AR Rent a Car Sarajevo ("we", "us", "our") respects your privacy and complies with the EU General Data Protection Regulation (GDPR) and Bosnia and Herzegovina's Law on the Protection of Personal Data. This policy explains what personal data we collect, why we collect it, how we use it, and your rights.

1. Data controller

AR Rent a Car Sarajevo, Kurta Schorka 36, 71210 Sarajevo, Bosnia and Herzegovina. Contact: info@ar-rent-a-car.com.

2. Data we collect

Booking form: first name, surname, phone number, email, country of origin, pickup/drop-off dates and locations, optional notes.
Reviews: first name, email (private, never displayed publicly), optional country, rating, review text.
Contact form / email / phone: the details you provide when reaching out.
Technical data: IP address, browser type, referrer, and pages viewed via privacy-respecting server logs and (if enabled) aggregated analytics. No cross-site tracking cookies.

3. Why we process it (lawful basis)

Contract performance (Art. 6(1)(b) GDPR): to check vehicle availability, confirm your booking, deliver the vehicle, invoice, and provide customer support.
Legal obligation (Art. 6(1)(c)): tax records, insurance documentation, and traffic-authority requirements.
Legitimate interests (Art. 6(1)(f)): preventing fraud, securing our systems, moderating reviews, and improving service quality.
Consent (Art. 6(1)(a)): when you publish a review, you consent to displaying your first name, country and review text.

4. Who we share data with

We share data only with processors strictly necessary to run the service, under written data-processing agreements:

Supabase (managed database and authentication — EU-region hosting).
Resend (transactional email delivery for booking confirmations).
Cloudflare (CDN, DDoS protection, DNS).
Payment providers, insurance companies, and authorities where legally required.

We never sell your personal data.

5. Retention

Booking records: up to 10 years to comply with tax and accounting obligations.
Reviews: until you request removal.
Contact enquiries not resulting in a booking: up to 12 months.
Server logs: up to 30 days.

6. Your rights

You have the right to access, rectify, erase, restrict or object to processing, and to data portability. You can withdraw consent at any time and lodge a complaint with your local data protection authority. To exercise any of these rights email info@ar-rent-a-car.com.

7. Cookies

The site uses only strictly-necessary cookies for authentication and CSRF protection. No third-party advertising or cross-site tracking cookies are set. If we add analytics that require consent in the future, you will see a cookie banner.

8. Security

Data is transmitted over HTTPS. Access to backend systems is restricted, logged, and protected by row-level security. Passwords are hashed and salted. We keep our software patched and monitor for vulnerabilities.

9. International transfers

Our primary infrastructure is hosted in the EU. Where a processor operates outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date above always reflects the current version. Material changes will be highlighted on the website.