Privacy policy

Last updated: 10 September 2026

The privacy of your data matters to us. This document explains what data we collect when you use nexa-mobility.ro or rent a vehicle from us, why we collect it, who we share it with, and what rights you have over it.

Company details

Company name: NEXA CAR RENTALS SRL
VAT number: 47051493
Trade Register no.: J2022002913162
EUID: ROONRC.J2022002913162
Incorporated on: 2022-10-20
Registered office: Str. Principala 28, Sat Hințești, jud. Argeș, 117509, România
Email: contact@nexa-mobility.ro
Phone: +40 773 860 155

1.The data controller

The controller of your personal data is NEXA CAR RENTALS SRL, with its registered office at Str. Principala 28, Sat Hințești, Argeș county, postal code 117509, Romania, registered with the Trade Register under no. J2022002913162, VAT number 47051493.

For any question about the processing of your data, or to exercise the rights described below, you can write to us at the email address shown above.

2.What data we collect

Depending on your relationship with us, we process the following categories of data:

Identification data — first and last name, date of birth, identity document series and number, personal numeric code, driving licence series and number.
Contact data — email address, phone number, postal address or the delivery address for the vehicle.
Contract data — the vehicle booked, the period, the pickup and return locations, the additional services selected, the odometer reading, and the condition reports and photographs from handover and return.
Billing and payment data — the billing details of the individual or company, payment history and the transaction identifier. We do not collect or store your full card number.
Incident data — information about accidents, damage, traffic fines or other events occurring during the rental, including, where strictly necessary to establish or defend a legal claim, health data arising from an accident.
Third-party data — the details of any additional drivers you give us. You must inform them of this processing beforehand.
Technical data — IP address, device and browser type, pages visited, and the preferences you express through cookies.

3.Why we process your data, and on what basis

We process your data only where we have a legal basis for doing so:

To enter into and perform the rental contract — booking, handover and return of the vehicle, assistance during the rental. Basis: art. 6(1)(b) GDPR, performance of a contract.
To take payment and issue the invoice. Basis: art. 6(1)(b) and (c) GDPR, performance of a contract and legal obligation.
To meet our tax and accounting obligations and to archive documents. Basis: art. 6(1)(c) GDPR, legal obligation.
To establish, exercise or defend legal claims, and to handle damage, fines and dealings with insurers. Basis: art. 6(1)(f) GDPR, legitimate interest, and for health data, art. 9(2)(f) GDPR.
To prevent fraud and protect our property, including verifying the documents presented at collection. Basis: art. 6(1)(f) GDPR, legitimate interest.
To reply to messages you send us by form, email or WhatsApp. Basis: art. 6(1)(f) GDPR, our legitimate interest in communicating with interested parties.
For commercial communications and offers, where you have given your consent. Basis: art. 6(1)(a) GDPR, consent, which may be withdrawn at any time.
For analytics and marketing cookies. Basis: art. 6(1)(a) GDPR, consent given through the cookie banner.

4.Who we share your data with

We do not sell your data. We share it only with those recipients who help us deliver the service, or to whom we are legally required to report. We currently use the following providers, acting as processors and handling the data solely on our instructions:

Supabase — hosting of the application database and files.
Vercel — hosting and delivery of the website.
Stripe Payments Europe — card payment processing. Card details are collected directly by Stripe, not by us.
Resend — sending transactional emails, such as the booking confirmation.
SmartBill — issuing and archiving invoices.

In addition, where necessary and justified, we may share data with: insurance companies, for claims handling; lawyers, technical experts and bailiffs, to defend a legal claim; public authorities, at their request or where the law requires it; and our accountants and auditors.

Where a provider processes data outside the European Economic Area, the transfer takes place on the basis of the standard contractual clauses adopted by the European Commission or an adequacy decision.

5.How long we keep your data

We keep data only for as long as it is needed for the purpose for which it was collected:

Contract documents, invoices and accounting records — 10 years from the end of the financial year, under Romanian Accounting Law no. 82/1991.
Data from bookings that did not result in a rental — 3 years, the general limitation period.
Records of damage, fines and disputes — 3 years from the final resolution of the matter.
Data processed on the basis of consent, for commercial communications — until consent is withdrawn.
Data collected through cookies — for the periods described in the cookie banner.

6.Your rights

As a data subject, Regulation (EU) 2016/679 gives you the following rights:

the right of access to your data and to information about how we process it (art. 15);
the right to have inaccurate or incomplete data corrected (art. 16);
the right to erasure, in the situations provided for by law (art. 17);
the right to restriction of processing (art. 18);
the right to portability of data provided on the basis of consent or a contract (art. 20);
the right to object to processing based on legitimate interest, including profiling (art. 21);
the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (art. 7(3)).

You can exercise any of these rights by writing to us at the email address above. We respond within one month of receiving your request; this period may be extended by two months for complex requests, in which case we will let you know.

Providing your data is not a legal obligation, but without your identification and contact details we cannot enter into and perform the rental contract.

7.Your right to lodge a complaint

If you believe we have infringed your rights, please contact us first. You always have the right, however, to lodge a complaint with the supervisory authority:

The National Supervisory Authority for Personal Data Processing, B-dul General Gheorghe Magheru no. 28-30, Sector 1, postal code 010336, Bucharest, Romania. Website: dataprotection.ro.

You may also bring proceedings before the competent courts.

8.Cookies

We use cookies that are strictly necessary for the site to work, as well as analytics and marketing cookies — the latter only with your consent, given through the banner shown on your first visit.

You can change or withdraw your cookie choices at any time, and delete cookies from your browser settings. Blocking strictly necessary cookies may affect how the site works.

9.Changes to this policy

We may update this policy when the way we process data changes or when new legal requirements arise. The version in force is always the one published on this page, with the date of the last update shown at the top.

Where the changes are substantial, we will inform you by email or through a prominent notice on the site.