AR Rent a Car Sarajevo ("we", "us", "our") respects your privacy and complies with the EU General Data Protection Regulation (GDPR) and Bosnia and Herzegovina's Law on the Protection of Personal Data. This policy explains what personal data we collect, why we collect it, how we use it, and your rights.

1. Data controller

AR Rent a Car Sarajevo, Kurta Schorka 36, 71210 Sarajevo, Bosnia and Herzegovina. Contact: info@ar-rent-a-car.com.

2. Data we collect

Booking form: first name, surname, phone number, email, country of origin, pickup/drop-off dates and locations, optional notes.
Reviews: first name, email (private, never displayed publicly), optional country, rating, review text.
Contact form / email / phone: the details you provide when reaching out.
Technical and audience data: IP address and browser type in server logs, plus first-party audience measurement provided by our hosting platform. For each page view it records the page address, the referring page, your browser user-agent string, your language and the country derived from your device time zone, together with a randomly generated session identifier that is stored in a first-party session-id cookie and expires after 30 minutes. The data is used only for aggregated visit statistics. There is no advertising, no profiling and no cross-site tracking.

3. Why we process it (lawful basis)

Contract performance (Art. 6(1)(b) GDPR): to check vehicle availability, confirm your booking, deliver the vehicle, invoice, and provide customer support.
Legal obligation (Art. 6(1)(c)): tax records, insurance documentation, and traffic-authority requirements.
Legitimate interests (Art. 6(1)(f)): preventing fraud, securing our systems, moderating reviews, and improving service quality.
Consent (Art. 6(1)(a)): when you publish a review, you consent to displaying your first name, country and review text.

4. Who we share data with

We share data only with processors strictly necessary to run the service, under written data-processing agreements:

Supabase (managed database and authentication — EU-region hosting).
Resend (transactional email delivery for booking confirmations).
Cloudflare (CDN, DDoS protection, DNS).
Payment providers, insurance companies, and authorities where legally required.
Google (Google Places API, USA): supplies the customer-review carousel shown on the homepage. Reviewer first name, photo and review text are fetched server-side; reviewer photos are proxied through our own domain so your browser does not contact Google directly. Google may also process your IP address only if you click through to a Google review link. Transfer safeguarded by EU Standard Contractual Clauses.
MCP AI agents (optional): our public MCP endpoint lets AI assistants (e.g. ChatGPT) submit bookings on your behalf when you explicitly ask them to. The same data (name, email, phone, dates, locations) is stored and processed as with a website booking, and the same confirmation emails are sent.

We never sell your personal data.

5. Retention

Booking records: up to 10 years to comply with tax and accounting obligations.
Reviews: until you request removal.
Contact enquiries not resulting in a booking: up to 12 months.
Server logs: up to 30 days.

6. Your rights

You have the right to access, rectify, erase, restrict or object to processing, and to data portability. You can withdraw consent at any time and lodge a complaint with your local data protection authority. To exercise any of these rights email info@ar-rent-a-car.com.

We respond within 30 days (GDPR Art. 12(3)). To protect your data we may ask for information to verify your identity before acting on a request.

7. Cookies

The site sets only first-party cookies: strictly-necessary cookies for authentication, CSRF protection and deployment routing, and one audience-measurement cookie named session-id, which holds a random session identifier for 30 minutes so repeat page views within a visit are counted once. No third-party advertising or cross-site tracking cookies are set, and no data is sold or shared with advertisers.

The measurement cookie is only set after you accept it in the cookie notice shown on your first visit. Declining keeps the site fully functional. You can change your choice at any time:

The Contact page contains an optional Google Maps embed. It is not loaded by default; when you click “Load map”, Google may set its own cookies and receive your IP address. See Google’s privacy policy for details.

AI assistant (“Ask AR”): the chat widget is optional and only starts after you agree. Your messages are sent to our server and to our AI provider solely to generate an answer; we do not store chat history — it is kept in your browser tab only and disappears when you close it. If you ask the assistant to book, the name, email, phone and dates you provide are stored as a normal pending booking request, exactly as if you had used the booking form. Do not share payment card details, passport numbers or other sensitive data in the chat.

8. Security

Data is transmitted over HTTPS. Access to backend systems is restricted, logged, and protected by row-level security. Passwords are hashed and salted. We keep our software patched and monitor for vulnerabilities.

9. International transfers

Our primary infrastructure is hosted in the EU. Where a processor operates outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date above always reflects the current version. Material changes will be highlighted on the website.