In short. We collect only what is needed to place a vehicle where you asked for it, keep that vehicle and its driver accountable, and meet Pakistani transport and tax obligations. We do not sell your personal data, we do not share it with data brokers, and we do not use it for advertising profiles.
You can ask us to delete your account and associated data at any time using the routes in section 11.
01 Who we are and what this covers
M/S CAR RENT (“M/S CAR RENT”, “we”, “us”, “our”) is a vehicle rental and ground mobility operator based in Islamabad, Pakistan. We are the data controller responsible for the personal data described in this policy.
This policy applies to the M/S CAR RENT mobile application distributed through Google Play, this website, and the booking, dispatch and customer-support services connected to them. It does not apply to any third-party website or service you reach through a link from our app or site — those operate under their own privacy policies.
Registered address: House No. 1, Islamabad, 44000, Pakistan.
Contact number: +92 300 854 2716.
02 Data safety summary
The table below mirrors the Data Safety declaration shown on our Google Play listing. Each row states what is handled, whether it is required to use the service, and why we handle it.
| Data type | Collected | Shared | Purpose |
|---|---|---|---|
| Name and phone number | Required | With assigned driver | Account creation, booking confirmation, driver–customer contact |
| Email address | Optional | Not shared | Receipts, booking records, corporate invoicing |
| Identity documents | Self-drive only | With insurer and authorities where legally required | Licence verification, rental agreement, fraud prevention |
| Approximate and precise location | Required in app | With assigned driver during an active booking | Pickup positioning, live dispatch, route and trip records |
| Payment information | Required | With payment processor | Charging the rental, refunds, deposits and settlement |
| Photos and files | Optional | Not shared | Document upload and joint vehicle condition scans |
| App activity and diagnostics | Required | With analytics and crash reporting providers | Stability, abuse prevention and service improvement |
| Device identifiers | Required | With analytics providers | Session security, fraud detection and push delivery |
We never sell your data
M/S CAR RENT does not sell, rent or trade personal data, and does not share it with data brokers or advertising networks for the purpose of building marketing profiles.
03 Data we collect
Data you provide to us
- Account details — full name, phone number and, if you choose to add one, an email address.
- Booking details — pickup and drop-off points, dates and times, plan type, vehicle class, passenger and luggage counts, flight number for airport transfers, and any notes you write for our dispatch desk.
- Verification documents — for self-drive rentals we require a valid driving licence and a CNIC or passport. For corporate accounts we collect the authorised signatory's details and company registration information.
- Payment details — the payment method used to settle a rental, deposit or damage claim. Full card numbers are entered directly with our payment processor; we retain only a masked reference and the transaction record.
- Support communications — records of calls, messages and complaints handled by our dispatch desk, including any recordings where we tell you a call is being recorded.
Data collected automatically
- Location data — approximate location when the app is open, and precise location during an active booking so a vehicle can be positioned and a trip can be logged. Background location is used only while a booking is live and only if you have granted that permission.
- Device and diagnostic data — device model, operating system version, app version, language, crash logs, and performance traces.
- Identifiers — an app instance identifier and a push notification token used to deliver booking updates.
- Usage data — screens opened, features used, searches for vehicle classes and bookings started or abandoned.
- Trip telemetry — for vehicles fitted with tracking units, we record route, distance, and start and end times of each rental. This is tied to the rental agreement, not to your device.
Data we do not collect
We do not collect health data, biometric identifiers, religious or political affiliation, contacts, SMS content, call logs, browsing history outside our own app, or audio from your microphone.
04 How we use your data
- Delivering the service — creating your account, confirming bookings, dispatching a vehicle and driver to your location, and handling handover and return.
- Airport transfers — matching your booking against the flight number you supply so the driver reaches the kerb at the actual arrival time.
- Payments — charging rentals, holding and releasing deposits, issuing receipts and processing refunds.
- Safety and accountability — verifying that a self-drive customer holds a valid licence, investigating incidents, damage, traffic violations and fuel discrepancies.
- Fraud and abuse prevention — detecting duplicate accounts, stolen payment instruments and misuse of vehicles.
- Service communications — booking confirmations, driver assignment, arrival alerts, changes and cancellations. These are operational messages and are not marketing.
- Improving the platform — aggregate analysis of demand by node, dispatch times and crash reports so we can fix defects and position vehicles better.
- Legal compliance — meeting Pakistani transport, taxation, insurance and law-enforcement obligations.
We do not use your personal data to build advertising profiles, and we do not make decisions producing legal effects about you by automated means alone.
05 Consent and legal basis
We process personal data on the following grounds: performance of the rental contract you enter with us; compliance with legal obligations that apply to vehicle rental operators in Pakistan; our legitimate interest in operating a safe and solvent fleet; and your consent where consent is the appropriate basis — for example, granting location or camera access, or opting in to optional communications.
Where processing rests on consent, you may withdraw it at any time in your device settings or by contacting us. Withdrawing consent does not affect processing already carried out, and some features — such as live dispatch to your position — cannot function without the related permission.
06 App permissions and why we request them
The M/S CAR RENT Android app requests only the permissions listed below. Each is requested in context, at the moment the related feature is used, and each may be refused or later revoked in your device settings.
| Permission | Why we request it | If you refuse |
|---|---|---|
| Location (approximate & precise) | Setting a pickup point, positioning the nearest idle vehicle and logging trip start and end | You can still book by typing an address manually |
| Location (in use / background) | Live arrival tracking during an active booking only; it stops when the booking ends | Live tracking is unavailable; bookings still work |
| Camera | Photographing a licence, CNIC or passport, and recording joint vehicle condition scans | Documents can be handed over in person at pickup |
| Photos and media | Uploading an existing document image or damage photo from your gallery | Use the camera instead, or submit documents in person |
| Notifications | Driver assignment, arrival and return reminders, and booking changes | You receive updates by phone call instead |
| Phone | Placing a call to the dispatch desk or assigned driver from within the app | Dial +92 300 854 2716 directly |
| Network state | Detecting connectivity so a booking is not submitted twice on a weak signal | Not applicable — required for the app to function |
07 How we share your data
We share personal data only in these circumstances:
- With your assigned driver — your first name, phone number and pickup and drop locations, for the duration of the booking only.
- With service providers — payment processing, cloud hosting, mapping, crash reporting and analytics, each bound by contract to process data only on our instructions.
- With insurers — where an incident, damage or theft claim is raised against a rental agreement.
- With corporate account holders — if you travel on a corporate account, the account administrator sees trips booked against their cost centres, including route, timing and cost.
- With authorities — where we are required by Pakistani law, a valid court order, or a lawful request from police or transport authorities, including traffic violations recorded against a vehicle you rented.
- In a business transfer — if M/S CAR RENT is merged with or acquired by another entity, data may transfer as part of that transaction; you would be notified before it becomes subject to a different policy.
08 Third-party services
Our app and website rely on a small number of external providers. Their processing is governed by their own privacy policies in addition to this one:
- Cloud hosting and databases — storage of accounts, bookings and trip records.
- Mapping and geocoding — converting addresses to coordinates and drawing routes.
- Payment gateway — card and wallet authorisation; card numbers are entered directly with the gateway.
- Crash reporting and analytics — diagnostic data used to fix defects and measure feature usage.
- Push notification delivery — sending booking updates to your device.
- Google Play — app distribution, licensing and update delivery.
We keep this list current. If we add a provider that materially changes how your data is handled, we will update this policy and, where required, ask for your consent.
09 How we protect your data
- All traffic between the app, the website and our servers is encrypted in transit using TLS.
- Identity documents are stored encrypted at rest and are visible only to staff performing verification.
- Access to customer records is role-based and logged; dispatch staff see only what a live booking requires.
- Payment card numbers are never stored on our servers — the payment gateway returns a masked reference only.
- Session tokens expire and can be revoked centrally if a device is lost.
No system is perfectly secure. If a breach affects your personal data, we will notify affected users and the relevant authorities without undue delay, describing what happened and what you should do.
10 How long we keep data
| Record | Retention period | Reason |
|---|---|---|
| Account profile | While the account is active | Providing the service |
| Booking and trip records | 5 years after the rental ends | Tax, audit and dispute resolution |
| Identity and licence documents | 2 years after the last rental | Insurance and transport compliance |
| Payment transaction records | 5 years | Financial reporting obligations |
| Precise location traces | 90 days | Incident review and billing disputes |
| Crash and diagnostic logs | 12 months | Stability and defect analysis |
| Support call recordings | 6 months | Quality assurance and complaint handling |
When a retention period ends, records are deleted or irreversibly anonymised. Anonymised and aggregated figures — such as average dispatch time per node — may be kept indefinitely because they no longer identify anyone.
11 Account and data deletion
You may delete your M/S CAR RENT account and the personal data attached to it at any time. There are three routes, and all three reach the same team:
- In the app — open Profile → Account settings → Delete account, then confirm. The request is queued immediately.
- By phone — call +92 300 854 2716 and ask for account deletion. We will verify your identity against the phone number registered to the account.
- By post — write to M/S CAR RENT, House No. 1, Islamabad, 44000, Pakistan, stating the phone number registered to your account.
What happens after a deletion request
- Your profile, saved addresses, uploaded documents, device identifiers and push tokens are deleted within 30 days.
- Precise location traces attached to your account are deleted in the same window.
- Booking, invoice and payment records are retained for the periods set out in section 10, because Pakistani tax and transport rules require it. These are held in a restricted archive and are not used for any other purpose.
- Any open rental, unpaid balance, damage claim or traffic violation must be settled before deletion completes; we will tell you if that applies to your account.
Deleting the app is not the same as deleting your data
Uninstalling removes the app from your device but leaves your account on our servers. Use one of the three routes above to have the account itself deleted.
12 Your rights and choices
- Access — request a copy of the personal data we hold about you.
- Correction — have inaccurate details fixed, either in the app or by calling the dispatch desk.
- Deletion — as described in section 11.
- Restriction and objection — ask us to pause processing while a dispute over accuracy or legitimate interest is resolved.
- Portability — receive your booking history in a structured, machine-readable file.
- Withdraw consent — revoke location, camera, photo or notification permissions in your device settings at any time.
- Complain — raise a concern with us first on +92 300 854 2716; you may also approach the competent data protection or consumer authority in Pakistan.
We respond to rights requests within 30 days. We may ask you to verify your identity against the phone number registered to the account before acting, to prevent someone else obtaining or erasing your records.
13 Children's privacy
M/S CAR RENT is not directed to children. Our services are available only to individuals aged 18 or over, and self-drive rentals additionally require a valid driving licence. We do not knowingly collect personal data from anyone under 18.
If we learn that we hold data belonging to a child, we delete it promptly. A parent or guardian who believes a child has provided us with personal data should call +92 300 854 2716 so we can remove it.
14 International data transfers
We operate in Pakistan, but some of our service providers — cloud hosting, analytics, crash reporting and push delivery — process data on servers outside Pakistan. Where that happens, we require the provider to apply protections consistent with this policy and to process the data only for the purposes we have specified.
15 Cookies and website analytics
This website uses only what is needed to serve the pages you request. We do not set advertising cookies, we do not run cross-site trackers, and we do not embed social media widgets.
Fonts and images on this site are served from third-party content networks, which necessarily receive your IP address and browser user-agent in order to deliver the file. If we later introduce analytics on the website, this section will be updated before it is switched on.
16 Changes to this policy
We may update this policy as the service, the law or our providers change. The effective date at the top of this page always reflects the current version.
For material changes — a new category of data, a new sharing recipient, or a new purpose — we will give notice in the app before the change takes effect and, where the law requires it, ask for your consent again. Continuing to use the app or website after an update takes effect means you accept the revised policy.
17 Contact us
For any question about this policy, a data request, or a privacy concern, contact our dispatch desk and ask for the data protection contact.
Islamabad, 44000
Pakistan