ECRCS Privacy Policy.
Last updated: 30 October 2026
The European Car Rental Conciliation Service ("ECRCS", "we", "our" or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, share, retain and protect personal data when you use the ECRCS service, submit or participate in a complaint, visit our website at www.ecrcs.com, contact us, or otherwise interact with us.
ECRCS processes personal data in accordance with applicable data protection legislation, including the EU General Data Protection Regulation ("EU GDPR") and, where applicable, UK data protection legislation.
1. Who we are
The data controller is the European Car Rental Conciliation Service (ECRCS), River Lodge, Badminton Court, Amersham, HP7 0DD, United Kingdom.
As data controller, ECRCS is responsible for deciding how and why personal data is processed. Questions about this Privacy Policy, requests to exercise data protection rights, or concerns about our use of personal data may be sent to ECRCS at the address above or using the contact details published on our website.
Because ECRCS provides services to individuals in the European Union, ECRCS will maintain an EU representative where required by Article 27 EU GDPR. The identity and contact details of that representative will be made available on our website and in this Privacy Policy once appointed.
2. Personal data we collect
Contact and identity information
- name;
- postal address;
- email address;
- telephone number;
- signature; and
- other information needed to identify you or communicate with you.
Complaint and case information
If you submit, respond to, or are otherwise involved in an ECRCS complaint, we may collect information including:
- details of your complaint;
- vehicle rental, booking and reservation information;
- rental agreements, invoices, receipts and relevant payment information;
- correspondence between you and a rental company or other relevant party;
- photographs and other supporting evidence;
- information supplied by the rental company concerned or another relevant third party;
- records of communications with ECRCS;
- the outcome of the complaint and the reasons for that outcome; and
- any other information reasonably necessary to consider and resolve the complaint.
Please avoid providing personal data that is not relevant to your complaint.
Professional information
Where relevant, we may collect your employer or organisation, your role or position, and business contact details.
Special category and other sensitive information
Information submitted in connection with a complaint or other communication may sometimes contain more sensitive personal data. For example, you may voluntarily provide information concerning your health, disability, racial or ethnic origin, religious or philosophical beliefs, or other information classified as special category personal data under the EU GDPR.
Information relating to criminal convictions and offences is subject to separate protections under data protection law and is not treated as special category data under Article 9 EU GDPR.
We ask that you only provide sensitive personal data where it is relevant and necessary for us to deal with your complaint or enquiry. Where we process special category personal data, we will do so only where an applicable condition under Article 9 EU GDPR and/or other applicable data protection legislation permits the processing.
Website and technical information
When you use our website, we may collect information such as your IP address, browser and device information, operating system, time zone, pages viewed, referring website or search terms, dates and times of visits, information about how you interact with our website, and cookie or similar technology information.
We may use cookies and analytics technologies to understand how our website is used and to maintain and improve it. Where required by law, non-essential cookies will only be used with your consent. Further information is available through our cookie information and preference controls.
3. Where we obtain personal data
We may obtain personal data:
- directly from you;
- through our website;
- when you submit a complaint;
- through telephone calls, emails or other correspondence;
- from the vehicle rental company against which a complaint has been made;
- from ECRCS participating organisations;
- from another person or organisation involved in or relevant to your complaint;
- from service providers acting on our behalf; and
- from other sources where permitted by law.
When dealing with a complaint, it may be necessary for us to receive information about you from the rental company concerned and to provide relevant information supplied by you to that company so that both sides of the complaint can be considered fairly.
4. How and why we use your personal data
We may use personal data to:
- receive, administer and investigate complaints;
- operate the ECRCS alternative dispute resolution service;
- communicate with complainants and participating rental companies;
- consider evidence and information supplied by the parties;
- reach, explain and communicate complaint outcomes;
- respond to enquiries and provide customer support;
- maintain appropriate case and service records;
- monitor and improve the quality, consistency and efficiency of our service;
- train and support our staff;
- administer, maintain and secure our website and IT systems;
- prevent and investigate fraud, misuse and security incidents;
- comply with legal and regulatory requirements;
- establish, exercise or defend legal claims; and
- produce statistical, management and service-performance information.
Where reasonably possible, information used for statistical or analytical purposes will be aggregated or anonymised.
5. Our lawful bases for processing
Legitimate interests
For the core administration of the ECRCS alternative dispute resolution service, we generally process personal data where necessary for our legitimate interests under Article 6(1)(f) EU GDPR. Those interests include operating an effective and fair alternative dispute resolution service, receiving and investigating complaints, communicating with the parties, considering relevant evidence, resolving complaints, maintaining appropriate case records, protecting our systems and services, and establishing, exercising or defending legal claims.
Before relying on legitimate interests, we consider whether the processing is necessary and balance our interests against the rights, freedoms and interests of the individuals concerned.
Other lawful bases
In particular circumstances, we may process personal data because it is necessary to comply with a legal obligation, because it is necessary to perform a contract with you, or because you have given consent for a specific optional purpose. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
We do not rely on consent as the general lawful basis for administering or deciding an ECRCS complaint.
6. How we use artificial intelligence and other technology
We may use approved artificial intelligence ("AI") and other technology tools to assist our staff in providing the ECRCS service. These tools may, for example, be used to help summarise or organise case information, identify relevant information within case materials, improve the clarity or structure of correspondence, prepare draft correspondence or case responses, and support other administrative or productivity tasks.
AI tools assist ECRCS staff. They do not make ECRCS adjudication or complaint decisions. |
An authorised member of ECRCS staff remains responsible for considering the relevant information and evidence, reaching or approving the outcome of a complaint, and reviewing any AI-assisted content before it is relied upon or communicated.
Where an AI tool processes personal data, we will use it only for a legitimate and appropriate purpose and will take reasonable steps to protect the confidentiality and security of the information. We seek to minimise the personal data provided to AI tools and require staff to use only AI and technology services approved for ECRCS work.
We may use third-party AI and technology providers acting as service providers to ECRCS. Where those providers process personal data on our behalf, we require appropriate data protection, confidentiality and security arrangements to be in place.
ECRCS does not use solely automated processing to make complaint or adjudication decisions that produce legal effects or similarly significantly affect an individual.
7. Who we share personal data with
We do not sell personal data.
Where necessary and permitted by law, we may share personal data with:
- the rental company or other participating organisation involved in a complaint;
- individuals or organisations whose involvement is reasonably necessary to investigate or resolve a complaint;
- IT, cloud hosting, email and communications providers;
- Microsoft, including in connection with Microsoft Dynamics 365 and Microsoft email and productivity services;
- approved AI and other technology service providers;
- professional advisers, including legal advisers and auditors;
- regulators, supervisory authorities and other competent authorities;
- law enforcement agencies, courts and tribunals; and
- other organisations where disclosure is required or permitted by law.
Where an organisation processes personal data on our behalf, we require appropriate contractual, confidentiality, security and data protection arrangements. We may also disclose personal data where necessary to prevent or investigate fraud, protect the rights or safety of ECRCS or others, comply with a legal obligation, or establish, exercise or defend legal claims.
8. International transfers of personal data
ECRCS uses cloud-based technology and other service providers to operate its services, including Microsoft Dynamics 365 and approved AI and technology services.
Personal data may be stored, accessed or otherwise processed outside the European Economic Area ("EEA") in certain circumstances, including where our service providers or their sub-processors operate internationally or where particular cloud or AI service functionality involves processing outside the EEA.
Where personal data is transferred outside the EEA and an appropriate safeguard is required, we will use a transfer mechanism permitted by applicable data protection law. This may include an adequacy decision, European Commission-approved Standard Contractual Clauses, or another lawful transfer mechanism. Where required, we will also consider whether additional safeguards are necessary.
You may contact us for further information about the safeguards applicable to international transfers of your personal data.
ECRCS is based in the United Kingdom and uses cloud-based technology and other service providers to operate its services. Personal data may therefore be transferred between the EEA, the United Kingdom and other countries.
9. How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, regulatory, accounting and reporting requirements and establishing, exercising or defending legal claims.
Where you register a complaint against an ECRCS participating member, personal data provided for that complaint will normally be retained for up to one year from the date of the complaint, unless there is a lawful reason to retain some or all of the information for longer.
We may retain information for longer where a complaint or dispute remains ongoing, litigation or another legal claim is underway or reasonably anticipated, a legal or regulatory requirement requires retention, or information needs to be retained in connection with fraud, security or safeguarding concerns.
At the end of the applicable retention period, personal data will be securely deleted or anonymised in accordance with our retention arrangements.
10. Call recordings
Incoming and outgoing telephone calls may be recorded. Where a call is recorded, we may collect a recording of the conversation, your telephone number, and information voluntarily provided during the call.
Call recordings may be used to monitor and improve service quality, support staff training, investigate and resolve complaints, establish what was discussed or agreed, address safeguarding concerns, and comply with legal or regulatory requirements.
Recordings are kept securely and confidentially. Our normal retention period for call recordings is no longer than 24 hours, unless a recording needs to be retained for an investigation, legal requirement, complaint, dispute, potential legal claim or safeguarding concern.
We may disclose information contained in a recording where required or permitted by law, including to law enforcement agencies, regulators or courts.
11. How we protect personal data
We take appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures include controls designed to restrict access to authorised individuals with a legitimate business need, protect information held within our IT systems, manage access provided to suppliers and service providers, maintain appropriate confidentiality obligations, and identify and respond to suspected personal data breaches.
Employees, contractors and service providers who process personal data on our behalf are required to handle it appropriately and subject to applicable confidentiality and data protection requirements.
While we take appropriate steps to protect personal data, transmission of information over the internet cannot be guaranteed to be completely secure. We maintain procedures for dealing with suspected personal data breaches and will notify affected individuals and relevant supervisory authorities where required by law.
12. Your data protection rights
Depending on the circumstances and applicable law, you may have the following rights:
Access: to ask whether we process your personal data and request a copy of the personal data we hold about you.
Rectification: to ask us to correct inaccurate personal data or complete information that is incomplete.
Erasure: to ask us to delete your personal data in certain circumstances.
Restriction: to ask us to restrict the way we process your personal data in certain circumstances.
Objection: where processing is based on legitimate interests, to object to that processing in certain circumstances.
Data portability: in certain circumstances, to receive personal data you provided to us in a structured, commonly used and machine-readable format and/or ask us to transfer it to another organisation.
Withdraw consent: where we rely on consent, to withdraw that consent at any time.
Automated decision-making: rights relating to certain decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
ECRCS does not use solely automated processing to make ECRCS complaint or adjudication decisions of this kind.
These rights are subject to conditions and exemptions under applicable data protection legislation and therefore will not apply in every circumstance. We may need to request information from you to confirm your identity before responding to a request. We will respond within the period required by applicable data protection law.
13. Complaints about our use of personal data
If you have concerns about how ECRCS processes your personal data, we encourage you to contact us first so that we can investigate your concerns.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO), www.ico.org.uk.
If the EU GDPR applies to the processing of your personal data, you may also have the right to lodge a complaint with the competent supervisory authority in an EU or EEA Member State, including the supervisory authority in the country where you live or work or where you consider an infringement of data protection law to have occurred. A list of EU/EEA supervisory authorities is available from the European Data Protection Board.
14. Cookies and website analytics
Our website may use cookies and similar technologies for purposes including operating the website, maintaining security, remembering preferences, understanding how visitors use the website, and improving website performance.
Where required by law, non-essential cookies and similar technologies will only be used with your consent. You can manage your preferences through the cookie controls available on our website. Further information about the cookies and analytics technologies currently in use is available through our website cookie information.
15. Children's personal data
The ECRCS service is not directed at children. If information concerning a child is provided as part of a complaint, we will process that information only where it is relevant and necessary and in accordance with applicable data protection law.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technology, processing activities or legal and regulatory requirements. The latest version will be published on our website.
Where a change materially affects how we use personal data, we will take reasonable steps to bring the change to the attention of affected individuals where required. The date on which this Privacy Policy was last updated is shown at the beginning of the policy.
17. Contact us
If you have questions about this Privacy Policy, wish to exercise your data protection rights or wish to make a complaint about our handling of personal data, please contact:
European Car Rental Conciliation Service (ECRCS)
River Lodge
Badminton Court
Amersham
HP7 0DD
United Kingdom
You may also contact ECRCS using the privacy or contact details published on www.ecrcs.com.