1. About This Policy

This privacy policy explains how Savvy Car Hire Pty Ltd (ABN 87 694 482 034) (“Savvy Car Hire”, “we”, “us”, “our”) collects, uses, holds, discloses and protects your personal information. We handle your personal information in accordance with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth), the Notifiable Data Breaches scheme, and the Identity Verification Services Act 2023 (Cth) where it applies to our use of the Australian Government Document Verification Service.

We are committed to managing your personal information openly and transparently. This policy describes the kinds of personal information we collect, how we collect it, what we use it for, who we share it with, how long we keep it, how we keep it secure, and how you can access, correct or complain about it.

2. Information We Collect

We collect the following categories of personal information when you make a booking, hire a vehicle from us, or otherwise interact with us:

Full name, date of birth, and residential address
Contact details including email address, mobile and landline phone numbers, and (where used) WhatsApp number
Driver's licence details including licence number, card number, state or country of issue, expiry date, and front and back images of the licence
Passport details and images (where presented as supporting identification)
Australian visa details and visa grant numbers (for non-citizen customers)
A selfie photograph collected for identity verification (see section 3)
Proof-of-address or secondary identity documents you provide, such as a utility bill, bank statement or accommodation lease
Your declaration of any criminal convictions, licence suspensions or disqualifications, and insurance claims or accidents within the last three years, together with your attestation that the declaration is true (see section 3)
Emergency contact name, relationship and phone number
Electronic signature records when you sign your rental agreement, including the signature itself and the IP address, device details and time of signing
Payment information including the name on the card, the last four digits and expiry of the card, billing address, and transaction history (full card details are tokenised by our payment processor and are not stored on our systems)
Vehicle inspection photographs and condition reports collected before and after each rental
Telematics and vehicle data, where the vehicle is fitted with a tracking device, including GPS location, mileage, and event data such as harsh braking or after-hours use
Communication records including SMS, email, WhatsApp and Facebook Messenger messages exchanged with us; recordings and transcripts of phone calls (including calls handled by our automated AI assistant, where notified at the start of the call); and the content of chats you have with our website or messaging AI assistant
Records of fines, infringements, tolls, and damage incidents associated with your rental
Information collected automatically when you use our website, including IP address, device type, browser type, and behaviour on the site

Some of the information above includes government-related identifiers, such as your driver's licence, passport or visa numbers. We do not adopt or use these as our own identifier for you. We only collect, use or disclose them where reasonably necessary to verify your identity, to meet our legal obligations, or where otherwise permitted by law.

3. Sensitive Information and Biometric Data

Some of the information we collect is “sensitive information” within the meaning of the Privacy Act 1988 (Cth). In particular:

Facial image data: a selfie photograph captured during identity verification, which we compare against the photo on your identity document
Criminal and driving history: your declaration of any criminal convictions, licence suspensions or disqualifications, and insurance claims or accidents within the last three years, collected as part of your booking application

We collect your facial image only with your explicit consent (provided at the point of booking and identity verification) and only where reasonably necessary to verify that the person presenting an identity document is the person depicted on that document. Where you choose the online check, that check is performed by our identity verification provider, Didit (see section 6), which uses automated face matching and liveness detection to compare the selfie you take with the photo on your licence and to confirm a live person took it. This involves creating a biometric template from your image for the duration of that check. Where you instead provide photographs for manual review, verification is performed by our own trained staff, who visually compare your selfie with your identity document, and no biometric template is generated. Selfie and identity document images are stored securely (see sections 12 and 13) and are deleted on a fixed schedule once your booking has been assessed. We do not use your facial image for any other purpose, and we do not share it for marketing or analytics.

We collect your criminal and driving history declaration only with your consent, and only to assess whether we can safely and lawfully hire a vehicle to you, including confirming your eligibility under our damage cover and our fleet insurance. We do not use it for any other purpose, and we do not disclose it except as described in section 9 (for example, to our insurer where required for a claim, or where required by law).

4. How We Collect Your Information

We collect personal information in the following ways:

Directly from you when you make a booking, complete an online identity verification, sign a rental agreement, collect or return a vehicle, contact us, or visit our website
From our payment processor, when we receive transaction confirmations and dispute notifications
From insurers, toll operators, road authorities, and law enforcement, in connection with claims, fines, infringements and tolls relating to your rental
From publicly available sources, where reasonably necessary to verify information you have provided or to enforce our rights under your rental agreement
Automatically through cookies and analytics tools when you use our website

Where it is reasonable and practicable to do so, we collect personal information directly from you rather than from a third party.

You can deal with us anonymously or under a pseudonym when making a general enquiry. However, we cannot provide a vehicle rental anonymously, as we are legally required to verify your identity and your right to drive before entering into a rental agreement.

5. How We Use Your Information

We use your personal information for the following primary purposes:

To process and manage your vehicle rental booking
To verify your identity, your driver's licence, and your right to drive
To process payments, the refundable security bond, and refunds
To communicate with you about your booking, including confirmations, reminders, pickup and return instructions, and post-rental receipts
If you start a booking on our website but don't finish it, to send you one email to help you pick up where you left off, with a link to unsubscribe (see section 16)
To contact your nominated emergency contact if there is an emergency involving you or the vehicle, or if we cannot reach you while the vehicle is overdue or unaccounted for
To process toll charges and to nominate you to relevant authorities as the driver for any infringements, fines or penalties incurred during your rental
To conduct pre-rental and post-rental vehicle inspections and to manage damage claims and excess recoveries
To manage our insurance policies and to assist insurers in processing claims
To detect, investigate and prevent fraud, theft and misuse of our vehicles
To comply with our legal, regulatory, tax and accounting obligations
To improve our services, vehicle fleet, pricing and customer experience
To respond to your enquiries and complaints

We will not use your personal information for any secondary purpose unless that purpose is related to the primary purpose, you would reasonably expect that use, you have consented to it, or the use is otherwise permitted by law.

6. Identity Verification

As part of every rental, we verify the identity of the person hiring the vehicle and confirm they hold a valid driver's licence. To do this, we:

Collect images of the front and back of your driver's licence, and any other identity documents you present (such as a passport, visa, or proof-of-address document)
Collect a selfie photograph so we can confirm you are the person shown on your identity document
Where you choose the online check, have our identity verification provider, Didit, read and authenticate your licence, compare your selfie to the licence photo, and confirm a live person took the selfie
Where you instead provide photographs, have a trained member of our team manually review your documents and selfie, checking that the documents are current, that the details match your booking, and that the photographs match
Record the outcome of that check and use it as one input to a decision, made by a person, on whether to proceed with your rental

We will tell you before this identity verification occurs and ask you to consent to it. If you do not consent, or if the verification cannot be completed, we will not be able to enter into a rental agreement with you.

The online check is optional. You can instead provide photographs of your licence and a selfie for manual review by our staff, or show your licence in person at pickup. We do not currently check your licence against any government database. If we adopt the Australian Government Document Verification Service (DVS) in the future, we will update this policy before doing so. Didit holds the images and extracted details for the period needed to complete the check and resolve any dispute, after which they are deleted in line with section 13.

7. Automated Decisions, AI Assistant and Human Review

We do not make automated decisions about whether to hire you a vehicle. The online identity check produces an automated result, but booking approval is decided by a person: a member of our team reviews that result (or your documents and selfie), your booking details and, in most cases, speaks with you by phone before your rental is confirmed. A declined online check does not by itself refuse your booking; you can provide documents for manual review instead.

If you believe an identity verification or booking decision is incorrect, you can ask us to review it by contacting us using the details in section 19. We will reconsider the matter using the information you provide and any additional documents you supply.

AI assistant. When you call us, your call may be answered by an automated AI voice assistant rather than a person. The assistant can answer general questions, look up your booking and arrange extensions. At the start of the call we tell you that you are speaking with an AI assistant and that the call is recorded; if you would prefer to deal with a person, you can ask at any time and we will transfer you or arrange a callback. We also offer an AI assistant on our website and across messaging channels (such as SMS, WhatsApp and Facebook Messenger), and a member of our team can take over the conversation where needed.

To provide these assistants, the content of your calls and messages is processed by our technology providers, including Twilio Inc. (telephony and messaging), OpenAI OpCo, LLC (conversation processing, and transcription of recorded calls, including calls with a member of our team), ElevenLabs Inc. (speech synthesis) and Deepgram, Inc. (speech-to-text). These providers process the information outside Australia (see section 10). We use it to handle your enquiry, keep a record of what was agreed, and improve our service. We do not use an automated decision to refuse you a rental without the option of human review.

8. Payment Information

All payment transactions are processed by Stripe Payments Australia Pty Ltd (“Stripe”). Stripe is PCI DSS Level 1 certified, which is the highest level of payment-card-industry security certification. We do not store full credit card numbers, CVV codes or full card expiry information on our systems. We retain a tokenised reference, the last four digits of the card, the cardholder's name and the billing address solely for the purposes of recording transactions, processing refunds and fines, and reconciling our accounts.

We share your personal information with the following categories of recipients, only to the extent necessary for the purposes set out in this policy:

Stripe Payments Australia Pty Ltd for payment processing
Twilio Inc. for SMS, WhatsApp and telephone communications, including the telephony behind our AI voice assistant
SendGrid, Inc. (a Twilio company) for transactional and customer service emails
OpenAI OpCo, LLC, ElevenLabs Inc. and Deepgram, Inc., which process the audio, transcripts and content of calls and chats handled by our AI assistant (conversation processing, speech synthesis, and speech-to-text); OpenAI OpCo, LLC also transcribes our recorded phone calls
Meta Platforms, Inc., where you contact us through Facebook Messenger, and, if you accept cookies, for advertising measurement (the Meta Pixel and Conversions API)
Google LLC for website analytics (Google Analytics) and, if you accept cookies, advertising measurement, address autocomplete (Google Maps / Places) when you enter an address during booking, and AI image processing (Google Gemini) used to prepare vehicle listing photographs
Our telematics provider, where a vehicle is fitted with a tracking device, for live location, mileage and event data (our telematics software is self-hosted on cloud infrastructure provided by Railway Corporation)
Vercel Inc. (website and application hosting, including stored vehicle inspection images) and Neon Inc. (a Databricks company) (database hosting, including stored images of identity documents and selfies), which store the personal information you provide to us
Xero Australia Pty Ltd (ABN 89 124 215 247) for accounting, invoicing, payroll and tax record keeping
Insurance providers and brokers including our fleet insurer, for policy administration, claims handling, damage assessment and excess recovery
Toll operators, including CityLink Melbourne Limited (ABN 65 070 810 678), trading as Linkt under licence from Transurban Limited (ABN 96 098 143 410), and other toll road operators and road authorities, for processing tolls incurred during your rental and recovering them from you
VicRoads, the Department of Transport and Planning, Victoria Police, and equivalent authorities in other states and territories, for nominations of drivers responsible for infringements, fines and penalties incurred during your rental
Service providers and contractors including roadside assistance providers, vehicle service centres, locksmiths, key replacement services, and recovery agents, where required to maintain, recover or repair our vehicles
Debt collection and legal services, where you have unpaid amounts owing to us
Law enforcement, courts and government agencies, where required by law, court order, or where we reasonably believe disclosure is necessary to prevent or investigate a serious threat to life, health, safety or property
Our professional advisers including our accountants, auditors and lawyers, where reasonably necessary
A purchaser or successor entity, if our business or its assets are sold, merged or restructured, on the condition that they protect your personal information consistently with this policy

We do not currently disclose your identity documents or facial images to any third party identity verification provider; they are stored on our own systems and reviewed by our own staff (see section 6). If we engage such a provider in the future, we will update this policy first.

We do not sell your personal information to third parties and we do not disclose your personal information for the marketing purposes of other organisations.

10. Overseas Disclosure

Some of the third parties listed in section 9 are based outside Australia or use cloud infrastructure located outside Australia. In particular:

Stripe (Stripe Payments Australia Pty Ltd), Twilio Inc., SendGrid, Inc. and certain Google LLC products store and process data in the United States and other countries
Meta Platforms, Inc. stores and processes Facebook Messenger communications in the United States and other countries
OpenAI OpCo, LLC, ElevenLabs Inc. and Deepgram, Inc., which power our AI call and chat assistant, process the audio, transcripts and content of those interactions in the United States and other countries
Vercel Inc., Neon Inc. and Railway Corporation, which host our website, database, stored document and inspection images, and our telematics and voice-assistant software, store and process data on cloud infrastructure that may be located outside Australia, including in the United States
Xero Australia Pty Ltd stores data in Australia and may use service providers located in the United States and the United Kingdom
Didit, our identity verification provider, is based in Spain and processes identity document images, selfies and extracted details in the European Union

Before disclosing your information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles in relation to your information. This may include relying on the recipient's binding privacy commitments, contractual data protection terms, certifications such as ISO 27001 or SOC 2, and the laws of the jurisdiction where the recipient is located.

By providing your personal information to us and agreeing to our terms, you acknowledge that your personal information may be disclosed to and processed by recipients located outside Australia for the purposes set out in this policy.

11. Cookies, Analytics and Tracking

Our website uses cookies and similar technologies to operate the site, remember your preferences, understand how visitors use the site, and improve our services. Cookies are small text files placed on your device by websites you visit.

We use:

Strictly necessary cookies that are required for the website and booking system to function
Analytics cookies, including Google Analytics, which we set only if you consent (see below) and which collect anonymised information about pages visited, time on site, referring pages, and device and browser type
Advertising cookies, from Google and Meta, which we set only if you consent (see below)
Third party cookies and similar technologies set by embedded services, such as our payment processor's fraud-prevention scripts and the Google Maps embeds on our contact and locations pages

We also record first-party usage events on our own systems, such as which pages you visit and which steps of the booking process you complete. This information is used only to understand and improve our website and booking flow; it stays on our systems and is not shared with advertising networks.

If you select “Accept” on our cookie banner, we also use advertising measurement from Google and Meta to learn which of our ads lead to bookings. When you book, we may send them your booking reference, the hire value, and your email and mobile number in scrambled (hashed) form so they can match your booking to an ad. If you select “Decline”, we don't load Meta's tools or send your details to Google or Meta for advertising.

When you first visit our website we ask for your consent before setting any analytics or advertising cookies. These cookies are not set unless you select “Accept” on our cookie banner, and you can change your choice at any time using the “Cookie settings” link in the footer of our website. You can also control or disable cookies through your browser settings; disabling strictly necessary cookies may prevent parts of our website from working. As a further option, you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

12. Data Retention

We retain personal information only for as long as we need it for the purposes set out in this policy, or for as long as required by law, whichever is longer. Specific retention periods include:

Booking, rental and account records, including identity document images and copies: for the duration of your rental plus 7 years, to meet our tax, legal, insurance and regulatory obligations
Facial images (selfies) used for identity verification: deleted within 30 days after our identity review for your booking is finalised, unless we need to retain an image longer in connection with an active dispute, claim or investigation (for example, a payment dispute). No biometric template is generated or retained (see section 3)
Identity document images not connected to a completed booking (for example, where you upload documents but do not finish booking): deleted within 7 days
Vehicle telematics and GPS event data: 12 months from collection, unless required for a specific claim, fine or investigation
Vehicle inspection photographs and condition reports: 7 years from the end of the rental
Communication records (SMS, email, WhatsApp, call logs): 2 years from the date of the communication
Website analytics and cookie data: in accordance with the retention settings of the relevant analytics provider (currently up to 14 months for Google Analytics)
Marketing list entries: until you unsubscribe
Unsubscribe requests: the email address you unsubscribed, for as long as we send marketing email, so that we never send it any again

Where personal information is no longer needed, we securely delete or de-identify it in accordance with our data destruction procedures.

13. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Our security measures include:

Encryption of personal information in transit using HTTPS and TLS
Encryption at rest of data stored with our database and hosting providers
Access to personal information is restricted to authorised staff through individually authenticated administrator accounts, with tiered access levels assigned per staff member and the ability to revoke access immediately
Two-factor authentication available on administrator accounts
Audit logging of administrative actions taken on customer and identity records
Secure disposal of records and media containing personal information
Use of service providers who hold recognised security certifications, such as our payment processor Stripe (PCI DSS Level 1)

No security measure is perfect. While we take reasonable steps to protect your personal information, we cannot guarantee absolute security.

14. Notifiable Data Breaches

We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). If we suspect that an eligible data breach has occurred (one that is likely to result in serious harm to any individual whose personal information is involved), we will:

Promptly investigate and contain the breach
Assess whether the breach is likely to result in serious harm
If it is, notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable, in the form and manner required by the Act
Take reasonable steps to remediate the breach and reduce the risk of future breaches

15. Your Rights and How to Exercise Them

Under the Australian Privacy Principles, you have the following rights in relation to your personal information held by us:

Right of access: you can ask us for a copy of the personal information we hold about you
Right to correct: you can ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading
Right to request deletion: you can ask us to delete your personal information, subject to legal retention requirements
Right to withdraw consent: you can withdraw your consent to optional uses of your personal information at any time, although doing so may prevent us from providing services to you
Right to opt out of direct marketing: see section 16
Right to complain: see section 19

How to make a request: email us at info@savvycarhire.com.au or call us on 0485 018 888 and tell us what you would like to do. To protect your information, we may need to verify your identity before processing your request. We will respond to access and correction requests within 30 days. There is no fee for making a request, although in some circumstances we may charge a reasonable cost-recovery fee for providing access where the request is unusually large.

If we are unable to give you access or to correct information at your request, we will give you a written explanation.

16. Marketing Communications

We may use your contact details to send you information about our services, special offers, fleet additions and reminders relating to your account. You can opt out of marketing communications at any time by:

Clicking the unsubscribe link in any marketing email
Replying STOP to a marketing SMS
Contacting us using the details in section 19

The unsubscribe link works straight away, needs no login and costs nothing. It stops all of our marketing email to that address, including the email about a booking you didn't finish.

Opting out of marketing communications will not prevent us from sending you transactional and operational communications relating to your bookings, payments, vehicle pickup and return, fines, infringements or other matters arising from your rental.

17. Consequences of Not Providing Information

Most of the information we collect is necessary for us to provide you with a vehicle rental, manage payments and meet our legal obligations. If you choose not to provide the information requested, including consent to identity verification:

We may not be able to confirm your identity or your right to drive
We may not be able to enter into a rental agreement with you
We may not be able to process payments, refunds, fines or tolls
We may not be able to contact you for important information about your rental

Emergency contact details are required for all rentals so that we can reach someone if there is an emergency involving you or the vehicle, or if we cannot contact you while the vehicle is overdue. Some information is optional, such as marketing preferences. We will tell you at the point of collection whether information is mandatory or optional.

18. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, the services we offer, or our legal obligations. The updated version will be posted on our website with the “Last updated” date revised accordingly. Where changes are material, we will take reasonable steps to bring them to your attention, including via direct notification to existing customers where appropriate.

19. Contact Us and Complaints

For privacy questions or to exercise your rights:

Savvy Car Hire Pty Ltd
ABN 87 694 482 034
28 Alice Street, Malvern VIC 3144
Phone: 0485 018 888
Email: info@savvycarhire.com.au

Mark your email “Privacy” so we can route it to the right person.

Making a complaint: if you believe we have not handled your personal information in accordance with the Australian Privacy Principles or this policy, please contact us using the details above and tell us what has happened. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

Escalating to the OAIC: if you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner:

Online: oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992
Mail: GPO Box 5288, Sydney NSW 2001

Privacy policy.