Privacy Policy

1. Data controller

The controller of your personal data is the publisher of this site, whose full identity is set out in the legal notice:

Publisher: Loccor — self-employed, secondary occupation, Liège (Belgium)

Company number (CBE): 0771.759.318 — VAT BE 0771.759.318

Data contact: contact@loccor.com

As the publisher is established in the European Union, Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018 apply to every processing activity described here, whatever the visitor’s country of residence and wherever the rental takes place. No data protection officer has been appointed: the conditions requiring one are not met. Requests should therefore be sent to the address above or through the contact form.

2. Data processed

  • Account: name, email address, phone number, role (customer, agency, partner), profile picture if you upload one, and a technical Google or Apple identifier if you use that sign-in method. Passwords are never stored in clear text, only as a cryptographic hash.
  • Booking: dates, city, chosen vehicle and options, amounts, together with the driver’s identity (name, date of birth, licence number, date and country of issue) and, where applicable, that of the additional driver.
  • Payment: your card details never pass through our servers and are never stored there; they are entered directly with the payment provider. We keep the amount, the date, the payment method and the transaction reference.
  • Partner agencies: identity and business documents of the manager (ID card, trade register), business contact details, photographs of the vehicles offered.
  • Technical data: IP address, browser type, pages viewed, account sign-in history.
  • Correspondence: messages sent through the site’s messaging, the contact form or WhatsApp.

3. Purposes and legal bases

Each processing activity rests on a specific legal basis:

  • Creating and managing your account, handling your bookings, connecting you with the agency — performance of the contract (Art. 6(1)(b) GDPR). Without this data the booking cannot be completed.
  • Collecting payments, issuing invoices and keeping accounts — legal obligation (Art. 6(1)(c)) and performance of the contract.
  • Checking that an applicant agency exists and is entitled to operate — performance of the contract concluded with it, and legitimate interest: listing only genuine professionals.
  • Keeping the service secure, preventing and detecting fraud and abuse (sign-in logs, request rate limiting, message filtering) — legitimate interest (Art. 6(1)(f)).
  • Sending you messages relating to your booking (confirmation, cancellation, reminders, password reset) — performance of the contract.
  • Measuring site audience through Google Analytics 4 — consent (Art. 6(1)(a)), obtained via the cookie banner and revocable at any time.
  • Sending you commercial messages or invitations — consent (Art. 6(1)(a)), withdrawable through the unsubscribe link in every message.

Where processing rests on our legitimate interest, you may object to it (section 7).

4. Recipients

Your data is neither sold, rented nor disclosed for advertising purposes. It is passed only to the following recipients, each for a defined role:

  • Stripe — card payment provider: collection of the deposit and online payments, refunds, payment fraud prevention.
  • PayPal — alternative payment method, where you choose it.
  • Google — audience measurement (Google Analytics 4), only after your consent.
  • Google and Apple — identity providers: if you choose “Continue with Google” or “Continue with Apple”, they pass us your email address and an account identifier. The Google sign-in script is loaded from Google’s servers on the sign-in and sign-up pages: your IP address is therefore known to them as soon as either page opens, even if you do not use this sign-in method. No other data is passed to them unless you click the button.
  • Esri — map tiles: when you display the city map on the search page, the map images are downloaded from Esri’s servers (arcgisonline.com), which then knows your IP address and the area you are viewing. The map only loads after you answer the cookie banner; before that, the list of cities is shown in its place, with no external request. This service sets no cookie.
  • Hostinger — hosting of the public site and delivery of our emails (outgoing mail server).
  • IONOS — hosting of the application server and the database, in Germany.
  • Your browser’s notification service (Google, Mozilla or Apple, depending on the browser) — delivery of push notifications, if you enabled them. The message content reaches them encrypted.
  • Meta (WhatsApp Business) — delivery of messages exchanged with our customer service on WhatsApp, if you choose that channel.
  • The selected partner agency — your contact details and the driver’s identity are passed to it once the booking is confirmed, so the vehicle can be handed over. Conversely, the agency’s identity is disclosed to you only at that point.
  • Competent authorities — upon lawful request.

5. Transfers outside the European Union

  • To Morocco: partner agencies are established there. Confirming a booking passes them your contact details and the driver’s identity. Morocco is not covered by an adequacy decision of the European Commission; this transfer is necessary for the performance of the contract you enter into (Art. 49(1)(b) GDPR).
  • To the United States: some of the providers listed in section 4 (payment, audience measurement, identity providers, notification service) are US companies or belong to US groups. These transfers are governed by the European Commission’s standard contractual clauses and, where the provider is certified under it, by the EU — US Data Privacy Framework.

6. Retention periods

  • Account: kept for as long as it exists. An account whose email address was never confirmed may be deleted automatically: a reminder is sent after 48 hours and deletion follows 24 hours later.
  • Bookings, payments and invoices: kept for accounting and tax purposes, including after your account is deleted, in anonymised form. The exact period remains to be defined.
  • Agencies’ identity and business documents: automatically erased 90 days after the file is accepted or rejected. Only the record of the check is kept — its date, never the document.
  • In-house audience counting: no IP address is stored; pseudonymous rows are deleted after 90 days, only aggregate totals remain.
  • Account sign-in history (date, IP address): period to be defined.
  • Google Analytics: period set in the service configuration, to be defined. The cookie set by that service expires at the latest two years after your last visit.

7. Your rights

You have the following rights over your personal data:

  • Access: learn whether we process your data and obtain a copy of it.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: obtain deletion of your data, except where a legal obligation requires us to keep it.
  • Restriction: ask for processing to be frozen, in particular while a dispute is examined.
  • Portability: receive the data you provided in a structured, machine-readable format, or have it transmitted directly to another controller.
  • Objection: object to processing based on our legitimate interest, and without having to give reasons where direct marketing is concerned.
  • Withdrawal of consent: at any time, for audience measurement as well as commercial messages. Withdrawal does not affect what was done beforehand.

How to exercise them. Write to contact@loccor.com or use the contact form; we answer within one month. Two rights are exercised directly on the site, without writing to us:

  • Erasure: from “My profile”, section “Delete my account”. Your personal data is erased and the account is made unusable at once; your past bookings remain, anonymised, for accounting. A confirmed booking in progress blocks the operation: the agency must be able to reach you until the vehicle is returned. Complete or cancel it, then start again. This button exists on customer accounts only; agencies and partners exercise this right at the address above.
  • Withdrawal of cookie consent: through the “Manage cookies” button at the bottom of this page.

8. Complaints

If you consider that your rights are not being respected, you may lodge a complaint with the supervisory authority of the publisher’s country of establishment:

Data Protection Authority (Belgium)

Rue de la Presse 35, 1000 Brussels

contact@apd-gba.be — www.autoriteprotectiondonnees.be

You may also contact the data protection authority of your country of residence.

9. Automated decision-making

No decision producing legal effects concerning you, or significantly affecting you, is taken solely on the basis of automated processing. Automated checks may flag a message or a booking; the decision that follows is always made by a person. We do not carry out advertising profiling.

10. Cookies and trackers

The site sets cookies that are strictly necessary for it to work: the session cookie that keeps you signed in, and the storage of your language choice. These require no consent and serve no measurement purpose.

Audience measurement (Google Analytics 4) is only set after you accept the banner. Until you accept, Google’s script is not loaded at all: declining does not merely stop cookies from being read, it stops them from being set. No advertising cookie is used.

You can change your choice at any time using the button at the bottom of this page.

11. Security

Exchanges with the site are encrypted (HTTPS). Passwords are stored as a bcrypt hash, never in clear text. The session token is held in a cookie that scripts cannot read, and two-factor authentication is available to accounts that enable it. Access to data is restricted to those who need it. No measure makes the risk zero: should a data breach be likely to result in a high risk to your rights, you would be informed in accordance with Article 34 GDPR.

12. Changes to this policy

This policy may be amended to reflect changes in the service or in the law. The date of the last update appears at the top of the page; in the event of a substantial change, account holders are informed by email.