Privacy policy

1. Who is the controller

Moesker Group VOF (operating as GoDushi), Carstensdijk 77, 7916 RA Elim, Netherlands, KvK 97344567, is the data controller for personal data processed via the platform. You can reach our privacy contact at privacy@godushi.com.

2. What we collect

Identity data

Name, email address, phone number, profile picture (where you upload one or sign in via Google), and date of birth (renters only, used for age verification).

Account data

Login credentials (managed by our authentication provider, so we never see your password), account creation date, and the provider you signed in with (email/password or Google).

Renter-specific data

Nationality, driver license details where you provide them for a host, payment method (held by our payment provider, we see only a token), booking history, and reviews you write.

Host-specific data

Company name, KvK number, VAT number where applicable, business address, listings, calendar, booking history, and reviews about your cars. (We don't hold your bank or payout details, because you collect rental payments directly from renters rather than through us.)

Communication data

Messages you exchange with other users on the platform. Support emails you send to us.

Technical data

IP address, browser type, device type, and pages visited. We collect this for security purposes (rate-limiting, abuse detection) and for our own basic, first-party visitor statistics. Those statistics use two pseudonymous cookies (a random session id and a first-touch attribution id) that are never tied to your identity. They're described in full on our cookie policy.

Marketing analytics (with consent only)

We are planning to add third-party analytics and advertising tools (Google Analytics, Google Ads conversion tracking, and the Facebook (Meta) Pixel) to measure marketing campaigns and improve how the platform performs. These tools are not active yet. When we turn them on we will:

• Show a cookie consent banner on first visit, with a clear choice between “Accept” and “Reject”.
• Activate these tools only for users who have given consent. Rejecting still gives you full access to the platform.
• Update this policy and the sub-processors page at the time of launch, and notify active users by email at least 30 days in advance.

3. Why we process your data

• To provide the service. Match renters with hosts, take payments, send pickup instructions, and so on. Legal basis: performance of contract.
• To keep the platform safe. Detect fraud, abuse, and prohibited activity. Legal basis: legitimate interest in platform integrity.
• To comply with the law. Keeping the business details hosts give us (company name, Chamber of Commerce and VAT numbers) for invoicing, retaining booking and commission records for the statutory period, and responding to valid court orders. Legal basis: legal obligation.
• To improve the platform. Aggregate usage data to make the product better. Legal basis: legitimate interest. We do not use individual-level data for ads or sell it on.
• To send you updates. Booking confirmations and operational notices (legal basis: contract), and product newsletters (legal basis: consent, which you can withdraw at any time).
• For marketing analytics, once activated, to measure the effectiveness of advertising campaigns (Google Ads, Facebook). Legal basis: consent, opt-in via the cookie banner.

4. Who we share data with

Only as much as needed for the platform to work:

• The other side of a booking. Renters see the host's name, contact details, and pickup location. Hosts see the renter's name, phone, and (where they ask for it) ID details at pickup.
• Sub-processors we depend on (database and authentication, application hosting, transactional email, and where applicable our payment provider, plus the marketing analytics providers listed above once activated). They process data only on our instructions and are bound by data processing agreements. The current list and what each one processes is published on our sub-processors page.
• Authorities when legally required, for example court orders, tax investigations, or criminal investigations. We push back on overbroad requests and notify you where allowed.

We do not sell your personal data to third parties.

5. Where your data is stored

Our primary database is hosted in the European Union. Some sub-processors (notably for hosting and email delivery) may store data in the United States or other jurisdictions outside the EU. In those cases we rely on the EU Standard Contractual Clauses to protect international transfers. The current location of each sub-processor is listed on our sub-processors page.

6. How long we keep it

• Active account data for as long as your account is open.
• Booking, commission, and tax records for at least 7 years after the booking, as required by Dutch tax law, even if you delete your account.
• Review content kept indefinitely, with your name removed if you delete your account, so future renters can still see host history.
• Support emails typically up to 2 years.
• Marketing consent until you opt out.

7. Your rights under GDPR

You have the right to:

• Access the personal data we hold on you.
• Correct data that's wrong or incomplete.
• Delete your data (within the limits of our retention obligations, see section 6). The fastest path is the “Delete account” button in your account settings.
• Restrict or object to certain processing.
• Receive your data in a portable format. Email us and we'll arrange the export.
• Withdraw consent for marketing emails or analytics tracking at any time, via the unsubscribe link, your notification settings, or the cookie banner.
• Lodge a complaint with the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) if you think we're not handling your data correctly.

To exercise any of these rights, email privacy@godushi.com. We aim to respond within 30 days.

8. Security

We protect your data with industry-standard measures: encryption in transit (HTTPS everywhere), encryption at rest, access controls, audit logging, and regular security review of our infrastructure providers. No system is perfect. If you spot a security issue, please report it to security@godushi.com.

9. Children

GoDushi is not intended for anyone under 18, and you must be at least 18 to create an account. To rent a specific car you also have to meet that host's minimum driver age, which is set per listing and is typically 21 or higher. We don't knowingly collect data from minors. If we learn we have, we'll delete it.

10. Changes

We may update this policy when our practices change or when the law requires. Substantive changes will be communicated by email at least 30 days in advance.

11. Contact

Privacy questions go to privacy@godushi.com. General questions: info@godushi.com.