At Carmio Rent A Car, we value the security of your personal data. This notice explains which personal data we process as the data controller, for what purposes and on which legal grounds, and the rights you have in relation to that processing.
Last updated: October 2, 2026
1. Data Controller
Your personal data is processed by Carmio Rent A Car, the data controller (NO:62, Nicosia 1065, Northern Cyprus), under the Turkish Republic of Northern Cyprus Personal Data Protection Law and applicable legislation.
2. Personal Data We Process
- Identity details: first name, surname, date of birth, identity or passport number
- Contact details: telephone number, email address, address
- Driver details: driving licence number, category and date
- Reservation details: rental dates, pickup locations, flight number, selected services
- Financial details: payment amount, masked card details containing the last digits, deposit records
- Transaction security details: IP address, session and cookie records
- Vehicle usage information: damage, traffic fine and accident records
3. Purposes of Processing
- Creating reservations and entering into and performing the rental contract
- Processing payments, deposits and refunds
- Verifying driver eligibility and identity
- Reservation notifications and customer service processes
- Handling traffic fines, damage and insurance processes
- Meeting legal obligations and requests from official authorities
- Maintaining website security
4. Legal Grounds
Your personal data is processed on the legal grounds of being directly related to entering into or performing a contract, fulfilling the data controller's legal obligations, establishing, exercising or protecting a right, and our legitimate interests provided these do not harm your fundamental rights and freedoms. Processing that does not rely on these grounds, such as promotional messages, takes place only with your explicit consent.
5. Collection Methods
Your personal data is collected electronically or physically through the website, reservation forms, customer service conversations, emails and documents presented at pickup.
6. Data Transfers
Limited to the purposes above, your personal data may be shared with payment providers and banks, insurance companies, legally authorised public institutions, legal advisers and suppliers providing services such as hosting and email. If our infrastructure providers have servers abroad, transfers take place in accordance with the conditions required by applicable legislation.
7. Retention Period
Your personal data is retained for the period required by the purpose of processing and legal retention obligations. Once this period ends, it is deleted, destroyed or anonymised.
8. Your Rights
You have the following rights regarding your personal data:
- Learn whether your personal data is being processed and request information if it has been processed
- Learn the purpose of processing and whether your data is used in accordance with that purpose
- Know the third parties to whom your data has been transferred
- Request correction of incomplete or inaccurate data
- Request deletion or destruction of data under the conditions set out in legislation
- Object to an adverse outcome resulting from analysis by automated systems
- Request compensation for damage caused by unlawful processing
9. Submitting a Request
You may send requests concerning your rights, together with information verifying your identity, by email to destek@carmio.com or in writing to NO:62, Nicosia 1065, Northern Cyprus. Requests are resolved free of charge within 30 days at the latest.
10. Explicit Consent
The following activities take place only with your explicit consent. By selecting the relevant box during reservation, you give explicit consent to these activities:
- Processing my identity, contact and reservation details to inform me about campaigns, discounts and new services
- Sending commercial electronic messages to my contact details by SMS, email or telephone
- Contacting me with satisfaction surveys to measure service quality
- Transferring my personal data abroad where suppliers providing infrastructure services have servers abroad
11. Withdrawing Consent
You may withdraw your explicit consent at any time, without giving a reason, by notifying destek@carmio.com. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Declining explicit consent does not prevent you from using reservation and rental services. Data required to perform the contract is processed without relying on explicit consent.