1. Who we are
Noir Rentals Ltd (company no. 16954847, registered office: 124 City Road, London, EC1V 2NX) is the data controller for the personal data described in this policy. Questions or requests: [email protected].
2. What we collect
To provide vehicle hire we collect: your name, email address, phone number and home address; your driving licence number and a DVLA licence-check (share) code; photographs of the front and back of your driving licence and a proof-of-address document, which you upload through our secure portal; your digital signature on the hire agreement; booking and payment details (card payments are processed by Stripe — we never see or store your full card number); and records of our correspondence with you.
3. Why we collect it (lawful bases)
Performance of a contract: processing your booking, verifying you hold a valid licence, preparing and signing the hire agreement, managing the deposit, and running the hire. Legal obligations: insurance requirements, responding to Penalty Charge Notices and traffic enforcement, and keeping business and tax records. Legitimate interests: preventing fraud and vehicle theft, recovering unpaid charges, and maintaining internal records of hire history. We do not sell your data and we do not use it for third-party marketing.
4. Where your data lives and who processes it
Your data is stored on Supabase infrastructure hosted in the European Union (Zurich region), with documents held in private, access-controlled storage. We use a small number of processors to run the service: Stripe (payments), Supabase (database and document storage), Netlify (website hosting), and Resend (transactional email). Each processes data only on our instructions. Where a processor transfers data outside the UK/EEA, transfers are protected by recognised safeguards such as the UK Addendum to the EU Standard Contractual Clauses.
5. How long we keep it
Booking enquiries that do not become hires are removed within 12 months. Hire agreements, identity verification documents, signatures and payment records are kept for the duration of the agreement and up to 6 years after it ends — the limitation period for contractual claims and the window in which fines, PCNs and insurance matters can still arise. We delete or anonymise data when it is no longer needed.
6. Your rights
Under UK GDPR you have the right to access a copy of your data, correct it, request deletion, restrict or object to processing, and receive your data in a portable format. Email [email protected] and we will respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk) if you believe we have mishandled your data.
7. Security
Access to your documents is restricted to staff who need it to verify your hire, over encrypted connections, with role-based permissions and audit logging in our operations system. Portal links are unique, tokenised and expire automatically.
8. Cookies
The public website uses only essential cookies: a session cookie when you sign in to a portal or account, and cookies set by Stripe during checkout for payment security and fraud prevention. We do not use advertising or cross-site tracking cookies.
9. Changes to this policy
We will update this page when our practices change and revise the date below. Significant changes affecting existing customers will be notified by email.