GDPR Compliance

Last updated: July 13, 2026

Our Commitment to Data Protection

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual necessity: Processing is necessary to fulfill our vehicle rental contract with you
• Legal obligation: Processing is required to comply with legal requirements
• Legitimate interests: Processing is necessary for our legitimate business interests, such as improving services and fraud prevention
• Consent: Where you have given explicit consent for specific processing activities

Data Controller

The data controller responsible for your personal information is:

leaf-flow
42 Colmore Row
Birmingham B3 2BS
United Kingdom
Email: [email protected]

Your GDPR Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access

You have the right to obtain confirmation that we are processing your personal data and to request a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes it was collected.

Right to Restrict Processing

You can request that we limit the processing of your personal data in specific situations.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format and to transmit it to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: [email protected]

We will respond to your request within one month. In complex cases, this period may be extended by two additional months.

Data Breaches

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

International Data Transfers

Your personal data is processed and stored within the United Kingdom. We do not transfer personal data outside the UK.

Complaints

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: www.ico.org.uk

Updates to This Notice

We may update this GDPR notice periodically to reflect changes in our data processing practices or legal requirements. Please review this page regularly for updates.