Privacy policy
We respect your privacy. Below we explain what data Rent-Move.IT collects, why, how long we keep it, who we share it with and what rights you have — including how we use data received from Google.
1. Data controller and contact
The personal data controller is Rent-Move.IT Daniel Zasieczny, Huby 6j, 64-553 Grzebienisko, Poland, NIP 7872157437.
For any personal data matter, write to danielzasieczny@rent-move.it or call +48 734 490 136. We have not appointed a data protection officer — the controller handles all matters directly.
2. Scope of this policy
This policy describes how personal data is processed in the Rent-Move.IT service: on rent-move.it (including the calculators, the booking form and the contact forms of the IT, drone and electrical service pages), in the customer panel, in the rental operator panel and in the API running at api.rent-move.it. It covers website visitors, customers, drivers named in a reservation and people who send us messages.
We process data in line with Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act and the Polish Electronic Communications Law.
3. What data we process
| Category | Data | Source |
|---|---|---|
| Customer account | name, e-mail address, password (stored only as a cryptographic hash by Supabase Auth — we never know your password), optionally company name, phone number (required when booking — we also save it in your profile to pre-fill your next booking), marketing consent status | from you at sign-up, or from your Google account (section 6) |
| Reservation | contact phone number (required — we call it about vehicle pick-up and return, e.g. to confirm a cash booking), vehicle, pick-up and return date and time, options (child seats, additional driver, insurance package, trip abroad, after-hours pick-up), price, discount, required deposit, payment method, reservation status, date change requests, cancellation reason | from you (calculator, customer panel) or from the operator for phone bookings |
| Driver | date of birth, driving licence category, licence expiry date, statement that no driving ban applies | from you when booking; on your next booking the panel pre-fills them from the previous one |
| Sales document | document type (receipt or invoice) and, for an invoice, tax ID (NIP), company name, address | from you |
| Payments | amount, Paynow transaction ID and status, payment date, refunds; for cash — confirmation that payment was received. We never process card numbers or bank login data — Paynow handles them | from Paynow and from the operator |
| Deposit | amount of the cash deposit taken at pick-up, amount returned, amount withheld and the reason | from the operator |
| Vehicle condition and protocol | photos of the vehicle at pick-up and return, mileage, fuel level, description and location of damage, handover protocol in PDF; for an electronic signature — the signature image, name, date and time, IP address and browser details | from the operator; the signature — from you |
| Customer messages | e-mail address and the phone number from the booking, message type (e.g. confirmation, pick-up reminder, protocol link), delivery status and the provider’s message ID | generated by the system |
| Contact form | name, e-mail address, subject and message text, optionally company and phone number (give it if you would like us to call you back), the page language — we use it for the confirmation of your enquiry that we send to the e-mail address you gave | from you |
| Visit statistics | page visited, vehicle viewed, event type (e.g. booking started), country derived from the browser time zone (the IP address is never sent to any geolocation service), and a visitor identifier: without consent — anonymous, computed on the server from a hash of the IP address and browser with a key rotated daily (nothing is stored in your browser and it cannot be linked to a person or to a visit on another day); with consent — a random identifier stored in your browser. The IP address itself is not stored; no form contents, e-mails or reservation numbers | from your browser; “Essential only” in the cookie banner turns collection off completely |
| Partner banners | daily number of views and clicks of each banner — without any personal identifier and nothing stored in the browser; with “Essential only” nothing is counted. A click takes you to the partner’s site, which has its own privacy policy | automatically from your browser |
| Technical and security data | IP address, browser and device type, request time and URL in server logs, counters that limit the number of attempts (abuse protection) | automatically from your device |
| Browser storage | sign-in session, language and theme choice, cookie banner decision, unfinished reservation — see the cookie policy | stored in your browser |
We do not collect special categories of data (e.g. health data) or criminal records. We do not store scans of identity cards or driving licences in the service; if the rental agreement requires showing or copying a document, this happens at vehicle pick-up.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| creating and running the customer account | Art. 6(1)(b) — contract for an electronic service |
| quote, reservation, vehicle pick-up and return, performing the rental agreement | Art. 6(1)(b) — contract or steps before entering into it |
| preliminary driver check (age, licence category and validity) | Art. 6(1)(b) and (f) — fleet safety |
| online and cash payments, deposit settlement | Art. 6(1)(b) |
| issuing receipts and invoices (including via KSeF), accounting | Art. 6(1)(c) — tax and accounting obligations |
| documenting vehicle condition, protocol and signature, establishing and defending claims | Art. 6(1)(f) — legitimate interest |
| transactional messages (confirmations, reminders, protocol link) by e-mail and text message | Art. 6(1)(b) |
| answering a contact form enquiry | Art. 6(1)(b) or (f) |
| marketing information | Art. 6(1)(a) — consent (voluntary, withdraw it in the panel settings) |
| anonymous aggregate visit statistics (nothing stored in the browser) | Art. 6(1)(f) — legitimate interest: knowing which pages and services interest visitors; object with “Essential only” in the cookie banner |
| analytics with an identifier stored in the browser | Art. 6(1)(a) — consent in the cookie banner |
| settling partner banners (aggregate view and click counts) | Art. 6(1)(f) — legitimate interest: settling with advertisers |
| service security, abuse protection, operator audit log | Art. 6(1)(f) |
| syncing reservations to the rental owner’s Google Calendar | Art. 6(1)(f) — organising the rental business (section 7) |
5. Do you have to provide data
Providing data is voluntary, but without account, reservation and driver data we cannot enter into or perform the rental agreement, and without invoice data we cannot issue an invoice. A phone number is required for a booking, because we use it to contact you about vehicle pick-up and return; in the contact forms a phone number is optional. Marketing and analytics consent are never a condition of using the service.
6. Sign in with Google
You can create an account or sign in with the “Continue with Google” button. Sign-in is handled by Supabase Auth on our behalf. From Google we receive only basic profile data: name, e-mail address, profile photo URL and Google account ID — within the “openid”, “email” and “profile” scopes.
This data is used only to create your account, sign you in and contact you about reservations. We get no access to your Gmail, contacts, files, calendar or any other data in your Google account. You can revoke the connection at any time at myaccount.google.com/permissions.
7. Google user data — Google Calendar integration
The operator panel lets the rental owner connect their own Google account so that reservations appear in their Google Calendar. The integration is used only by the Rent-Move.IT owner (administrator). Customers are never asked for access to their calendar.
What data we access
- Permission scope: https://www.googleapis.com/auth/calendar.events — creating, updating and deleting calendar events.
- The app creates, updates and deletes only the events it created itself for Rent-Move.IT reservations (each tagged with the reservation ID). It does not read, search or analyse any other events in the calendar.
- If Google provides it, we also store the e-mail address of the connected account — only to show in the panel which account is connected.
How we use it
An event in the owner’s calendar contains: the vehicle, reservation number, customer name, customer e-mail and phone, amount, payment status, reservation status and the pick-up and return times. This data is used only to organise vehicle pick-ups and returns. When a reservation changes or is cancelled, the event is updated or deleted.
How we store and protect it
- The refresh token from Google is stored in a database in the European Union (Supabase, Frankfurt) only in encrypted form (AES-256-GCM); the encryption key is kept separately in the server configuration.
- The access token is used only in server memory for the duration of the Google API call and is never stored.
- The connection to Google and all communication are encrypted (HTTPS). Only an account with the owner role can connect or disconnect the integration.
Who we share it with
We do not sell data received from Google APIs, share it with third parties, use it for advertising (including personalised ads), for creditworthiness assessment or to train artificial intelligence or machine learning models. No person reads this data unless the owner consents, it is necessary for security purposes (e.g. investigating abuse) or the law requires it.
Retention and deletion
- We keep the token only until the calendar is disconnected. The “Odłącz Google” (Disconnect Google) button in the operator panel immediately deletes the encrypted token from the database.
- Access can also be revoked at any time at myaccount.google.com/permissions — the app then can no longer write to the calendar.
- Events already created remain in the owner’s calendar and can be deleted there. On request sent to the address in section 1 we delete all data from the integration within 30 days.
Rent-Move.IT’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. Who receives the data
We entrust data only to providers the service cannot work without, and only to the extent needed. We have data processing agreements with the processors acting on our behalf.
| Recipient | Scope and purpose |
|---|---|
| Supabase, Inc. | database, sign-in (including via Google) and private file storage (vehicle photos, protocols, sales documents); servers in the EU (Frankfurt) |
| hosting provider | servers of rent-move.it and api.rent-move.it, server logs |
| Paynow (mBank S.A.) | online payments; Paynow processes payment data as a separate controller |
| Resend, Inc. | sending transactional e-mails (e-mail address, message content) |
| SMSAPI (LINK Mobility Poland sp. z o.o.) | sending transactional text messages (phone number, content) — only when text messaging is enabled |
| Google Ireland Limited / Google LLC | Google sign-in (section 6), the owner’s calendar (section 7), directions map embedded on the site (Google Maps loads from Google’s servers) |
| Ministry of Finance (KSeF) | structured invoices in the National e-Invoicing System — legal obligation |
| accounting office, legal advisers | accounting and legal protection, to the extent necessary |
| insurer, repair shop, public authorities | handling damage claims, or when required by law (e.g. police, court, tax office) |
We do not sell personal data or share it for advertising purposes.
9. Transfers outside the EEA
Some providers (Supabase, Resend, Google) are companies based in the USA. Database data is stored in the EU, but the provider may have service access from the USA. Such transfers are based on the European Commission adequacy decision (EU-US Data Privacy Framework) where the provider is certified, or on standard contractual clauses approved by the European Commission. You can get a copy of the safeguards by writing to the address in section 1.
10. How long we keep data
| Data | Period |
|---|---|
| customer account | until the account is deleted; afterwards only data linked to reservations and documents, for the periods below |
| reservations, payments, sales documents | 5 years from the end of the calendar year in which the tax payment deadline passed (tax and accounting law) |
| handover protocol, photos, signature, deposit settlement | as for sales documents and, if a dispute is ongoing, until it ends and claims become time-barred |
| protocol signing link | single-use, valid 72 hours; only its cryptographic hash is stored |
| driver data | as for the reservation they were given for |
| document copy (if the agreement requires it) | the agreement term and no more than one year after it ends, unless longer is required by law or to defend claims |
| contact form | 90 days, or as for reservation data if the enquiry leads to a booking |
| visit statistics | up to 13 months, then deleted automatically |
| cash booking notification metadata | 13 months |
| e-mail and text messages (delivery log) | as for the reservation they relate to |
| owner’s Google Calendar token | until the calendar is disconnected (section 7) |
| marketing consent and marketing data | until consent is withdrawn |
| server logs and security counters | briefly, only as long as needed for diagnostics and abuse protection |
After the period ends we delete the data or irreversibly anonymise it. We keep it longer only when necessary to establish, pursue or defend claims — until they become time-barred (generally 6 years, and 3 years for claims related to business activity).
11. Automated decisions and profiling
The calculator automatically computes the price from the vehicle, dates and options. The panel automatically checks that the driver is at least 18 on the pick-up day and that the category B licence is valid until the return day — this is a preliminary check; a person makes the final decision to hand over the vehicle at pick-up. We make no decisions based solely on automated processing that produce legal effects or similarly significantly affect you, and we do not profile you for marketing.
12. Your rights
- right of access and to a copy of your data (Art. 15 GDPR),
- right to rectification (Art. 16),
- right to erasure, including deleting your account (Art. 17),
- right to restriction of processing (Art. 18),
- right to data portability (Art. 20),
- right to object to processing based on legitimate interest (Art. 21),
- right to withdraw consent at any time — without affecting the lawfulness of processing before withdrawal,
- right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
To exercise your rights, write to the address in section 1. We reply without undue delay and within one month at the latest (in specific cases this may be extended by two months — we will tell you). We may ask you to confirm your identity so we do not disclose data to the wrong person. You can change analytics consent with the “Cookie settings” button in the page footer and marketing consent in the customer panel settings.
13. Data security
- all connections to the site, panels and API are encrypted (HTTPS, HSTS),
- passwords are stored by Supabase Auth only as cryptographic hashes,
- only people with an assigned role can access the operator panel, and permissions (e.g. to customer and financial data) are checked on the server; operator actions are recorded in an audit log,
- photos, protocols and sales documents are kept in private file storage, and the browser only receives short-lived signed links to them,
- Google integration tokens are encrypted (AES-256-GCM) and service keys are kept only in the server configuration,
- we limit the number of sign-in and form attempts and verify the signatures of payment notifications.
Under the rental agreement you may be informed that the vehicle’s position is monitored by GPS; location data is used only for vehicle security, performing the agreement and protecting claims. The service does not monitor or record the vehicle interior. No method of transmitting data over the internet is 100% secure; we will inform you of a personal data breach likely to result in a high risk, as required by the GDPR.
14. Children
The services are intended for adults. We do not knowingly collect data from people under 16; if we learn that we have, we will delete it.
15. Changes to this policy
We update this policy when the services, the way data is processed or the law changes. The current version is always available on this page with the date of the last change. Registered customers will also be informed of significant changes by e-mail.