Privacy Policy

1. Personal Information Collected & Collection Methods

We collect the following minimum personal information necessary for service provision.

• At booking: Full name (Korean/English), email, phone number (or KakaoTalk ID)
• At vehicle pick-up & identity verification: Driver's license number and type, passport number
• At advance driver registration (document photos): a photo of the passport photo page or of the front and back of an EU national ID card, photos of the front and back of the driver's license, and – for non-EU licenses – photos of the cover and photo page of the International Driving Permit (IDP)
• Credit card/payment info: Online payments are processed by Barion Payment Zrt. Card data is handled exclusively on Barion's PCI DSS Level 1 certified secure servers. We do not store or have access to your card information.

Document photos are used solely to verify driver qualification and identity, to perform the rental contract, and to satisfy insurance and legal requirements (legal basis: Art. 6(1)(b) and (c) EU GDPR). They are stored in strongly encrypted cloud storage, no public internet link to them is ever created, and only authorized staff can view them. They are not shared with third parties and are never forwarded via messengers or email.

2. Purpose of Collection and Use

Collected information is used only for the following purposes.

• Vehicle booking, cancellation, and rental/return processing
• Driver qualification verification for insurance purposes
• Booking-related email notifications and emergency contact

3-1. Barion Smart Gateway (Payment Fraud Prevention)

Our website uses the Barion Smart Gateway service for payment fraud prevention. The Barion Pixel may collect the following data:

• Browser data (type, version, language, screen resolution)
• On-site activities (page views, clicks)
• Transaction identifiers and payment status
• IP address (anonymized)

Data processing is solely for the purpose of preventing and detecting payment fraud. The legal basis for processing is Art. 6(1)(f) of the EU GDPR (legitimate interest). You can review Barion's privacy policy here: Barion Privacy Policy.

Cookies set by the Barion Pixel: ba_vid and ba_sid (essential, fraud prevention, work without consent) and BarionMarketingConsent (marketing). If you click "Accept" in the cookie banner, Barion may also use anonymised browsing data for marketing purposes. You can withdraw this consent at any time by clearing this site's data (cookies and storage) in your browser, after which the banner is shown again. The banner is shown again at least every 13 months.

The payment service provider is Barion Payment Zrt. (Registered office: H-1117 Budapest, Irinyi József utca 4-20, 2nd floor, Company reg. no.: 01-10-048552). Barion Payment Zrt. is regulated by the Central Bank of Hungary (Magyar Nemzeti Bank), license no.: H-EN-I-1064/2013.

4. Retention and Disposal of Personal Information

JOAJO RENT securely stores your information using Google's top-tier cloud infrastructure with strong encryption.

Once the rental purpose is fully achieved (vehicle returned) and any legally required retention periods end, personal information is immediately deleted or securely masked (***) to prevent identification.

5. Travel Stories (Customer-Written Content)

If you write a travel story for us, we process the data below. Writing one is entirely voluntary and does not affect your rental in any way.

• Data collected: the story text, uploaded photos, your booking number, the display name (derived from the name on your booking), the timestamp and IP address of your consent, and – if you request the gift – your Korean mobile number
• Purpose: publishing the story on our website and on the JOAJO blog; with separate consent, additional use on social media and in advertising
• Legal basis: your consent (Art. 6(1)(a) EU GDPR). Each consent is given separately and can be withdrawn at any time.
• Publicly visible: only the approved story text, the photos, and the display name. Your real name, email, phone number, booking number and IP address are never published.
• Publication licence (1 year): the gift is given in exchange for permission to keep your story and photos published on our website and blog for 1 year from the publication date. This is a copyright licence, so during that period you cannot ask us to unpublish the story. After it ends you may request deletion at any time, and we act within 30 days.
• Your personal data is separate: you may withdraw consent to showing your name at any time, independently of the licence above (Art. 7(3) EU GDPR). We then switch the story to anonymous and delete the real name we hold – while the text and photos remain until the licence ends.
• Mobile number: used only to send the gift voucher and deleted once it has been sent. It is never published and never used for marketing messages.
• Thank-you gift: we send a small gift to those who write a story. It is sent regardless of what the story says, and we never ask for a positive one. We disclose this next to the published stories.
• Photos of other people: please upload photos without faces where possible. If a face appears, we blur it before publishing. Upload photos of other people only with their agreement; we can hide individual photos on request.

To withdraw consent or have a story removed, write to info@joajorentcar.com. Withdrawal does not affect the lawfulness of processing carried out beforehand.

6. Rights of Data Subjects (EU GDPR Compliance)

You may request access, correction, deletion (right to be forgotten), or processing restriction of your personal information at any time. Please send your request to the contact below for prompt action.