Privacy Policy
Last updated: June 2026
1. Who is the data controller?
The data controller is Majestic Auto Group d.o.o., Vojvode Vratka 14, 11080 Belgrade, Serbia, MB: 22124510. Email: info@majesticautogroup.rs
2. What personal data do we collect about you?
We collect the following personal data that you provide voluntarily: — First and last name, email, phone number — Driver's license number, ID card details — Billing and payment data — Location and reservation data — IP address and browser data
3. When do we collect data?
— When you register / become a Majestic Auto Group member — Make an online reservation — Sign up for the loyalty program — Sign up for email notifications — Take part in a survey, competition or prize draw — Contact Majestic Auto Group — Use our online services — Submit an online inquiry
4. Purpose of processing
The data is used for: — Registering you as a Majestic Auto Group member and assigning a customer number — Processing and managing reservations — Invoicing and payment processing — Communication regarding your reservation — Meeting legal obligations — Improving the quality of our services — Responding to your questions or suggestions — Sending emails with news and promotions, if you have consented — Contacting you about a reservation you did not complete online on our website — Processing your participation in a prize draw or competition
5. Recipients of your data (processors)
We do not sell your personal data. To provide our services we use carefully selected service providers who process data only on our behalf and under contract: — Supabase (database hosting, servers in the EU / Ireland): secure storage of reservation and account data. — Resend (USA): delivery of booking confirmations and notification emails. — Google (USA): Google Search Console and related services for operating and analysing our website. — AirLabs: flight-status lookup for the flight number you provide for airport pick-ups. Beyond these, data is shared with insurance companies, payment service providers and government authorities only where this is necessary to perform the contract or required by law.
6. International data transfers
Some of our processors are located outside the Republic of Serbia and the EU — in particular Resend and Google (USA). Where personal data is transferred to such third countries, we ensure an adequate level of protection through appropriate safeguards, in particular the EU Standard Contractual Clauses, in line with the Serbian Personal Data Protection Act (ZZPL).
7. Data security
We apply technical and organizational measures to protect your data. Transmission is encrypted via SSL/TLS.
8. Your rights
You have the right to access, rectify, erase and restrict the processing of your data, as well as the right to data portability and to object to processing. Deletion / account deletion: Because deletion is performed manually by our administrators, please send your request by email to the address stated in our Legal Notice (Impressum). We will then delete or anonymise your personal data, unless we are legally required to keep it. Right to complain: You have the right to lodge a complaint with the supervisory authority — the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, www.poverenik.rs. Contact: info@majesticautogroup.rs
9. Retention period
We store personal data only for as long as necessary for the purposes described or as required by law. — Booking data including personal details (in particular driver's licence number and year of birth) is anonymised or deleted 2 years after the end of the rental. — Invoice and accounting data that is relevant for tax purposes is retained for the statutory retention period of 10 years.
10. Anonymous traffic measurement
To understand how our website is used, we operate our own privacy-friendly, cookieless traffic measurement. We do not set any consent-requiring cookies, do not use fingerprinting and do not create cross-site identifiers. Your IP address is never stored in readable form — it is used only briefly to determine the approximate country and a daily-rotating anonymous hash, and is then immediately discarded. We record only anonymous, aggregated data per page view (time, page, source/referrer, approximate country, device type and language). This data cannot be linked to you. Because the measurement is anonymous and cookieless, no consent is required.