Carzoo — PRIVACY NOTICE
Platform, Booking and Marketplace Services
This Privacy Notice explains how CARZOO S.A.R.L. collects, uses, stores, discloses and otherwise processes personal data in connection with the CARZOO website, mobile website, applications, customer-support channels, booking services and automotive marketplace (collectively, the “Platform”).
CARZOO S.A.R.L. is a Lebanese limited liability company registered with the Beirut Commercial Register under number 2083036, with its registered office at Sheile, Rue 113, Blue Zone, Kesrouane, Lebanon (“CARZOO”, “we”, “us” or “our”).
This Notice should be read together with the CARZOO Terms and Conditions, the Cookie Notice and any booking-specific information displayed during checkout. A Rental Company, insurer, payment provider or other independent third party may provide a separate privacy notice for processing under its own responsibility.
1. SCOPE AND KEY CONCEPTS
This Notice applies to visitors, registered Users, Customers, Main Drivers, additional drivers, persons for whom a Booking is made, customer-support contacts, and individual representatives of Rental Companies, suppliers and business partners.
“Personal Data” means any information relating to a natural person who is identified or can reasonably be identified, directly or indirectly, including through the comparison or combination of information from different sources. Information about a company or fleet is covered by this Notice only to the extent that it identifies or relates to an individual.
“Processing” includes collecting, recording, organizing, storing, reviewing, using, sharing, transferring, correcting, restricting, deleting or otherwise handling Personal Data.
2. WHO IS RESPONSIBLE FOR THE DATA
Carzoo determines the purposes and methods of Processing Personal Data for Platform accounts, search and comparison services, Booking facilitation, payment-related services, customer support, security and Carzoo’s own business operations. For those activities, Carzoo is the person responsible for the Processing.
The relevant Rental Company is ordinarily a separate person responsible for Processing Personal Data needed to confirm and perform the vehicle rental, verify driver eligibility, issue the Rental Agreement, collect deposits or direct payments, manage the vehicle, and address incidents, damage, insurance, fines and returns. Its own privacy notice and Rental Agreement may apply.
Payment providers, insurers and other third parties may also determine independently how they Process data for their regulated or separate services. Carzoo will make any declaration and seek any authorization or license required for its Processing under applicable Lebanese law.
3. PERSONAL DATA WE MAY COLLECT
Depending on how the Platform is used and the Booking selected, Carzoo may Process the following categories of Personal Data:
· identity data, including name, date of birth, nationality and identification-document details where required;
· contact data, including email address, telephone number, WhatsApp number, address and preferred language;
· account data, including login identifiers, encrypted credentials, settings, saved preferences and account history;
· driver and eligibility data, including driving-license information, license history or duration, age category, additional-driver information and other information required by the selected Rental Company;
· Booking and rental data, including search criteria, dates, locations, vehicle category, Rental Company, rate, options, Booking status, confirmation, cancellation, refund and rental-performance information;
· payment and transaction data, including payment method, transaction reference, currency, amount, authorization status, refund, chargeback and limited card information received from a payment provider;
· communications and support data, including messages, complaints, requests, photographs, documents and records of assistance;
· technical and usage data, including IP address, device and browser information, application identifiers, timestamps, pages or features used, approximate location derived from an IP address, and precise location only where enabled and permitted;
· security and verification data, including login events, suspected fraud indicators and information used to protect accounts, payments and the Platform;
· marketing and preference data, including communication choices, campaign interactions and consent records;
· business contact data relating to representatives, personnel or contractors of Rental Companies, suppliers and partners; and
· incident, accident, damage, insurance or legal-claim information were reasonably necessary to provide support, comply with law or protect legal rights.
Carzoo does not ask Users to provide health, genetic data as part of an ordinary search or booking. If information of a specially protected nature becomes necessary for accessibility, safety, an incident, insurance or a legal claim, it will be Processed only to the extent necessary and where the required consent, legal basis, declaration, authorization or license exists.
4. HOW WE OBTAIN PERSONAL DATA
Carzoo may obtain Personal Data directly from you when you browse, create an account, submit or manage a Booking, make a payment, communicate with support, enter a promotion, provide feedback or adjust preferences.
We may also receive Personal Data from a person making a Booking for you; the Main Driver; a Rental Company or its connected inventory or booking system; payment, identity-verification, fraud-prevention, communications or support providers; your device or browser; and public authorities or lawfully available sources.
Where data is obtained from another source, Carzoo will provide the information required by law unless you already have that information or an applicable legal exception permits otherwise.
5. MANDATORY AND OPTIONAL INFORMATION
The Platform, the Booking Conditions or the collection form will indicate where information is mandatory. Information required to create an account, identify the contracting person, confirm availability, process payment, prevent fraud or satisfy a Rental Company’s disclosed driver’s requirements must be supplied if you wish to use the relevant service.
If mandatory information is not provided or cannot be verified, Carzoo or the relevant Rental Company may be unable to create an account, process or confirm the Booking, accept payment, release the vehicle, provide support or comply with a legal duty. Optional information may be withheld without preventing unrelated Platform functions.
If you provide Personal Data about another person, you confirm that you are authorized to do so and that you have given that person the information required by law, including this Notice where appropriate.
6. WHY WE PROCESS PERSONAL DATA
Carzoo processes Personal Data only for legitimate, specific and explicit purposes. Depending on the circumstances, Processing may be necessary to take steps requested before a contract, perform Carzoo’s contractual services, comply with law, protect legitimate business or legal interests, or act on consent where consent is required.
The purposes may include:
· operating, maintaining and securing the Platform and User accounts;
· providing search, comparison, availability and vehicle-listing functions;
· facilitating, confirming, administering, changing or cancelling Bookings;
· communicating Booking details to the relevant Rental Company and supporting formation and performance of the Rental Agreement;
· processing or facilitating payments, deposits, refunds, chargebacks and financial reconciliation;
· verifying identity, eligibility and Booking information and preventing fraud, abuse and unauthorized activity;
· providing customer support, handling complaints and assisting communications and dispute resolution;
· addressing safety, accidents, damage, theft, insurance, fines, tolls and legal claims where relevant;
· complying with legal, regulatory, tax, accounting, judicial and law-enforcement obligations;
· monitoring performance, diagnosing faults, developing and improving the Platform and producing internal operational reporting;
· sending marketing or measuring campaigns where permitted and subject to applicable consent or objection rights; and
· protecting Carzoo, Users, Rental Companies and third parties and establishing, exercising or defending legal rights.
Carzoo will not subsequently use Personal Data for a purpose incompatible with the purpose identified at collection unless permitted by law and accompanied by any required notice or consent.
7. BOOKINGS AND SHARING WITH RENTAL COMPANIES
Carzoo may transmit non-identifying search details, such as dates, location and vehicle category, to connected Rental Companies or systems to obtain prices and availability. Identifying data is shared only where needed for the selected Booking or another disclosed purpose.
When you submit or confirm a Booking, Carzoo shares the necessary identity, contact, driver, Booking and payment-status information with the relevant Rental Company so that it can confirm the reservation, prepare the Rental Agreement, verify eligibility, release and receive the vehicle, provide the rental, and address support or legal issues.
Carzoo does not disclose a customer’s identifiable Booking or rental information to unrelated Rental Companies merely because they participate in the marketplace. Disclosure to another supplier requires a relevant service need, your instruction or consent, or a legal, safety, fraud-prevention or dispute-related justification.
The relevant Rental Company may provide Carzoo with confirmation, availability, cancellation, rental performance, incident or refund information so Carzoo can administer the Booking and provide support.
8. PAYMENT INFORMATION
Depending on the Booking, payment may be collected by Carzoo a payment service provider, the Rental Company, or a combination of them. The applicable arrangement is displayed during checkout.
Payment-card details may be entered directly into a payment provider’s secure environment. In that case, Carzoo generally receives limited information such as the card brand, last digits, transaction token or reference, amount, currency and authorization result, and does not receive or retain the complete card number or security code.
Carzoo and the relevant providers may use transaction data to obtain authorization, complete payment, issue refunds, perform reconciliation, prevent fraud, address disputes or chargebacks, and comply with financial and legal obligations. Banks and payment providers process data under their own terms and privacy notices where applicable.
9. OTHER RECIPIENTS AND SERVICE PROVIDERS
CARZOO may disclose Personal Data, to the extent reasonably necessary to:
· hosting, cloud, database, software-development, API, cybersecurity, identity-verification and fraud-prevention providers;
· payment processors, banks and providers supporting payments, refunds and accounting;
· email, SMS, WhatsApp, communications, analytics and customer-support providers;
· professional advisers, auditors, insurers and claims handlers;
· competent courts, public authorities, law-enforcement bodies and regulators where disclosure is required or lawfully justified; and
· an affiliate, legal successor or proposed purchaser in connection with a genuine reorganization, financing, merger, acquisition or sale, subject to appropriate confidentiality and lawful-use restrictions.
Service providers acting for Carzoo receive access only on a need-to-know basis and must be subject to contractual, professional or legal duties concerning confidentiality, security and permitted use appropriate to their role.
Carzoo does not sell or rent Personal Data as a standalone commercial product.
10. INTERNATIONAL PROCESSING AND TRANSFERS
10. INTERNATIONAL PROCESSING AND TRANSFERS
Carzoo is established in Lebanon, but certain Personal Data is stored, accessed or otherwise Processed outside Lebanon in connection with the operation of the Platform and the services described in this Notice.
Hosting and Infrastructure
Carzoo's Platform, production database and primary infrastructure are hosted by Railway in the Netherlands. Network services, backups, technical logs and related infrastructure operations may involve Processing in other countries.
Third-Party Service Providers
Carzoo uses third-party providers to support its operations, including:
Railway: Platform hosting, database infrastructure and storage.
Sentry: Technical error monitoring and Platform reliability.
Resend and Microsoft: Transactional emails, business correspondence and customer communications.
Cloudflare: Domain and network services.
Mapbox: Mapping and location-related functionality.
Google, OpenAI and Meta: Analytics, advertising measurement and related services, where the relevant technologies are enabled and the required consent has been obtained.
These providers may Process Personal Data in countries outside Lebanon, including countries where they operate infrastructure or engage authorized service providers. The categories of information shared depend on the relevant service and purpose.
Rental Companies and Booking Systems
When a User submits a Booking, Carzoo shares the necessary Personal Data with the selected Rental Company to facilitate the reservation and rental services.
Certain Rental Companies may use booking systems or service providers located outside Lebanon. Such Rental Companies are generally responsible for their own Processing activities under their applicable privacy notices and legal obligations.
Protection of International Transfers
Carzoo seeks to limit international transfers to Personal Data reasonably necessary for the relevant services and applies appropriate technical and organizational safeguards, taking account of applicable legal requirements and the nature of the Processing.
Where required by applicable Lebanese law, Carzoo will make the relevant declarations or obtain the necessary authorizations for international Processing and transfers.
Users may request further information about international recipients, relevant countries and applicable safeguards by contacting Carzoo using the details provided in Section 20 of this Notice.
11. RETENTION
11. RETENTION
Carzoo retains Personal Data for as long as reasonably necessary to fulfill the purposes described in this Notice, including operating the Platform, administering Bookings, providing customer support, maintaining security and complying with applicable legal, accounting, tax and regulatory obligations.
Retention periods vary depending on the nature of the information, the purpose of Processing and applicable legal requirements.
Accounts and Customer Profiles
Account and profile information is generally retained while the account remains active. Users may request account closure and the deletion or anonymization of their Personal Data by contacting privacy@carzooapp.com. Such requests will be reviewed and handled in accordance with applicable law, including any requirements to retain information for contractual, financial, security or legal purposes.
Bookings and Transaction Records
Booking information, including customer contact details, reservation information, supplier communications and related transaction records, may be retained after a Booking is completed or cancelled where necessary for accounting, tax, dispute resolution, fraud prevention or legal-claims purposes.
Confirmed Bookings and financial records may be retained for longer periods where required by applicable law. Incomplete or unconfirmed Booking records may be retained for
12. SECURITY AND INCIDENT RESPONSE
Carzoo applies technical and organizational measures appropriate to the nature of the Personal Data and the risks of Processing. Measures may include access controls, authentication, encryption where appropriate, secure transmission, backups, logging, vendor controls, staff confidentiality, testing and incident-response procedures.
No internet, storage or transmission system is completely secure. If a security incident affects Personal Data, Carzoo will investigate, contain and remediate it and will notify affected persons or competent authorities where applicable law requires notification.
Users must protect account credentials, use secure devices and notify Carzoo promptly at privacy@carzooapp.com if they suspect unauthorized access, fraud or misuse.
13. COOKIES AND SIMILAR TECHNOLOGIES
Carzoo may use cookies, software development kits, pixels, local storage and similar technologies to operate the Platform, maintain sessions, remember preferences, measure performance, prevent fraud and, where permitted, evaluate advertising.
Technologies strictly necessary for security, network management, checkout or requested functions may operate without an optional preference. Analytics, personalization and advertising technologies are subject to applicable law and the choices offered through the Platform.
Advertising and Conversion Measurement
Where a User has provided the required Advertising consent, Carzoo may use advertising technologies, including Google Ads, Meta Pixel and the OpenAI Ads Pixel, to measure advertising effectiveness, attribute Bookings to advertisements and improve advertising campaign performance.
Certain advertising technologies, including the OpenAI Ads Pixel, may automatically detect contact information entered into Platform forms, such as email addresses and telephone numbers, normalize and hash that information, and transmit the resulting identifiers to advertising providers for conversion matching and measurement.
Hashed contact identifiers may still constitute Personal Data. This Processing is subject to applicable privacy laws and the User's consent choices.
Users may withdraw Advertising consent at any time through the Platform's Cookie Settings. Withdrawal stops future optional advertising tracking but does not automatically delete information previously transmitted to advertising providers.
Further information about the technologies used, their providers, purposes, storage periods and available controls is provided in Carzoo's Cookie Notice at https://carzooapp.com/cookies.
14. OPERATIONAL AND MARKETING COMMUNICATIONS
Carzoo may send communications necessary to operate an account or booking, including verification messages, confirmations, payment records, changes, cancellations, security alerts, service notices and support responses. These communications are part of the service requested and are separate from marketing.
Marketing communications will be sent only were permitted by law and in accordance with the recipient’s consent, preferences and right to object. You may unsubscribe through the message or contact Carzoo. An objection to marketing does not prevent essential account, security, Booking or legal communications.
Where communications are delivered through email, SMS, WhatsApp, push notification or another provider, that provider may Process delivery and device information under its applicable terms.
15. AUTOMATED PROCESSING
Carzoo may use automated rules or tools to assist with account security, payment authorization, fraud detection, prioritization of support and Platform performance. These tools may generate indicators or recommendations for review.
Carzoo will not use automated Processing in a manner prohibited by applicable law. Where an automated process materially affects a booking or service and the law gives a right to information, objection or human review, you may contact Carzoo using the details below.
16. YOUR RIGHTS
Subject to applicable law and any statutory exceptions, the person concerned may:
· ask whether Carzoo Processes Personal Data relating to them;
· obtain an understandable copy of their Personal Data;
· request information concerning the purposes, categories, source, nature and recipients of the Processing and relevant access;
· request the correction, completion, updating or erasure of data that is inaccurate, incomplete, ambiguous, expired, incompatible with the Processing purpose or otherwise unlawfully Processed;
· object for legitimate reasons to collection or Processing, including Processing for commercial promotion, subject to exceptions provided by law;
· withdraw consent prospectively where Processing depends on consent, without affecting prior lawful Processing;
· review and object to information or analyses used in relevant automated Processing as provided by law; and
· seek recourse before the competent Lebanese courts.
Requests should be sent to privacy@carzooapp.com with sufficient information to identify the requester and the relevant account or booking. CARZOO may verify identity and authority before responding. An authorized representative or heir may exercise rights where and to the extent permitted by law.
Carzoo will respond within the period required by law. Where Article 101 of Lebanese Law No. 81/2018 applies, the required correction operation is to be completed free of charge within ten days of the correction request. A copy charge will not exceed the permitted reproduction cost, and manifestly abusive or repetitive requests may be handled as allowed by law.
Some requests may be limited where retention or Processing is required by law, necessary for a contract, needed to protect another person, or required to establish, exercise or defend legal rights. Carzoo will explain an applicable limitation where legally required.
17. PERSONS WITHOUT FULL CAPACITY AND THIRD-PARTY DATA
The Platform is not intended for people who lack the legal capacity required to accept the Terms and submit a Booking. Drivers must also satisfy the minimum age and eligibility rules stated by the relevant Rental Company.
Carzoo does not knowingly seek to create rental Bookings for children. If a parent or legal representative believes that a person without the required capacity provided Personal Data improperly, they should contact Carzoo so the matter can be investigated and appropriate action taken.
A Customer who enters data about a Main Driver, additional driver, passenger, beneficiary or other person must have lawful authority to provide that data and must not provide more information than the Booking reasonably requires.
18. CORPORATE CHANGES
If Carzoo undergoes a merger, financing, reorganization, transfer of business, sale of assets or similar transactions, Personal Data may be reviewed or transferred as part of the transaction where lawfully necessary. The recipient must use the data consistently with this Notice and applicable law unless a new notice and any required consent are provided.
No corporate transfer reduces mandatory privacy or consumer rights.
19. CHANGES TO THIS NOTICE
Carzoo may update this Notice to reflect legal, regulatory, technical, security or operational changes. The updated Notice and its effective date will be made available on the Platform.
Where a change is material, Carzoo will take reasonable steps to provide additional notice where required or appropriate. Personal Data will not be used retrospectively for an incompatible new purpose without a lawful justification and any notice or consent required by law.
20. CONTACTS, COMPLAINTS AND LANGUAGE
Person responsible for Processing: CARZOO S.A.R.L.
Commercial Registration: Beirut Commercial Register No. 2083036
Registered office: Sheile, Rue 113, Blue Zone, Kesrouane, Lebanon
Website: carzooapp.com
Privacy and rights requests: privacy@carzooapp.com
Customer Support: help@carzooapp.com | Telephone/WhatsApp: +96171000438
Please state “Privacy Request” and include enough information for CARZOO to identify the relevant data and respond securely. Do not send complete payment-card information or unnecessary identity documents by ordinary email.
Carzoo will seek to resolve privacy concerns promptly. This does not affect the right to apply to the competent Lebanese courts or to contact the Lebanese Ministry of Economy and Trade or another competent authority where the matter falls within its jurisdiction.
This Notice is issued in English and Arabic, and both versions are intended to have the same meaning. If an inconsistency cannot reasonably be reconciled, the Arabic version prevails to the extent permitted by applicable law.