Privacy Policy
Your privacy and data protection are our top priorities
Last updated: January 12, 2026
1. Introduction
This Privacy Policy explains how Turist ekspert d.o.o., a company registered in the Republic of Croatia, collects, uses, and protects personal data when you use our website hit-rent.com and our car rental services.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Croatian data protection laws.
2. Data Controller
3. Personal Data We Collect
We may collect and process the following personal data:
- Full name
- Email address
- Phone number
- Billing and invoicing details
- Copy and details of the driver's license
- Reservation and rental agreement data
- Vehicle-related data during the rental period
- IP address and browser information
- Online payment data
Note: We do not store full credit card details. Payments are processed securely by Stripe Payments Europe, Ltd., a certified payment service provider.
4. Purpose of Data Processing
Personal data is processed for the following purposes:
5. Legal Basis for Processing
We process personal data based on:
Performance of a contract
Article 6(1)(b) GDPR
Legal obligation
Article 6(1)(c) GDPR
Legitimate interest
Article 6(1)(f) GDPR
Consent
Article 6(1)(a) GDPR
6. Storage of Driver's License Copies
Copies of driver's licenses are collected solely for identity verification and rental compliance purposes.
Such data is:
- Accessed only by authorized personnel
- Stored securely with restricted access
- Retained only for the necessary period
- Deleted or anonymized when no longer required, unless legal retention applies
7. Data Retention
Personal data is retained only for as long as necessary to fulfill the stated purposes or as required by applicable Croatian laws.
8. Data Sharing
Personal data may be shared with:
- Stripe Payments Europe, Ltd. (payment processing)
- IT, hosting, and booking system providers
- Accounting and legal service providers
- Competent public authorities when required by law
All recipients process personal data in compliance with GDPR.
9. International Data Transfers
If personal data is transferred outside the European Economic Area (EEA), appropriate safeguards are applied in accordance with GDPR, including Standard Contractual Clauses.
10. Data Subject Rights
You have the right to:
- Access your personal data
- Rectify inaccurate data
- Request erasure where legally permitted
- Restrict or object to processing
- Withdraw consent at any time
- Lodge a complaint with the Croatian Data Protection Authority (AZOP)
Supervisory authority: Croatian Personal Data Protection Agency (AZOP)
www.azop.hr →Requests may be sent to: [email protected]
11. Data Security
We apply appropriate technical and organizational security measures, including SSL encryption, secure servers, access controls, and limited staff access.
12. Cookies
Our website uses cookies for functionality, analytics, and marketing purposes. Cookie preferences can be managed through the cookie consent banner. Learn more about our Cookie Policy
13. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy. Changes will be published on this page with an updated "Last updated" date.