Meili Travel Technology Limited (“Meili”, “we”, “us”, “our”) provides technology services that enable access to car rental services offered by third-party providers through partner websites and applications.
Meili is committed to protecting personal data and complying with applicable data protection and privacy laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection and privacy laws in the jurisdictions in which we operate or provide our services.
Meili is committed to applying consistent data protection standards globally, regardless of the location of the data subject.
This Privacy Notice explains how personal data is processed in connection with the Meili services.
Meili acts solely as a data processor when processing personal data in connection with the services.
This means:
Meili’s services are typically integrated into third-party websites or applications. As a result, you interact directly with the relevant partner or provider, rather than with Meili itself.
Meili does not have a direct relationship with end users and does not collect or use personal data for its own independent purposes.
Depending on how you access the services, the data controllers may include:
For an individual booking, the data controller will typically be:
These organisations are responsible for:
The legal basis for processing your personal data is determined by the relevant data controller and will be set out in their privacy notice, which you will be presented with at the point where you submit your personal data.
Meili does not sell personal data and does not use personal data for cross-context behavioural advertising or any independent commercial purposes.
We process personal data strictly on behalf of the data controllers and only as necessary to provide the services.
We may process personal data relating to the following categories of individuals, depending on how the services are used:
The categories of personal data processed may include any information you provide at the time of booking or through your use of services powered by Meili, such as the following:
Identification Data
Transaction Data
Technical Data
Marketing Data (where enabled by the Controller)
Meili does not knowingly process special categories of personal data (as defined under applicable law).
Where such data is processed, this occurs only on documented instructions from the data controller and subject to appropriate safeguards.
Meili does not knowingly process personal data relating to children except where instructed by the relevant data controller.
Meili processes personal data only on behalf of and under the instructions of the data controllers for the following purposes:
Where required by applicable law, Meili may process personal data independently of controller instructions, in which case we will inform the controller unless prohibited by law.
Meili stores and processes personal data solely on behalf of the data controllers and in accordance with their documented instructions.
This means:
In practice, personal data may be retained:
Upon termination of services:
Where personal data remains in encrypted backups:
As Meili acts as a data processor, we do not independently determine how personal data is used and do not typically respond directly to data subject rights requests.
If you wish to exercise your rights (including access, rectification, erasure, restriction, or portability), you should contact the relevant data controller.
Where required by applicable law, Meili may assist directly in responding to such requests.
If Meili receives a request:
Meili may engage authorised third-party service providers (“sub-processors”) to support the delivery of the services.
These may include providers of:
All sub-processors:
Where personal data is transferred outside the European Economic Area (EEA), the United Kingdom, or other relevant jurisdictions, Meili ensures appropriate safeguards are in place, including:
Meili implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk in accordance with applicable data protection laws (including Article 32 GDPR).
These measures include:
Access to personal data is restricted to authorised personnel with a legitimate business need and subject to confidentiality obligations.
Meili may provide marketing-related services where this has been explicitly enabled by the relevant data controller.
In such cases:
If you wish to withdraw your consent or manage your preferences, you should follow the instructions provided in the communication or contact the relevant data controller directly.
For general queries regarding this Privacy Notice:
Meili Travel Technology Limited
1 Grant’s Row
Lower Mount Street
Dublin 2, D02HX96
Ireland
Data protection and privacy laws may vary depending on your location.
Where required by applicable law, you may have additional rights in relation to your personal data. These rights should be exercised with the relevant data controller, as Meili acts solely as a processor.
Meili will assist data controllers in fulfilling such obligations where required under applicable law.
Any changes to this Privacy Notice will be posted on our website so you are always aware of how personal data is processed in connection with the services, and under what circumstances, if any, we may disclose it.