Effective 29 September 2026 · Version 2026-09-29-en-v1
1. Who is responsible
HIKKARU Pvt Ltd, registration number PV-00265249, Sri Lanka, is responsible for processing in rentacar.hikkaru.lk. Correspondence address: 23, S R Nanayakkara Mawatha, Hikkaduwa 80240, Southern Province, Sri Lanka.
For privacy enquiries and requests about your data, contact booking@hikkaru.lk. Initial contact is also available by telephone/WhatsApp +94 77 150 0010 and Telegram @hikka_ru. We verify entitlement before disclosing order information.
This notice covers Rentacar. Visiting hikka.ru, taxi.hikkaru.lk or another website does not automatically share your entire order history between services.
2. Information processed
- Booking information: vehicle, dates, locations, extras, price, deposit, status and changes.
- Contact information: your name in Latin letters as in your passport, chosen messenger and contact details you provide. An operator does not ask for your Telegram password or login code in conversation.
- Email and Telegram verification information: a stable account identifier, its link to an internal profile, verification date and validity. A username alone does not prove account ownership.
- Optional information you enter: hotel and meeting instructions, times, flight details, driving-document information needed for a selected service; for a child seat, the child's height and weight. Do not add a child's name, medical information or unnecessary details to a free-text comment.
- Rental and deposit payment preferences. The form does not collect card details; actual payments and refunds are recorded separately as necessary.
- Technical information: a protected session identifier, browser/device details, network and diagnostic information needed for operation, abuse prevention and investigating errors.
- Handover and return information: the condition record, vehicle photographs, mileage, fuel level and damage identified. For an incident, necessary information about the location, circumstances and participants, with supporting records. Avoid including bystanders or their documents in ordinary vehicle photographs.
- For a vehicle with a GPS tracker, location and movement information to the extent actually collected. When linked to the agreement, these records may relate to the driver and journey. They come from vehicle equipment, not from permission for a browser to locate your phone.
An initial booking does not require a passport copy. Documents and the transfer method for a separate service are agreed beforehand. Do not place them at public links or in groups containing unrelated people. The agreement and handover payment information are recorded in the restricted order group under section 4; this does not require publishing passport or licence copies in advance. Any future website upload will have its own purpose and retention notice; this notice does not state that such an uploader is already available.
3. Purposes
We use information to calculate and arrange rental, check vehicle supply, contact and meet you, provide selected services, record payments and deposits, send notifications, provide access to your orders, handle enquiries and protect the service.
Rental vehicles have GPS tracking equipment. HIKKARU uses vehicle location and available movement records to locate and protect vehicles, arrange operations and investigate possible misuse, together with inspection and other evidence. The equipment currently used is unbranded and was obtained in Sri Lanka. The tracking application’s provider, hosting country and recording settings have not yet been verified. We therefore cannot currently give a verified list of the tracker’s technical providers or promise that its records stay in Sri Lanka. Ask HIKKARU about tracking on your specific vehicle before rental if this affects your choice. The operator has access to the tracking application; customers are not given access to other vehicles or journeys. Vehicle tracking is separate from your phone’s browser-location permission.
Order and payment information is used for internal records. Analytics and AI training use only anonymised materials from which a person cannot reasonably be identified. Training materials exclude contacts, order identifiers, documents, faces and other identifying features; precise routes, dates and locations are also generalised or removed where they could identify someone. Merely replacing a name or booking number with a code is insufficient. Identifiable conversations and raw tracks are not sent for AI training. This rule does not authorise indefinite retention of the original personal data.
Where the relevant law applies, request and contract processing relies on the necessity of those steps; mandatory records rely on legal obligations; abuse prevention and handling claims rely on justified interests balanced against individuals' rights. Where consent is the basis, it is requested separately for the stated purpose and can be withdrawn. Accepting rental terms is not consent to advertising.
We may be unable to provide a particular service without necessary information. Optional instructions, flight details and an exact hotel can be supplied later. Rejecting optional analytics or advertising does not prevent booking.
4. Telegram, WhatsApp and Google Places
Email confirmation sends a short-lived code through our Hostinger mail service. We use your confirmed address for account access and service messages. Selecting Telegram verification takes you to Telegram, which processes information under its own rules. Rentacar receives verification results and information needed to link the account to your access. Enter login codes only in Telegram's interface.
If you permit the bot to send private messages, we use that channel for service notifications and order links. Refusing or withdrawing messaging permission may stop message delivery but does not cancel a rental. An order number in a link does not itself disclose personal information to strangers.
When using address suggestions, the search text is sent to Google Places to find the location. Do not enter passport details, contacts or information unrelated to an address in that field. You can select a town without an exact-address search and agree the meeting point later. Opening an external map also falls under Google's rules.
A separate WhatsApp group for the order records the handover. The customer, operator and delivery driver or handover representative see the agreement, mileage, payment and deposit information: amounts, currency, payment method and necessary supporting photographs or receipts. This provides one agreed record. Telephone numbers, conversations and shared materials are also processed under WhatsApp's rules. Unrelated customers are not added; membership changes are disclosed. WhatsApp use does not itself verify website order access or subscribe you to marketing.
Information shared is limited to what participants need for performance and checking payments. Passwords, verification codes, full card details and unrelated information in photographs are not needed. Passport or licence copies for a separate service are not automatically sent to the group. If WhatsApp is unavailable, equivalent recording is agreed before handover; this does not change an existing Telegram verification.
Provider notices: Telegram, WhatsApp and Google.
5. Recipients
Access is given to staff and contractors who need it for the order, including operators, the rental provider's representative and delivery personnel. A partner receives information needed for its service, rather than your full history. Where a partner independently determines processing, its identity and applicable notice are provided for that service.
We use Hostinger infrastructure and Google services, including operational spreadsheets and automation, for storage and processing; Telegram is used for verification and agreed messages. Operator notifications go to a work channel with restricted membership. Participants can see the order number and details included in the notification. See Hostinger's notice.
We do not sell personal data, publish private conversations or routes, or provide them to unrelated parties for their own commercial purposes. For an insurance incident, necessary materials are provided to the police, insurer and vehicle owner, whether HIKKARU or a partner. Relevant vehicle and event details, damage photographs, inspection records, repair estimates and necessary parts of agreements or official documents may be used for handling the case. Customer contact details from incident materials are disclosed only to the police or insurer on a necessary basis; partner copies have those contacts removed and HIKKARU coordinates customer communication. This rule concerns incident-material disclosure: previously agreed handover-participant access is described in section 4 and is not undone by it. Other mandatory legal disclosure is not excluded. The HIKKARU brand does not grant another site or partner unrestricted access to the data.
Where WhatsApp is used, its provider processes the relevant conversations. If an external GPS service is used, its identity, role, processing locations and authorised users are included in the tracker notice and international-processing information. Recipients receive only information needed for their task; location access is not automatically given to everyone in an operational chat.
6. International processing
Hostinger, Google and the messaging providers used for your booking may process information outside Sri Lanka or your country. Their roles and published privacy information are linked above; Hostinger also publishes a data processing addendum. Exact processing locations depend on the service and configuration. We do not claim that all data remains in Sri Lanka or that every provider’s subprocessor receives all booking information. The GPS application’s provider and processing locations are still being established. Contact HIKKARU for information about a particular recipient or transfer. Accepting rental terms does not authorise unrelated uses of your information.
Hosting and authentication services may keep their own request and security logs, including technical login redirects. Their retention and deletion arrangements are different from a booking draft's lifetime. We do not promise the complete absence of such records from providers' internal systems.
7. Retention
A draft remains accessible for 24 hours after the last activity. Expired drafts and sessions are cleaned up on a schedule; expiry of access does not mean immediate deletion of every data copy.
Telegram verification is valid for six calendar months unless revoked sooner. This is the period of trust in a verification, not a promise to delete every profile or booking record after six months. Reverification may be required afterwards.
Order information is separated by purpose. Necessary accounting records of services, agreements, payments and refunds form a restricted archive for the company's current accounting period and ten completed accounting periods. This period applies to necessary accounting material, not to every message, photograph, route or customer profile. After expiry, those data are erased or anonymised unless particular records remain subject to a continuing retention obligation or a justified unresolved dispute. The accounting-record scope and period calendar must be checked against the company's accounts.
A minimal contact profile and short booking history are retained for returning customers. Our retention rule is to delete or anonymise that profile after five years without a booking or enquiry, unless a separate legal obligation or unresolved claim requires limited records. You can ask to end returning-customer use sooner. Financial-record retention does not automatically justify keeping an active contact profile. Requests and periodic reviews are handled by HIKKARU; this notice does not claim that all external services provide automatic deletion.
Our internal retention policy sets an internal limit of 365 days for our security logs and 30 days for ordinary technical logs, measured from each entry. These are internal periods for detecting and investigating failures and attacks, not universal statutory maximums. Necessary evidence for a particular unresolved incident is placed in a restricted case file with its own retention justification. Passwords, access codes, complete identity documents and unnecessary conversation content are excluded from logs.
Hostinger's published rules retain daily backups for 7 days and weekly backups for 6 weeks (42 days). The project adopts that cycle without indefinite accumulation of ordinary site snapshots; daily backup availability depends on the plan. This records the provider's published policy, not verification of current account settings. Following deletion from live systems, residual data in an ordinary backup is put beyond routine use and expires through that copy's rotation; after restoration, deletions must be reapplied before returning the system to service. Downloaded local copies require separate inventory and deletion; the mandatory accounting archive is separate from ordinary recovery snapshots. For future document copies with shorter 7/30-day periods, a general 42-day backup cycle does not replace the special deletion requirements.
Operational order conversations are retained for 180 days after actual vehicle return or, if rental never began, closure or cancellation of the request. HIKKARU is responsible for applying this retention rule to copies under its control. A copy independently held by a participant or provider may require a separate request.
Our retention limit for detailed GPS tracks is 90 days after actual vehicle return. Deletion settings in the external tracking applications are still being verified; we do not claim that these applications automatically delete all tracks at that deadline. Ordinary pickup/return photographs and operational attachment copies are retained for 180 days after return; for a rental that never began, the period for existing materials runs from request closure or cancellation. Agreements, payment records and evidence needed for unresolved claims are separated into a restricted archive; their retention follows the relevant purpose and mandatory requirements rather than automatically ending at 180 days. At expiry, identifiable materials are deleted or anonymised in all copies under our control. Deletion for one WhatsApp participant does not guarantee deletion from another participant's phone or a provider's independent systems; copies and actual deletion measures are identified and checked separately.
Necessary retention for an unresolved dispute or mandatory records may extend beyond the normal period, limited to what is needed. Removing a reservation from an active calendar or cancelling it does not automatically delete financial records or the history of agreed actions.
8. Requests and security
You may request information, correction, access, deletion, restriction, objection or portability to the extent the applicable law provides the relevant right. Consent can be withdrawn without affecting lawful processing before withdrawal. We explain if a request cannot be fulfilled completely, for example because financial records must be retained.
Identity checks should be proportionate. Do not send a passport merely as a precaution. You may also contact a competent data protection authority, including the Data Protection Authority of Sri Lanka within its powers currently in force, or an authority in your jurisdiction where applicable.
We restrict access according to work needs, protect connections and check entitlement when orders are viewed. Absolute security cannot be guaranteed. Tell us if you lose email or Telegram access or suspect unauthorised order access so that we can investigate and restrict access.
9. Updates
A new version is published with its effective date. Material changes to processing purposes are disclosed beforehand, and new consent is sought where required. Booking agreement is not converted retrospectively into consent for an incompatible new purpose.