Data Processing Agreement

Version 1.1 · in force from: 2 November 2026 · last updated: 2026-10-02

This document is a data processing agreement within the meaning of Article 28(3) GDPR. You conclude it with us by accepting the Terms – you do not have to sign a separate document. If your procedure requires a signed version, write to privacy@onerental.app and we will send you a copy for electronic signature.

Controller – the Customer (the rental company) using OneRental under the Terms. Processor – Digital Development, a sole trader business entered in CEIDG (the Polish register of sole traders), NIP PL6372208579, REGON 384504071, address: Leśna 1B, 32-310 Rodaki.

---

1. Subject matter and general principles

1.1. The Controller entrusts the Processor with the processing of personal data to the extent and for the purpose described in Annex A, solely for the purpose of providing the services set out in the Terms.

1.2. The Processor processes the data only on documented instructions from the Controller. The Terms, this agreement, the configuration set by the Controller in the application and requests submitted by the Controller's authorised users are treated as such instructions.

1.3. If the obligation to process follows from Union or national law, the Processor informs the Controller of that before processing, unless that law prohibits it on important grounds of public interest.

1.4. The Processor immediately informs the Controller if, in its opinion, an instruction given infringes the GDPR or other data protection provisions.

1.5. The Processor does not use the entrusted data for its own purposes, in particular it does not sell it and does not use it for marketing or for training artificial intelligence models. Aggregated and statistical data that does not allow individuals to be identified is not personal data and may be used to develop the service.

2. The Controller's obligations

2.1. The Controller declares that it is the controller of the entrusted data and has a legal basis for processing it.

2.2. The Controller fulfils the information obligations towards data subjects, including towards renters and drivers, and is responsible for the content of its own rental terms and privacy notices.

2.3. The Controller does not enter into the application special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR), other than in the cases set out in Annex A. Entering such data contrary to this provision is done at the Controller's sole responsibility.

2.4. The Controller configures its users' permissions in line with the principle of minimum access and immediately withdraws access from persons who have lost the right to it.

2.5. Creating a calendar link (Annex C) is an instruction from the Controller within the meaning of § 1.2. The Controller decides to whom it gives a link and which level of detail it chooses, and is responsible for that disclosure complying with data protection law. Providers of calendar applications and booking platforms that receive a link are recipients chosen by the Controller, not our subprocessors (§ 5). Data they have fetched is outside the Processor's control: deletion and return of data (§ 6.1, § 9) do not reach it, and revoking a link, the Account switching to read-only mode, suspension of access or the end of the Agreement stops further fetches but does not delete copies already fetched.

3. Confidentiality and personnel

3.1. Only persons for whom it is necessary in order to perform their duties are given access to the data, after an authorisation has been granted and a confidentiality commitment made.

3.2. The Processor keeps a register of authorisations and trains its personnel in data protection.

4. Security

4.1. The Processor implements technical and organisational measures appropriate to the risk, described in Annex C, and maintains them throughout the term of the agreement.

4.2. The measures may be changed provided that the level of protection is not lowered.

5. Sub-processing

5.1. The Controller gives general authorisation for the use of the subcontractors (subprocessors) listed in Annex B, published at /subprocessors.

5.2. We give at least 30 days' notice of an intention to add or change a subprocessor – by e-mail to the Account's contact address and by updating the list.

5.3. Within that period the Controller may raise a reasoned objection. If we do not find an alternative solution, the Controller may terminate the Agreement with effect as of the day preceding the introduction of the change, without paying fees for the unused period.

5.4. We impose on the subprocessor obligations no less stringent than those arising from this agreement and we are liable to the Controller for its actions as for our own.

6. Assistance to the Controller

6.1. Data subject rights. The Application allows the Controller to handle on its own a request for access and rectification (viewing and editing the renter's data) and for restriction of processing (archiving the record), and to download documents and reports. Permanent deletion or anonymisation of a renter's data, and export of their data in a machine-readable format, we carry out on the Controller's instruction – without undue delay, no later than within 14 days and at no additional charge for standard requests. You send the instruction to privacy@onerental.app.

6.1a. Documents signed by the renter (rental agreements, protocols) and photographs of the vehicle's condition are not covered by the deletion referred to in § 6.1 – their retention usually follows from accounting obligations and the ability to pursue claims (Article 17(3)(b) and (e) GDPR). The decision to delete them earlier is taken by the Controller and reported to us.

6.2. A data subject request addressed directly to us is passed to the Controller without undue delay, no later than within 3 business days, and we do not answer it on the merits without the Controller's instruction.

6.3. Assistance with the obligations under Articles 32–36 GDPR. We make available the information needed to carry out a data protection impact assessment and to consult the supervisory authority, to the extent that it concerns our services.

7. Personal data breaches

7.1. We inform the Controller of an identified breach of the security of the entrusted data without undue delay, no later than within 24 hours of becoming aware of it, to the e-mail address assigned to the Account.

7.2. The notification contains – to the extent available at the time – the nature of the breach, the categories and approximate number of individuals and records, the likely consequences, the measures taken and proposed to address it, and contact details for further clarification. We supplement the information progressively.

7.3. Notification to the supervisory authority and communication to the individuals are made by the Controller; we provide it with the necessary assistance in doing so.

8. Audit and demonstrating compliance

8.1. On request we make available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR, including a description of the security measures and the test reports we hold.

8.2. The Controller has the right to audit, including inspection, carried out by itself or by an authorised auditor. An audit is announced 30 days in advance, is conducted during business hours, no more than once a year (other than after a breach or at the authority's request), in a way that does not disrupt the continuity of the services and preserves the confidentiality and security of other customers' data. The cost of the audit is borne by the Controller, except for an audit that reveals a material breach on our side.

9. End of processing

9.1. After the provision of the services ends, we return the data or delete it, as the Controller chooses.

9.2. In the absence of other instructions we apply the procedure from the Terms: the account switches to read-only mode for 30 days so that data can be exported, after which the data is deleted from the production environments and the backups expire in line with the retention cycle. Until the backups expire, the data remains covered by this agreement.

9.3. We retain data whose storage is required by law, only to that extent and for the period required by those provisions.

10. Final provisions

10.1. This agreement is in force for the duration of the main Agreement and, as regards § 9 – until the deletion of the data is complete.

10.2. In the event of a conflict between this agreement and the Terms, this agreement prevails in data protection matters.

10.3. We make changes under the procedure for amending the Terms (§ 10 of the Terms), giving 30 days' notice.

---

Annex A – description of the processing

Subject matter: provision of the OneRental service (SaaS for rental company management and reservation handling).

Duration: the term of the Agreement and the period for deleting the data in accordance with § 9.

Nature and purpose: storage, structuring, making available to the Controller's authorised users and – on its instruction – to the recipients of calendar links (Annex C), generating documents, sending notifications, creating backups, maintenance and technical support.

Categories of data subjects:

• renters and additional drivers,
• contact persons of the Controller's business customers,
• the Controller's employees and associates who use the system,
• persons who get in touch through the Controller's reservation or contact form.

Types of data:

• identification and contact data: first name, surname, e-mail, telephone, address, date of birth,
• driving licence data: number, country and dates of issue and of expiry, driving experience (without photographs of the document),
• reservation and rental data: dates, vehicle, prices, deposit, change history,
• documents: rental agreements, handover and return protocols, electronic signatures, attachments uploaded by the Controller,
• photographs of the vehicle's condition and of damage taken at handover and return,
• settlement data: amounts, forms and statuses of payments and deposits recorded by the Controller,
• correspondence and service notes, including the reasons for an entry on the refusal list,
• technical data: account identifiers, access logs, IP addresses.

Special categories of data: the application does not provide for collecting them. The Controller should not enter health data or other data under Article 9 GDPR in description fields.

Identity verification status: we store the verification status set manually by the Controller's personnel; we do not store photographs of identity documents.

Annex B – subprocessors

Current list: /subprocessors. It forms an integral part of this agreement.

Annex C – technical and organisational measures

Access control

• session-based authentication of users with token rotation; passwordless sign-in – with a one-time link sent by e-mail or with a Google account,
• roles and permissions (RBAC) checked on the server side on every user request; calendar links (iCal) are authenticated separately, as described below,
• data isolation between customers at the database level (Row-Level Security) and mandatory filtering by tenant identifier in the application layer,
• personnel access to the production environment limited to persons holding administrative roles, with multi-factor authentication.

Calendar links (iCal)

• an optional feature: the Controller creates a link and decides to whom it gives it (§ 2.5); through the link a calendar application or booking platform fetches reservations without signing in, read-only,
• authentication by a token contained in the address, derived with HMAC-SHA256 and not stored in the database; we verify the token on every fetch, before any data is read,
• each link is limited to one company and to all of its reservations, one branch or one vehicle; reservations are read with the data isolation between customers preserved,
• the default level “Busy only” contains no data about renters; the “Staff details” level contains the reservation reference, the renter's first name and surname, branch names and a link to the reservation in the application; no level contains contact data, driving licence or identity document data, date of birth, notes or amounts,
• a link works only while the Controller's Plan includes the feature, the Account is not in read-only mode and access to it is not suspended; the Controller may revoke it at any time, with effect from the next fetch,
• creating and revoking a link are recorded in the audit log; we do not write the link's address to the audit log or to application logs – as part of the request address it may reach the request logs of infrastructure providers (Annex B).

Data protection

• encryption in transit (TLS 1.2+) and of data at rest on the infrastructure providers' side,
• stored files accessible only through time-limited signed addresses (calendar links do not expire – they work until revoked),
• no storage of full payment card data – Stripe handles it.

Business continuity

• daily backups with point-in-time recovery,
• separated environments: production, test and preview (without production data),
• availability monitoring and event logging in an independent system.

Accountability

• an audit log of changes identifying the user, the time and the IP address,
• review of code changes before deployment, automated tests and dependency scanning,
• a procedure for reporting and handling security incidents,
• confidentiality commitments for personnel and subcontractors.

We do not hold our own security certifications (e.g. ISO 27001) or penetration test reports; we use the infrastructure of the providers indicated in the Subprocessor list, who maintain such certifications. We will update this annex once we carry out our own audit or penetration test.

Annex D – transfers outside the EEA

We process data in the European Union wherever the provider makes it possible. For providers outside the EEA we use standard contractual clauses (European Commission Implementing Decision 2021/914) or the adequacy decision under the EU–US Data Privacy Framework, together with a transfer impact assessment. We indicate the basis for each provider in the Subprocessor list. Annex D does not cover the disclosure of data to recipients chosen by the Controller (§ 2.5); assessing such disclosure is for the Controller.