Version v2026.10.7 · effective from 2026-10-14. Based on the Law on Personal Data Protection No. 91/2025/QH15 and Government Decree No. 356/2025/ND-CP (in force from 01.01.2026). The personal data controller and processor (the person who determines the purposes and means of processing) is CÔNG TY TNHH VINRENT, Lô 21 LK8-5, Đường 16, KĐT Mỹ Gia, Gói 8, Nha Trang, Khánh Hòa; contact for data matters: [email protected], backup address [email protected]; +84 258 730 0336.
1. What data we process and why
| Data | Purpose | Basis | |---|---|---| | Name, date of birth, nationality, passport or ID, contacts (phone, e-mail, residential address where necessary) | to conclude and perform the rental contract, to contact you, to issue documents | contract; compliance with law | | Driving licence details (country, category, validity, type) and its original at handover | to verify the right to drive; to meet legal requirements; to prove the check | contract; compliance with law; protection of rights in a dispute | | Payment data: payment status and identifier, last digits and type of card, amount (we do not receive or store card numbers and codes: the payment forms are operated by payment providers) | to accept payment, make a refund, handle a dispute with the bank | contract; compliance with law (accounting, taxes) | | Signed documents, signing log, IP address, device and browser data at the time of acceptance and signing | to prove what you accepted and signed, and when | contract; protection of rights in a dispute | | Handover and return records, photos and video of the car (and of your return), correspondence about damage | to record the condition of the car, calculate damage, review a dispute | contract; protection of rights in a dispute | | The car's location data (GPS) | protecting the car from theft, help in an accident or breakdown, checking a reported violation after notifying you | your separate consent | | Dashcam video (if installed) | confirming the circumstances of an accident and disputed situations | your separate consent | | Cookies and site analytics data | operation of the site, measuring traffic, improvement | necessary ones — operation of the site; analytics — your consent (see the Cookie Policy) | | Messages to the chat, messengers, the form | to answer a question | contract; your requests | | Separate consents to mailings | to inform about offers | your separate consent |
We do not sell personal data and do not use it for automated decisions that have legal consequences for you without human involvement.
2. Location data and video (telematics)
2.1. Cars equipped with GPS or a dashcam are marked when you choose them; the same is stated in the Card and inside the car. The dashcam records the road situation. VinRent employees can see the car's position and the recordings for the purposes stated in this document; every access is logged. Consent to the processing of this data is requested by a separate action, not together with the general acceptance of the terms.
2.2. How we use GPS: (a) protecting the car from theft and tracing it in case of theft; (b) help in an accident or breakdown, at your request; (c) checking a reported violation (for example, a possible departure from the permitted territory) — only after notifying you and with the opportunity to explain the circumstances; the decision is made by a staff member, not by the system. We do not use GPS to charge a fee automatically and we do not track you outside the purpose of protecting the car and performing the contract.
2.3. Access to location data and video is given only to staff who need it for the stated purposes, with access recorded (a log: who, when, why).
2.4. Withdrawal of consent. You may withdraw consent at any time ([email protected] or through a staff member). Withdrawal does not affect the lawfulness of processing before withdrawal. If the withdrawal is made during the rental and the car cannot be used safely without GPS, we will offer a replacement with a car without GPS or an end to the rental without penalties for termination.
3. Retention periods
| Data | Period | |---|---| | GPS data (route points) | for the rental period and 30 days after return; longer — only if a dispute or investigation has been opened on that case, until it is closed | | Dashcam video | overwritten in order (up to 30 days); only the fragment relating to the incident is kept, for the duration of the review | | Records, photos and video of the car's condition, correspondence about damage | until the end of the period for making claims and the limitation period under the contract (as of the date of this version — up to 3 years after return); in a dispute — until it ends | | Contract, signing log, confirmations of acceptance of documents | not less than the period set by the law on accounting, taxes and electronic transactions, and until the limitation period ends | | Payment records | periods under accounting and tax legislation | | Account data | while the account exists; after deletion — only what we are obliged by law to keep | | Messages to the chat and form | up to 24 months, if not connected with a dispute | | Analytics data | in accordance with the analytics provider's settings and the Cookie Policy |
When the period ends, data is deleted or anonymised; a "freeze" (legal hold) applies only for the duration of a dispute.
4. To whom we pass data
We pass data only to the extent necessary for the stated purposes:
- Payment providers (VinRent uses the providers chosen on the payment page: 2C2P, PayPal, a QR payment provider and others stated at payment) — to accept and refund payments.
- VNPT eContract (Vietnam) — for electronic signing of the contract and keeping the signing log.
- Hosting and infrastructure (servers in the European region — Finland; Cloudflare — delivery and protection of the site).
- Communication services: Telegram and the e-mail provider — for messages about the booking and for the chat.
- Analytics (Google Analytics, Microsoft Clarity) — only with your consent in the cookie banner.
- Partner car owners, the cars' insurers, experts, repair contractors — to the extent necessary to record an incident and calculate damage.
- Government authorities — as required by law.
Some recipients are located outside Vietnam. Before passing data we assess the risks and take protective measures (contractual confidentiality obligations, limiting the amount of data, encryption of channels). The list of recipients and countries is available on request.
5. Your rights
You have the right to: obtain information on which of your data we process; obtain a copy; correct inaccurate data; restrict processing; object to processing; demand deletion of data when there is no ground to keep it further; withdraw consent; lodge a complaint with the competent authority. Write to [email protected]: we reply within the period set by law and in any case confirm receipt of the request within 3 working days. For requests we may verify your identity.
6. Security and incidents
We restrict access by role, keep a log of access to location and video data, encrypt transmission channels and keep backups. In the event of a data breach that creates a risk to your rights, we notify the competent authority and the persons affected within the periods set by law.
7. Children
The site is not intended for persons under 18. We process a child's data only to the extent necessary to select a child seat (height, weight), with the consent of a parent or legal representative, and for a child aged 7 or over also with the child's own consent.
8. Photos of documents in your account
If you upload a photo of your passport or driving licence in your account, we: (a) keep the file in private storage that only you and the VinRent staff handling your booking can open; (b) send the photo once to an AI service (Anthropic, USA) that reads the printed fields — the request contains no account name, phone or e-mail, but the photo itself of course shows what is printed on the document; you then check and confirm the result; (c) after your confirmation, save the fields (name, date of birth, nationality, document number and expiry, licence categories) in your profile to pre-fill your bookings and the rental card. The basis is your consent, given with a separate tick when you confirm. We keep the photos and the data read from them while your account exists and for as long as needed to perform the rental contract, handle claims and meet legal obligations. You may ask for access, correction or deletion by writing to [email protected]; we delete the data except what we are required or entitled to keep by law (for example, to defend claims arising from a rental).
9. Changes
A new version is published on the site with its effective date. It does not extend to consents already given without your new consent, if the change broadens the purposes or the scope of data.