data processed on the basis of consent — until the consent is withdrawn.

You have the right of access to your data (art. 15 GDPR), to rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20) and to object to processing based on legitimate interests (art. 21).

You have the right to withdraw consent at any time, to the extent that data is processed on that basis.

Please send requests to kontakt@aacorporation.pl. We respond without undue delay and no later than one month from receipt.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

The website does not collect any information automatically other than the information contained in cookies and in the browser's local storage.

Cookies are IT data, in particular text files, stored on the user's end device. They usually contain the name of the website they come from, their storage time and a unique number.

The entity placing cookies on the user's device and accessing them is the controller identified in section 1.

The website uses only cookies necessary for it to function — session handling, security, and remembering your language, colour scheme and cookie decision. The record of the consent decision itself is necessary and is stored without separate consent.

Analytics, marketing and profiling cookies are used only after consent is given in the consent banner.

Once you consent to analytics cookies, the website uses Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It collects visit statistics: the pages you view, the source of your visit, approximate location, and device and browser type. Until you consent, Google's script is not loaded at all and no data — including your IP address — is sent to Google. We do not use advertising or ad personalisation.

Google may also process data outside the European Economic Area, including in the United States. Such transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) and on standard contractual clauses.

Analytics consent can be withdrawn at any time via the “Cookie settings” link in the footer; withdrawal does not affect the lawfulness of processing carried out before it.

Consent to non-essential cookies can be changed at any time via the “Cookie settings” link in the website footer, and through your browser settings. Restricting cookies may affect some website functions.

The website provides a text assistant (“Ask AI”) that answers questions about the fleet, prices, availability and rental rules. Using it is voluntary — the same information is available by phone, by e-mail and through the contact form.

The content of the conversation is stored: the user’s messages and the assistant’s replies, together with what the conversation established, such as the chosen model, the dates or the stated budget. If a user volunteers contact details in the conversation so that an offer can be prepared, those details are stored as an enquiry and handled in the same way as an enquiry from the contact form.

We use conversations to handle the enquiry, to improve the quality of the answers and for the security of the website — including limiting abuse and automated flooding of the chat.

Stored conversations are deleted 90 days after the last message. An enquiry created from a conversation is retained on the terms described in section 8, like any other enquiry.

Please do not type data into the chat that is not needed for an answer — in particular national identification numbers, identity document numbers, payment card details or health information. A model, a date range and a way to reach you are enough to prepare an offer.

Before a message is analysed for what the user is asking about, we automatically remove phone numbers, e-mail addresses, national identification numbers, document numbers and strings that look like a card number. The analysis is carried out using the infrastructure of the provider that operates the website’s artificial-intelligence features (Cloudflare, Inc.); that provider receives no data from the reservation system or from customer records — only the cleaned text of a single message.

The assistant makes no decisions producing legal effects — it does not conclude a contract, confirm a reservation or grant discounts. The prices and availability it quotes come from the same price list and the same calendar as the reservation form.

Data is not used for decisions based solely on automated processing, including profiling, that produce legal effects concerning the data subject.

We apply technical and organisational measures appropriate to the risk — encrypted transmission (HTTPS), access control for the reservation systems, logging of operations in the admin panel, and backups.

Access to data is limited to authorised persons, to the extent necessary to perform their duties.

This policy may be updated if the law, the scope of our services or the tools we use change. The current version, with the date of the last update, is published on the website.