Privacy

Autowise AS (company reg. no. 997 008 901) is the data controller for the personal data we process about you. We process data in accordance with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

Contact us about privacy:

• Autowise AS, Strømsveien 322, 1081 Oslo, Norway

• Email: post@autowise.no

• Phone: +47 22 32 34 00

We process the following categories of personal data:

• Contact and quote requests: name, email, phone number, the chosen service, your message and language preference.

• Booking/rental: name, email, phone number, rental period (pickup and return time), pickup and return location, the chosen vehicle, any notes, booking number and a secure link to manage the booking.

• Customer and contract data: billing/address details and company/VAT number for business customers, as well as information relating to rental agreements, damage and contracts (e.g. the name and email of the signer, and IP address on electronic signing).

• Payment data: payment status and references from the payment provider. Full card details are handled by the payment provider, not by us.

• Check-in and driver licence: during digital check-in before pickup we process driver licence details (licence number, expiry date, date of birth, issuing country) and photos of the front and back of the licence, as well as any photos of the vehicle taken at delivery and return. The images are stored encrypted in a restricted archive with strictly limited access and are never shared with third parties.

• Technical data: cookies, and – for logged-in administration – IP address, browser type and an activity log (audit log).

We do not ask for special categories of personal data via the website forms. Please avoid providing more information than necessary in free-text fields.

We process personal data for the following purposes and on the following legal bases:

• Provide the services (rental and workshop services), administer orders, send confirmations and communicate with you – to perform the contract with you or take steps prior to entering into a contract (GDPR Art. 6(1)(b)).
• Respond to quote and contact requests – to take steps prior to a contract, or our legitimate interest in answering enquiries (Art. 6(1)(b)/(f)).
• Accounting and bookkeeping (invoices, receipts) – legal obligation under the Norwegian Bookkeeping Act (Art. 6(1)(c)).
• Security, fraud prevention and documentation (e.g. audit log, anti-abuse) – legitimate interest (Art. 6(1)(f)).
• Website analytics (e.g. Google Analytics, Plausible or Umami) – only based on your consent (Art. 6(1)(a)).
• Marketing, if you have requested it – based on consent (Art. 6(1)(a) / section 15 of the Marketing Control Act). You can withdraw your consent at any time.

The website uses cookies. Necessary cookies are required for the website to function, including:

• a cookie that remembers your cookie consent choice,
• a cookie for language preference,
• a login cookie for the admin panel (staff only).

Analytics and statistics cookies are set only if you consent in the consent banner. You can change or withdraw your consent at any time via "Cookie settings" in the footer. The use of cookies follows the requirements of the Norwegian Electronic Communications Act.

We do not sell personal data. We share data with providers who process data on our behalf (processors), under data processing agreements, including:

• Payment: Nets (online card payments).

• Email: our provider for sending transactional email (e.g. SMTP/email provider).

• Hosting and storage: cloud hosting and file storage providers (e.g. storage of invoices and documents).

• Analytics: the chosen analytics provider, only with consent.

We may also disclose data to public authorities or insurance/debt-collection companies when legally required or to establish, exercise or defend legal claims.

Some of our providers may process data outside the EU/EEA. When this happens, we ensure a lawful transfer mechanism, for example the European Commission's Standard Contractual Clauses (SCC) or a valid adequacy decision, so that your data remains adequately protected.

We retain personal data for as long as necessary for the purposes above:

• Booking and contract data is kept for the duration of the customer relationship and for as long as necessary to handle complaints and legal claims.

• Accounting and voucher data is kept for as long as required by the Norwegian Bookkeeping Act (generally five years after the end of the accounting year).

• Quote and contact requests that do not lead to a customer relationship are deleted when no longer necessary.

• Consent-based data is processed until you withdraw your consent.

• Driver licence photos and other identity documents uploaded at check-in are deleted automatically after the rental ends, in accordance with our published retention policy. You may request earlier deletion at any time.

• Signed rental agreements are kept for a fixed period due to limitation and bookkeeping rules, in accordance with our published retention policy.

You have the right to:

• access the personal data we process about you,
• have inaccurate data corrected,
• have data erased ("the right to be forgotten") within the limits of the law,
• request restriction of processing,
• object to processing based on legitimate interest,
• request data portability,
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, contact us at post@autowise.no. We normally respond within 30 days. We may ask you to verify your identity before disclosing data.

If you believe we process personal data contrary to the rules, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). We would appreciate it if you contacted us first so that we have the opportunity to put things right. More information is available at datatilsynet.no.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss and misuse, including encrypted transmission (HTTPS), access control, two-factor authentication for administration and change logging.

Our services are aimed at businesses and adults and are not intended for children. We do not knowingly collect personal data from children.

We may update this privacy policy. The version in force at any given time is published on the website, and for material changes we will provide information where appropriate. If you have questions about privacy, contact us at post@autowise.no.