Privacy policy.

What data we collect

• Rental requests: your full name, email address, phone number, chosen car, pick-up and return dates, pick-up location and any note you add.
• Contact by email or phone: the information you send or tell us.
• Technical data: when you send a request, we record the time and a one-way hash of your IP address (not the address itself). Our hosting provider keeps standard technical logs of visits, such as IP address and browser type.

Data needed for the rental contract, such as your ID document and driving licence, is not collected through the website but at our office when you pick up the car.

Purpose and legal basis

• Answering your request and arranging the rental: steps taken at your request before entering into a contract, and the consent you give in the form.
• Protecting the website from unwanted and automated requests: our legitimate interest in keeping the service secure.
• Meeting legal obligations once a rental contract is signed, such as accounting and tax rules.

We do not use your data for marketing, we do not sell it and we do not share it with third parties, except the service providers listed below.

Service providers

To run the website, we use service providers that process data on our behalf:

• Vercel Inc.: website hosting.
• Supabase Inc.: storing requests in a database.
• Resend Inc.: sending requests to our email address.
• Google LLC: the email account where we receive requests, and the Google Maps map shown on the site.
• Cloudflare Inc.: checking that the form is not sent by an automated program (Turnstile).

Some of them process data outside Bosnia and Herzegovina, including in the European Union and the United States, under their own data protection terms.

How long we keep data

• Requests sent through the website are kept for up to 12 months and are then deleted automatically, together with the IP address hash.
• The copy of a request that reaches us by email is kept as long as needed to communicate with you.
• If we sign a rental contract, contract data is kept for as long as accounting and tax rules require.

Cookies and browser storage

The website does not use tracking or advertising cookies and has no visitor analytics. Your browser only remembers the display mode you chose (light or dark), and this never leaves your device. The Google Maps map loads from Google servers, and Google may set its own cookies under its privacy policy. The site administration uses a necessary login cookie for authorised staff only.

Your rights

Regarding your personal data, you have the right to:

• request access to your data and a copy of it
• request correction of inaccurate data
• request deletion of your data
• request restriction of processing
• object to processing based on legitimate interest
• request data portability
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

Send your request to mapehmedjugorje@gmail.com and we will reply within 30 days at the latest. If you believe your rights have been violated, you can lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina (azlp.ba).

Security

Data is transferred over an encrypted connection (HTTPS). Requests are accessed only by authorised staff through a protected administration area, and the site is protected against automated attacks.

Changes to this policy

We may update this policy from time to time. The current version is always published on this page with the date of the last update.