Privacy policy

ekrily SARL, based in Tunis, is the controller of the personal data processed on ekrily. This processing is declared to the National Authority for the Protection of Personal Data (INPDP), under Organic Law No. 2004-63 of 27 July 2004. Questions: support@ekrily.tn.

• Identity and contact: name, phone number, email address, language.
• Driver: date of birth and licence issue date, when the agency requires them.
• Bookings: dates, places, car, amounts, messages with the agency and customer service, reviews.
• Payment: transaction status and reference. Your card number is handled by our payment provider; we never have access to it.
• Technical data: IP address, device type, connection logs, a random device identifier used against abuse.

For agencies: the manager’s identity, the company’s and cars’ legal documents, bank details for invoicing.

• To carry out your booking and pass it on to the agency.
• To collect the service fee, issue receipts and invoices, and keep our accounts.
• To keep you informed about your booking by email, SMS or WhatsApp (confirmation, reminder, change).
• To provide customer service, the ekrily guarantee and complaint handling.
• To prevent fraud and secure the service.
• To improve ekrily using aggregated statistics.

We only send you promotional messages with your consent, which you can withdraw at any time.

• The agency you book with, which receives what the rental needs, with the consent you give when booking (article 47 of Organic Law No. 2004-63).
• Our payment providers (Konnect, Flouci) and our hosting, email, SMS and WhatsApp messaging providers, acting on our behalf.
• Public authorities, when the law requires it.

We never sell your data. We keep no customer list shared between agencies, and no agency can see bookings made with another agency.

Some providers are located outside Tunisia, including our hosting provider in the European Union and, if you use them, Google or Facebook sign-in. Under articles 51 and 52 of Organic Law No. 2004-63, these transfers require INPDP authorisation and are limited to what the service needs.

• Account: while it is active; deleted at your request.
• Bookings: during our relationship, then as long as needed to handle complaints and defend our rights.
• Receipts and accounting records: for the period required by accounting and tax law.
• ID documents sent to prepare a pickup: 90 days after return at most.
• Technical logs: 12 months.

When these periods end, the data is destroyed or anonymised.

Traffic is encrypted, sessions are protected and access to data is limited to the people who need it. ID documents are stored encrypted. Payments are made on the provider’s secure page, with 3-D Secure.

Under Organic Law No. 2004-63, you have:

• the right to access your data and obtain a copy within one month (articles 32 and 40);
• the right to have inaccurate data corrected, updated or erased (article 40);
• the right to object for legitimate reasons, and at any time to marketing (article 42);
• the right to withdraw your consent (article 27).

To exercise them, write to support@ekrily.tn from your account’s email address, or use the settings in “My account”. You can also contact the INPDP (www.inpdp.nat.tn).

The booking service is for people aged 18 or over. We do not knowingly collect data about children.

We update this policy when our processing changes. The update date is shown at the top of the page; we tell you about any significant change.