Privacy Policy
We take the protection of your personal data very seriously. This privacy policy explains what personal data we process when you use our website and services, for what purposes, and what rights you have under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
Last updated: July 20, 2026
Controller
The controller responsible for processing your personal data on this website is:
KTT Khalawi Transport & Trade GmbH
Parkring 12A/17, 1010 Vienna, Austria
For any questions regarding the protection of your data, please use the contact details above.
Scope & General Information
This policy applies to our website and the booking of car rentals and tours offered through it. Personal data is any information relating to an identified or identifiable natural person, such as your name, contact details or booking information.
Hosting & Database
This website (frontend) is served via the edge network of Vercel Inc. (440 N Baxter Ave, San Francisco, CA 94107, USA). For visitors from Austria, the primary server location is Frankfurt am Main, Germany (region eu-central-1). A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel. Further information: vercel.com/legal/privacy-policy.
Application and booking data is stored in a database operated by our database provider, which processes this data on our behalf as a processor under Art. 28 GDPR on secured servers. Where a provider processes data outside the EU/EEA, appropriate safeguards such as the EU Standard Contractual Clauses are in place.
Data We Process
Depending on how you use our services, we process the following categories of personal data:
- Booking & contract data: first and last name, email address, phone number, postal address, driving licence and identity document details, rental or travel dates, and payment information.
- Communication data: the content of messages you send us via email, contact links, WhatsApp or social media.
- Technical data: server log files including IP address, browser type, and the date and time of access, transmitted automatically by your browser.
- Cart data: the items you add to your cart, which are stored locally in your browser (local storage) and are not transmitted to us until you complete a booking.
Purposes & Legal Bases
We process your personal data on the following legal bases under Art. 6 GDPR:
- To prepare, conclude and perform your rental or tour booking and to process payments — Art. 6(1)(b) GDPR (performance of a contract).
- To comply with legal obligations, in particular accounting and tax retention duties — Art. 6(1)(c) GDPR.
- To operate, secure and improve our website and to respond to your enquiries — Art. 6(1)(f) GDPR (legitimate interests).
- Where we ask for your consent (e.g. optional communications), processing is based on Art. 6(1)(a) GDPR, which you may withdraw at any time.
Cookies & Local Storage
We only use cookies and browser local storage that are technically necessary to operate the website. We do not use tracking or advertising cookies and do not create user profiles. Specifically, we use:
- Language preference (NEXT_LOCALE cookie): stores your selected language so the site is displayed correctly on your next visit.
- Shopping cart (local storage): keeps the items you add to your cart in your browser; this data is only transmitted to us when you complete a booking.
- Session (authentication cookies): set only if you sign in to the administration area, to keep you logged in. These are not used for regular website visitors.
As these are strictly necessary for the requested service, they are based on § 165(3) of the Austrian Telecommunications Act 2021 (TKG) and our legitimate interest (Art. 6(1)(f) GDPR), and do not require consent.
You can delete or block cookies and local storage at any time via your browser settings; the website may then no longer function fully.
Payment Processing
Online payments are processed by Stripe (Stripe Payments Europe, Ltd.). When you pay online, your payment details are transmitted directly to Stripe; we do not store your full card details. Stripe processes this data in accordance with its own privacy policy. Legal basis: Art. 6(1)(b) GDPR.
Recipients & Third Parties
We only share your personal data where necessary to provide our services: with our hosting and database providers, our payment provider, and — to process and confirm your booking — via secure messaging services (such as Telegram or WhatsApp) used by our team. We do not sell your personal data. Disclosure to public authorities takes place only where we are legally obliged to do so.
International Data Transfers
Some of our service providers may process data in countries outside the EU/EEA (e.g. the United States). In such cases we ensure an adequate level of protection through appropriate safeguards, in particular the EU Standard Contractual Clauses pursuant to Art. 46 GDPR.
Data Retention
We store your personal data only for as long as necessary for the purposes described above. Booking and invoice data is retained for the statutory retention period of seven years under Austrian accounting and tax law (§ 132 BAO). Data that is no longer required is deleted or anonymised.
Your Rights
Under the GDPR you have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
To exercise your rights, please contact us using the details in the Controller section above.
Right to Lodge a Complaint
If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria — dsb.gv.at.