CarmaCars collects only the personal information it needs to rent cars safely, and uses it only with your consent or as the law allows. This policy covers renters, additional drivers, owners, staff and Site visitors. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Terms defined in Part 1 apply here. "Tracker" means the GPS tracking and remote disabling device in each vehicle.
Our Privacy Officer is responsible for this policy: privacy@carmacars.ca (email).
1. What we collect and why
| Information | Why we need it |
|---|---|
| Identity: name, date of birth, address, phone, email, and images and details of your identification and driver's licence | To confirm who you are and that you may drive, meet our insurer's requirements and prevent fraud |
| Face: a live photo of your face and, where the identity check uses it, an automated match against your ID photo | Only to confirm that the ID is yours |
| Payment: cardholder name, card type, last four digits, billing address and payment history. Our payment processor holds the full card number, not us | To take payment, hold the Deposit, charge amounts that arise later, and pay refunds |
| Tracker data: vehicle location, speed, distance, ignition status, tampering alerts and each remote disabling event. No sound or video | To manage the rental, measure distance, match tolls and tickets, enforce the Rental Agreement, handle claims and recover the vehicle |
| Rental records: bookings, signed agreements, proof of coverage, condition report photos, incident reports, and toll and ticket records | To run the rental, prove the vehicle's condition, handle claims and collect what is owed |
| Messages: emails, texts and portal messages with us | To serve you and keep a record |
| Owner information: business and HST details, vehicle, ownership, lender and insurance documents, and banking details | To enrol vehicles, prepare registration forms, bill fees and pay payouts |
| Site data: IP address, device, pages viewed and cookies | To secure and improve the Site |
We also receive information from our identity verification provider, insurers, toll and ticket authorities, the police, and the renter who names you as an additional driver.
2. Tracking
The Tracker records the vehicle's location continuously for the whole rental, including where it is parked. Tracking and remote disabling are a condition of renting, because we cannot protect or insure the fleet without them. Section 12 of the Rental Agreement sets when a vehicle may be disabled. Tracker data may be used as evidence. The vehicle's owner can see the vehicle's location during your rental. For owners, the Tracker also records when you drive your own vehicle.
3. Consent
We rely on your consent. You give express consent to tracking, remote disabling and identity verification at booking (Part 4). By using the Site or giving us information, you consent to the uses described here. You may withdraw consent on reasonable notice, subject to legal and contractual limits. If you withdraw consent to tracking or identity verification, we cannot rent to you. If you prefer not to use the automated face match, ask us for a staff review instead. We use or disclose information without consent only where the law permits or requires it, for example to investigate fraud, collect a debt or respond to a lawful demand.
4. Who we share it with
We do not sell personal information. We share only what each recipient needs:
- Insurance. Our insurer and broker, and the provider of optional rental coverage if you buy it, for underwriting and claims.
- Payment and identity. Our payment processor and our identity verification provider.
- Vehicle owners. The owner of a vehicle can see its location during your rental, its status and its booking dates. The owner cannot lock it, sound its alarm or shut it off during a rental we manage. An owner who manages their own rentals also receives the renter details needed to hand over the vehicle. Owners must keep this confidential and may not use it to follow, contact or monitor a renter.
- Authorities. Police, courts, regulators, and toll and parking authorities, where the law requires or permits. This includes naming the driver responsible for a toll or ticket and reporting a vehicle stolen.
- Service providers. Hosting, messaging, electronic signature, analytics, towing and recovery, repair shops, collection agencies, professional advisers, and our remote customer service and billing staff.
- A buyer of our business, under the same protections.
5. Where it is stored
Some service providers and our remote staff are outside Canada, including in the United States. Information held there is subject to local law and may be accessed by that country's courts, law enforcement and security authorities. We remain responsible for it. Our contracts require protection comparable to ours, and remote staff work through our portals with limited permissions.
6. How long we keep it
| Information | Kept for |
|---|---|
| Identification images and face data | 90 days after the rental ends, or after the check if you do not rent |
| Tracker data | 12 months |
| Rental, payment and owner records, including condition reports and messages | 7 years |
| Marketing contact details | Until you unsubscribe |
We keep information longer only while a claim, dispute, unpaid amount or legal duty requires it. We then delete or anonymise it.
7. Safeguards
We protect personal information with encryption, access limited by role, logs of tracker and disabling commands, confidentiality agreements and training for staff, and contracts with service providers. No system is perfectly secure.
8. Breaches
If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner of Canada as soon as feasible. We keep a record of every breach.
9. Your rights
You may ask to see the personal information we hold about you and to have it corrected. Write to the Privacy Officer. We will confirm your identity and answer within 30 days, at no or minimal cost. We may refuse where the law allows, for example to protect another person's information, and will tell you why. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
10. Cookies and analytics
Essential cookies keep you signed in and keep bookings secure. Analytics cookies measure how the Site is used and are set only if you accept them. You can block cookies in your browser, but parts of the Site may then not work.
11. Marketing messages
We send promotional emails and texts only if you opted in, or where Canada's anti-spam law otherwise allows. Every message identifies us and lets you unsubscribe. We act on an unsubscribe within 10 business days. Messages about your booking, payments or safety are not marketing and are always sent.
12. Changes
We post changes to this policy with their date. We will ask for your consent before using your information for a new purpose.