Legal
Privacy Policy
Effective: 15 May 2026 · Last updated: 2 September 2026
1. Who We Are
Rentouri is operated by Damian Gadomski, a sole trader (Jednoosobowa Działalność Gospodarcza) registered in Poland under NIP: PL5213819318, with a business address at ul. Zamiany 8/LU202, 02-786 Warszawa (“Rentouri”, “we”, “us”, “our”).
We operate the website rentouri.com and the ERP platform app.rentouri.com.
For any privacy questions, contact us at: [email protected]
2. Data We Collect
When you register as a guest:
- Email address and password (stored as a one-way hash — we cannot read it)
- First and last name
- Phone number — shared with the shop you book with so they can reach you about your rental
When you make a booking:
- Booking details: dates, equipment type, shop location
- Rental agreement e-signature: your typed or drawn signature, signer name, IP address, and browser information — kept as evidence that the agreement was signed
- Payment information — processed by Stripe; we never store card numbers or CVVs
- Identity verification status — if verification is required, it is processed by Stripe Identity and we receive only a pass/fail result
When you use the platform:
- IP address, browser type, device type
- Pages visited and actions taken (server logs)
When you register as a shop owner:
- Business name, VAT/NIP number, registered address
- Bank account details — provided directly to Stripe via their hosted onboarding; we do not store these
When you subscribe to our newsletter:
- Email address only — no account is required, and subscribing is entirely optional
- Confirmation of your opt-in (timestamp and IP address), kept as proof of consent
- Whether you opened or clicked a newsletter we sent, so we can measure what is worth writing about
3. Legal Basis for Processing (GDPR Article 6)
| Data | Legal Basis |
|---|---|
| Account registration | Contract performance (Art. 6(1)(b)) |
| Booking processing | Contract performance |
| Rental agreement signature records | Contract performance + legitimate interest — evidence that the agreement was signed |
| Payment processing | Contract performance + legal obligation |
| Identity verification (where required) | Legal obligation + legitimate interest |
| Platform server logs | Legitimate interest (Art. 6(1)(f)) — security and abuse prevention |
| Login and registration protection (Google reCAPTCHA) | Legitimate interest (Art. 6(1)(f)) — preventing automated abuse |
| Newsletter and marketing emails | Consent (Art. 6(1)(a)) — given by subscribing and confirming; you may withdraw at any time via the unsubscribe link in every email |
| Financial records | Legal obligation (Art. 6(1)(c)) — Polish tax law requires 5-year retention |
4. How We Use Your Data
- Process bookings and reserve the equipment you selected
- Process payments and manage refunds and damage deposit releases
- Send transactional emails: booking confirmation, pickup reminder, return reminder
- Send our newsletter — roughly monthly, and only if you subscribed and confirmed your address
- Verify your identity where verification is required (Stripe Identity)
- Protect login and registration forms from automated abuse (Google reCAPTCHA)
- Operate, secure, and improve the platform
- Respond to support requests
- Comply with our legal obligations (tax, consumer law, GDPR)
5. Who We Share Your Data With
With rental shops: When you make a booking, we share the minimum necessary information with the relevant shop — your name, phone number, booking dates, and the equipment you booked — so they can fulfil the rental. Shops receive this data as independent data controllers and are contractually prohibited from using it for marketing, contacting you outside the Rentouri platform, or sharing it with third parties.
With our service providers (data processors):
- Stripe, Inc. (USA) — payment processing and identity verification. Data is transferred to the US under Standard Contractual Clauses (SCCs). Stripe Privacy Policy: stripe.com/privacy
- Hetzner Online GmbH (Germany) — server hosting and object storage. Data remains within the EU/EEA.
- Google LLC (USA) — reCAPTCHA, which protects our login and registration forms from automated abuse. Google receives your IP address and browser information when you use those forms. Data is transferred to the US under the EU–US Data Privacy Framework. Google Privacy Policy: policies.google.com/privacy
- OpenFreeMap (map tile rendering) and the OpenStreetMap Foundation / Komoot GmbH (Germany) — map tiles and address search. Map and search requests include your IP address and the place you search for, but no personal booking data.
- Klaviyo, Inc. (USA) — newsletter delivery, for subscribers only. It receives your email address, your opt-in record, and newsletter open/click activity — never your bookings or payment data. Data is transferred to the US under Standard Contractual Clauses (SCCs). Klaviyo Privacy Policy: klaviyo.com/legal/privacy
We do not sell your data. We do not share your data with advertisers.
6. Data Retention
| Data | Retention Period |
|---|---|
| Account data (name, email, phone) | Until you request account deletion |
| Booking records | 5 years from booking date (Polish tax law) |
| Payment records | 5 years from payment date (Polish tax law) |
| Identity verification records | As required by Stripe Identity compliance obligations |
| Signed rental agreements and signature records | 6 years after the rental ends (limitation period for contract claims) |
| Newsletter subscription and consent record | Until you unsubscribe, then 3 years for the consent record as proof the mailing was lawful |
| Server logs | 90 days |
When you request account deletion, we anonymise all personal data we are not legally required to retain. Anonymised booking records may be kept for aggregate analytics.
7. Your Rights Under GDPR
You have the right to:
- Access — request a copy of personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of your data (subject to legal retention requirements)
- Restriction — restrict processing in certain circumstances
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interest
- Withdraw consent — for any processing based on consent, at any time without affecting the lawfulness of prior processing. For the newsletter, the unsubscribe link at the bottom of every email does this immediately.
To exercise any right, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw — uodo.gov.pl.
8. Cookies
- Strictly necessary cookies: session management and authentication. No consent required — without these the platform cannot function.
- Stripe cookies: set when you interact with the payment form. Required for fraud detection and 3D Secure authentication.
- Google reCAPTCHA cookies: set on the login and registration pages to distinguish people from bots. Google receives your IP address; see policies.google.com/privacy.
- Analytics cookies: we currently do not use third-party analytics. If we introduce analytics in future, we will update this policy and request your consent first.
9. Security
We apply industry-standard security measures: TLS 1.3 encryption in transit, encrypted storage at rest, least-privilege access controls, and regular security reviews. No system is 100% secure. If you discover a security vulnerability, please report it responsibly to [email protected].
10. Changes to This Policy
We may update this policy. For material changes, we will notify registered users by email and update the “Last updated” date above. Continued use of the platform after the notification period constitutes acceptance of the revised policy.
11. Contact
- Data controller: Damian Gadomski
- Email: [email protected]
- Address: ul. Zamiany 8/LU202, 02-786 Warszawa
- Supervisory authority: UODO, ul. Stawki 2, 00-193 Warsaw, Poland