This Privacy Policy explains how RINGBROS NURBURG SRL processes personal data when you visit ring-bros.com, contact us, make a booking or rent one of our vehicles. It is intended to be read with our Terms and Conditions and Cookie settings. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 and other applicable Romanian and European data-protection rules.

1. Who is responsible for your data

The controller is RINGBROS NURBURG SRL (CUI 54338524; Trade Register No. J2026019578004; EUID ROONRC.J2026019578004), 14 Dinu St., Bezdead, DB, Romania, 137035. Contact us about privacy or to exercise your rights at ringbros@ring-bros.com or +40 752 177 388. This is our privacy contact point. If a Data Protection Officer is appointed, their contact details will be made available here.

2. People and data covered by this notice

This notice covers website visitors, people who contact us, customers and prospective customers, booking participants and people named in a booking. Depending on how you use the site, we may process:
• Identity and contact details, such as name, email address, telephone number, billing address and country.
• Booking and transaction details, such as the vehicle or service selected, date and time, number of laps, extras, order reference, price, payment status, messages and cancellation or rescheduling requests.
• Information needed to issue invoices and meet accounting and tax duties, including company or VAT details where you provide them.
• Information you provide when contacting us, including the content of your message and any attachments.
• If needed to check rental eligibility or administer a rental, information shown in a driving licence or other identification document. Please do not send identity documents unless we ask for them or they are needed for your booking.
• Technical and usage data, such as IP address, browser and device information, pages visited, referring page, cookie identifiers, consent choices, security logs and approximate location derived from an IP address.
• Where a vehicle is equipped with an active dashcam, video and, if enabled, audio recordings associated with use of the vehicle. See section 7.

3. Why we use data and our legal bases

We use personal data only for specified purposes and on an applicable legal basis:
• To answer questions, provide quotes and take steps requested before a contract: performance of a contract or pre-contractual steps (GDPR Article 6(1)(b)).
• To create and administer bookings, provide the vehicle or service, communicate booking details, manage changes and support customers: performance of a contract (Article 6(1)(b)).
• To take and reconcile payments, prevent payment fraud and manage refunds: performance of a contract and, where applicable, our legitimate interests in protecting the business and customers (Articles 6(1)(b) and 6(1)(f)). Payment card data is handled by the payment provider as described in section 5.
• To issue invoices, keep accounting records, respond to lawful requests and meet tax, consumer and other legal duties: compliance with a legal obligation (Article 6(1)(c)).
• To secure and operate the website, diagnose errors, prevent abuse, protect our vehicles and property, and establish or defend legal claims: our legitimate interests (Article 6(1)(f)), balanced against your rights and freedoms.
• To use non-essential cookies, analytics or advertising technologies: your consent where required by law (Article 6(1)(a) GDPR and applicable electronic-communications rules). You may refuse or withdraw consent through the cookie settings without affecting necessary site functions.
• To send direct marketing, where we do so: your consent or another lawful basis permitted by applicable law. You can opt out at any time using the unsubscribe option or by contacting us.

4. Bookings, accounts and information you must provide

Bookings and orders are managed through the website’s online store and booking tools, including WooCommerce and, where a booking flow uses it, Amelia. We use the information you enter to confirm the booking, provide the service and contact you about it. Fields needed to complete a booking or invoice are identified in the relevant form or checkout. If you do not provide required information, we may be unable to accept, administer or fulfil the booking or issue the required invoice. Creating an account is optional unless a particular feature requires it.

5. Payments and invoicing

Online card payments are processed through the payment gateway selected at checkout, including NETOPIA Payments where that method is selected. The payment processor and relevant banks or card schemes receive the information needed to authenticate, process and record the transaction. RINGBROS does not ask you to email card details and does not intend to store your full card number or card security code on this website. The processor’s own privacy notice also applies to its processing. For bank transfers or cash payments, we process the payment and payer details needed to match the payment to the booking. Invoice and accounting information may be sent to SmartBill or another accounting/invoicing provider used by RINGBROS.

6. Cookies, analytics and embedded content

The site uses necessary cookies and similar technologies for core functions, security, shopping-cart and checkout operation, and saving your privacy choices. Cookiebot/Usercentrics is used to present or manage cookie choices. Other technologies may include Jetpack features, Google Tag Manager and tags or integrations such as Google or Reddit services, depending on the current site configuration. Non-essential analytics or advertising technologies should run only where permitted by your cookie choice. You can change or withdraw consent at any time using the cookie settings available on the site or your browser settings; blocking necessary cookies may affect checkout or other functions. Cookie names, providers and expiry periods can change as the site changes; consult the cookie declaration/settings presented by Cookiebot for the current scan and controls.

The site may display embedded material or links from services such as Instagram, Facebook or WhatsApp. When an embedded feature loads or you follow an external link, the relevant provider may receive technical data from your browser and process it under its own privacy notice. We do not control those providers’ separate processing.

7. Vehicle safety recordings and promotional material

Some rental vehicles may be equipped with a dashcam. If safety or incident recording is active, it may capture video and, only where enabled, audio during vehicle use. We use safety recordings to protect people and property, investigate incidents and handle insurance or legal claims. The usual legal basis is our legitimate interest (GDPR Article 6(1)(f)), subject to an assessment of necessity and the balance of interests. We will provide information about active recording before it begins, restrict access to people who need the footage for these purposes, and delete or overwrite it when no longer needed. Footage relating to an incident or claim may be retained until the matter is resolved and any relevant legal limitation period has expired.

Safety recording and promotional use are separate purposes. Signing a rental contract or accepting these Terms does not give consent to use a person’s identifiable image, video or voice for advertising or other public promotion. RINGBROS will use such material for promotional purposes only after obtaining separate, specific, informed, freely given and documented consent from each identifiable person whose consent is required. The consent will describe the material and intended promotional use; it is optional and refusing it will not affect a booking. Consent may be withdrawn at any time by contacting ringbros@ring-bros.com. After withdrawal, we will stop future use based on that consent and remove material from channels we control within a reasonable time, subject to any legal obligations. Incidental images or voices of other identifiable people will be removed, blurred, muted or otherwise handled under an applicable legal basis before publication.

8. Who may receive personal data

We disclose only the information needed for the relevant task. Recipients may include our website hosting, security, maintenance and communications providers; WordPress/WooCommerce and booking-system providers; NETOPIA Payments and banks/card schemes; SmartBill or other invoicing/accounting providers; Cookiebot/Usercentrics; analytics or advertising providers enabled on the site; insurers, legal or professional advisers; and public authorities, courts or law-enforcement bodies where disclosure is required or permitted by law. These providers may act as processors under our instructions or as separate controllers for their own services. We do not sell personal data.

9. Processing outside the European Economic Area

Some service providers may process data outside the European Economic Area. Where a restricted international transfer occurs, RINGBROS will use a transfer mechanism permitted by GDPR Chapter V, such as an adequacy decision, Standard Contractual Clauses or another applicable safeguard, and will provide information about the safeguard on request. Please also review the relevant provider’s privacy notice for its own transfer practices.

10. How long we keep data

We keep personal data only for as long as needed for the purpose for which it was collected, then delete or anonymise it unless a longer period is required to meet a legal duty or resolve a claim. In particular:
• Booking, customer-service and contract records are kept for the duration of the booking and afterwards for the applicable limitation period for claims, normally up to three years from when a claim may be brought, unless a dispute or another legal rule requires longer.
• Invoices, accounting records and supporting documents are retained for the statutory accounting period. Romanian accounting law generally requires retention for 10 years from the end of the financial year in which the records were prepared, subject to legally applicable exceptions.
• Enquiry messages are normally retained for up to 12 months after the matter is closed, unless they become part of a booking, complaint or legal claim.
• Marketing data is kept until you withdraw consent or object, and suppression information may be retained to honour your opt-out.
• Technical logs, cookie identifiers and safety recordings are kept for the period needed for security, consent management or the purposes in sections 6 and 7, based on provider settings and our retention criteria. Promotional material will be used only while the relevant consent remains in effect and the material remains necessary for the stated purpose. Incident footage may be retained for a claim as described above.

11. Your rights

Subject to the conditions and exceptions in the GDPR, you may ask us for access to your personal data, correction, erasure, restriction of processing or a copy in a portable format. You may object to processing based on legitimate interests and to direct marketing. Where processing is based on consent, you may withdraw consent at any time; withdrawal does not affect processing that was lawful before withdrawal. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. G-ral Gheorghe Magheru 28–30, Sector 1, Bucharest 010336, Romania; email anspdcp@dataprotection.ro; https://www.dataprotection.ro/.

Send rights requests to ringbros@ring-bros.com. We may ask for proportionate information to verify your identity and protect your data. We will respond without undue delay and normally within one month. This may be extended by up to two further months for complex or numerous requests; if so, we will tell you within the first month and explain why. Some data cannot be erased while we are legally required to retain it or need it to establish, exercise or defend legal claims.

12. Automated decisions and children

We do not make decisions about you that are based solely on automated processing and produce legal or similarly significant effects. The site and rental services are intended for adults and are not directed to children. If you believe a child has provided personal data to us, contact us so we can review and take appropriate action.

13. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. The website uses HTTPS encryption. No internet transmission or storage system can be guaranteed completely secure; please use the contact details above to report a suspected security or privacy issue.

14. Changes to this notice

We may update this Privacy Policy when our services, website tools or legal requirements change. The current version is published on this page with its effective date. Material changes will be brought to your attention where required by law.

Effective date: 26 October 2026.