Privacy Policy

1. Introduction

IDM Services LLC, doing business as NÜ Car Rentals ("NÜ Car Rentals," "we," "us," or "our"), respects your privacy. This Privacy Policy explains how we collect, use, share, and protect personal information when you make a vehicle reservation, rent a vehicle, visit our websites, use our customer self-service surfaces, or receive notifications from us — including SMS text messages.

This Policy applies to information collected through our reservation systems, our affiliate locations operating under the NÜ Car Rentals brand, the applications used by our staff to manage your rental — including the Tygar App mobile application described in Section 3 — and the email and SMS notifications we send you in connection with a reservation or rental agreement.

2. Information We Collect

We collect the following categories of personal information:

2.1 Information you provide directly

• Identity information — first and last name, date of birth, driver's license number and issuing jurisdiction, and a scanned image of your driver's license at the time of vehicle pickup.
• Contact information — email address, mobile phone number, mailing address, and emergency contact details.
• Payment information — credit or debit card number, expiration date, billing address, and authorization holds. Card numbers are tokenized by our payment processor and are not stored in our systems in clear form.
• Reservation and rental data — pickup and return locations and times, vehicle class preferences, optional services (insurance, child seats, additional drivers, etc.), corporate or promotional rate codes, and the contents of your signed rental agreement.
• Communications you send us — the contents of email, SMS, or phone conversations with our customer service team.

2.2 Information collected automatically

• Device and usage data — IP address, browser type, operating system, referring URL, pages visited, and timestamps when you interact with our websites or self-service surfaces.
• Vehicle telematics — for vehicles equipped with telematics devices, location, mileage, fuel level, and diagnostic data during the rental period.
• Cookies and similar technologies — session cookies required to keep you signed in to self-service surfaces, plus a limited set of analytics cookies. We do not use third-party advertising cookies.

2.3 Information collected from other sources

• Online travel agencies (OTAs) — when you book through a partner site (Expedia, Priceline, etc.), we receive your name, contact details, and the reservation parameters from that partner so we can fulfill the rental.
• Identity verification services — at the counter, the result of an automated driver's license validity check.

3. Information Collected Through Our Staff Mobile Application (Tygar App)

Tygar App is a mobile application used by NÜ Car Rentals employees to record vehicle check-outs and returns, damage and accident reports, and fleet inspections. It is not a consumer application and is not available to the general public: using it requires a company-issued account granted by NÜ Car Rentals. Renters do not install the app or sign in to it.

Information described in this section is recorded by an employee in the course of their work and becomes part of the rental, fleet, or incident record it documents. It is handled under this Policy on the same basis as information collected at the rental counter.

3.1 Location

• Precise location — when an employee creates a vehicle inspection, a return, a damage or accident report, or a fleet scan, the app records the GPS coordinates of the employee's own device at that moment and stores them with the record, as evidence of where the vehicle was inspected.
• Approximate location — the same GPS reading necessarily identifies the general area, such as the city or locality, in which the record was created. We do not collect a separate coarse location signal.

This is separate from the vehicle telematics described in Section 2.2, which come from equipment installed in the vehicle. The app does not track the location of a renter's device, and it does not collect location in the background — a position is captured only at the moment a record is created. Because it shows where an employee was at a given time, this is also employee personal information under the California Consumer Privacy Act.

3.2 Photographs and signatures

• Vehicle photographs — walkaround, condition, and damage photos taken at check-out, at return, and during fleet inspections, attached to the corresponding rental agreement, vehicle, or damage record.
• Photograph of the renter — where the rental location has enabled it, a photograph taken at the counter for identity verification and attached to the rental agreement.
• Signatures — the renter's signature, an additional driver's signature, the employee's signature, and, in an incident, the signature of a third party, captured on the device screen.

When a photograph of a person is taken, the app may use on-device face detection to help the employee frame the shot. That detection runs entirely on the device, is used only to position the camera, and is not used to identify or recognize anyone; no facial measurements are stored or transmitted.

Photographs and signatures are retained with the record they document, for the periods described in Section 7 — rental agreement records for at least seven years, and damage or incident records for as long as the related claim, insurance, or legal matter requires.

3.3 Information about people who are not the renter

When an accident or damage report involves someone other than the renter — the driver of another vehicle, a witness, or a responding police officer — the app records that person's name, phone number, and email address, together with insurance, vehicle, and police report details where applicable, so that the incident can be documented and any resulting claim processed. This information is used only for that purpose and is shared only as described in Section 6, for example with our insurers, the other party's insurer, or law enforcement.

3.4 Device identifiers

• Push notification token — a token issued to each installation of the app by our push notification provider (Google Firebase Cloud Messaging), used solely to deliver operational notifications to that employee's device, such as an internal message from a colleague. It is removed when the app is uninstalled or the employee removes the device, and automatically when the employee's password is changed or reset, when an administrator revokes their sessions, or when their account is deactivated.

The app carries no advertising, no advertising identifiers, and no third-party analytics or advertising software development kits. We do not use device identifiers for advertising, and we do not share them with advertisers or data brokers.

3.5 Security of information on the device

Personal information held on the device — including reports drafted offline and not yet uploaded — is encrypted before it is written to device storage, in addition to the encryption provided by the mobile operating system. All transmission between the app and our servers uses HTTPS with TLS 1.2 or higher. Once the information reaches our systems, the safeguards described in Section 8 apply to it.

3.6 No sale, no advertising, no third-party sharing

We do not sell any information collected through the Tygar App, we do not use it for advertising or marketing, and we do not share it with third parties for those third parties' own purposes. It is shared only with the service providers listed in Section 6 that process it on our behalf, and with insurers, law enforcement, or regulators where an incident or a legal obligation requires it. Requests to delete information collected through the app are handled as described in Section 9.

4. SMS Communications

We collect your mobile phone number to send SMS text messages connected to your reservation, rental, or relationship with NÜ Car Rentals. SMS sending is performed by our SMS service provider (Twilio Inc.) acting on our behalf.

4.1 Types of messages you may receive

• Reservation confirmations — when you book a vehicle through us or a partner OTA.
• Pickup and return reminders — typically 24 hours before your scheduled pickup and return times.
• Vehicle availability alerts — when a class you requested becomes available.
• Self-service rental extension offers and links — when your rental is approaching its return date.
• Operational updates — flight-delay reschedules, location or time changes, and safety recall notices for the vehicle assigned to you.
• Account and security notices — confirmations of contact information changes and self-service account actions.
• Promotional offers — limited-frequency offers about discounts, loyalty rewards, and new services. You can opt out of promotional messages at any time without affecting reservation-related messages.

4.2 Consent, opt-in, and opt-out

By providing your mobile phone number to NÜ Car Rentals — at the time of reservation, at the rental counter, through a self-service surface, or by replying to one of our messages — you consent to receive SMS messages from NÜ Car Rentals at that number for the purposes described above.

You may opt out at any time by replying STOP to any of our messages. After receiving STOP, our system will send a single confirmation message and will not send you further SMS messages other than legally required notices. You may opt back in at any time by replying START. For assistance, reply HELP or contact us using the details in Section 13.

Message frequency varies based on your reservation activity. A typical customer with a single active reservation may receive between two and six messages per rental cycle. Customers who opt in to promotional messages may receive up to four additional messages per month. Message and data rates from your mobile carrier may apply.

4.3 We do not sell or share your phone number

We do not sell, rent, or share your mobile phone number, or the consent you give us to message it, with any third party for that third party's own marketing purposes. Your phone number is shared only with our SMS service provider (Twilio) for the sole purpose of delivering messages from NÜ Car Rentals to you.

5. How We Use Your Information

We use personal information for the following purposes:

• Fulfilling reservations and rentals — creating and managing your rental agreement, assigning a vehicle, processing pickup and return, and issuing receipts.
• Communicating with you — sending reservation confirmations, reminders, operational updates, and (when you have not opted out) promotional offers via email and SMS as described in Section 4.
• Customer service — responding to questions, resolving complaints, and recovering lost property.
• Payment processing and billing — authorizing security deposits, charging the final rental amount, processing damage and incidental charges, and issuing refunds.
• Fraud prevention and security — detecting and preventing fraudulent reservations, verifying driver eligibility, and protecting our customers, employees, and vehicles.
• Legal compliance — responding to subpoenas, court orders, law-enforcement requests, and applicable regulatory requirements (including toll, tax, and safety reporting).
• Service improvement — analyzing usage of our self-service surfaces in aggregate to improve performance and user experience.

6. Information Sharing

We share personal information only with:

• Affiliate rental locations in the NÜ Car Rentals network that fulfill your reservation. Each affiliate is a separate operating entity bound by NÜ Car Rentals brand standards and by data protection obligations equivalent to this Policy.
• Payment processors (CenPOS and the underlying card networks) that authorize and settle payments on our behalf.
• Communications providers — Mailgun (email delivery) and Twilio (SMS delivery), each acting under a written data-processing agreement and processing your contact information solely to deliver messages from NÜ Car Rentals to you.
• Identity verification providers (such as 365ID) that validate driver's licenses at the rental counter.
• Toll and traffic-citation administrators that process tolls and citations attributable to a rental.
• Professional advisors (auditors, attorneys, insurers) under confidentiality obligations.
• Law enforcement and government agencies when we are legally required to do so or when disclosure is necessary to protect rights, property, or safety.
• An acquirer or successor in connection with a merger, acquisition, financing, or sale of assets, subject to the protections of this Policy continuing to apply.

We do not sell personal information, and we do not share personal information with third parties for those third parties' own marketing or advertising purposes.

7. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy and as required by applicable law. In general:

• Reservation and rental agreement records — retained for at least seven years from the close of the rental for tax and accounting purposes.
• Driver's license images — retained for the duration of the rental and for an additional period required by applicable insurance and law enforcement obligations.
• Payment records — retained as required by card-network rules and tax law. Card numbers themselves are tokenized and never stored in clear form.
• SMS and email logs — retained for ninety days for delivery troubleshooting; aggregate metrics may be retained longer in de-identified form.
• Telematics data — retained for the duration of the rental and a short period thereafter for billing and incident review.
• Inspection, damage, and incident records — the photographs, signatures, and location stamps described in Section 3 are retained with the rental, vehicle, or incident record they document, for as long as that record is retained and for any additional period required by an open claim, insurance obligation, or legal matter.

8. Security

We use a combination of technical, administrative, and physical safeguards to protect personal information, including:

• Encryption of personal data at rest using AES-256.
• Encryption in transit using TLS 1.2 or higher for all customer-facing and internal connections.
• Tokenization of card numbers at our PCI-DSS compliant payment processor.
• Role-based access controls limiting employee access to personal information based on job responsibilities.
• Audit logging of access to sensitive customer records.
• Regular security reviews and dependency monitoring.

No system can be guaranteed completely secure. If we become aware of a security incident affecting your personal information, we will notify you and applicable regulators consistent with applicable law.

9. Your Rights

Depending on where you reside, you may have rights with respect to your personal information, including the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information, subject to legal and contractual record-retention obligations.
• Withdraw consent to receive marketing communications (see SMS opt-out in Section 4.2; email unsubscribe links are included in every marketing email we send).
• Receive a portable copy of the information you provided directly.
• Lodge a complaint with the appropriate data protection authority where you reside.

To exercise any of these rights, contact us using the details in Section 13. We may need to verify your identity before responding to a request, and we will respond within the timeframes required by applicable law.

California residents: the California Consumer Privacy Act (CCPA) gives you the rights described above and the right not to be discriminated against for exercising them. We have not sold personal information in the preceding twelve months.

10. Children's Privacy

Our services are intended for adults of legal driving age in the jurisdiction of the rental. We do not knowingly collect personal information from children under thirteen (13) years of age. If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe we may have inadvertently collected information from a child under 13, please contact us using the details in Section 13.

11. International Visitors

NÜ Car Rentals operates in the United States. If you visit our websites or rent a vehicle from us while you reside outside the United States, your personal information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence. By using our services, you acknowledge this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will revise the Effective date at the top of this page and, when appropriate, notify customers with active reservations by email. Your continued use of our services after a change becomes effective constitutes acceptance of the updated Policy.

August 6, 2026 — added Section 3, describing the information collected through the Tygar App mobile application used by our staff: device location, photographs, signatures, information about people involved in an incident who are not the renter, and push notification tokens. Sections previously numbered 3 through 12 were renumbered to 4 through 13; no other section was changed in substance.

13. Contact Information

If you have questions about this Privacy Policy or our handling of your personal information, or if you wish to exercise any of the rights described in Section 9, contact us at:

IDM Services LLC
d/b/a NÜ Car Rentals
Email: Reservations@NUCarRentals.com
Phone: +1 (877) 535-7117