Privacy policy

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and describes how we process the personal data of people who visit bvan.it, ask for information or rent a Bvan vehicle. In case of differences between language versions, the Italian text prevails.

1. Data controller

The data controller is B-Action Srl, trading as Bvan, with registered office at Via Paolo Galleri 5, 07100 Sassari, Italy, VAT no. 02711440905.

For any request about personal data you can write to info@bvan.it, call +39 393 331 3788 or send a letter to the operating office at Via Giuseppe Garibaldi 87, 07041 Alghero (SS), Italy. Certified email (PEC): baction@pec.it.

2. Personal data we process

We process the following categories of data:

• identification and contact details: first name, surname, date of birth, home address, telephone number, email address;
• driving licence and identity document details of the customer and of any additional drivers;
• booking and rental details: dates, times, pick-up and return locations, vehicle, additional services and, if provided by the customer, arrival and departure flight or ferry details;
• payment and invoicing details; payment card data is processed by the payment service provider Stripe;
• location and usage data of the rented vehicle, as described in section 4;
• data about accidents, damage, theft, fines, tolls and parking relating to the rental period;
• browsing data, as described in section 10;
• data contained in requests sent through the form on the Contact page, by email, telephone, WhatsApp or other contact channels.

The data is provided directly by the person concerned or, for additional drivers and bookings made by third parties, by the person making the booking, who guarantees they are entitled to do so.

3. Purposes and legal bases

The data is processed for the following purposes:

• to handle requests for information and quotes, on the basis of pre-contractual steps taken at the person's request (Art. 6(1)(b) GDPR);
• to conclude and perform the rental contract, including booking, delivery and return of the vehicle, payments and assistance, on the basis of performance of the contract (Art. 6(1)(b) GDPR);
• to comply with legal obligations on tax, accounting, public security and road traffic, including communicating the driver's details to the authorities that establish traffic offences (Art. 6(1)(c) GDPR);
• to protect company assets, prevent and establish theft, fraud and damage, manage claims and recover debts, on the basis of the controller's legitimate interest (Art. 6(1)(f) GDPR);
• to establish, exercise or defend a legal claim, in or out of court, on the basis of the controller's legitimate interest (Art. 6(1)(f) GDPR);
• to ensure the security and proper functioning of the site, on the basis of the controller's legitimate interest (Art. 6(1)(f) GDPR).

The data is not used to send marketing communications, unless the person has given specific consent, which can be withdrawn at any time.

4. Vehicle location

Vehicles may be fitted with satellite systems and remote control devices. These systems record the position of the vehicle and events attributable to impacts, lifting or accidents.

The data is processed to protect the vehicle against theft and misappropriation, to reconstruct how accidents happened and to recover the vehicle if it is not returned. It is not used to monitor the customer's movements systematically.

Location data is kept for 3 months, unless it is needed to manage an accident, a theft or a dispute.

5. Whether providing data is required

Providing identification, driving licence, identity document and payment data is necessary to conclude and perform the rental contract: without it we cannot proceed with the booking or hand over the vehicle.

Providing flight or ferry details and other optional data is voluntary and only helps us organise the handover better.

6. Recipients of the data

The data may be disclosed, to the extent necessary, to the following categories of recipients:

• the provider of the booking and rental management platform (HQ Rental Software), acting as data processor;
• the payment service provider (Stripe) and banks;
• the provider of website hosting and email services (OVH);
• insurance companies, loss adjusters, garages, body shops and roadside assistance companies;
• public security authorities, judicial authorities, enforcement bodies and collection agents, for offences and tolls relating to the rental period;
• tax and legal advisers, debt collection companies;
• the controller's staff authorised to process the data.

The data is not disseminated or sold to third parties.

7. Transfers outside the European Economic Area

Booking data is hosted on servers located in the European Union. If a provider processes data in countries outside the European Economic Area, the transfer takes place in compliance with Articles 44 et seq. of the GDPR, on the basis of an adequacy decision of the European Commission or standard contractual clauses.

8. Retention period

The data is kept for the time needed for the purposes for which it was collected, and in particular:

• contractual, accounting and tax data for 10 years from the end of the rental, as required by civil and tax law;
• copies of the driving licence and identity document for the duration of the rental and, afterwards, for the time needed to manage fines, accidents and disputes;
• data about accidents, damage and fines until the matter is settled and the related rights are time-barred;
• requests for information and quotes not followed by a rental for 12 months;
• browsing data for the periods stated in section 10.

After these periods the data is deleted or anonymised.

9. Your rights

You can exercise at any time the rights provided by Articles 15 to 22 of the GDPR, and in particular:

• obtain confirmation that data about you is being processed and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have the data erased or the processing restricted, in the cases provided by law;
• object to processing based on the controller's legitimate interest;
• receive the data in a structured, commonly used format and transmit it to another controller;
• withdraw any consent given, without affecting the lawfulness of processing carried out before the withdrawal.

Requests should be sent to info@bvan.it. The controller replies within one month of receipt; this period can be extended in the cases provided by the GDPR.

You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State where you live or work.

10. Browsing data and cookies

While you browse, the site's systems acquire some technical data, such as IP address, browser type and pages requested, which is needed for the site to work and stay secure. This data is kept for a maximum of 12 months and is not used to identify visitors.

The site does not use profiling cookies or third-party analytics tools. Any visit statistics are obtained in aggregate form from the server logs.

The form on the Contact page sends the controller, by email, the name, email address and message entered; the site keeps no copy.

Online booking takes place on an external platform provided by HQ Rental Software (address b-action.bvan.it), which uses technical session cookies needed to complete the booking. During payment, the provider Stripe may use its own cookies for security and fraud prevention.

The videos on the site are hosted on YouTube. A video is loaded only when the visitor starts it with a click, in the YouTube mode that limits the use of cookies; from that moment Google's privacy policy applies.

The site's virtual assistant, when active, answers visitors' questions through an artificial intelligence service provided by Anthropic. Questions typed into the assistant are sent to that provider solely to generate the answer and may be processed on servers located outside the European Economic Area, in compliance with section 7. The site does not store conversations. Please do not enter personal data in the assistant.

11. Automated decision-making

The controller does not take decisions based solely on automated processing, including profiling, that produce legal effects on the person concerned.

12. Changes to this notice

This notice may be updated. The version in force is the one published on this page, with the date of the last update: 12 November 2026.