1. Controller
[RENTARVO BETREIBERGESELLSCHAFT]
[ANSCHRIFT]
[E-MAIL]
2. Privacy contact
Privacy contact if appointed: [DATENSCHUTZ-KONTAKT]
Data protection officer if legally required: [DSB]
3. Roles
RENTARVO operates the marketplace and the SaaS software. The named rental company is typically the party to the rental contract and may be an independent controller for that rental. This notice describes processing by the platform. The rental company may publish its own notice.
4. Hosting and storage
Services actually wired or prepared:
- Storage: SQLite
- Payment provider setting: mock
- Stripe: not configured
- PayPal: not configured
- Outbound email: not configured
- Map tiles: OpenStreetMap raster tiles via MapLibre (proxied)
- Geocoding: internal gazetteer (no external geocoding provider in V1)
- Routing: not enabled
- Analytics / Marketing pixels: not used in this codebase
- Object storage / CDN / error monitoring SaaS: not used in V1
- Production host: [HOSTING-ANBIETER]
5. Server logs
Technical connection data may be processed briefly for operational security. [LOG RETENTION]
6. Registration and customer account
Name, email, password hash, optional phone, address, date of birth, driving-licence data.
7. Rental-company account
Company data, contacts, fleet, bookings and settings of that company.
8. Marketplace search and location
Search place, dates, filters. Coordinates only if you use device location; the UI shows an address or place name, not raw coordinates. Search uses OpenStreetMap Nominatim; well-known demo places are also in an internal catalogue. Results are cached.
9. Bookings, contracts, invoices
Booking data including driver details, prices, status, accepted document versions (if recorded).
10. Payments
Payment is initiated via the configured provider. Card data are not stored in this application; they are processed by the payment provider when that provider is used.
11. Licence / ID documents and uploads
Uploaded evidence belongs to the customer account. Rental-company staff see it only if that customer is visible in their company.
12. Support, email, notifications
Contact form, transactional email if configured, in-app notifications. Third-party push is not wired in V1.
13. Cookies
See /cookies. Non-essential technologies (currently map tiles) only after consent where consent is required.
14. Analytics, fraud, maps
No advertising or analytics pixel is included in the shipped code. Maps: OpenStreetMap tiles once the map is loaded with comfort consent. Fraud prevention: login throttling and public rate limits.
15. Recipients
The named rental company (to perform the contract), payment providers if used, hosting [HOSTING-ANBIETER], email provider if configured, authorities where legally required.
16. International transfers
May occur through the chosen payment provider. [THIRD COUNTRY / SCC — LEGAL REVIEW REQUIRED]
17. Legal bases (typical, not exhaustive)
Art. 6 (1) b, c, f GDPR; consent (Art. 6 (1) a) where required for optional technologies.
18. Retention
Contract and invoice data per statutory retention (platform-configurable, default 10 years). Account data until erasure unless a duty prevents it.
19. Rights and complaint
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent. Complaint to a supervisory authority. [DATA PROTECTION AUTHORITY]
20. Automated decisions
No standalone automated decision-making module with legal effect is shipped in V1. Search ranking is described at /ranking.