1Overview
Eko Car Rental Ltd ("Eko," "we," "us," or "our") operates the Eko Car Rental platform (the "Platform"). This Privacy Policy applies to all users of the Platform, including customers, drivers, fleet partners, and visitors.
By using the Platform, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Platform.
2Data We Collect
We collect the following categories of personal data:
Identity & Contact Data
- • Full name and display name
- • Email address and phone number
- • Profile photo (if provided)
- • Government-issued ID / driver's licence number
Account Data
- • Login credentials (hashed password)
- • Account role (customer, driver, fleet partner)
- • OAuth identifiers (e.g. Google ID, if you sign in with Google)
- • Account creation and last login timestamps
Booking & Transaction Data
- • Booking history, reservation details, and cancellations
- • Payment method type and last-4 digits (we never store full card numbers)
- • Payment processor transaction IDs
- • Pickup and drop-off locations
Technical Data
- • IP address and approximate geolocation
- • Browser type, device type, and operating system
- • Pages visited, session duration, and referral source
- • Cookies and similar tracking technologies
Communications Data
- • Support messages and email correspondence
- • In-app notification preferences
- • Survey or feedback responses
3How We Use Your Data
We use your personal data to:
- Provide our services — process bookings, payments, and manage your account
- Verify your identity — confirm you meet eligibility requirements
- Communicate with you — send booking confirmations, OTPs, alerts, and updates
- Personalise your experience — surface relevant vehicles, offers, and content
- Ensure safety & security — detect fraud, prevent misuse, and enforce our Terms
- Improve the Platform — analyse usage patterns and fix bugs
- Comply with legal obligations — respond to lawful government requests
- Send marketing — only with your explicit consent (you can opt out at any time)
4Legal Basis for Processing
We process your personal data on the following legal grounds:
| Purpose | Legal Basis |
|---|---|
| Account creation & management | Contractual necessity |
| Processing bookings & payments | Contractual necessity |
| Fraud prevention & security | Legitimate interests |
| Platform analytics & improvement | Legitimate interests |
| Marketing communications | Consent |
| Legal compliance & reporting | Legal obligation |
6Data Retention
We retain your personal data for as long as necessary to fulfil the purposes described in this policy, or as required by law. Specifically:
- Account data: Retained for the lifetime of your account, plus 30 days after deletion request
- Transaction records: Retained for 7 years for accounting and legal compliance
- Marketing data: Retained until you withdraw consent
- Technical/log data: Retained for up to 90 days
When data is no longer required, it is securely deleted or anonymised.
7Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal data:
🔍 Right to Access
Request a copy of the personal data we hold about you
✏️ Right to Rectification
Correct inaccurate or incomplete data
🗑️ Right to Erasure
Request deletion of your data ("right to be forgotten")
⏸️ Right to Restrict
Limit how we process your data in certain circumstances
📦 Right to Portability
Receive your data in a machine-readable format
🚫 Right to Object
Object to processing based on legitimate interests or for marketing
🔄 Right to Withdraw Consent
Withdraw consent at any time where processing is consent-based
🛡️ Right to Lodge a Complaint
File a complaint with the relevant data protection authority
To exercise any of these rights, email us at privacy@ekocarrental.com. We will respond within 30 days.
9Security
We implement industry-standard security measures to protect your data, including:
- TLS/HTTPS encryption for all data in transit
- Bcrypt password hashing — your password is never stored in plain text
- HTTP-only, secure cookies for authentication tokens
- Role-based access controls limiting internal data access
- Regular security audits and vulnerability assessments
- Automated anomaly detection for suspicious account activity
Despite these measures, no system is 100% secure. In the event of a data breach affecting your rights, we will notify you promptly as required by applicable law.
10Children's Privacy
The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.
If you believe a child has provided us with personal data, please contact us at privacy@ekocarrental.com.
11International Transfers
Your data is primarily stored and processed in Antigua and Barbuda. Some of our service providers may process data in other countries. Where this occurs, we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent protections, in compliance with applicable data protection laws.
12Changes to this Policy
We may update this Privacy Policy periodically. When we make material changes, we will notify you via email or a prominent notice on the Platform at least 14 days before the changes take effect.
We encourage you to review this policy periodically. The date at the top of the page reflects when this policy was last revised.
13Contact Us
For any privacy-related questions, requests, or to exercise your data rights, contact our Data Protection team:
Last updated: March 4, 2026