Privacy notice

In force from 1 September 2026. Version 2.0.

Excellence V.I.P. Rent Kft. (the Company or the Controller) processes the personal data of natural persons in the course of its vehicle rental business, the operation of its website (viprent.hu) and the operation of its registered office. This notice is provided under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and under Act CXII of 2011 on informational self-determination and freedom of information (Infotv.). It sets out what data the Company processes, for what purpose, on what legal basis and for how long, to whom it is disclosed, and what rights data subjects have.

• Name: Excellence V.I.P. Rent Kft.
• Registered office: 1121 Budapest, Rácz Aladár út 150.
• Company registration number: 01-09-927815
• Tax number: 14959457-2-43
• Data protection enquiries: info@viprent.hu
• Telephone: +36 70 277 7797
• Website: https://viprent.hu

The Company is not required to designate a data protection officer under Article 37 GDPR and has not appointed one. Data protection matters can be raised with the Company at the e-mail address above.

Answering enquiries and messages received through the contact form on the website, by e-mail or by telephone.

• Data subjects: natural persons contacting the Company, and the contact persons of companies.
• Data processed: name, e-mail address, telephone number, the content of the message, the vehicle requested and the rental period.
• Legal basis: Article 6(1)(b) GDPR — steps taken at the data subject's request prior to entering into a contract.
• Retention: if no contract is concluded, 1 year from the closing of the enquiry; if a contract is concluded, as set out in the next section.
• Recipients: the Company's administrative staff; the mail system is provided by Google Ireland Ltd. as a processor.

Providing the data is voluntary, but without it the Company cannot prepare a quotation.

Concluding the vehicle rental contract, identifying the renter and any additional authorised drivers, handing over and taking back the vehicle (including delivery and rental with a chauffeur), handling the rental fee and the deposit, and enforcing claims arising from the contract.

• Data subjects: the renter, any additional driver named in the contract, and, for corporate rentals, the person taking delivery of the vehicle.
• Data processed: name, place and date of birth, mother's name, address, type and number of identity document, driving licence number, categories and validity, telephone number, e-mail address, details of the rented vehicle, the duration and fee of the rental, for delivery or chauffeur service the address and time of pick-up and drop-off, the amount of the deposit, the condition of the vehicle at handover and return together with photographs, and the mileage.
• Copies of documents: a copy of the identity document and the driving licence is made in order to identify the renter, to verify entitlement to drive, and to prevent misuse of the vehicle and enforce legal claims.
• Legal basis: Article 6(1)(b) GDPR — performance of the contract. For making and retaining copies of documents, Article 6(1)(f) GDPR: the legitimate interests of the Company (protection of a high-value asset, prevention of fraud and theft, enforcement of claims). The outcome of the balancing test is available from the Company on request.
• Retention: 5 years from termination of the contract (the general limitation period under section 6:22 of the Civil Code, Ptk.); for documents qualifying as accounting records, 8 years (section 169 of the Accounting Act, Számv. tv.).
• Storage: on paper at the Company's registered office in a locked archive, and electronically in the Company's password-protected internal systems.
• Recipients: the accounting processor; in the event of damage, the insurer; in the event of a legal dispute, the Company's legal representative; in the event of an official request, the authority conducting the proceedings.

Providing the data is a condition of concluding the contract; without it the Company will not rent out the vehicle.

• Data processed: billing name and address, tax number (if any), the details of the invoice, the method and date of payment, and for bank transfers the bank account number.
• Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation (section 169 of the Accounting Act, Számv. tv.; section 169 of the VAT Act, Áfa tv.).
• Retention: 8 years following the year in which the invoice was issued.
• Recipients: the accounting processor, the National Tax and Customs Administration (online invoice data reporting), and the Company's bank.

In the case of card payment the Company does not learn or store the card details; those are processed by the card acceptance provider as a separate controller, under its own privacy notice. The Company retains only the fact, the amount and the identifier of the transaction.

Every vehicle the Company rents out is fitted with a GPS tracking device. The device records the position, movement and speed of the vehicle. By signing the rental contract the renter expressly acknowledges that tracking takes place.

• Purpose: protection of a high-value asset, locating the vehicle in the event of theft, verifying use in accordance with the contract (territorial restrictions, mileage), assistance in the event of an accident or breakdown, and the enforcement of claims in official proceedings or legal disputes.
• Data processed: the geographical position and route of the vehicle with a timestamp, speed, ignition status, attributed to the renter during the rental period.
• Legal basis: Article 6(1)(f) GDPR — the legitimate interests of the Company. The balancing test is available from the Company on request.
• Retention: 30 days after the end of the rental period; in the event of damage, theft, official proceedings or a legal dispute, until the final closure of the proceedings or the lapse of the claim.
• Processor: ProSec Biztonságtechnikai Kft. (operator of the tracking system).

The Company does not use tracking data to monitor the renter continuously during the rental period; only authorised members of staff access it, and only if one of the purposes above arises. The data subject may object to processing based on legitimate interests, but an objection does not result in tracking being switched off while the rental relationship is in force, because the vehicle cannot be rented out without tracking.

If a traffic offence is committed with the vehicle during the rental period, the authority contacts the Company as the operator of the vehicle. Under sections 21 and 21/A of Act I of 1988 on road traffic the Company is obliged to tell the authority who was using the vehicle at the time of the offence; otherwise the fine must be paid by the Company. The same applies to parking charges, road tolls and requests from foreign authorities.

• Data processed: the renter's name, address and driving licence details, a copy of the rental contract, and the time and place of the offence.
• Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation; as regards passing the charge on to the renter, Article 6(1)(b) GDPR.
• Retention: 5 years after the proceedings are closed.
• Recipients: the authority conducting the proceedings, parking companies, toll operators, and foreign authorities or their agents.

• Data processed: the name and contact details of the renter and of any other persons involved, the description, place and time of the incident, photographs, the accident report, the police report, the amount of the damage, and the use of the deposit.
• Legal basis: Article 6(1)(b) GDPR — performance of the contract; as regards the enforcement of the Company's claims, Article 6(1)(f) GDPR.
• Retention: 5 years after the damage case is closed.
• Recipients: the vehicle's insurer (as a separate controller), loss adjusters, repair workshops, and in the event of a dispute the legal representative.

The Company operates a closed-circuit electronic surveillance system at its registered office. A notice at the entrance informs visitors of the fact of surveillance and of the field of view of the cameras.

• Data subjects: customers, visitors, suppliers and employees entering the registered office.
• Purpose: protection of the vehicles and other assets, prevention and proof of unlawful acts, and the protection of persons and property.
• Data processed: image recordings showing the data subject's likeness and actions, and the place and time of the recording.
• Legal basis: Article 6(1)(f) GDPR — the legitimate interests of the Company, having regard to Act CXXXIII of 2005 on the rules of security services and private investigation. The balancing test is available from the Company on request.
• Retention: 3 days, after which recordings are deleted automatically. If a recording serves as evidence of an unlawful act or is needed for official proceedings, the Company retains it until those proceedings are closed.
• Access: only the Company's managing director and the staff designated by them; the Company discloses recordings to third parties only on an official request or for the enforcement of a legal claim.

A data subject may ask the Company to retain a recording of them beyond the 3-day period if it is needed to enforce a right or legitimate interest.

The Company uses cookies strictly necessary for the operation of the viprent.hu website without the data subject's consent, under section 13/A of Act CVIII of 2001 on electronic commerce. Every other cookie and tracking code serving statistical or advertising purposes is placed only on the basis of the visitor's prior consent given on the cookie banner.

• Services used: Google Analytics 4 (visitor statistics) and Google Ads (advertising measurement and conversion tracking). Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
• Data processed: a pseudonymous visitor identifier, IP address (not stored in the case of Google Analytics 4), the pages visited, the time of the visit, device and browser details, and the fact of a click on an advertisement.
• Legal basis: Article 6(1)(a) GDPR — the data subject's consent, which can be withdrawn at any time on the cookie banner.
• Retention: until the individual cookies expire, at most 24 months; the detailed cookie list is available in the settings panel of the cookie banner.
• Transfers: Google may also process the data in the United States. The transfer takes place under the EU-US Data Privacy Framework, of which Google LLC is a certified participant.
• Hosting provider: Ruffnet Zrt. (processor).

The Company operates Google Analytics with Consent Mode and IP anonymisation. Refusing consent does not restrict use of the website.

This section describes what is actually implemented in the website's system. It is not a statement of intent.

• Your IP address is not stored with the enquiry. What is stored is a SHA-256 hash salted with a secret key, from which the original address cannot be recovered. A full IP address appears only in the web server's operational log, never in the customer database.
• The operational log is deleted automatically after 30 days.
• An enquiry is deleted 1 year after it arrives by a job that runs daily, regardless of the status of the enquiry. An earlier deletion request is carried out by a member of staff.
• Data already deleted may remain for a time in the backups. Backups are taken hourly and kept hourly for 48 hours, daily for 30 days and weekly for 12 weeks; backups are not touched other than to restore from them and to verify that they can be restored.
• The abuse-prevention counter keeps the row belonging to an IP hash even after the enquiry is deleted. That row contains nothing but the hash and a timestamp.
• The administration interface can only be entered with a password. Passwords are not stored: only a hash produced with the scrypt algorithm and a salt unique to each user goes into the database, and likewise only a hash of the session token. A session expires after 14 days.
• Inside the interface every operation requires its own permission, and every change is logged: who changed what, and when. The log contains no personal data and no password hashes.
• The database is not reachable over the network, only from the machine running the website, and the website is served over HTTPS.

There is no registration and no online booking on the website.

• Data subjects: the natural-person contacts of the Company's corporate customers, suppliers and partners.
• Data processed: name, position, work e-mail address and telephone number, and the organisation represented.
• Legal basis: Article 6(1)(f) GDPR — the shared legitimate interest of the Company and the partner in maintaining the contractual relationship.
• Retention: until the business relationship ends, or until claims arising from it lapse.

The Company uses the processors below, who process the data solely on the Company's instructions and under a written contract:

• ProSec Biztonságtechnikai Kft. — operation of the GPS tracking system.
• Ruffnet Zrt. — website hosting.
• Google Ireland Ltd. — e-mail and document storage (Google Workspace), web analytics (Google Analytics 4), advertising (Google Ads).
• The Company's appointed accountancy firm — bookkeeping, payroll and tax returns.

The following receive data as separate controllers: the vehicles' insurers, the card acceptance provider, the Company's bank, the National Tax and Customs Administration, the authorities and courts conducting proceedings, parking and toll companies, and, in the event of a dispute, the Company's legal representative.

The Company does not transfer personal data to a third country other than in the case described in the Website, cookies and web analytics section. The Company does not use automated decision-making or profiling.

The Company stores personal data in password-protected IT systems with access control, and paper documents in a locked archive. Only those members of staff who need it to do their job have access to the data. The Company serves the website over an encrypted (HTTPS) connection.

In the event of a personal data breach the Company acts under Articles 33-34 GDPR, and where the breach is likely to result in a high risk to data subjects it informs them directly.

A data subject may at any time request the following from the Company at info@viprent.hu or by post:

• Access: information as to whether the Company processes their personal data and, if so, what data, for what purpose, for how long and to whom it is transferred, and a copy of the data processed (Article 15 GDPR).
• Rectification: correction of inaccurate data and completion of incomplete data (Article 16).
• Erasure: deletion of the data where it is no longer needed, consent has been withdrawn, an objection has been made and there is no overriding legitimate ground, or the processing is unlawful; erasure cannot be requested while the processing is required by law or is needed to enforce a legal claim (Article 17).
• Restriction of processing: blocking of the data in the cases listed there, for example until a rectification or an objection has been decided (Article 18).
• Data portability: release, in a structured, machine-readable format, of data processed by automated means on the basis of a contract or consent (Article 20).
• Objection: to processing based on legitimate interests, on grounds relating to the data subject's particular situation; in that case the Company may continue processing only if it demonstrates compelling legitimate grounds which override the interests of the data subject, or if the processing is needed to enforce a legal claim (Article 21).
• Withdrawal of consent: at any time where processing is based on consent, without affecting the lawfulness of processing before the withdrawal (Article 7).

The Company fulfils the request, or refuses it with reasons, without undue delay and at the latest within one month of receipt. That deadline may be extended by a further two months in view of the complexity of the request, of which the Company informs the data subject within the first month. Fulfilling a request is free of charge unless it is manifestly unfounded or repetitive. The Company is entitled to verify the data subject's identity before fulfilling a request.

If a data subject considers that the Company is processing their personal data unlawfully, we suggest contacting the Company first at info@viprent.hu. The data subject may also lodge a complaint with the supervisory authority or bring court proceedings.

• Supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
• Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary
• Telephone: +36 1 391 1400
• E-mail: ugyfelszolgalat@naih.hu
• Website: https://naih.hu

Court proceedings may be brought, at the data subject's choice, before the tribunal competent for the Company's registered office or for the data subject's place of residence (section 23 Infotv.).

The Company may amend this notice unilaterally, in particular where the legal environment or the services it uses change. The notice in force at any given time is available on the viprent.hu website, and an amendment takes effect on publication. The Company informs data subjects who are already party to a rental contract of material amendments by e-mail.

In force from 1 September 2026. Version 2.0. This notice replaces the Company's earlier privacy notice published in 2017.

This English text is a translation provided for convenience. In the event of any discrepancy, the Hungarian version of this notice prevails.