Smarter Car Hire Florida Privacy Policy
Effective date: 30th September 2026
This Privacy Policy explains how Direct Villas UK Limited (company number 06009413), trading as Smarter Car Hire Florida (“we”, “us”, “our”), collects and uses personal data when you use our website and when we provide our car hire booking and administration service.
We are committed to protecting your personal data in accordance with applicable data protection law. For customers in the UK, this includes the UK GDPR and the Data Protection Act 2018. For customers in the European Economic Area (EEA), this includes the EU General Data Protection Regulation (EU GDPR). Where this policy refers to 'GDPR', it means the UK GDPR and/or the EU GDPR as applicable to you.
1) Who we are (data controller) and how to contact us
Data controller: Direct Villas UK Limited (t/a Smarter Car Hire Florida)
Registered office: Newham House, Dudley Road, Darlington, DL1 4GG, United Kingdom
Email: [email protected]
Telephone: +44 (0)1325 808 123
Website: www.smartercarhireflorida.com
ICO registration number: Z3020380
We do not have a formally appointed Data Protection Officer (DPO). If you have questions or wish to exercise your rights, contact [email protected] with the subject line “Data Protection”.
2) Personal data we collect
We may collect the following categories of personal data:
A. Information you provide
When you request a quote, make a booking, or contact us, you may provide:
name and contact details (email address, telephone number, postal address);
booking details (pick-up/return locations, dates and times, vehicle preferences, flight number where relevant);
driver details needed to administer the booking (for example, age/date of birth and driving-licence related details);
the content of your communications with us.
B. Payment information
When you pay for a booking on our website, payment is taken by Direct Villas UK Limited and processed securely by Opayo. We do not store full card details (such as full card number or CVV) on our systems. We may keep payment references (e.g., transaction IDs) for reconciliation, fraud prevention and customer support.
C. Information collected automatically (website/device data)
When you use our website, we (and our technology providers) may collect:
IP address;
browser/device information;
pages viewed and actions taken;
cookie identifiers and similar online identifiers.
D. Information we receive from third parties
Bookings placed through this website are administered via Zest Car Rental (Economy Car Hire Ltd), for whom we act as agent. To confirm and administer your booking, we receive booking/reservation information and status updates from Zest Car Rental and/or the car hire provider supplying the vehicle.
3) How we use personal data (purposes)
We use personal data to:
provide quotes and process and administer bookings;
send booking-related communications (confirmations, payment requests, changes and important service messages);
provide customer support and handle complaints;
apply and administer automated price monitoring/price adjustment features where offered;
process and reconcile payments;
prevent fraud, misuse and security incidents;
maintain, protect and improve our website (including analytics and performance monitoring);
comply with legal obligations (including accounting and tax).
4) Lawful bases for processing
We rely on the following lawful bases under the UK GDPR and, for customers in the EEA, under the EU GDPR (the lawful bases are equivalent in both regimes):
Contract (Art 6(1)(b)) – to provide our booking and administration service and manage your booking.
Legal obligation (Art 6(1)(c)) – to meet legal and regulatory requirements.
Legitimate interests (Art 6(1)(f)) – to operate and improve our business, provide customer service, prevent fraud, and maintain website and network security (balanced against your rights).
Consent (Art 6(1)(a)) – where required, typically for non-essential cookies/trackers (see section 10).
5) Who we share personal data with
We act as an authorised booking agent for Zest Car Rental (Nelson House, Church Street, Dereham, Norfolk, NR19 1DJ).
Data Shared with Zest Car Rental: When you make a booking request on our website, we pass your personal and driver details (name, contact information, date of birth, flight numbers, and rental preferences) to Zest Car Rental so they can place, process, and fulfill the vehicle reservation.
Data Received from Zest Car Rental: Zest Car Rental shares booking references, confirmation numbers, and reservation status updates back with us so we can track bookings, manage customer service, and administer your reservation.
Car Hire Suppliers (Florida, USA): Zest Car Rental transmits necessary driver details to the underlying vehicle rental operator in Florida (e.g., Hertz, Dollar, Thrifty, Alamo, Enterprise, National, and SIXT) so they can execute the rental agreement at pickup.
Payment Processors: Payments are processed securely by Opayo on behalf of Direct Villas UK Limited. We do not pass credit or debit card details to Zest Car Rental or US car rental providers, nor do they share card details with us.
IT & Infrastructure Vendors: Microsoft Azure (UK hosting), Google Analytics 4, and Meta (where enabled via cookie consent).
We do not sell your personal data to third parties. Zest is an independent data controller for the personal data it processes for its own purposes" and Zest's DPO contact "[email protected]
6) International transfers
Initial collection and processing of your personal data takes place in the United Kingdom via our UK hosting infrastructure (Microsoft Azure UK) and our arrangement with Zest Car Rental (a UK-based entity).
To fulfill your vehicle booking in Florida, United States, booking information must be transferred out of the UK/EU to car hire operators in the USA. This international transfer is facilitated through Zest Car Rental and governed under Chapter V of the UK GDPR and EU GDPR using approved legal safeguards, including:
Data Privacy Framework (DPF) / UK Extension: Where US rental operators are self-certified under the UK Extension to the EU-US Data Privacy Framework.
Standard Contractual Clauses (SCCs) / UK IDTA: Approved transfer agreements providing mandatory data protection safeguards.
Contractual Necessity (Article 49(1)(b)): Where transferring your driver details to the US rental supplier is strictly necessary to perform the booking contract and secure your vehicle pickup.
US rentals: where your booking involves a rental in the United States, personal data may be processed in the USA to fulfil your booking.
Bookings via Zest: your booking is placed with and administered by Zest Car Rental (UK) in its capacity as principal car hire booking provider, with Smarter Car Hire Florida acting as Zest's agent. Where your rental is supplied outside the UK, Zest shares the necessary booking data with the relevant car hire provider , as Zest's privacy policy explains, this may involve transfers outside the EEA. Zest's privacy policy: https://www.zestcarrental.com/privacy/
Where personal data is transferred outside the UK or the EEA by our technology vendors (for example analytics, advertising or security providers), we will ensure appropriate safeguards are in place as required by the UK GDPR and/or EU GDPR (such as adequacy decisions, the UK IDTA / UK Addendum, and/or the EU Standard Contractual Clauses).
7) Data retention
We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:
Booking and transaction records: Retained for 6 to 7 years following the end of the booking to comply with statutory accounting, tax, and legal liability obligations (aligning with our master broker, Zest Car Rental).
Customer support correspondence: Retained for up to 6 years after closure.
Marketing consent records: Retained until you withdraw consent or opt out.
Call recordings: retained for 12 months, unless required longer to deal with a dispute, complaint, fraud issue or legal obligation.
Cookie/analytics data: retained according to relevant tool settings.
8) Call recording
We may record telephone calls for training, quality assurance, compliance, and dispute handling. Where required, we will provide an appropriate notice at the start of the call.
9) Your rights
You have rights under UK data protection law and, if you are located in the EEA, under the EU GDPR. These include access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent where we rely on consent. The rights available to you (and how they apply) may depend on where you are located.
To exercise your rights, contact [email protected].
Complaints: You have the right to complain to the ICO: https://ico.org.uk/ (telephone 0303 123 1113). We would appreciate the opportunity to address your concerns first, so please contact us in the first instance.
If you are located in the EEA, you also have the right to lodge a complaint with the supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement. A list of EEA supervisory authorities is available at https://www.edpb.europa.eu/our-work-tools/general-contacts/supervisory-authorities
10) Cookies, analytics, advertising technologies and site security (PECR)
Our website uses cookies and similar technologies.
Strictly necessary cookies are required for the website to function and to help keep it secure.
Non-essential cookies/trackers (including analytics and advertising technologies such as Google Analytics 4, Google Tag Manager, and Meta Pixel/Meta Conversions API) require consent under UK privacy rules.
At present, you can control cookies through your browser settings. We are implementing a cookie consent solution so that non-essential cookies/trackers are only used where you have provided consent.
We also use security and anti-bot measures such as Google reCAPTCHA and Cloudflare, which may process device and usage information (including IP address and browser/device characteristics) to protect the website and prevent fraud/abuse.
For more information, please see our Cookie Policy: [insert link].
11) Security
We use appropriate technical and organisational measures designed to protect personal data, including access controls and secure hosting. No method of transmission or storage is completely secure, but we work to protect your information.
12) Direct marketing
We do not send general newsletters or promotional email marketing as a routine service. We will send service communications necessary to administer your booking.
13) Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post any updated version on our website and update the effective date. Where changes are material, we will take appropriate steps to bring them to your attention, which may include notifying you by email where we hold your contact details. This policy was last updated on 30th September 2026