Privacy policy

1. Controller

The controller for the processing of personal data on this website and for our rentals is:

Velnero Rent, Owner: Carlo Segreto (sole trader)

Minervastraße 51, 90469 Nürnberg

Phone +49 911 13394110, Email info@velnero-rent.de

2. Summary

• Our public pages set no cookies and use no tracking, analytics or advertising services.
• Fonts, images and videos are stored with our host Cloudflare (section 3) and are not loaded from Google or other providers. Opening the site sends no data to third parties such as Google or Meta.
• There is no customer account, no request form and no online payment. You contact us via WhatsApp, phone or email.

3. Hosting and server logs

Our website is run by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare delivers pages, images and videos via its global network and resizes images for your device, usually in a data centre near you.

For every request Cloudflare processes technically necessary data: IP address, date and time, requested address, status code and amount of data transferred, the previously visited page (referrer, if your browser sends it), and browser and operating system.

The purpose is to deliver the website, keep it running reliably and fend off attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Storage of access logs is switched off in our Cloudflare account, so we do not receive or store this data ourselves. Cloudflare processes it only as long as necessary for delivery and for fending off attacks.

Cloudflare processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

4. Storage in your browser

So that the price calculator keeps your chosen rental period when you change pages, the site stores it in your browser's session storage. It stays on your device, is not sent to us and is deleted when you close the tab.

This storage is strictly necessary for the function you are using and therefore permitted without consent (Section 25(2) no. 2 TDDDG).

5. Requests via WhatsApp

The “Request via WhatsApp” and “WhatsApp” buttons are plain links. As long as you do not click them, nothing is sent to WhatsApp. Clicking opens WhatsApp with a prepared message (car, dates, displayed price). Depending on your device, your browser first calls wa.me or api.whatsapp.com; WhatsApp then receives your IP address, browser and device information and the prepared message text before you send anything. The message only reaches us when you tap send yourself.

In the European Region, WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a Meta company. If you message us, we process your phone number, your WhatsApp name and the content of your messages. Message content is end-to-end encrypted. WhatsApp and Meta process connection and usage data under their own terms, including in the USA (see section 9). Details: https://www.whatsapp.com/legal/privacy-policy-eea

The legal basis is Art. 6(1)(b) GDPR if your message concerns a rental, otherwise our legitimate interest in answering your question (Art. 6(1)(f) GDPR). Using WhatsApp is voluntary: you can reach us just as well by phone or email.

Chats that do not lead to a rental are deleted no later than 180 days after the last contact. Chats relating to a rental are kept as long as they are needed for the rental agreement and are then deleted unless a statutory retention obligation applies.

6. Requests by phone or email

If you call or email us, we process your details (such as name, phone number, email address and the content of your request) to deal with it. Emails to info@velnero-rent.de are received by Cloudflare (see section 3) and automatically forwarded to our mailbox (Cloudflare Email Routing); Cloudflare does not store their content. Emails are stored by our email provider. The legal basis is Art. 6(1)(b) GDPR for requests about a rental, otherwise Art. 6(1)(f) GDPR.

Requests that do not lead to a rental are deleted no later than 180 days after the last contact. If they belong to a rental agreement, the statutory retention periods apply (section 7).

7. Reservation and rental agreement

For a reservation we enter your name, contact details, the car, the dates and the price in our management system. Like the website, it runs on Cloudflare. The data is stored in a database of the Neon service (Databricks, Inc., USA, parent company of Neon, LLC) in a data centre in Frankfurt am Main. This provider also processes the data on our behalf (Art. 28 GDPR).

On collection we process what we need for the rental agreement:

• Name, address, date of birth and contact details
• Details from your ID card or passport and from your driving licence
• Payment and deposit details; if you put up your own car as the deposit, also the details from its registration certificate Part II
• The condition of the car and the fuel level in the handover report

The purpose is concluding and performing the rental agreement (Art. 6(1)(b) GDPR). Without this data we cannot hand over a car. We also check the driving licence because we may only let a car to people with a valid licence (Section 21 German Road Traffic Act, Art. 6(1)(c) GDPR).

If you pay the rental price or the deposit by card, the provider of our card terminal and the banks and card schemes involved receive the payment data required for this (Art. 6(1)(b) GDPR).

In the event of damage or traffic offences during the rental we pass on the necessary data to our insurer, the police, the authorities responsible for traffic fines or the courts where we are obliged to or where it is necessary to protect our rights (Art. 6(1)(c) and (f) GDPR). Our tax adviser receives the documents needed for accounting and tax purposes.

Requests that do not lead to a rental are anonymised automatically by our management system 180 days after rejection or cancellation, or after the requested return date. Backups of the management system are encrypted and kept for no more than 8 weeks. Documents relating to rental agreements and invoices are kept as long as tax law requires (Section 147 AO, Section 14b UStG: generally eight years, up to ten years for certain records) and deleted afterwards.

8. Links to Google

“Get directions”, “See our Google reviews” and “Open in Google Maps” under our recommendations are plain links; no map is embedded on our site. Only when you click one of them are you taken to Google, where the privacy policy of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland applies: https://policies.google.com/privacy

9. Transfers to the USA

Cloudflare, Inc., Databricks, Inc. and Neon, LLC (database) as well as WhatsApp LLC and Meta Platforms, Inc. are based in the USA and certified under the EU-US Data Privacy Framework. Where data is transferred to them in the USA, this is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). EU standard contractual clauses have also been agreed with Cloudflare (Art. 46(2)(c) GDPR); you can obtain a copy on request at info@velnero-rent.de.

10. Management area

The management area is for our staff only. It sets only strictly necessary cookies: a session cookie for signing in with passkeys and, when new staff are invited, a cookie valid for five minutes through which the invitation code is displayed. To prevent misuse, sign-in stores a check value derived from the IP address for no more than one day (Art. 6(1)(f) GDPR). Visitors to the public pages are not affected.

11. Your rights

You have the right to:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR), unless a retention obligation applies
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)

Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal message is enough, most easily to info@velnero-rent.de.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de

12. Other

The website is only transmitted in encrypted form (HTTPS). We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles.