Customer Data Retention Policy

Customer Data Retention Policy

As a result of recent data breaches affecting Optus and Medibank in Australia, we have been reviewing how we can further protect your customers’ ‘identity data.’ This includes data that is commonly used not only when renting a vehicle but also for loan applications, credit card applications or other types of applications that need to verify a customer’s identity. Rental Car Manager strongly encrypts all your customers’ data but will now also implement an ‘Identity data retention policy.’ This policy has Two Tiers of retention depending on the sensitivity of the data:
  1. Tier 1 is for more sensitive data and involves the retention of the customers DOB, driver’s license and passport number. By default, the retention of this data will be set to 6 months, meaning the data will be permanently obscured 6 months after the drop off date for each customer’s booking unless the customer has future bookings. This retention period can be lengthened or shortened depending on the requirements of your business. 
  2. Tier 2 is for less sensitive data and involves the retention of the customers Email Address, Mobile Number, and Address Information. By default, this data will be set to Alway Retain, meaning that the information will never be obscured. However, you are able to set a retention period for this data that will act the same as described above. 
These Tiers are configured by two different system parameters, and this is where you will be able to set the retention periods as required for your business.  For information on setting the system parameters, please see the Setting the Retention Period for Sensitive Customer Data article. 

Below is an example of how the information will appear in RCM after it has been permanently obscured. You can see that the first and last characters are kept, but the rest of the information will be replaced with asterisks (*).



These changes will help ensure the strongest possible protection for your customers’ identity data. We strongly recommend setting the ‘Identity Retention Period’ to be as short as possible after completion of a booking to protect yourself and your customers’ data from any possible compromises.