1. Who We Are

Quality Car Rental Ltd. - TCI is responsible for handling the personal information described in this notice in connection with its vehicle-rental business in the Turks and Caicos Islands.

2. Information We May Collect

Depending on the reservation and rental, QCR may collect:

• name, title, address, telephone number, email address and emergency-contact information;
• date of birth, driving-licence details, passport or other identification information where reasonably required;
• reservation dates, flight details, collection and return locations, vehicle category, extras and pricing;
• approved-driver information and eligibility records;
• payment, card-authorisation and security pre-authorisation records;
• vehicle-condition records, photographs, fuel, mileage, inspection and return information;
• communications through telephone, email, WhatsApp, website forms or other approved channels;
• accident, damage, roadside, traffic, complaint, refund, insurance and claim information; and
• vehicle-location or security information where disclosed and reasonably used for approved operational purposes.

3. How We Use Personal Information

QCR may use personal information to:

• prepare, confirm and manage reservations and Rental Contracts;
• verify identity, driver eligibility, payment and security requirements;
• provide vehicle collection, return, roadside, replacement and customer-support services;
• process payments, pre-authorisations, refunds and valid supported post-rental charges;
• manage accidents, damage, theft, traffic notices, insurance matters and legal claims;
• prevent fraud, protect customers, staff, vehicles and business assets;
• respond to complaints, disputes, access requests and correction requests;
• maintain accounting, audit, tax, insurance and legal records; and
• improve service quality, systems, staff procedures and customer communications.

4. Payment-Card and Identification Information

QCR inspects original identification and keeps copies only where reasonably required by law, an insurer, the merchant bank, a booking channel, fraud prevention or a claim. Identification images must not remain on personal phones, unsecured galleries or unapproved messaging accounts.

5. GPS, Vehicle Location, CCTV and Communications

Where a vehicle or QCR location uses GPS, telematics, CCTV or recorded communications, QCR will provide reasonable notice and limit use to legitimate purposes such as:

• vehicle theft, recovery, overdue or unauthorised retention;
• roadside support, safety incidents, severe weather and return verification;
• investigating material prohibited use, accidents, damage or official requests; and
• security of QCR premises, vehicles, customers and staff.

6. When Information May Be Shared

QCR may share the minimum information reasonably necessary with:

• insurers, insurance representatives, assessors and claims professionals;
• banks, payment processors and merchant-service providers;
• booking platforms and authorised reservation partners;
• roadside, towing, recovery, repair, cleaning and vehicle-service providers;
• accountants, auditors, legal advisers and technology providers;
• police, courts, government departments and regulatory authorities where required or reasonably necessary; and
• another authorised business successor where the service is transferred lawfully and customer rights are not reduced.

QCR does not sell customer identity, rental or location information.

7. Storage, Security and Retention

QCR uses reasonable administrative, physical and technical controls appropriate to the information being handled. Access should be limited to staff and service providers who need the information for an authorised purpose.

Records are retained only for documented operational, accounting, tax, insurance, legal, fraud-prevention or dispute purposes and should then be securely deleted, destroyed or anonymised. QCR does not intentionally retain personal information indefinitely.

Information received through WhatsApp or another convenient channel should be transferred to the approved business record where necessary, and unnecessary sensitive copies should be deleted from the original channel.

8. Service Messages and Marketing

QCR may send messages reasonably necessary to manage a reservation or rental, including confirmations, collection instructions, return reminders, safety information, payment or refund updates and complaint responses.

Marketing messages are separate from essential service communications. Marketing consent should be voluntary and may be withdrawn by contacting QCR.

9. Access, Correction and Privacy Concerns

A customer may ask QCR to:

• confirm whether QCR holds personal information about them;
• provide reasonable access to information that may lawfully be disclosed;
• correct inaccurate or incomplete information;
• explain a material use or disclosure; or
• review a privacy concern or suspected data incident.

QCR may need to verify identity before responding and may retain information where required for a current rental, legal obligation, insurance matter, payment dispute, fraud investigation or legal claim. QCR aims to respond to ordinary access or correction requests within 30 days where reasonably practical.

10. Data Incidents

Staff must report any suspected loss, unauthorised access, disclosure, alteration or destruction of personal information internally without delay. QCR will take reasonable steps to secure the information, investigate the incident, preserve relevant evidence, obtain professional advice and notify affected persons or authorities where appropriate.

11. Changes to This Notice

QCR may issue a new controlled version of this notice when its services, systems, legal duties or approved procedures change. A revised notice applies prospectively from its stated effective date and does not silently create new financial obligations or retrospectively alter an existing Rental Contract.

This notice should be read with the applicable reservation confirmation, Vehicle Rental Agreement, Master Vehicle Rental Terms, Schedule of Charges and any specific notice provided when personal information is collected.