Privacy Policy

Last updated: 12 October 2026

This is an English translation provided for information; in case of any discrepancy, the Romanian version prevails.

Protecting your data is important to us. This policy explains what personal data we process, for what purpose, on what legal basis and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 and applicable national legislation.

Who the data controller is

Atlass Automotive Rapid SRL (brand: Închirieri Auto Otopeni), with a handover point at Henri Coandă Airport, Otopeni, Ilfov, tax ID (CUI) 37175850, registered with the Trade Register under no. J40/3016/09.03.2017, a company providing private services to its customers and partners.

You can contact us on any data protection matter at office@inchirieriauto-otopeni.com or by phone at +40 760 193 060. We are not legally required to appoint a data protection officer (DPO), but requests concerning your data are handled directly by the company’s management.

What data we process

Identification and contact data: first name, last name, email address, phone number — when you contact us via the form, by phone, on WhatsApp or through the virtual assistant (chatbot).
Data for booking a car: rental period, pickup location, chosen car, the country you are travelling from and date of birth (needed to check the legal minimum driving age) — entered in the booking form.
Data needed to provide the requested services: the identification data and documents you give us in order to provide the service (for example name, contact details and, where applicable, the data needed to draw up the related documents or issue the invoice), strictly to the extent necessary to perform the contract and meet legal obligations.
Billing data: the data needed to issue tax documents.
The content of conversations with the AI assistant (chatbot): the messages you send in the chat window, if this feature is active — see the „Virtual assistant (AI chatbot)” section.
Technical and usage data: IP address, device and browser type, pages visited, referral source — collected through cookies and similar technologies, only with your consent (see the Cookie Policy).

Purposes of processing

Responding to requests sent via the form, by phone, by email or through the chatbot, and sending offers;
Providing the requested services: preparing the documents and fulfilling the obligations we have towards you;
Sending documents to the partners or collaborators involved in providing the service, where necessary;
Meeting legal obligations (financial-accounting, archiving and other obligations provided by law);
Measuring and improving the website (traffic statistics) and, where applicable, marketing and remarketing — only on the basis of your consent;
Administrative communications related to your services.

Legal basis

We process data on the basis of: performing the service contract or pre-contractual steps at your request (Art. 6(1)(b) GDPR); the legal obligations incumbent on us (point c); your consent for statistics and marketing cookies, third-party content and optional communications (point a); and our legitimate interest in managing and protecting our business (point f). Identification data are processed solely to provide the requested services and meet the related legal obligations.

Data of other people that you provide to us

For some services you give us personal data of people other than yourself — for example collaborators, representatives or contact persons. By sending us these data you confirm that you have the necessary basis to provide them and that you have informed, or will inform, these people about the processing of their data by the Company for the purpose of providing the service, under this policy. You may give them this privacy policy, which explains the applicable purposes, legal bases and rights. The Company processes these data solely to provide the requested service and discloses them, where applicable, to the partners involved and, where the law requires, to the competent institutions.

Statistics, marketing and cookies

With your consent given through the cookie banner, we use third-party tools to understand how the website is used and, where applicable, for marketing campaigns:

Google Analytics 4 and Google Tag Manager (Google Ireland Ltd.) — aggregated traffic statistics to improve the website. Activated only when you accept the „Statistics” category.
Google Ads (Google Ireland Ltd.) and Meta Pixel (Meta Platforms Ireland Ltd.) — measuring ad effectiveness and, where applicable, remarketing. Activated only when you accept the „Marketing” category.

We use Google Consent Mode v2: before you consent, these tools do not set cookies or send identifying data. We do not make automated decisions with legal effects on you; any audience segments used for advertising do not produce such effects. You can withdraw your consent at any time from „Cookie settings” (page footer). Details: Google Privacy, Meta Privacy.

Virtual assistant (AI chatbot)

If a virtual assistant (an artificial-intelligence chatbot) is active on the website, it helps you with general information about our services and can take a contact request. Please note:

The conversation may be processed by a third-party AI technology provider, acting as a processor under a data processing agreement; messages may be stored temporarily to provide and improve the service.
The answers are informative and indicative, may contain inaccuracies and do not constitute individual professional advice. For your specific situation, a Company consultant will confirm it.
Please do not enter sensitive or unnecessary data in the chat (for example a personal identification number or data from identity documents). For such data we use the service’s secure channels.
You can ask at any time for the conversation to be taken over by a person (human contact).

Who we may disclose data to

We do not sell or rent your data. They may be accessed, strictly for the purposes above, by: the partners and collaborators involved in providing the service, under confidentiality obligations; the competent public institutions, where providing the service or the law requires it; providers supporting our business (accounting, web and email hosting, the statistics/marketing provider and, if applicable, the AI assistant provider). They act as processors or independent controllers, under confidentiality obligations. Data may be disclosed to authorities only where the law requires it.

How long we keep data

Data are kept only as long as necessary for the purpose for which they were collected or as required by legal obligations (financial-accounting and archiving periods, as well as other obligations provided by law). Statistics/marketing data are kept for the duration of the related cookies (see the Cookie Policy). After that, the data are deleted or anonymised.

Transfers outside the EEA

Some providers (for example Google, Meta or the AI assistant provider) may process data, including your IP address, on servers outside the European Economic Area. These transfers are based on appropriate safeguards under Art. 44–49 GDPR (the EU–US Data Privacy Framework adequacy decision and standard contractual clauses, respectively).

Your rights

Under the GDPR, you have the right of: access to your data, rectification, erasure („the right to be forgotten”), restriction of processing, portability, objection and not to be subject to an automated decision with legal effects. You can withdraw your consent at any time, without affecting the lawfulness of prior processing. The right to erasure may be limited by legal obligations to keep documents.

To exercise these rights, write to us at office@inchirieriauto-otopeni.com. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.

Processing of the personal identification number (CNP)

Where providing the services or a legal obligation requires processing the Romanian personal identification number (CNP), we apply the safeguards provided by Law no. 190/2018 (Art. 4): we process the CNP solely for the purpose for which it was collected, based on the data minimisation principle, with access restricted to the staff involved and with specific technical and organisational security measures.

Minors

Our services and website are intended for people with full legal capacity and are not intended for minors. We do not knowingly collect data from minors under 16; if you notify us of such a situation, we delete the data.

Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure: a secure connection (HTTPS), restricted access to documents and protected storage.

Changes to the policy

We may update this policy to reflect changes in legislation or in our services. The version in force is the one published on this page, with the date of the last update stated at the top.