Data processing agreement

1. Roles

Your business is the controller of the personal data of its customers, drivers, buyers and staff that it puts into RentDeck. RentDeck is the processor, and processes it only to provide the service and on your documented instructions (these terms and how you use RentDeck).

2. What is processed

Customer and driver details (name, contact details, date of birth, address, licence details), licence photos and selfies if you collect them, bookings, payments made, signed agreements, messages sent, reviews, enquiries and marketing preferences.

3. Security

Each business's data is kept separate in the database with row-level security. Data is encrypted in transit and at rest. Keys and secrets are encrypted. ID photos are private, served through short-lived links, and every view is logged. Access by RentDeck staff is limited, needs two-step sign-in, and is logged.

4. Staff and sub-processors

RentDeck staff with access are bound by confidentiality. Sub-processors: Microsoft Azure (hosting, database, files, email), Cloudflare (network, security, domains), Telnyx (texts and WhatsApp). We will tell account owners 30 days before adding one, and you may object.

5. Helping you meet your duties

RentDeck gives you tools to answer your customers: export a customer's data, erase it on request, and set how long ID photos are kept (deleted automatically after the last rental). We will help with requests the tools don't cover.

We will tell you without undue delay, and within 72 hours, if we become aware of a breach affecting your customers' data, with what we know and what we are doing about it.

6. At the end

You can download your data at any time. When you close your business, RentDeck deletes your data, including files, 30 days later, except where the law requires us to keep it. Backups are overwritten within 35 days.

7. Audits

On request, once a year, we will answer reasonable written questions about how we protect your data. Write to legal@rentdeck.io.