Persónuvernd og vafrakökur

The data controller is Ring Road Cars ehf., trading as Ring Road Cars (kennitala 620914-0100, VSK-nr. 141747), registered at Bogatröð 1, 262 Reykjanesbær, and operating from Keflavík, Iceland, established 2014. You can reach us at info@ringroadcars.is or +354 779 9499 for anything related to your privacy.

• Booking & quote enquiries. When you ask for a quote or contact us, we collect the details you give us — typically your name, email, phone number, travel dates, and which vehicle you are interested in. We use these to answer you and to arrange your rental. Legal basis: taking steps at your request to enter into a contract.
• Analytics & ads measurement. With your consent, we use Google Analytics 4 and Google Ads measurement to understand site traffic and whether visits came from our ads. Legal basis: your consent, which you can withdraw at any time (see §4).
• Technical logs. Like every website, our host keeps short-lived request logs (such as IP address and browser type) to keep the site secure and reliable. Legal basis: our legitimate interest in a safe, working website.
• Vehicle telematics (connected-car data). Our rental vehicles are fitted with a GPS telematics device that records data such as location, speed, harsh-impact/collision events, distance travelled, and the device identifier. We use it to prevent theft and recover stolen vehicles, support insurance and damage claims, detect prohibited use (for example off-road or F-road driving), and keep the fleet safe — not as continuous marketing surveillance, and we do not sell it. Our telematics provider acts as our processor, and data is kept only as long as needed for these purposes and any related claim. Legal basis: our legitimate interest (Art. 6(1)(f)); we have carried out a legitimate-interests assessment and access is restricted to the purposes above. Because this relies on legitimate interest, you have the right to object under GDPR Art. 21 — email us and we will stop the processing unless we have compelling legitimate grounds or need it to establish or defend a legal claim. This is set out in full in our rental terms.
• Rental documents (at pickup). When you collect a vehicle we check your driving licence and a photo ID and record the authorised driver(s) on the agreement. Legal basis: performance of the rental contract and our legal obligations as a rental operator.
• Vehicle handover records. We record a timestamped condition report — a 360° video or photos — at pickup and return and keep it as damage evidence for 30 days after the rental ends, then delete it — unless a damage claim or dispute is open, in which case we keep the records for that claim until it is settled (and never longer than the limitation period in §6). Legal basis: performance of contract and our legitimate interest in fair, accurate damage resolution.
• Payment, fines, tolls & damage records. To take payment and settle any post-rental amounts, a payment credential is held by our PCI-compliant payment provider (we do not store full card numbers), together with records of any fuel, toll, parking, fine or damage charge and the evidence behind it. Legal basis: performance of contract and compliance with our legal and accounting obligations.

We do not collect special-category data, and we do not ask for your payment-card number through this website — card details are handled inside the secure booking flow, not stored by us in plain form.

For visitors in the EEA, the UK, and Iceland, we run Google Consent Mode v2 with everything denied by default. Analytics and ads storage stay switched off unless you actively choose “Accept” in the cookie banner.

One thing to know about how Consent Mode works: the Google tag itself loads with the page, so even if you decline, it may send limited, cookieless signals to Google (such as the page address and the fact that consent was denied). No cookies are set, no analytics or advertising identifiers are stored, and declining keeps it that way.

Requesting a quote or making a booking does not depend on accepting cookies. Decline and the whole site still works.

You can change your mind at any time. The button below clears your stored choice and brings the cookie banner back so you can choose again — and you can always clear cookies and site data in your browser settings.

Withdrawing consent stops future analytics and ads-measurement collection; it does not affect anything that already happened lawfully while consent was given.

We do not sell your personal data. We share it only with the service providers we need to run the rental and the website:

• Our reservation system. Processes your booking and quote details so we can confirm and manage your rental.
• Google (Analytics & Ads). Only when you have consented to analytics / ads measurement.
• Our email provider. Sends you booking and enquiry emails (for example, a quote or confirmation).
• Our website host (Vercel). Serves the site and keeps the technical logs described above.
• Our telematics provider. Processes the connected-vehicle data described in §2 (location, speed, impact events, distance) so we can prevent theft, support claims, and detect prohibited use. Bound by a data-processing agreement.

Each of these acts as our processor under a contract that limits them to what we instruct. We may also disclose data where the law requires it.

We keep personal data only as long as we need it, then delete or anonymise it. The periods we apply:

• Quote enquiries that don't become a booking: up to 12 months, then deleted.
• Booking, rental and accounting records: up to 7 years, to meet Icelandic bookkeeping and tax law (Act no. 145/1994), then deleted or anonymised.
• Vehicle handover videos and photos: deleted within 30 days of the rental end date, unless a damage claim or dispute is open — then kept only for that claim until it is settled, and no longer than the general Icelandic limitation period for claims (4 years, Act no. 150/2007). The signed Vehicle Condition Report and any Damage Liability Form form part of the rental record above.
• Vehicle telematics data: only as long as needed for the purpose and any related claim, then deleted.
• Analytics and ads-measurement data: per your consent and the retention Google applies; your cookie choice stays in your browser until you clear it.

Where the law requires a longer or shorter period, we follow the law.

Under the EU General Data Protection Regulation (GDPR) and Iceland's Data Protection Act No. 90/2018 you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased where there is no overriding reason to keep it;
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent for analytics / ads at any time (see §4).

To exercise any of these, email info@ringroadcars.is. If you believe we have mishandled your data you can complain to the Icelandic Data Protection Authority, Persónuvernd (personuvernd.is).

We operate in Iceland, within the European Economic Area. Some of our providers (such as Google, Vercel, and our email provider) may process data outside the EEA. Where they do, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We may update this policy as our services or the law change. The date at the top shows when it was last revised; material changes will be reflected here.

Ring Road Cars ehf. (trading as Ring Road Cars) · kennitala 620914-0100 · VSK-nr. 141747 · Bogatröð 1, 262 Reykjanesbær, Iceland
info@ringroadcars.is · +354 779 9499