Draft — do not publish this page yet

This policy is complete except for the following, which cannot be written for you. Open privacy.php and fill in the configuration block at the top; this banner disappears on its own.

the document folder still sits inside the web root — move it before publishing, because until then this page has to describe a storage arrangement that breaches s.20(1) and s.42(1) of the Act
no explicit consent is recorded for passport and licence images — if a passport scan is sensitive personal data under s.22(1), processing it is prohibited without a s.22(2) exception, and explicit consent is the only realistic one here

Privacy Policy

Effective 21 October 2026. This policy explains what we do with your personal information when you book a car with us.

Who we are

Ocean Car Hire, of Beau Belle, Bel Ombre, Mahé, Seychelles, is responsible for the personal information described here. We are a self-drive hire operator licensed in Seychelles.

Questions about this policy, or about the information we hold about you, should go to Samuel Gonzalves at samuel.b.gonzalves@gmail.com, or by WhatsApp on (+248) 2 664 760.

What we collect, and why

We only collect what we need to rent you a car and meet the obligations that come with doing so.

What	Why we need it
Your name, email address and telephone number	To take the booking, send your confirmation, and reach you about the rental.
Where you are staying	To deliver and collect the vehicle.
Your rental dates, times, pickup and drop-off points, and the vehicle chosen	To price the rental, reserve the vehicle and plan the handover.
The driver's name, and an image of the driving licence	We are required by Seychelles self-drive hire regulations to check that the driver holds a valid licence before handing over a vehicle. Our insurance also depends on it.
An image of the passport photo page	To confirm identity and, where it matters, date of entry into Seychelles — a visitor's own national licence is valid here only for a limited period after arrival.
Technical details recorded with an upload: the time, the file's size and type, a checksum, your IP address and your browser's user-agent string	To tie a document to the booking it belongs to, to detect tampering, and to investigate misuse of the upload form.
Any voucher code used, and the amounts charged	To apply the discount and keep accurate records of what was paid.

We do not take card details on this website. Payment is made on collection, and we do not store card numbers.

What allows us to hold it

The Data Protection Act 2023 requires us to have a specific legal reason for each thing we do with your information, and to tell you what it is. These are ours.

What we do	Our legal reason
Take and fulfil your booking — name, contact details, dates, vehicle, delivery address, amounts	Performance of our contract with you. Without these details there is no rental to perform.
Check the driving licence and record that we checked it	A legal obligation. The Seychelles self-drive hire regulations require us to satisfy ourselves that the driver is licensed and to certify that we did. We do not rely on your consent for this, because we cannot lawfully hand over a vehicle without it.
Keep the signed rental agreement	A legal obligation. Where a vehicle was on hire, the authorities may require the original agreement in connection with a traffic offence, and we must be able to produce it.
Hold an image of the passport photo page	Your explicit consent, which we ask for when the document is checked at handover, alongside our need to confirm identity and entitlement to drive here. You can withdraw it at any time and we will delete the image, though we may then be unable to complete the rental.
Record technical details with an upload — time, size, type, checksum, IP address, browser string	Our legitimate interest in knowing that a document has not been altered and that the upload form is not being misused. We have weighed this against your privacy and keep the detail to the minimum that serves the purpose.
Deal with an accident, a claim or a dispute	Our legitimate interest in defending and pursuing claims, and a legal obligation where an accident must be reported.
Keep accounting records	A legal obligation under Seychelles tax and accounting rules.

We do not send marketing email, and we do not profile you or make decisions about you by automated means. The discounts shown during booking are calculated from the dates and vehicle you choose and nothing else.

Driving licences and passports

These are the most sensitive documents we handle, so they are treated separately from everything else.

Uploaded images are stored on our web host, under names that cannot be guessed, and they are not published or indexed anywhere. Access is limited to the people who run the rental.

We keep them for 90 days after your rental ends, and then delete them. We do not use them for marketing, we do not sell them, and we do not share them with anyone except as described in the next section.

Who we share information with

Our insurer, SACOS Seychelles, where a claim arises, or where the insurer requires driver details in order for cover to apply.
The Seychelles Police, where an accident must be reported, or where we are required by law to identify the driver of a vehicle — for example in connection with a traffic offence.
The Seychelles licensing and transport authorities, where we are required to produce the rental agreement or confirm who was driving — for example when a fixed-penalty notice is issued for a vehicle that was on hire.
Hostinger, our web host, which stores this website, its database and the uploaded documents on our behalf and may not use any of it for its own purposes.
Our email provider, which carries booking confirmations and correspondence.
WhatsApp, if you choose to contact us there. Messages you send us on WhatsApp pass through its operator's systems, which we do not control. If you would rather not use it, email reaches us just as well.
Our lawyer, accountant or a debt recovery agent, only where a specific claim, dispute or unpaid amount makes it necessary.
The companies that serve parts of this page. Some fonts, icons, layout files and the award badge in our footer are loaded from other companies' servers rather than our own, which means your IP address and browser details reach them when a page loads. They are listed under Cookies and tracking below.

We do not sell personal information, and we do not share it for advertising.

Where your information goes

Seychelles law restricts sending personal information outside the country, and requires that whoever receives it protects it to a comparable standard. You should know that this does happen, because of how a small business like ours operates:

Our web host's servers are outside Seychelles. Your booking details and any uploaded documents are stored there, under a contract that obliges Hostinger to protect them and to use them only to provide the hosting.
We administer the business from abroad for part of the year. When we are overseas, bookings are managed from there through the same website and our own management app. The information is not copied to anyone else; it is simply reached from a different country.
The companies serving fonts, icons and badges on this page are outside Seychelles, and receive your IP address when a page loads, as described below.

If you would like to see the terms we hold our host to, ask and we will show you.

Children

Our vehicles are rented only to drivers who meet the minimum age in our terms, and this website is not intended for children. We do not knowingly collect information about anyone under 18. Where a booking mentions children — a child seat, for example — we record only what is needed to provide it, and nothing identifying about the child. If you believe we hold information about a child, tell us and we will delete it.

How long we keep things

Driving licence and passport images: 90 days after the rental ends.
The signed rental agreement: kept for as long as a claim or a traffic matter arising from the rental could still reach us, and in any event long enough to produce the original if the authorities ask for it.
Booking records — names, contact details, dates, vehicle and amounts — 7 years, which is the period our accounting and tax obligations require, and then deleted.
Correspondence for two years after the rental, unless it relates to a claim or dispute, in which case it is kept until that is finished.

If you ask us how long we are keeping something specific, we will tell you.

Keeping it safe

This website is served over an encrypted connection. Uploaded documents are held with restricted file permissions under names that cannot be guessed. Access to the booking system is limited to people who need it and is protected by individual logins.

If something goes wrong and personal information is exposed, we will report it to the Seychelles data protection authority within the time the law allows, and tell you directly where the risk to you is significant.

Your rights

You can ask us to:

tell you what information we hold about you, and give you a copy;
tell you who we have shared it with, and how long we will keep it;
correct anything that is wrong, incomplete or out of date;
delete information we no longer have a reason to keep;
stop using your information for a particular purpose;
give you your booking details in a portable form, so you can pass them to someone else;
stop relying on your consent, where consent is what we relied on — for the passport image, for instance. Withdrawing it does not undo what we did while it was in force, and we may be unable to complete a rental without it.

Write to samuel.b.gonzalves@gmail.com and we will reply within 30 days, and sooner where we can. There is no charge. We may need to confirm who you are before we hand over documents — which, for a passport copy, is in your interest as much as ours.

If we have processed your information unlawfully and that has caused you loss or distress, Seychelles law gives you a right to compensation. That is a matter for the courts rather than for us, but you do not have to go through us to pursue it.

Cookies and tracking

This site uses only the cookies it needs to keep your booking together as you move from one step to the next. We set no advertising cookies and we do not follow you around other websites.

We should be straight with you about one thing that is not a cookie but has a similar effect. Some parts of these pages — fonts, icons, layout files and an award badge — are loaded from other companies' servers instead of ours. Your browser has to ask those servers for the files, and in doing so it tells them your IP address, which page you are on and what browser you are using. This happens as the page loads, before you have agreed to anything, and we cannot see or control what they do with it.

Google (fonts.googleapis.com) — web fonts.
Font Awesome (kit.fontawesome.com) — icons.
jsDelivr (cdn.jsdelivr.net) — layout and script libraries.
Kayak (content.r9cdn.net) — the Kayak award badge in the footer.

We are working through moving these onto our own server, which will stop it happening. A browser extension that blocks third-party requests, or private browsing, will prevent it in the meantime.

Complaints

If you are unhappy with how we have handled your information, we would like the chance to put it right — most problems are quicker to fix directly. But you do not have to come to us first.

You have the right to complain to the Information Commission of Seychelles, which supervises data protection here and can investigate us, audit us and issue enforcement notices. Its website is infocom.sc.

Changes to this policy

If we change how we handle personal information we will update this page and change the effective date at the top. Where a change materially affects you, we will tell you directly.

Terms & Conditions · Rental Agreement · Cancellation Policy · Insurance & Excess