Privacy Policy

Last updated: September 20, 2026

1. Who we are

QiraPro is an online marketplace for car rental in Kosovo. Through our website at qirapro.com and our mobile app, you can search cars offered by independent rental companies, send a booking request, and message the company directly.

This Privacy Policy explains what personal data we collect about you, why we collect it, who we share it with, and what rights you have over it.

The controller of your personal data is:

  • [REGISTERED COMPANY NAME], [LEGAL FORM]
  • Business registration number: [BUSINESS NUMBER / NUI]
  • Registered address: [REGISTERED ADDRESS]
  • Email for privacy questions: [PRIVACY CONTACT EMAIL]
  • General contact: [CONTACT EMAIL] — [PHONE NUMBER]

In this policy, "QiraPro", "we", "us" and "our" mean the company above. "You" means anyone who uses our website or app.

2. Our role, and the rental company's role

QiraPro is an intermediary. We run the platform where rental companies list their cars and where you send booking requests. We do not own, rent out or operate any vehicle, and we do not take payment from you.

This matters for your data, because two separate organisations handle it:

  • We are the controller of your QiraPro account, your use of the platform, the messages you send through it, and the booking records held on it.
  • The rental company is a separate, independent controller for everything it does with your data once you book with it — preparing and signing the rental contract, checking your driving licence, its own invoicing and bookkeeping, insurance claims, and any legal obligation it has as a vehicle rental business. Its own privacy policy applies to that, not ours. If you want to know how a particular company handles your data, ask that company.

We pass your data to a rental company only when you choose to deal with it — by sending a booking request or by opening a message thread with it.

3. What we collect, and why

Information you give us when you create an account

  • Full name and email address — required to open an account, to identify you to a rental company you book with, and to send you account and booking emails.
  • Password — stored only as a cryptographic hash. We never store it in readable form and we cannot recover it for you; we can only send you a link to set a new one.
  • Phone number (optional) — so a rental company can reach you about your booking.
  • Driving licence number (optional) — so the rental company can prepare your rental in advance. You do not have to provide it to use the platform.
  • Language preference — so that our emails to you are written in the language you chose.

If you sign in with Google

If you use "Sign in with Google" in our mobile app, Google sends us a signed token containing your Google account identifier, your email address, your name, and whether Google has verified that email address. We use it to create or open your QiraPro account. We never receive your Google password. Your Google account identifier is stored so we can recognise you next time; it is never shown in our app or returned by our API. Google's own privacy policy governs what Google does with your data.

Information created when you use the platform

  • Bookings — the car, the rental company, the pickup location, the rental dates, the add-ons you chose, the total price, any deposit, the payment method, the booking status, and the fact that you accepted our Terms of Service, together with the version you accepted and the time you accepted it.
  • Messages — the content of the messages you exchange with rental companies and with QiraPro support through the platform, and whether they have been read.
  • Reviews — your rating and any comment you write after a completed rental. Reviews are shown publicly on the car's page and on the rental company's page, together with your name.
  • Saved cars and companies — the favourites you mark, so you can find them again.
  • Notifications — the in-app notifications we generate for you and whether you have read them.
  • Your email preferences — whether you want to receive an email about new messages and about offers.

Information we collect automatically

  • Session data. When you sign in, we create a session and record the session identifier, the IP address and the browser or device description (user agent) the sign-in came from, when it was created, and when it was last used. You can see your active sessions in your account settings and end any of them. We keep this to keep you signed in, to show you where your account is signed in, and to detect and investigate abuse of an account.
  • Server logs. Our servers and our hosting providers record technical information about requests — such as IP address, time, the page or endpoint requested, and error details — for security, abuse prevention and diagnosing faults.
  • Push notification token (mobile app only). If you allow notifications, the app registers a push token with us, together with whether the device is Android or iOS, so we can send you a notification about a booking or a new message. Removing the app or signing out removes the token.

We do not use analytics, advertising, tracking pixels, profiling or automated decision-making that produces legal effects for you. We do not sell your personal data, and we do not share it with advertisers.

If you contact us without an account

If you use the contact form on our website, we receive your name, email address, phone number (if you give one), the reason for your message and the message itself, so that we — or the rental company you addressed — can reply.

4. Why we are allowed to use your data

Under the Law on Protection of Personal Data of the Republic of Kosovo (and, where it applies to you, the EU General Data Protection Regulation), we rely on the following legal bases:

  • Performance of a contract with you — creating and running your account, handling your booking requests, passing them to the rental company, delivering your messages, and sending you the transactional emails that go with them (verification, password reset, booking confirmed, booking cancelled).
  • Our legitimate interests — keeping the platform secure and available, preventing fraud and abuse, keeping records of bookings and of accepted terms so that a dispute can be resolved, improving the service, and replying to your enquiries. We only rely on this where your rights and interests do not override it.
  • Your consent — for optional emails about offers, for push notifications on your device, and for any data you choose to give us that is not required (your phone number, your driving licence number). You can withdraw consent at any time; withdrawing it does not affect what we did with it before.
  • Compliance with a legal obligation — where the law requires us to keep or disclose data, for example in response to a lawful request from a competent authority.

5. Who we share your data with

Rental companies. When you send a booking request, the rental company receives your name, your email address, your phone number and driving licence number if you provided them, and the details of the booking. When you message a company, it sees your name and your messages. A company only ever sees data relating to its own cars, bookings and conversations.

Our service providers. These are companies that process data on our instructions, under a contract, only to provide us with a service:

  • Hosting and database — our servers and database run on a cloud hosting provider.
  • Website delivery and security — our website is served through a global content delivery and security network.
  • Object storage — car photographs and company logos are stored with an S3-compatible storage provider.
  • Email delivery — our transactional and notification emails are sent through an email delivery provider, which processes your email address and the content of the message.
  • Push notification delivery (mobile app) — push messages are delivered through the Expo push service and then through Apple's or Google's notification service to reach your device.
  • Sign-in with Google (mobile app, optional) — used only if you choose it.

Authorities and legal claims. We may disclose data where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim.

A business transfer. If our business is sold or reorganised, data may transfer to the new owner, who would remain bound by this policy until you are told otherwise.

6. Where your data is stored

Our providers may store and process data on servers inside and outside Kosovo, including in the European Union and the United States. Where data leaves Kosovo or the European Economic Area, we rely on the safeguards permitted by data protection law — such as standard contractual clauses or an adequacy decision — to make sure it stays protected to the same standard. You can ask us for details of the safeguards that apply.

7. How long we keep it

  • Your account and profile — for as long as your account exists.
  • Sessions — a session expires 30 days after it was last used, and expired sessions are deleted automatically every day. Signing out deletes that session immediately.
  • Password reset and email verification links — until they expire or are used, and then for a further seven days so that we can still tell you a link has already been used. They are then deleted automatically.
  • Bookings, and the record that you accepted our terms — kept after the rental ends, because they are the record of an agreement and may be needed for accounting, a complaint or a legal claim. We keep them for [RETENTION PERIOD FOR BOOKINGS, e.g. 6 years] and then delete or anonymise them.
  • Messages — kept while your account exists, so that both you and the rental company keep the history of what was agreed.
  • Reviews — kept while published. If you delete your account, we may keep the rating and comment in anonymised form, because removing it would distort a company's public rating.
  • Contact enquiries — [RETENTION PERIOD FOR ENQUIRIES, e.g. 2 years] after the enquiry is closed.
  • Push tokens — until you sign out, uninstall the app, or the notification service tells us the token is no longer valid.
  • Server logs — [RETENTION PERIOD FOR LOGS, e.g. 12 months].

If a super administrator suspends an account for abuse, this locks the account and signs it out everywhere; it is not a deletion. The records stay under the retention periods above.

8. Your rights

You have the right to:

  • Access — ask whether we hold data about you and get a copy of it.
  • Rectification — have inaccurate data corrected, and incomplete data completed. You can correct most of it yourself in your account settings.
  • Erasure — ask us to delete your data, where there is no overriding reason for us to keep it (see the retention periods above).
  • Restriction — ask us to stop using your data while a dispute about it is resolved.
  • Object — object to our use of your data where we rely on legitimate interests.
  • Portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible.
  • Withdraw consent — at any time, for anything we do on the basis of your consent.
  • Not be subject to marketing you did not ask for — see section 9.

To exercise any of these, write to [PRIVACY CONTACT EMAIL] from the email address on your account. We will answer within 30 days. We may need to confirm your identity first. Exercising your rights is free, unless a request is clearly unfounded or excessive.

If you believe we have handled your data unlawfully, you may complain to the Information and Privacy Agency of the Republic of Kosovo (Agjencia për Informim dhe Privatësi). If you are in the European Union, you may also complain to the supervisory authority in the country where you live.

9. Emails and notifications you can switch off

Some emails are part of the service and cannot be switched off while you have an account: confirming your email address, resetting your password, and telling you that a booking was created, confirmed or cancelled.

Two kinds are optional, and you control them in your account settings:

  • an email when you receive a new message on the platform;
  • an email when a rental company you have saved publishes an offer.

Offer emails also carry an unsubscribe link, and an unsubscribe button in email clients that support one. You can use either without signing in; both switch off offer emails only. The link works because it carries a random token unique to your account, which we only ever put in emails addressed to you and never disclose through our API.

Push notifications on your phone are controlled by your device settings and by the permission you grant the app. You can withdraw that permission at any time.

10. Security

We protect your data with measures including: encryption in transit (HTTPS) across the website, the app and our API; passwords stored only as hashes; session cookies that scripts on the page cannot read, sent only over HTTPS in production; session identifiers stored in your device's secure storage in the mobile app; access to production data limited to the people who need it; rate limiting on sign-in, registration and password-reset endpoints; and separate, independent sign-in systems for customers and for staff.

No system is completely secure. Please use a password you do not use anywhere else, and tell us at [PRIVACY CONTACT EMAIL] if you think someone else has access to your account.

11. Children

QiraPro is not intended for children. You must be at least 18 years old to create an account and to book a car. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to [PRIVACY CONTACT EMAIL] and we will delete it.

12. Cookies

Our website uses only the cookies it needs to work — there are no analytics, advertising or tracking cookies. Our Cookies Policy at qirapro.com/cookies explains each one.

13. Changes to this policy

We may update this policy. The date the current version was published is shown at the top of this page. If a change materially affects your rights, we will tell you by email or through the platform before it takes effect.

14. Contact us

Questions about this policy or about your data:

  • Email: [PRIVACY CONTACT EMAIL]
  • Post: [REGISTERED COMPANY NAME], [REGISTERED ADDRESS]
  • Support: [CONTACT EMAIL] — [PHONE NUMBER]