Skip to content Skip to footer

A car rental website needs to turn a visitor’s dates into a reservation your team can fulfil. Start by deciding how availability, prices and confirmation will work. Then choose the website platform and connect it to the rental operation. The first test is whether a reservation reaches the desk with the right car, price and payment status.

For a small operator, a hosted booking engine connected to an existing website is often worth evaluating first. WordPress with a rental booking extension and a custom website are other routes. Compare them using your actual rental rules and a test booking, not the number of design templates.

Write the booking rules before choosing a platform

Decide whether customers reserve a specific vehicle or a vehicle class. With a class booking, the site can promise an economy automatic while your team assigns a particular car later. If you sell an exact model, substitution becomes a different conversation. Make that distinction visible in the listing and confirmation. Document pickup and return locations, local time zones, staffed hours and turnaround time. A vehicle returned at 10:00 may need cleaning and inspection before its next rental. Set the buffer in availability rather than leaving the counter team to discover the problem after a customer books.

  • Which drivers qualify, and when will the business verify their documents?
  • What is the daily or hourly charging unit, and how are late returns or partial days handled?
  • Which charges are mandatory, and which extras can the renter decline?
  • Does booking require full payment, a part payment, card authorisation or only a request?
  • When does the reservation become confirmed, and who handles a failed payment or a vehicle problem?
  • What are the cancellation, no-show and amendment rules?

Include cases that are easy to miss: a different return branch, a rental crossing a daylight-saving change, a requested extra with limited stock, and an extension that conflicts with the next reservation. Put those cases in the brief you send to suppliers.

Choose how the website and booking system fit together

ApproachUseful whenCheck before committing
Hosted booking engine on your websiteYou want to keep a marketing site and use a specialist system for rental rulesMobile behaviour, design limits, domain handoff, tracking and which booking states reserve inventory
WordPress with a rental booking extensionYour team can maintain WordPress and needs control over page contentCompatibility, updates, availability logic, payment support and a way to test changes before release
Custom website and integrationYour operation has requirements a standard setup cannot meetResponsibility for development, inventory concurrency, security, upgrades and support after launch

Ask for a demonstration using one of your harder bookings: a three-day rental, an additional driver, a child seat, a different return time and a failed first payment attempt. Watch what appears in both the customer journey and the staff calendar. If the demonstration ends at a contact form, you have tested an enquiry website, not an instant reservation system.

Confirm who owns the domain and can export the content and booking records. Ask what happens if you change suppliers, which data can leave the system, and whether integrations cost extra. Allow for setup, migration, training, payment fees and ongoing maintenance as well as the subscription.

TopRentApp is one option to assess for car rental management and online booking. Bring the same requirements to any product demonstration and confirm the features available in the plan you are considering.

Set up the domain and a place to test

Register the domain in an account controlled by the business and choose hosting appropriate to the platform. For WordPress, check the current hosting requirements, then use your host’s installer or the official installation instructions. Connect the domain using the records supplied by the host, enable HTTPS and check that both the website and booking destination open without certificate warnings. Keep individual staff accounts and a recoverable backup.

Build the first version on a private test site. Add a simple mobile-friendly theme, create the main pages and connect the booking engine using its supported integration. Enter a small sample fleet with your actual billing rules before copying in every vehicle. Use test payment credentials during setup. When the booking tests pass, move to the live domain, replace test credentials through the provider’s release process, and remove any search-blocking setting from the public pages. Keep the test site private.

Rental business owner working on a laptop in a small branch office

Build the pages customers need before they pay

Keep the initial site manageable. A clear homepage, fleet or vehicle-class pages, location pages, rental conditions and a contact page cover the main decisions. Add a privacy notice and the other disclosures that apply to the business. Policies should be easy to find before the customer commits to a reservation.

On the homepage, explain where you operate and put the date and location search near the top. Show the types of vehicles you actually offer. A traveller arriving late needs collection details more urgently than a long company history, so give that information a clear route from the main page.

A useful vehicle listing answers practical questions: seats, luggage, transmission, fuel or powertrain, and whether the displayed model is an example. Use current photographs of your own fleet where the page represents specific vehicles. State when an image is illustrative and avoid promising a model that a class booking does not guarantee.

Location pages should identify the pickup point, opening hours, return instructions and any delivery arrangement. If an airport customer has to take a shuttle, explain the meeting point and operating hours. A map pin alone does not explain where the handover happens.

Write rental conditions in language the customer can act on. Explain the accepted payment method, security deposit, mileage, fuel or charging policy and what to do if the vehicle breaks down. Make the commercial information consistent with the agreement the customer will sign. Have the applicable legal wording checked for the jurisdictions where you operate.

Make the price and reservation status unambiguous

The customer journey normally moves from dates and location to vehicle class, extras, driver details and checkout. Preserve the customer’s choices when they go back a step. Show a booking summary with pickup and return times, selected extras, the payable amount and the next action.

Consider this fictional price calculation: three rental days at $45, plus a child seat at $5 per day, gives a subtotal of $150 before any applicable taxes or other charges. If a $300 security authorisation also applies, show it separately. A temporary hold is not the same thing as charging another $300 for the rental. Use your own currency, tax treatment and pricing rules in the live system.

ItemExample amountHow to explain it
Vehicle rental: 3 × $45$135The charge for the stated period
Selected child seat: 3 × $5$15An optional extra the customer chose
Rental subtotal$150Before any applicable taxes and other disclosed charges
Security authorisation$300Separate from the rental subtotal; explain timing and release conditions

A request-to-book flow can work when staff must approve availability or driver eligibility. Label the action “Request a booking” and tell the customer when to expect a response. Do not send a confirmed-reservation message while the request is still waiting for approval.

For instant bookings, inventory control must handle two customers attempting to reserve the last available vehicle at the same time. Ask the supplier how it holds stock during checkout, expires an abandoned hold and handles delayed payment messages. Verify that only one successful reservation can consume the final unit.

Traveller using a smartphone beside a packed suitcase in a bright lounge

Connect payments and customer messages to the same booking

Use a payment provider’s supported checkout or secure payment components. Avoid collecting card numbers through a normal enquiry form, email or staff notes. Confirm which payment methods and currencies are supported for your business location, and what the provider requires for deposits, authorisations and refunds.

The return from a payment page is not sufficient proof of payment. With Stripe, for example, its Checkout fulfilment documentation uses server-side payment events to trigger reliable fulfilment. Your integration should check the payment state and process repeated notifications without creating duplicate reservations. Check the corresponding requirements when using another provider. Keep the booking reference attached to the charge, confirmation and staff record. If a payment succeeds but the customer closes the browser, the business still needs to find the reservation and send the correct confirmation. Test the opposite case too: an unpaid booking must not look paid merely because someone reached a confirmation URL.

Send a confirmation that includes the collection location, local pickup and return times, selected vehicle class, charges, amount already paid, balance due and deposit arrangements. Add the documents the driver must bring and a contact route for amendments. Explain whether the customer is confirmed or still awaiting approval.

Store only the customer information the operation needs, restrict staff access, and set a retention policy appropriate to the business. Keep licence images and payment details out of marketing analytics. The privacy notice should describe how the real website and its providers handle customer data; a generic page copied from another business cannot establish that.

Test the booking on a phone and with a keyboard

A calendar that looks clean on a desktop can be difficult to use on a narrow screen. Check whether a customer can change the return date, read the full total and correct a mistake without losing the booking. Test on more than one screen size, including a phone with the keyboard open.

Give every form control an understandable label. The W3C guidance on form labels explains how a visible label and the underlying control should be associated. A placeholder that disappears after typing is a poor substitute for a persistent label.

Error messages should identify the field and explain the correction. “Return time must be after pickup time” helps the customer move forward. A red border alone does not. W3C’s form notification guidance gives practical patterns for accessible feedback.

Use the keyboard to move through the date controls, extras, payment step and confirmation. Check that focus stays visible, that menus can close, and that a validation error takes the user to an understandable place. Ask someone who did not build the site to complete a booking from the conditions page. Their hesitation often points to a missing explanation.

Rental employee preparing a compact car in a clean vehicle collection bay

Run a launch test that reaches the rental desk

Follow the test reservation through to the rental desk. Use the payment provider’s test environment where available. If a final live transaction is necessary, follow the business’s approved test and refund process and keep a clear record of it.

TestExpected result
Last available car booked in two sessionsInventory rules prevent two confirmed bookings for the same final unit
Payment fails or customer abandons checkoutThe booking state and inventory hold follow the documented rules
Payment succeeds but browser closesOne booking and the correct confirmation still exist
Return time changes across a charging boundaryDuration, charges and availability recalculate consistently
An extra sells outThe site stops selling that extra for the affected dates
Rental is cancelled or amendedAvailability, payment actions and customer messages remain consistent
Booking reaches the branchStaff can find the reference, driver requirements, balance and handover details

Record who owns each part after launch: website updates, booking configuration, payment issues and customer support. Back up the content and confirm the recovery process for operational data. If the site becomes unavailable, staff need a known way to handle existing reservations and incoming enquiries.

Finally, measure completed reservations separately from visits and clicks on the booking button. Record checkout failures and availability searches that return no results. Those two reports can tell you whether the next improvement belongs in the website, the pricing rules or the fleet. Work through one actual customer journey before adding another page.

TopRentApp
Privacy Overview

We care about your privacy

1. PRIVACY POLICY

INFORMATION FOR THE PROCESSING OF PERSONAL DATA
(Articles 13 and following of European Regulation 679/2016)

Dear data subject,

Oxygen S.R.L. is a company specialized in the field of Information Technology.

With this document (hereinafter referred to as the “Privacy Policy”), we aim to renew our commitment to ensuring that the processing of personal data collected through this website (hereinafter referred to as the “Website”), carried out in any manner, whether automated or manual, is fully compliant with the safeguards and rights recognized by Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR” or “Regulation”) and other applicable regulations regarding the protection of personal data.

The term “personal data” refers to the definition contained in Article 4, point 1) of the Regulation, which states that “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (hereinafter referred to as “Personal Data”).

The Regulation requires that, before proceeding with the processing of Personal Data – understood as any operation or set of operations performed with or without the use of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction – it is necessary for the person to whom such Personal Data belongs to be informed about the reasons why such data is required and how it will be used.

In this regard, this Privacy Policy – prepared based on the principle of transparency and all the elements required by Articles 13 and following of the Regulation – aims to provide you, in a simple and intuitive manner, with all the useful and necessary information so that you can provide your Personal Data knowingly and informed, and at any time, request clarification and/or rectification.

A. DATA CONTROLLER

The company that will process your Personal Data for the main purpose described in Section B of this Privacy Policy and will therefore act as the data controller, as defined in Article 4, point 7) of the Regulation, which states that the data controller is “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data” is:

– Oxygen S.R.L. (hereinafter referred to as the “Data Controller”), with registered office at Via Francesco Severi, 4, VAT number 16591601006, 00166 – Rome (RM) (hereinafter referred to as the “Registered Office”).

B. PURPOSES

Your personal data is collected and processed by the Data Controller for purposes strictly related to the use of the Website and its informational services. Additionally, your personal data may also be used in various processing operations (such as storage, archiving, processing, etc.) that are compatible with these purposes. In particular, your personal data may be processed for the following purposes:

a) To respond to inquiries;
b) To enable the provision of services requested by you;
c) To comply with legal obligations;
d) To send promotional and direct marketing communications, including newsletters and market research.

The legal basis for the processing of personal data for the purposes described in points a), b), and c) is Article 6(1)(b) and (c) of the GDPR, as the processing is necessary to respond to the data subject’s requests, provide the requested services, and fulfill a legal obligation of the Data Controller. The provision of personal data for these purposes is optional, but failure to provide such data may result in the inability to activate the services provided by the website or respond to requests.

The legal basis for the processing of personal data for the purpose described in point d) is Article 6(1)(f) of the GDPR. The Data Controller may carry out this activity based on its legitimate interests, regardless of your consent, and until your objection or limitation (as provided in Section G, point d) of this Privacy Policy) to such processing, as further explained in Consideration 47 of the Regulation, which considers it a legitimate interest to process personal data for direct marketing purposes. This will also be possible based on the assessments made by the Data Controller regarding the potential prevalence of your interests, rights, and fundamental freedoms requiring the protection of personal data over its legitimate interest in sending direct marketing communications.

Contact methods for direct marketing activities may be both automated and traditional. However, as better specified in Section G, you will have the option to withdraw your consent, even partially, for example by consenting only to traditional contact methods.

Regarding contact methods involving the use of your phone contacts, please note that the Data Controller’s direct marketing activities will be carried out after verifying your possible registration with the Register of Oppositions, as established under the provisions of Legislative Decree September 7, 2010, No. 178 and subsequent amendments.

The personal data required for the above-mentioned purposes will be those indicated in the contact form, including but not limited to: name, surname, email address, and phone numbers.

C. RECIPIENTS TO WHOM YOUR PERSONAL DATA MAY BE DISCLOSED

Your personal data may be disclosed to specific recipients who are considered to be recipients of such personal data.
Indeed, Article 4, point 9) of the Regulation defines the recipient of personal data as “a natural or legal person, public authority, agency, or another body to whom the personal data are disclosed, whether a third party or not” (hereinafter referred to as the “Recipients”).
In order to correctly carry out all the processing activities necessary to achieve the purposes described in this Privacy Policy, the following Recipients may be involved in the processing of your personal data:

  • Third parties who carry out part of the processing activities and/or activities connected and instrumental to the same on behalf of the Data Controller. These parties have been appointed as data processors, which, according to Article 4, point 8) of the Regulation, means “a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller” (hereinafter referred to as the “Data Processor”).
  • Individual persons, employees, and/or collaborators of the Data Controller, who have been entrusted with specific and/or multiple processing activities related to your personal data. These individuals have been given specific instructions regarding the security and proper use of personal data and are defined, in accordance with Article 4, point 10) of the Regulation, as “persons authorized to process personal data under the direct authority of the Data Controller or the Data Processor” (hereinafter referred to as the “Authorized Persons”).

If required by law or to prevent or suppress the commission of a crime, your personal data may be communicated to public entities or the judicial authority without being considered Recipients. In fact, according to Article 4, point 9) of the Regulation, “public authorities that may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be considered recipients”.

D. DATA RETENTION PERIOD

One of the principles applicable to the processing of your personal data concerns the limitation of the retention period, as regulated in Article 5(1)(e) of the Regulation, which states that “personal data shall be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1), subject to the implementation of appropriate technical and organizational measures required by this Regulation to safeguard the rights and freedoms of the data subject.”

In light of this principle, your personal data will be processed by the Data Controller only for the time necessary to achieve the purposes described in Section B of this Privacy Policy.

In particular, regarding the purposes described in Section B points a), b), and c), your personal data, subject to legal obligations, will be processed for a period of time equal to the minimum necessary, as indicated in Consideration 39 of the Regulation, which is 3 months from the contact request.

Regarding the processing carried out for the purpose described in Section B point d) of this Privacy Policy, the Data Controller may lawfully process your personal data for one year.

E. WITHDRAWAL OF CONSENT

As provided by the Regulation, if you have given your consent to the processing of your personal data for one or more purposes for which it was requested, you may revoke it in whole or in part at any time without affecting the lawfulness of the processing based on consent before its withdrawal.

The methods for revoking consent are very simple and intuitive. You just need to contact the Data Controller using the contact channels provided in this Privacy Policy, specifically in Section G point g).

G. RIGHTS

As provided in Article 15 of the Regulation, you have the right to access your personal data, request its rectification and updating if incomplete or inaccurate, request its erasure if the collection was made in violation of a law or regulation, as well as object to the processing for legitimate and specific reasons.

In particular, we hereby inform you of all your rights that you may exercise at any time against the Data Controller.

a. Right of access

You have the right, in accordance with Article 15(1) of the Regulation, to obtain from the Data Controller confirmation of whether or not your personal data is being processed and, if so, access to such personal data and the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom your personal data has been or will be disclosed, particularly recipients in third countries or international organizations; d) where possible, the envisaged retention period for the personal data or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the Data Controller rectification or erasure of personal data or restriction of processing concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You can find all this information within this Privacy Policy, which will always be available to you in the Privacy section of the Website.

b. Right to rectification

You can obtain, in accordance with Article 16 of the Regulation, the rectification of your personal data that is inaccurate. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

c. Right to Erasure

You have the right, in accordance with Article 17(1) of the Regulation, to obtain the erasure of your personal data without undue delay, and the Data Controller shall have the obligation to erase your personal data if one of the following reasons applies: a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; b) you have withdrawn your consent on which the processing is based, and there is no other legal ground for the processing; c) you have objected to the processing pursuant to Article 21(1) or (2) of the Regulation, and there are no overriding legitimate grounds for the processing; d) the personal data have been unlawfully processed; e) the erasure of personal data is required to comply with a legal obligation under EU or Member State law.

In some cases, as provided in Article 17(3) of the Regulation, the Data Controller is entitled not to proceed with the erasure of your personal data if their processing is necessary, for example, for the exercise of the right to freedom of expression and information, for the performance of a legal obligation, for reasons of public interest, for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, or for the establishment, exercise, or defense of legal claims.

d. Right to Restriction of Processing

You have the right to obtain the restriction of processing, in accordance with Article 18 of the Regulation, in the following cases: a) if you contest the accuracy of your personal data (the restriction will be in place for the period necessary for the Data Controller to verify the accuracy of the personal data); b) if the processing is unlawful, but you oppose the erasure of your personal data and request the restriction of their use instead; c) even if the Data Controller no longer needs the personal data for processing purposes, they are required for the establishment, exercise, or defense of legal claims; d) if you have objected to the processing pursuant to Article 21(1) of the Regulation, pending the verification whether the legitimate grounds of the Data Controller override yours.

In case of restriction of processing, your personal data will be processed, except for storage, only with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of substantial public interest. You will be informed before the restriction is lifted.

e. Right to Data Portability

You can, at any time, request and receive, in accordance with Article 20(1) of the Regulation, all your personal data processed by the Data Controller in a structured, commonly used, and machine-readable format or request their transmission to another data controller without hindrance. In this case, it is your responsibility to provide us with all the exact details of the new data controller to whom you intend to transfer your personal data, providing us with written authorization.

f. Right to Object

In accordance with Article 21(2) of the Regulation and as reiterated in Consideration 70, you can object, at any time, to the processing of your personal data when it is carried out for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

g. Right to Lodge a Complaint with the Supervisory Authority

Without prejudice to your right to seek administrative or judicial remedies, if you believe that the processing of your personal data carried out by the Data Controller is in violation of the Regulation and/or the applicable law, you can lodge a complaint with the competent Supervisory Authority for the Protection of Personal Data.

To exercise all your rights as identified above, you simply need to contact the Data Controller using the following methods:
– Sending an

email to the email address info@toprent.app;
– Sending a registered letter to the legal address of Oxygen S.R.L.

H. DATA PROCESSING LOCATIONS

Your personal data will be processed by the Data Controller within the territory of the European Union.

If, for technical and/or operational reasons, it becomes necessary to involve entities located outside the European Union, we inform you in advance that such entities will be appointed as Data Processors in accordance with Article 28 of the Regulation, and the transfer of your personal data to such entities, limited to the performance of specific processing activities, will be regulated in accordance with the provisions of Chapter V of the Regulation.

All necessary precautions will be taken to ensure the total protection of your personal data, basing such transfers on: (a) adequacy decisions of the recipients’ third countries expressed by the European Commission; (b) appropriate safeguards expressed by the third-party recipient in accordance with Article 46 of the Regulation; (c) the adoption of binding corporate rules; (d) the use of standard contractual clauses approved by the European Commission.

In any case, you can request further details from the Data Controller if your personal data has been processed outside the European Union by requesting evidence of the specific safeguards implemented.