Privacy notice

Who is responsible?

Narvik Rent A Car AS is the controller responsible for the personal data described here.

Organisation number: 932 803 097. Registered address: Neset 5, 8522 Beisfjord, Norway.

This notice applies to website visitors, renters, additional drivers and people booking on behalf of a business.

What information do we process?

When you book, we process your name, date of birth, email address, telephone number and address, together with information about authorised drivers, the vehicle, rental period, collection and return locations, and selected extras.

We receive photos or PDFs of driving licences for review before confirming the booking. These documents may contain a photo, licence number, validity dates, licence categories and restrictions.

We also process rental agreements, confirmations and communications about the booking. For business bookings, we receive relevant company, contact and billing information.

The information comes from you or from the person or business booking on your behalf. Additional information may be provided by telephone, email or messaging service.

Comments are optional. Do not enter payment card details, national identification numbers or health information in comments or chat.

Why do we process this information?

• Process the booking and fulfil the rental agreement.
• Check driving licences and administer authorised drivers.
• Communicate about the booking, collection and return.
• Meet accounting obligations and handle specific damage, insurance cases and disputes.
• Operate, secure and improve the website.

Where you are a party to the agreement, processing necessary for your booking and rental agreement is based on Article 6(1)(b) of the GDPR.

Driving licence checks, administration of additional drivers and business contacts, necessary security measures and handling legal claims are based on legitimate interests under point (f). These interests are to provide a responsible rental service, protect the service and safeguard necessary claims.

Statutory accounting processing is based on point (c). Google Analytics is used with consent under point (a). Our own visitor statistics are based on the legitimate interest in understanding traffic and improving the booking process.

If information needed for the booking or driving licence check is missing, we cannot complete the booking or handover until this is clarified.

Driving licence images

The rental manager reviews the uploaded driving licence before confirming the booking and assesses whether it appears valid.

We retain driving licence images throughout the rental period and delete them six calendar months after the vehicle has actually been returned.

If particular images remain necessary for a specific damage or insurance case, dispute or legally binding preservation order, we retain only the necessary material for as long as that need continues. We reassess the need during this time.

Who has access?

The rental manager processes information needed for the rental. Authorised developers have technical access for operation and maintenance.

We use DigitalOcean for hosting and Webhuset to send emails. The rental agreement is sent by email, and the rental manager receives a copy. Where several drivers are registered, the mailing may also include their registered email addresses.

The website uses Google Analytics for optional analytics, Google Maps for maps and Sentry for error reporting. When the AI assistant is enabled and you send a message, it is processed through Anthropic to answer your question.

In specific cases, necessary information may be disclosed to insurers, advisers or authorities where there is a lawful basis.

How long do we keep other information?

Accounting documentation is generally retained for five years after the end of the financial year.

Agreements and significant correspondence that serve as supplementary accounting records are normally retained for three years and six months after the end of the financial year. If the rental agreement is necessary evidence of a recorded transaction, the five-year period applies.

For specific claims or disputes, necessary documentation may be retained longer to handle the case. This does not automatically extend retention of all information about the customer.

Anonymised statistics that do not allow individuals to be identified may be retained after personal data has been deleted.

Your rights

You may request access to your information, rectification, erasure or restriction of processing.

You may object to processing based on legitimate interests. We will assess your objection and whether there remains a lawful basis for processing.

You may have a right to data portability for information you have provided where processing is automated and based on contract or consent.

You can withdraw consent to Google Analytics through ‘Analytics settings’. This does not affect the lawfulness of processing before consent was withdrawn.

These rights apply under the conditions of the GDPR. We may need to retain some information for statutory accounting obligations or necessary legal claims.

Send your request to [email protected]. We respond without undue delay, normally within one month. If the conditions for an extension are met, we will inform you within the first month.

You can complain to Datatilsynet. You do not need to contact us first.