Privacy Policy

1. Personal Information Collected & Collection Methods

We collect the following minimum personal information necessary for service provision.

• At booking: Full name (Korean/English), email, phone number (or KakaoTalk ID)
• At a Prague quote request: name in Latin letters, date of birth, email, phone number, KakaoTalk ID (optional), rental dates and times, pick-up and return locations (accommodation name and address), number of passengers and bags if you ask us to recommend a car, requests
• When you save a trip to your account: trip name, stops and number of nights (and the location of any point you marked on the map), and the pick-up and return points if you chose them. They are deleted together with your account.
• At vehicle pick-up & identity verification: Driver's license number and type, passport number. If we check your identity with our identity verification service (Didit), Didit reads your ID document. In our Didit settings, comparing the photo on the document with a face captured by the camera during the check is switched on, so the result may include a face match score. The information we receive from Didit may include the result (whether you were verified, the face match score, warnings and, for checks done in the app, the result of reading the document's chip) and the details read from your ID document (name, including any non-Latin spelling, date of birth and age, sex, nationality, place of birth, document type and number, personal number, issuing country, date of issue and expiry date). Of this, we keep only whether you were verified and the issuing country with your booking, and we include the result and the document details in our staff notifications (Telegram, see 4-2). We do not store any other part of this information in our database. Before this amendment, the result details were also written to our server logs; those logs are deleted automatically within about 30 days of this amendment.
• At advance driver registration (document photos): a photo of the passport photo page or of the front and back of an EU national ID card, photos of the front and back of the driver's license, and – for non-EU licenses – photos of the cover and photo page of the International Driving Permit (IDP)
• Credit card/payment info: Online payments are processed by Barion Payment Zrt. Card data is handled exclusively on Barion's PCI DSS Level 1 certified secure servers. We do not store or have access to your card information.
• When you log in (Kakao or Google): the email address the login service gives us (for Kakao, only if Kakao has verified it), your name or nickname, the link to your profile picture (Google), and your member ID at the login service
• Corporate inquiries: company name, contact person's name, email, phone number, the number of cars and rental period needed, and your message. To block automated submissions, this page uses Google reCAPTCHA, which sends device, browser and page-interaction information to Google.
• When handling traffic fines and tolls: the information in fine notices or driver-identification requests sent by the authorities (license plate, date, time and place of the offence, amount and, where included, the driver's name, address and driver's license number)
• When you use the website (our own statistics): the pages you visit and their order, the booking steps you reach and the time spent on each, your search details (dates, locations, car and quoted price), clicks on the contact buttons, how often you open the chat window on our website, when and on which page you first open it, which question, link and contact buttons you tap in it, how many questions you type and send, how often you rate an AI answer, and how often it fails to load or to get an answer (these statistics do not include the content of any question; for the chat window's conversation records, see the chat assistant item below), how you reached us (referring site, ad campaign, Naver search-ad keywords), device type, screen language and time zone. We do not put your name, email address, phone number or IP address in these records. Only if you click Accept in the cookie banner, a random visitor number stored on this device links your later visits, and when you complete a booking on the website, the visit record is linked to your booking number. Without your consent, the records are only linked within a single visit. When you book on the website or request a Prague quote, we also store how you reached us (including the referring address and search terms) with that booking or request; ad click IDs are stored only with your consent.
• When you use the chat assistant (the chat window on our website): your question and the answer shown to you (unmasked, as written; each question up to about 2,000 characters), the time of the question, the screen language and the type of page you were on, kept as conversation records. Questions the chat assistant could not process (for example because of usage limits, because the question was too long, because AI answers were switched off, or because of an error) are kept in the same way; however, if an unusually large number of requests arrives in a short time, some of the questions that could not be processed are only counted and their text is not kept, and questions that never reach our servers (for example because the connection dropped) are not kept. Opening the chat window, starting a new conversation, sending a question (without its text), the buttons you tap in the chat window, the links and contact buttons (KakaoTalk, WhatsApp) you use, your ratings of AI answers and the guidance cards shown to you are each recorded, together with the time, the screen language and the type of page, for each conversation under a random conversation number; these records contain no text and no personal information such as names or contact details. We also process your IP address for usage limits (we do not store the address itself, only a value derived from it with a secret key we hold; for the records our servers keep automatically, see "Server access logs" below). What is sent to the AI and how long it is kept are described in 4-3.
• Preventing abuse of the service: your IP address when you use features such as booking and change requests, booking look-up, submitting driver details and documents, return photos, Prague quote requests and payment links (used to count how often they are used within a short period and to check for misuse; when a payment link is created, the IP address is also kept in our server logs and in the Barion transaction note)
• Server access logs: records our servers keep automatically when you use the website's server functions (IP address, time, requested address, browser information, and processing details such as booking numbers and the recipient addresses of emails we send)
• Error reports: if an error occurs on a page, the error details (including where in our code it occurred), the type of error, a random number created each time a page is opened, the address of the page (without the part after "?" or "#") and browser information. Some records saved before this amendment still contain the part after "?"; they are also deleted within the period in section 4 (90 days).

Document photos are used solely to verify driver qualification and identity, to perform the rental contract, and to satisfy insurance and legal requirements (legal basis: Art. 6(1)(b) and (c) EU GDPR). They are stored in strongly encrypted Google cloud storage located in the United States (see 4-2), no public internet link to them is ever created, and only authorized staff can view them. They are not shared with third parties and are never forwarded via messengers or email.

2. Purpose of Collection and Use

Collected information is used only for the following purposes.

• Vehicle booking, cancellation, and rental/return processing
• Driver qualification verification for insurance purposes
• Booking-related email notifications and emergency contact
• Checking and confirming Prague round-trip quotes and arranging the rental with our partner Express Rent (including checking that the driver is at least 26)
• Login and account management
• Responding to corporate inquiries
• Handling traffic fines and tolls, and answering driver-identification requests from the authorities
• Improving the website and analyzing the booking process (our own statistics)
• Answering rental questions in the chat assistant, checking the quality of its answers and what we told you, and preventing misuse of the chat assistant (see 4-3)
• Running and securing the service, fixing errors, and preventing abuse such as automated or excessive requests

3-1. Barion Smart Gateway (Payment Fraud Prevention)

Our website uses the Barion Smart Gateway service for payment fraud prevention. The Barion Pixel may collect the following data:

• Browser data (type, version, language, screen resolution)
• On-site activities (page views, clicks)
• Transaction identifiers and payment status
• IP address (anonymized)
• A one-way hash of the email address and phone number you enter in the booking details step

Data processing is solely for the purpose of preventing and detecting payment fraud. The legal basis for processing is Art. 6(1)(f) of the EU GDPR (legitimate interest). You can review Barion's privacy policy here: Barion Privacy Policy.

Cookies set by the Barion Pixel: ba_vid and ba_sid (essential, fraud prevention, work without consent) and BarionMarketingConsent (marketing). If you click "Accept" in the cookie banner, Barion may also use anonymised browsing data for marketing purposes. You can withdraw this consent at any time by clearing this site's data (cookies and storage) in your browser, after which the banner is shown again. The banner is shown again at least every 13 months.

The payment service provider is Barion Payment Zrt. (Registered office: H-1117 Budapest, Irinyi József utca 4-20, 2nd floor, Company reg. no.: 01-10-048552). Barion Payment Zrt. is regulated by the Central Bank of Hungary (Magyar Nemzeti Bank), license no.: H-EN-I-1064/2013.

4. Retention and Disposal of Personal Information

JOAJO Rent a Car securely stores your information using Google's top-tier cloud infrastructure with strong encryption.

Once the rental purpose is fully achieved (vehicle returned) and any legally required retention periods end, personal information is immediately deleted or securely masked (***) to prevent identification.

The following records are deleted after a set period:

• Visit records from our own statistics: deleted after 90 days; only daily totals are kept.
• Server access logs: deleted automatically after about 30 days.
• Error reports: deleted within 90 days.
• IP address records for abuse prevention: deleted from our database within 3 days of your last use (for backups, see below).
• Chat assistant records: conversation records (including the record of what you do in the chat window and the guidance cards shown in it) have no set deletion date, are deleted at your request and can be viewed only by our administrators; the records used for usage limits are deleted from our database within 3 days of your last use (see 4-3; for backups, see below).
• Staff notification chats (Telegram) and booking management spreadsheets (Google): no automatic deletion period has been set; we keep them for as long as we need them for our work. If you ask us to delete your information, we handle the request as described in section 5.
• Backups: for disaster recovery we back up the whole database every day and keep each of these backups for 98 days (in the EU), and we also make a daily file backup of the data that we keep for up to 31 days (in the United States). Information we delete (including information deleted at your request and the IP address records for abuse prevention) may therefore remain in backups for up to 98 more days before it is deleted automatically. Files deleted from our file storage (such as document photos and expired file backups) remain recoverable for 7 days before they are erased. Backups are used only for recovery.

4-1. Disclosure to a Third Party (Prague partner: Express Rent)

If you request a quote for a rental that starts and ends in Prague, we share the data below with our local partner so that they can confirm the car and carry out the rental. We share it only if you give your consent on the quote request form.

• Recipient: Express Rent (operated by Alexandr Kulichkov, Czech business ID (IČO) 07870973), Panská 894/4, Prague 1, Czech Republic
• Purpose: checking car availability and the final price, concluding the rental contract, handing over and taking back the car, and handling the rental payment and deposit
• Data shared: name in Latin letters, date of birth, contact details (phone number, email), rental dates and times, pick-up and return locations (accommodation name and address), the car you chose (or, if you ask us to recommend one, the number of passengers and bags), and your requests
• Retention: until the rental contract has been performed and for any retention period required by Czech law (as set out in Express Rent's privacy notice)
• Transfer: the Czech Republic is an EU member state, so the EU GDPR applies in the same way.
• Legal basis: your consent (Art. 6(1)(a) EU GDPR) and the conclusion and performance of a contract (Art. 6(1)(b))
• Refusing consent: you may refuse, but then we cannot process a Prague quote or booking.

You conclude the rental contract directly with Express Rent at pick-up. Any data Express Rent processes from then on (for example ID documents and payment details) is covered by Express Rent's own privacy notice.

4-2. Processors and Transfers outside the EU

To run our service, we entrust the processing of personal information to, or share it with, the companies and bodies below.

• Google (Firebase, Google Cloud, Google Workspace): database, file storage (including document photos), backups, server functions and server access logs, login, sending emails, booking management spreadsheets, text recognition (OCR) of fine notices, protection of the corporate inquiry form against automated submissions (reCAPTCHA), website fonts (Google Fonts), videos (YouTube) and, if you consent, ad measurement and statistics (Google Ads, Google Analytics) — the database, the daily whole-database backup and the server functions are in the EU; file storage (including document photos, return photos, fine notices, and pick-up signatures and handover PDFs) and the daily file backup are in the United States; data for the other services may be processed outside the EU
• Anthropic: AI processing (see 4-3: reading fine notices, reading maintenance receipts and translating maintenance notes, chat assistant answers) — outside the EU, including the United States
• Barion Payment Zrt.: online payments, storing card tokens, payment fraud prevention (see 3-1) — Hungary
• Didit: identity verification at pick-up (reading ID documents and, as set in our Didit settings, comparing the document photo with a face; see section 1)
• KBOSS.hu Kft. (számlázz.hu): issuing invoices — Hungary
• Kakao Corp.: Kakao login — South Korea
• NAVER Corp.: search-ad conversion tracking if you consent (see section 3) — South Korea
• Telegram: staff work notifications — may be processed outside the EU. Data sent:
  • booking and operations notifications (new bookings, change requests, car assignment, pick-up and return, car swaps, payment results, driver-detail reminders, daily summaries, etc.): customer and driver names, booking number, dates, pick-up and return locations, car and license plate, amounts and payment results, mileage and fuel level, damage notes, the content of change requests, the company name for corporate bookings, car photos uploaded at self-return, and the recipient's email address if sending an invoice email fails
  • driver registration notifications: booking number, the driver's name and driver's license number, and the number of document photos uploaded (the photos themselves are not sent)
  • identity verification notifications: booking number (or a mark for on-site checks), Didit session ID, the result and the document details (name and any non-Latin spelling, document type and number, personal number, date of birth and age, sex, nationality, place of birth, issuing country, date of issue, expiry date, face match score, warnings) and, for checks done in the app, the chip reading result and signature check status
  • Prague quote notifications: request number, name, age, dates, pick-up and return locations, the car requested, number of passengers and bags, estimated price, email, phone number, KakaoTalk ID, your requests and the language you used
  • traffic fine deadline notifications: license plate, case number and the driver's name (or the booking number if the driver is not known)
  • error notifications: the error details (including where in our code it occurred), the type of error, the random number created when the page was opened, the page address (without the part after "?" or "#") and browser information
• Express Rent: Prague round-trip rentals (see 4-1) — Czech Republic
• Pick-up and return partners (such as MoParK at Budapest Airport): carrying out pick-up and return for the bookings we assign to them — customer name (in Latin and Korean letters), booking dates and car, payment collected on site, the pick-up signature and, when the handover email is sent, its recipient address — Hungary
• Map, place search and image providers: OpenFreeMap (through the Cloudflare CDN, trip planner maps), komoot (trip planner place search), flagcdn.com (flag images) and Wikimedia (logo on the login page) — your browser loads these directly when you open the page or search, so they receive your IP address (see section 3)
• Insurers, repair and towing companies: to the extent needed to handle accidents and breakdowns — Hungary and the country where it happened
• Police, road authorities and tax authorities: handling fines and tolls, and answering requests made under the law — the country concerned
• JOAJOTOUR CORP. (our Korean affiliate): collecting unpaid amounts under the Terms — South Korea

If you contact us on KakaoTalk or WhatsApp, your messages are also processed under the terms and privacy policy of that messenger's operator.

Transfers outside the EU rely on the following safeguards. Anthropic: the EU Standard Contractual Clauses (SCCs) in the Data Processing Addendum that forms part of Anthropic's Commercial Terms. Kakao, NAVER and JOAJOTOUR CORP.: the European Commission's adequacy decision for the Republic of Korea. Google: the safeguards in Google's data processing terms. You can request a copy of these safeguards at the email address in section 6. We do not sell personal information.

For Telegram, Didit and the map, place search and image providers, we are still confirming where the data is processed and, for any transfer outside the EU, which safeguard applies. We will add this to this section once confirmed.

4-3. Use of AI (Artificial Intelligence)

We use AI from Anthropic for the tasks below. Anthropic processes the data on our behalf and on our instructions as our processor and does not use it to train its models. Processing may take place outside the EU, including in the United States, under the EU Standard Contractual Clauses (SCCs) in the Data Processing Addendum that forms part of Anthropic's Commercial Terms. Anthropic deletes the content within 30 days; content found to violate its usage policy may be kept for up to 2 years, and the related classification scores for up to 7 years.

Reading traffic fine notices (staff task): when we handle a fine notice or a driver-identification request from the authorities, we send a copy of the notice (image or PDF) and its text-recognition (OCR) result to Anthropic to read items such as the amount and the deadline and to write an explanation for our staff. Notices may contain the license plate and the driver's name, address and driver's license number. Before we charge or notify a customer about a fine, our staff check the values read by the AI against the original notice, and we never charge a customer on the basis of the AI result alone. We previously used Google Cloud's AI (Gemini) for this task.

• Legal basis (fine notices): performance of the rental contract (Art. 17 of the Terms; Art. 6(1)(b) EU GDPR), our legal obligation to answer driver-identification requests from the authorities (Art. 6(1)(c)), and our legitimate interest in handling fines accurately and quickly (Art. 6(1)(f))

Reading car maintenance receipts and translating maintenance notes (staff task): we send garage receipts (photos or PDFs) to Anthropic to read items such as the date, mileage and amount, and when we prepare a maintenance history report for selling a car, we also have it translate the maintenance notes written by our staff. Receipts may contain the license plate and the name of the person who brought the car in.

• Legal basis (maintenance receipts): our legitimate interest in keeping maintenance records for our cars and selling them (Art. 6(1)(f) EU GDPR)

5. Rights of Data Subjects (EU GDPR Compliance)

You may request access, correction, deletion (right to be forgotten), or processing restriction of your personal information at any time. Please send your request to the contact below for prompt action.

You may also ask to receive the information you have given us in a machine-readable format or to have it transferred elsewhere (right to data portability). Where processing is based on your consent, you can withdraw it at any time, and you can object to processing based on our legitimate interests (such as our own statistics, server access logs, abuse prevention and the chat assistant). We reply to requests within one month and, if we need more time, we will tell you why. If you are unhappy with how we handle your personal information, you can lodge a complaint with the Hungarian supervisory authority (NAIH, Nemzeti Adatvédelmi és Információszabadság Hatóság, www.naih.hu).