Privacy policy
Version 2026-09-30 — last updated : 30 September 2026
Lowcationcar Sàrl
Chemin du Vernay 5, 1184 Luins, Suisse
IDE : CHE-440.279.365
Data protection : [email protected]
This policy describes the personal data that Lowcationcar Sàrl processes, why it processes them, to whom they are disclosed, how long they are retained and what rights you may exercise. It applies to the lowcationcar.ch website, to the customer area and to the management of rentals. It supplements the general rental terms, which remain the contractual document.
1. Data controller
Lowcationcar Sàrl, Chemin du Vernay 5, 1184 Luins (Vaud, Switzerland), UID CHE-440.279.365, is the controller within the meaning of the Swiss Federal Act on Data Protection (FADP).
For any question relating to data protection, or to exercise your rights: [email protected].
2. Data collected
Depending on the context, the following data are collected:
- •Identification — surname, first name, date of birth, nationality.
- •Contact details — postal address, e-mail address, telephone number.
- •Identity documents — driving licence (number, categories, validity, front and back images), identity document (passport, identity card or residence permit, front and back images), including the machine-readable zone where present.
- •Payment data — amounts, payment method, billing e-mail address. No payment card number passes through our servers or is retained: entry takes place directly with our payment provider.
- •Vehicle photographs — condition of the vehicle and odometer at pick-up and at return, time-stamped.
- •Rental data — reservation history, vehicles rented, mileage, amounts invoiced, signed contractual documents.
- •Technical data — IP address, request identifier, pages visited, and cookies according to your consent.
- •Correspondence — e-mails, messages and calls relating to your file.
3. Purposes of processing
Your data are processed for the following purposes:
- •Performance of the rental agreement: reservation, pick-up, return, closure.
- •Verification of your identity and of the validity of your driving licence, including by automated document analysis (art. 7).
- •Processing of payments, management of deposits and invoicing.
- •Communication relating to your file: confirmations, reminders, assistance.
- •Handling of incidents, damage and disputes, including the retention of evidence.
- •Handling of fines and offences, with transmission to the authorities where the law so requires.
- •Security of the service and prevention of abuse, which includes a count of calls to the public interfaces by IP address (art. 5).
- •Compliance with our legal obligations: accounting, tax, insurance.
- •Improvement of the website and of our services, with your consent for audience measurement.
- •Sending of commercial information, with your explicit and revocable consent.
4. Legal basis
Processing is based, depending on the purpose, on the following grounds:
- •Performance of the contract — the data necessary for the reservation and the rental (art. 31 para. 2 let. a FADP; art. 6(1)(b) GDPR for persons residing in the European Union).
- •Legal obligation — accounting, insurance, transmission to the authorities (art. 31 para. 2 let. c FADP; art. 6(1)(c) GDPR).
- •Legitimate interest — security, prevention of abuse, handling of disputes and retention of evidence (art. 31 para. 1 FADP; art. 6(1)(f) GDPR).
- •Consent — audience measurement and marketing cookies, commercial communications. Revocable at any time, without retroactive effect (art. 6 para. 6 FADP; art. 6(1)(a) GDPR).
5. Retention periods
The periods below are those we apply. Where a deletion depends on an action rather than on an automated process, the “Regime” column says so — we would rather write it than promise a purge that would not take place.
| Category | Period | Regime |
|---|---|---|
| Signed contractual documents (agreement, return report) | 10 years after the end of the rental | Legal obligation — art. 958f CO |
| Accounting data and invoices | 10 years after the close of the financial year | Legal obligation — art. 958f CO |
| Identity documents (driving licence, identity document) | Duration of the contractual relationship, then for as long as they remain necessary to evidence the contract | Deletion upon erasure request, subject to statutory periods |
| Vehicle photographs (pick-up and return) | 10 years after the end of the rental, together with the file | Legal obligation — art. 958f CO: they evidence the condition of the vehicle under the contract. The online copy is deleted after verified archiving on two media; the archive itself is retained |
| WhatsApp messages and e-mails of a rental file | 10 years after the end of the rental, like the agreement | Kept with the file, like the agreement (art. 958f CO); no automatic deletion |
| Audit log of the file (actions on your rental) | 3 years | Daily automatic purge |
| Log of internal administrative actions | 3 years | Daily automatic purge |
| Email sending log (which email, for which file, when, sent or not; neither its content nor your address) | 3 years | Daily automatic purge |
| Availability search logs | 12 months | Daily automatic purge |
| Counter of calls to the public interfaces (IP address, security and prevention of abuse) | 90 days | Daily automatic purge |
| Reservations abandoned before confirmation | 48 hours | Automatic discard |
| Consent cookie | 12 months | Cookie stored on your device, erasable by you |
| Audience measurement and marketing data | Until your consent is withdrawn | Withdrawal stops future processing; it does not erase measurements already transmitted |
Signed contractual documents (agreement, return report)
Accounting data and invoices
Identity documents (driving licence, identity document)
Vehicle photographs (pick-up and return)
WhatsApp messages and e-mails of a rental file
Audit log of the file (actions on your rental)
Log of internal administrative actions
Email sending log (which email, for which file, when, sent or not; neither its content nor your address)
Availability search logs
Counter of calls to the public interfaces (IP address, security and prevention of abuse)
Reservations abandoned before confirmation
Consent cookie
Audience measurement and marketing data
6. Recipients and transfers abroad
Categories of recipients. Your data and documents are processed by providers of hosting, electronic signature, payment, e-mail sending, messaging, technical monitoring, automated document analysis, mapping and audience measurement, in Switzerland, in the European Union and in the United States, subject to appropriate safeguards (standard contractual clauses).
Concretely: the application is hosted in Switzerland; the database, the documents and the photographs are hosted in the European Union (Ireland); electronic signature is operated on our own infrastructure in Switzerland; payment, technical monitoring, automated document analysis and audience measurement involve providers in the United States.
Your data may further be disclosed:
- •To the competent authorities — police, judicial, tax or road-safety authorities, upon a legal request or where the law so requires.
- •To our insurers and their experts — in the event of an incident or dispute, limited to the necessary information.
- •To our legal advisers and debt-collection providers — in the event of an unpaid claim, limited to the necessary information.
7. Automated document analysis
In order to verify your identity and your driving licence, the images of your documents are transmitted to an automated document analysis service established in the United States, under standard contractual clauses. That service extracts the relevant information from them (name, date of birth, licence number and categories, validity) in order to avoid manual re-entry and to detect non-compliant documents.
Automated effect, and your right. Where the analysis concludes that the document submitted is not a driving licence, the reservation journey is interrupted and you are asked to provide the correct document. This is an automated individual decision within the meaning of art. 21 FADP. You may request that it be reviewed by a person: write to us at [email protected] and we will handle your file manually.
The other results of the analysis (mileage read from an odometer, data from a vehicle registration document, information from an invoice) are purely indicative: they decide nothing and are always checked by a person before having any effect.
8. Your rights
In accordance with the FADP and, for persons residing in the European Union, with the GDPR, you have the following rights:
- •Right of access to your personal data and to obtain the list of our providers by name.
- •Right of rectification of inaccurate or incomplete data.
- •Right to erasure, subject to the statutory retention periods set out in art. 5. That erasure covers your identity documents (driving licence, identity document); the condition photographs of a rental file, by contrast, remain attached to that file for its contractual retention period — they evidence the condition of the vehicle under the contract (art. 958f CO), just as the signed agreement does.
- •Right to restriction of processing.
- •Right to portability of your data, in a structured, machine-readable format.
- •Right to object to processing based on legitimate interest.
- •Right to withdraw your consent at any time, without retroactive effect.
- •Right to obtain a human review of an automated decision (art. 7).
10. Data security
We implement appropriate technical and organisational measures: encryption of communications (TLS), role-based access separation, logging of sensitive actions, regular database backups whose execution is monitored, and restriction of access to authorised persons only.
Identity documents and contractual documents are kept in private storage areas, accessible only through a temporary signed link.
No measure makes a system impregnable. In the event of a breach of data security likely to result in a high risk to your rights, we inform the Federal Commissioner and, where the law so requires, the persons concerned (art. 24 FADP).
11. Supervisory authority
If you consider that the processing of your data infringes your rights, you may refer the matter to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern — edoeb.admin.ch.
Persons residing in the European Union may also refer the matter to the supervisory authority of their country of residence.
Version 2026-09-30 — 30 September 2026 — Lowcationcar Sàrl, CHE-440.279.365