Privacy Policy

Who we are

NZN CAR RENTAL SARL operates nzncarrental.com and provides car rental services in Morocco. ICE: 003324817000046. Office: HFX4+8R3, Bd Ali Yaâta, Casablanca 20250, Morocco. For privacy questions or requests, contact contact@nzncarrental.com or +212 660 391 460.

Information and purposes

We collect information you provide through our website, telephone, email, WhatsApp and rental process. This can include your name, contact details, address, date of birth, driving licence and identity-document details/copies, rental dates and locations, booking history and payment status. Website services may also process IP addresses, browser information and device information.

We use this information to answer enquiries, arrange and manage rentals, check identity and driving eligibility, administer accounts and payments, communicate about bookings, handle incidents and claims, and meet applicable legal obligations. Information needed to arrange a rental is distinct from optional advertising information.

Website providers

We use Hostinger and Supabase outside Morocco to host our website and store customer information. Hostinger’s network infrastructure is in France and its website server is in Lithuania. Our Supabase project hosting region is Sweden. These hosting locations do not describe every location where information may be processed, accessed for support or backed up.

Hostinger supports our website hosting. Online card payments are handled by CMI through Attijariwafa bank. We do not collect or store full card numbers or card security codes; we receive transaction identifiers and payment-status information.

Supabase provides database, file and account services. Google Maps, Google Fonts and the reviews.beaver.codes widget load independently of analytics preferences. The widget displays reviews from our Google Maps listing using Google Firestore and Google-hosted images.

Our analytics setup uses Google Tag Manager and Google Analytics 4 to measure visits on eligible public pages after analytics permission. Advertising permission and analytics permission are separate. See the Cookie and Storage Policy for controls and limitations.

Customer-list advertising through Google and Meta is planned but has not been activated. It would use customer contact information only after permission for that purpose. Contact contact@nzncarrental.com to request removal. We do not currently send promotional email, SMS or WhatsApp messages.

WhatsApp processes messages when you contact us through its service. Relevant information may be shared with payment providers, insurers and competent authorities for payments, incidents or lawful requests. Authorised personnel and service providers access information for their roles.

Your choices and retention

We retain customer rental records and document copies for three months after the rental ends. Digital deletion runs automatically through a Supabase scheduled job; our team manually destroys paper records and copies. Records that applicable law requires us to retain longer are kept for the legally required period. This customer-record retention period is separate from consent preference validity, browser storage lifetimes and GA4 data retention.

Your saved consent preference is valid for 180 days (approximately six months), separately from customer-record retention.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing. You may withdraw consent for processing based on consent, without affecting earlier lawful processing, and complain to the CNDP or another competent privacy authority. Contact contact@nzncarrental.com. We may need proportionate identity verification and will respond within applicable legal time limits. Some records must be kept despite a deletion request where the law requires it.

Google Analytics retention

Our GA4 event data retention and user data retention are each set to 14 months, with reset on new user activity enabled. New activity resets the retention period for that user identifier to 14 months from the new activity; it does not reset the retention of every historical event. These settings do not govern most standard aggregated reports. They are separate from the 180-day consent preference and customer-record retention.