Privacy notice

The EU business operating Sixt Go must identify its legal entity, registered address and direct privacy contact. These details have not yet been supplied. This notice remains incomplete until the controller and hosting arrangements are finalized; it must not be presented as a certificate of GDPR compliance.

The inquiry form collects your name, email, phone, pickup and destination, date, local time zone, traveler count, luggage and optional journey notes. The server records a reference, submission time and terms version. Do not provide card numbers, passport copies, health records or other unnecessary sensitive information.

The site uses your browser’s language preferences and, when needed, an approximate country lookup to choose a supported language. The country lookup runs locally on the server using an IP geolocation database; it does not obtain your precise position. Your IP address is not transmitted to a separate geolocation service or stored by the language detector. Your manual language selection is saved in an essential preference cookie for up to one year. A submitted inquiry records the selected language to support communication about your request.

IP Geolocation by DB-IP · CC BY 4.0

The support form records your name, email, optional phone number, topic, optional booking reference, subject and message, together with a support reference, submission time, selected language and privacy acknowledgement. Support records are stored privately for review by authorized staff. Email and verified network identifiers are hashed to enforce abuse-prevention limits. The form does not send an automatic email or change a booking.

Request information is used to assess availability, prepare a quotation, communicate about the inquiry and coordinate a service you choose to accept. For an applicable GDPR controller, steps requested before entering a contract may provide a basis under Article 6(1)(b). Security and abuse prevention require a separate documented assessment where legitimate interests are relied upon. Reading this notice is not consent to unrelated marketing.

Submitted inquiries are stored outside the public website directory with restricted access. The site is hosted on Beget. The operator and authorized service providers may need relevant details for an accepted journey; provider identity and necessary disclosures should be supplied before confirmation. The current form does not collect payments or sell inquiry data. Notification email has not yet been configured.

The controller must confirm Beget’s processing locations, processor agreement, sub-processors and any required cross-border transfer safeguards. EU personal data must not be described as EU-only simply because the operator is in the EU. Applicable GDPR transfer requirements, including a valid mechanism and any necessary assessment, must be resolved before operational collection is relied upon.

A browser journey draft expires after one hour. Submitted inquiry records are distinct from this draft. The operator must approve and implement a retention schedule for inquiries, completed bookings, legal obligations and backups. An indefinite retention period is not justified by this notice. This schedule and the deletion process remain to be finalized.

Where applicable, you may request access, correction, erasure, restriction or portability of your information and object to relevant processing. You may complain to your competent data protection authority. US state privacy rights depend on the jurisdiction and whether the business falls within the law’s scope. The direct request address must be published when the operator supplies it.

Only provide information necessary for the journey. Do not enter children’s contact details when a lead adult can manage the request. Restricted files and HTTPS reduce some risks but do not replace the controller’s operational safeguards, staff access controls, processor checks and incident response obligations.