Privacy Policy
This is an English translation of a document drawn up in Polish and governed by Polish law. It is provided for information only: if the two versions differ, the Polish version prevails.
Contents
Version 2.1 · in force from: 11 October 2026 · last updated: 2026-10-11
This policy explains what personal data we process in connection with OneRental, for what purpose and on what basis, who processes it on our behalf and what rights you have. It is supplemented by: the Cookie Policy, the Subprocessor list and the Data Processing Agreement for business customers.
1. Who is the controller
The controller of the data, within the scope described in § 3, is Digital Development, a sole trader business entered in CEIDG (the Polish register of sole traders), NIP PL6372208579, REGON 384504071, address: Leśna 1B, 32-310 Rodaki (“OneRental”, “we”).
Contact in personal data matters: privacy@onerental.app, alternatively support@onerental.app or the postal address above.
We have not appointed a data protection officer – we are not obliged to do so under Article 37 GDPR.
2. Two roles: controller and processor
OneRental is software for rental companies. The same company can act in two different roles – this distinction decides who you address your requests to.
| Whose data | Who is the controller | Our role |
|---|---|---|
| Rental company employee accounts (login, permissions), billing data, correspondence with us | OneRental | controller |
| Visitors to the onerental.app pages, enquiries from forms, newsletter, leads | OneRental | controller |
| Renters, drivers, reservations, agreements, photos, damage reports – entered into the system by the rental company | the rental company (our customer) | processor |
| Data of people visiting the rental company's booking page | the rental company, and us as regards the infrastructure | processor |
If you have rented a vehicle and want to exercise your rights (access, erasure, rectification), turn to the rental company with which you concluded the agreement. If you come to us, we will pass your request on to the relevant rental company and let you know – we cannot ourselves dispose of its data.
The rules on which we process data in the role of processor are set out in the Data Processing Agreement.
3. What we process as a controller
| Data category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Account data: first name and surname, e-mail, avatar, role, Google account identifier (with Google sign-in) | setting up and running the account, authentication, support | Article 6(1)(b) GDPR (contract) | the term of the agreement + 30 days; then erasure |
| Login and session data: IP address, user-agent, login time, session tokens | security, abuse detection, keeping the session alive | Article 6(1)(f) (legitimate interest: security) | up to 90 days from expiry of the session |
| Audit log: who changed what and when in the system, IP address | accountability, handling complaints and incidents | Article 6(1)(f) and (c) (Article 5(2) GDPR) | the term of the agreement (the log is not cleared automatically) |
| Billing data: company, NIP, address, payment history, Stripe customer identifier | performance of the agreement, issuing invoices | Article 6(1)(b) and (c) (tax obligations) | 5 years from the end of the tax year |
| Contact data from forms (contact, demo, quote) and correspondence | answering the enquiry, running the sales process | Article 6(1)(b) and (f) (commercial contact) | 24 months from the last contact |
| E-mail address in the newsletter | sending product information and marketing materials | Article 6(1)(a) (consent) + Article 398 PKE (the Polish electronic communications law) | until consent is withdrawn |
| Data on use of the sites: analytics events, cookie identifiers, approximate location from IP | statistics, product improvement, measuring campaign effectiveness | Article 6(1)(a) (consent – analytics and marketing cookies) | as set out in the Cookie Policy, max. 13 months |
| Google Ads conversions and remarketing: the ad click identifier, the conversion (trial started, lead form sent, demo booked) with its transaction identifier, and a SHA-256 hash of the e-mail address and, where given, the phone number you entered | measuring which ads lead to sign-ups and enquiries; with consent to ad personalisation, showing our ads to people who visited our pages (remarketing) | Article 6(1)(a) (consent – marketing cookies) | conversion cookies up to 90 days; remarketing lists up to 540 days (Google Ads) |
| Session recordings and interface events: replay of the course of a visit, performance metrics, reported errors; for a logged-in user also the account identifier, first and last name and e-mail address, and the company's identifier, name and plan | error diagnostics, improving the usability of the application | Article 6(1)(a) (consent – analytics cookies) | as per the retention set in Better Stack, 30 days by default |
| Technical logs and application errors | maintenance and diagnostics | Article 6(1)(f) (proper functioning of the service) | 30 days |
Providing the data marked as required is a condition of concluding the agreement – without it we will not set up an account. Providing data in marketing forms is voluntary.
4. Where we get your data from
Usually directly from you. We may also receive data:
- from the rental company that invited you to its account as an employee (first name, surname, e-mail, role),
- from Google, if you sign in with a Google account (first name and surname, e-mail address, profile picture, account identifier – within the extent of the
openid email profilescope; we do not retrieve the contents of your mailbox or your contacts), - from public registers (CEIDG, KRS (the Polish court register of companies), VIES) when verifying invoicing details.
5. Who we pass data to
5.1. We entrust data to providers that process it solely on our instructions: hosting and infrastructure, database, transactional e-mail, payments, analytics, monitoring and error diagnostics, ticket handling. We publish the current list, naming each provider together with the country of processing, as the Subprocessor list.
5.2. We may also disclose data to: legal and accounting advisers (on a confidential basis), public authorities – where the obligation follows from a provision of law, and to a buyer of the business in the event of a merger or sale, with the same protection rules maintained.
5.3. We do not sell personal data and we do not make it available to data brokers.
5.4. Google advertising tags. Our pages and the sign-up flow load Google's tags (Google Tag Manager, Google Analytics and Google Ads) in Google Consent Mode:
- Before you decide, and if you refuse, the tags store nothing on your device and read nothing from it. They send Google only cookieless signals: that a page was viewed or a conversion happened, the page address (which can contain an ad click identifier), the consent state, and the connection's IP address, which Google needs to deliver the request. No hashed contact data is sent. Google uses these signals to estimate conversions in aggregate. Basis: our legitimate interest in measuring our own advertising (Article 6(1)(f) GDPR); you can object at any time.
- With consent to marketing, Google Ads also stores the ad click identifier in cookies on onerental.app and receives the conversion with a SHA-256 hash of the e-mail address and phone number you entered ("enhanced conversions"), so it can match the conversion to the ad that led to it. Google receives the hash, not the address or number.
- With consent to ad personalisation, Google may add your browser to our remarketing lists and show you our ads on its services.
For conversion measurement Google acts on our behalf under the Google Ads Data Processing Terms; for ad personalisation Google Ireland Limited is a separate controller. How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites.
6. Transfers outside the EEA
We aim to process data in the European Union and we choose European regions wherever the provider makes that possible. Some providers are US companies – in such cases the transfer is based on standard contractual clauses (Article 46(2)(c) GDPR) or on an adequacy decision under the EU–US Data Privacy Framework, supplemented by encryption in transit and at rest. We indicate the basis for a specific provider in the Subprocessor list. We make a copy of the safeguards available on request.
7. Security
We use, among others: encryption of transmission (TLS) and of data at rest, isolation of data between customers at the database level (Row-Level Security), role-based access control, the principle of least privilege for staff, multi-factor authentication in administrative tools, event logging, backups with point-in-time recovery, and review of code changes before deployment. A fuller description of the measures is in the annex to the Data Processing Agreement.
We report a personal data breach to Prezes UODO (the President of the Polish data protection authority) within 72 hours of becoming aware of it, and to the data subjects – without undue delay, where the breach may result in a high risk.
8. Your rights
You have the right to: access to the data and a copy, rectification, erasure, restriction of processing, portability of the data, objection to processing based on a legitimate interest (including to direct marketing – with immediate effect) and withdrawal of consent at any time, without affecting the lawfulness of the earlier processing.
You address requests to the address in § 1. We respond within one month; in complex matters we may extend this deadline by two months, informing you of the reason.
You are also entitled to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (the President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
9. Automated decisions and profiling
We do not take decisions based solely on automated processing which would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). In the area of marketing we run statistics and audience segmentation on the basis of cookie consents – this is low-impact profiling, to which you can object.
10. Cookies
The rules for the use of cookies and similar technologies, including the list of specific tools and how to change your consent, are described in the Cookie Policy.
11. Children
The Application is intended for businesses. We do not direct our services to persons under 16 years of age and we do not knowingly collect their data.
12. Changes to the policy
We give notice of material changes by e-mail or by a message in the application at least 14 days in advance. The date of the last update is at the top of the document; we make earlier versions available on request.