Privacy policy
Last updated: October 30, 2026
We respect your privacy and collect as little data as possible. This policy explains what we process when you use carfast.gr, under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Greek Law 4624/2019.
1. Controller
- Company
- carfast.gr
- Address
- 265 Kifisias Ave, 145 61 Kifisia, Greece
- VAT number
- 118864446
- Tax office
- Kifisia Tax Office
- info@carfast.gr
- Phone
- 210 6206362
2. What data we process
Search details. We process the pick-up and drop-off place and dates, the driver’s age and country of residence, and send them to DiscoverCars to obtain offers. We do not ask for your name, email or card for a search, and searches are not linked to your identity. We only keep aggregated, anonymous price statistics per destination.
Technical data. Our server logs your IP address, browser type, requested page and time, for security and operation.
Contact. If you email or call us, we process your details and message to reply.
Cookies and analytics. See our Cookie policy.
We do not process payment details, licence or ID details, or your booking details. You give those directly to DiscoverCars.
3. Purposes and legal basis
- Showing offers for your search: performance of the service you request (Art. 6(1)(b)).
- Security and operation of the website: legitimate interest (Art. 6(1)(f)).
- Replying to messages: legitimate interest or steps at your request.
- Analytics and marketing cookies: your consent only (Art. 6(1)(a)), which you can withdraw at any time.
- Legal and tax obligations: Art. 6(1)(c).
4. DiscoverCars
When you click “Book”, you go to DiscoverCars (Discover Cars Ltd) with your search details and our partner code. From then on DiscoverCars is an independent controller for the data you give it and the cookies it sets, under its own privacy policy. DiscoverCars may report aggregated bookings to us to calculate our commission, without identifying you.
5. Who we share data with
- DiscoverCars: search details, to obtain prices.
- Our hosting provider, as a processor.
- Analytics providers such as Google Analytics, only with your consent.
- Public authorities where required by law.
We do not sell personal data.
6. Transfers outside the EEA
Some providers, such as Google, may process data outside the EEA under appropriate safeguards: an adequacy decision such as the EU–US Data Privacy Framework, or Standard Contractual Clauses.
7. Retention
- Server logs: up to 90 days, unless needed to investigate a security incident.
- Messages: up to 2 years after the last contact.
- Anonymous price statistics: no limit, as they are not personal data.
- Cookies: as stated in the Cookie policy.
8. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time. Email us at info@carfast.gr. We reply within one month. You may also lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifisias Ave, 115 23 Athens, www.dpa.gr.
9. Security
The website runs only over HTTPS, and we take reasonable technical and organisational measures to protect data.
10. Children
The service is intended for adults. We do not knowingly collect data from minors.
11. Changes
We may update this policy. The current version is always the one published here.