RentProg Privacy Policy

Last Updated: October 29, 2026

RentProg cares about your privacy. We aim to ensure that your personal data is secured by managing it in accordance with the provisions of the EU General Data Protection Regulation (GDPR) implemented on May 25, 2018, and other applicable data protection laws.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our services. By using our services, you agree to the collection and use of information in accordance with this policy.

1. Data Controller

RentProg is a car rental management software service. The data controller responsible for your personal data is:

RENTPROG, UNIPESSOAL LDA
Registered in Portugal
Commercial Registry Number: 519104528
Tax Identification Number (N.I.P.C.): 519104528
Registered Office: Estrada Nacional 2, 7, Carvoeira, 3360-179 Penacova, Portugal
Email: admin@rentprog.com

We provide software as a service (SaaS) for rental businesses to manage their operations, including customer management, booking systems, and related services.

2. Personal Data We Collect

We collect and process the following categories of personal data:

2.1. For Platform Users (Rental Business Owners/Operators):

• Name and surname
• Email address
• Phone number
• Company name and business information
• Tax identification number (TIN) - required for payment processing and invoicing
• Payment and billing information
• Account credentials and preferences
• Usage data and analytics

2.2. For End Customers (Renters) - Processed on Behalf of Our Clients:

• Name and date of birth
• Contact information (address, telephone number, email address)
• Passport and identity document information
• Driver's license information and photographs
• Tax identification number (where applicable in certain jurisdictions)
• Vehicle rental transaction details
• Payment information (processed by third-party payment processors)
• Social media account information (if provided)

3. How We Use Your Personal Data

We process your personal data for the following purposes:

3.1. Service Provision and Contract Performance:

• Provide access to and operation of the RentProg platform
• Process registrations and manage user accounts
• Enable rental businesses to manage their operations
• Process bookings and rental transactions
• Provide customer support and respond to inquiries
• Send service-related communications and notifications
• Process payments and billing
• Prevent fraud and ensure transaction security

3.2. Legal Compliance:

• Comply with legal obligations and regulatory requirements
• Respond to requests from government and law enforcement agencies
• Establish, exercise, or defend legal claims
• Maintain records for audit and compliance purposes

3.3. Business Operations:

• Analyze usage patterns and improve our services
• Conduct internal research and development
• Maintain security and prevent misuse of our platform
• Monitor and ensure system performance

3.4. Marketing (with consent):

• Send promotional materials about our services and special offers
• Conduct marketing campaigns and surveys
• Personalize user experience and recommendations

You may opt out of marketing communications at any time by following the unsubscribe instructions in our emails or contacting us at admin@rentprog.com.

3.5. AI-Assisted Document Recognition:

To speed up the booking process and reduce manual data entry errors, the platform may automatically extract text fields (such as name, document number, date of issue, and expiry date) from images of identity documents and driver's licenses using artificial intelligence (AI) services.

• Recognition is limited to text extraction. No biometric templates are created, and no facial recognition or face matching is performed.
• Extracted data is of an auxiliary nature and is subject to human review by the rental business before being relied upon. No decisions producing legal effects concerning you, or similarly significantly affecting you, are made based solely on automated processing (Article 22 GDPR).
• Where we act as a data processor, AI-assisted recognition is performed on the documented instructions of our clients (rental businesses) acting as data controllers.

The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR) or the legitimate interest of our clients in efficient and accurate rental processing (Article 6(1)(f) GDPR). The third-party AI providers involved in this processing are described in Section 6.3.

3.6. Development and Improvement Using Anonymised Vehicle Inspection Materials.

We may use photographs and videos of vehicles uploaded to RentProg during handover, return, inspection or damage recording, in fully anonymised form, at our discretion and where necessary, to develop and improve RentProg features, including training, testing and evaluating AI models for damage recognition and other vehicle inspection functions. To the extent we use materials under this Section, our client (the rental business) instructs us to anonymise the selected materials under the applicable DPA, as described in Terms Section 11.5 and Section 13.2 below. Document scans and images, and photographs or videos whose subject is a person, are excluded.

3.6.1. Anonymisation for the purposes of Section 3.6 applies only to materials selected for such use and takes place immediately before that use, before inclusion in a dataset. It does not take place upon upload or change the ordinary handling of materials within the services. We remove or irreversibly mask faces, registration plates, VINs and other identifiers, remove metadata, including EXIF/GPS, and remove video audio tracks. The dataset is not linked to the rental business, renters or other individuals and contains no keys allowing those links to be restored. Materials that cannot meet these requirements are excluded. We delete intermediate copies once anonymisation has been verified. Retention of original service records is governed separately and is not automatically extended for model training.

3.6.2. If we use materials under Section 3.6, their anonymisation remains processing of personal data performed by us as a processor under the client's documented instruction and the applicable DPA, as described in Terms Section 11.5 and Section 13.2 below. Only data that are fully anonymous, taking account of means reasonably likely to be used to identify individuals, fall outside GDPR; masking or pseudonymisation alone does not establish this. The rental business remains responsible as controller for its legal basis, rights in the materials, and informing renters and other affected individuals, including obtaining consent where required. This Policy does not itself replace a valid instruction under the DPA.

3.6.3. Where we use materials under Section 3.6, their preparation and use take place on our infrastructure or the infrastructure of sub-processors identified for this processing in Section 6.2, subject to the applicable DPA and the safeguards in Sections 6 and 8. We do not sell, publish or disclose datasets to third parties for independent use. Sub-processors have access only to perform services on our instructions and may not use the materials for their own purposes or to train their own models. Models we create belong to RentProg and do not contain the original photographs or videos; before use, we verify that they do not enable reconstruction of original materials or identification of individuals. Section 3.6 does not apply to document recognition under Section 3.5 and does not change the prohibition on training by document recognition providers in Section 6.3.

3.6.4. The rental business may opt out of the use of materials for the purposes of this Section by contacting support at admin@rentprog.com. The opt-out applies to photographs and videos uploaded after we receive its request and does not restrict access to the core services. We will confirm receipt and the effective date of the rental business’s opt-out. This opt-out does not limit any statutory rights of data subjects.

3.7. Messaging via the WhatsApp Business Platform:

A rental business may connect its own WhatsApp Business Account to RentProg through the WhatsApp Business Platform (Cloud API) provided by Meta Platforms Ireland Limited ("Meta"). This allows the rental business to receive messages from its customers in the RentProg CRM, reply to them, and send booking-related notifications. In connection with this feature we process:

• The customer's WhatsApp phone number and profile name;
• The content of messages and attached media (such as images, documents, audio and video);
• Message identifiers, timestamps, and delivery and read statuses;
• Message templates of the rental business and their approval status;
• Identifiers of the rental business's WhatsApp Business Account and phone number, and the access token issued to RentProg when the rental business connects its account.

For messages exchanged with renters, the rental business is the data controller and we act as its data processor (see Section 13.2). The rental business owns its WhatsApp Business Account and phone number, accepts Meta's WhatsApp Business terms directly, and pays Meta directly for messaging. We use data received through the WhatsApp Business Platform only to provide messaging features to the rental business that connected the account. We do not sell this data, do not use it for our own marketing, and do not use it to train AI models.

Message history is kept as part of the rental business's CRM records for as long as the rental business keeps it in RentProg, subject to Section 5. When the rental business disconnects WhatsApp, we stop using and delete the access token. Section 15 explains how to request deletion of this data.

4. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to perform our contract with you and provide our services
• Consent: You have given explicit consent for specific processing activities (e.g., marketing communications, optional features)
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, service improvement, and security (provided your rights don't override these interests)
• Legal Obligation: Processing required to comply with legal and regulatory obligations

You have the right to withdraw your consent at any time for processing activities based on consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations. Specific retention periods include:

5.1. Account and Service Data:

• Active accounts: Retained for the duration of your subscription and service use
• Inactive accounts: Deleted after 36 months of inactivity, unless legal obligations require longer retention
• Transaction records: Retained for 3 years after the transaction date for accounting and legal compliance

5.2. Marketing Communications:

• Marketing consent and preferences: Retained for 3 years from your last interaction with us
• Cookie data and online identifiers: Retained as specified in our cookie policy (typically up to 3 years)

5.3. Customer Service Records:

• General inquiries: Retained for 3 years from the date of resolution
• Complaints: Retained for 3 years from the date of resolution
• Support tickets: Retained for 3 years from closure

5.4. Legal and Compliance:

• Litigation or disputes: All relevant information is retained until resolution and for 3 years thereafter
• Regulatory investigations: Information retained for the duration of the investigation and 3 years after conclusion
• Law enforcement requests: Information retained as required by applicable law and court orders

At the end of the applicable retention period, we will securely delete or anonymize your personal data in accordance with our data retention and deletion procedures.

6. Sharing Your Personal Data with Third Parties

We may share your personal data with third parties in the following circumstances:

6.1. Payment Processors:

We use third-party payment processors to handle all payment transactions. Our primary payment processor is Paddle (Paddle.com Market Limited). We also use Stripe as an alternative payment processor for certain customers and payment methods. Additionally, we may use PayPal and other regional payment providers depending on your location and preferences.

We do not store full credit card information on our servers. Payment data is transmitted directly to payment processors who are PCI-DSS compliant and implement appropriate security measures to protect your financial information.

When you make a payment, your payment information is processed by the respective payment processor in accordance with their privacy policies:

• Paddle: https://www.paddle.com/legal/privacy
• Stripe: https://stripe.com/privacy

The payment processor used for your transactions will be indicated during the checkout process.

6.2. Service Providers:

We engage service providers to support our business operations, including:

• Cloud hosting and infrastructure providers
• Email delivery services
• Analytics and monitoring tools
• Customer support platforms

These providers act as data processors and are contractually bound to process data only on our instructions and in compliance with this Privacy Policy.

The RentProg platform and the data processed through it are hosted on cloud infrastructure located within the European Union (EU). We use the following cloud hosting and infrastructure providers, each acting as our sub-processor:

• Scaleway SAS, a company established in France (registered office: 8 rue de la Ville-l'Évêque, 75008 Paris, France; RCS Paris 433 115 904), which provides compute instances, managed database, object storage, load balancing and private networking services. Scaleway processes personal data under its Data Processing Agreement, which forms an integral part of its contract with us. Scaleway's own sub-processors are listed at https://www.scaleway.com/en/subprocessorlist/.
• Ubicloud B.V., a company established in the Netherlands, which provides cloud infrastructure services. Ubicloud processes personal data under a Data Processing Agreement concluded with us. Ubicloud's own sub-processors are listed at https://www.ubicloud.com/docs/about/sub-processors.

Each of these providers is contractually bound to process personal data only on our documented instructions, to maintain appropriate technical and organizational security measures, and to transfer personal data outside the EU only subject to appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

6.3. AI Service Providers:

For AI-assisted document recognition (see Section 3.5), we engage third-party providers of AI-based text recognition services, such as OpenAI, Anthropic, and Google. These providers act as our sub-processors under data processing agreements which ensure that:

• Your personal data is used solely to provide the recognition service and is not used to train AI models;
• Data is retained by the provider only for the minimum period necessary to provide the service, and zero-data-retention options are used where available;
• Appropriate technical and organizational security measures are applied;
• Any transfer of personal data outside the EEA takes place only under the safeguards described in Section 8 (International Data Transfers).

6.4. Legal Requirements:

We may disclose your personal data when required by law, including:

• In response to court orders, subpoenas, or other legal processes
• To comply with regulatory requirements
• To protect our rights, property, or safety, or that of our users or the public
• In connection with legal proceedings or investigations

6.5. Business Transfers:

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections as outlined in this policy.

6.6. With Your Consent:

We may share your data with other third parties when you have given us explicit consent to do so.

6.7. Messaging Platforms:

When a rental business connects its WhatsApp Business Account (see Section 3.7), messages between the rental business and its customers are transmitted through the WhatsApp Business Platform operated by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). Meta provides this service to the rental business under the terms the rental business accepts directly with Meta, and processes message data under those terms.

Important: We do not sell your personal data to third parties for their marketing purposes.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. These measures include:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security audits and vulnerability assessments
• Employee training on data protection
• Incident response procedures
• Secure data centers with physical access controls

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay, as required by GDPR.

8. International Data Transfers

We primarily process and store personal data within the European Economic Area (EEA). The RentProg platform is hosted on infrastructure located within the European Union and operated by our providers Scaleway SAS (France) and Ubicloud B.V. (the Netherlands) (see Section 6.2). In certain circumstances, however, your personal data may be transferred to and processed in countries outside the EEA — for example, when using third-party service providers (such as the AI providers described in Section 6.3) or when providing services to clients in other jurisdictions.

When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by the European Commission
• The EU-U.S. Data Privacy Framework, for transfers to U.S. service providers certified under it (including AI service providers described in Section 6.3)
• Binding Corporate Rules
• Other legally recognized transfer mechanisms under GDPR

We ensure that any international data transfers comply with applicable data protection laws and that your data receives an adequate level of protection equivalent to that provided within the EEA.

9. Cookies and Tracking Technologies

When you visit the RentProg website, cookies and similar tracking technologies are automatically placed on your device. Cookies are small text files that help us provide and improve our services.

9.1. Types of Cookies We Use:

• Strictly Necessary Cookies: Essential for the operation of our website and platform. These cannot be disabled as they are required for basic functions like authentication and security.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferences and login details.
• Analytics Cookies: Help us understand how visitors use our website by collecting anonymous information about page visits, traffic sources, and user behavior. We use services like Yandex Metrica and Google Analytics.
• Marketing Cookies: Used to deliver relevant advertisements and track advertising campaign effectiveness. These may be set by our advertising partners.

9.2. Managing Cookies:

You can control and manage cookies in several ways:

• Use the cookie consent banner when you first visit our website
• Adjust your browser settings to refuse or delete cookies
• Use browser add-ons or plugins that manage cookies

Please note that blocking certain cookies may impact your experience and limit functionality of our services.

For more information about cookies and how to manage them, visit www.aboutcookies.org.

10. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR) and other applicable data protection laws, you have the following rights regarding your personal data:

10.1. Right of Access:

You have the right to obtain confirmation as to whether we process your personal data and, if so, to access your personal data and receive information about how we process it.

10.2. Right to Rectification:

You have the right to request correction of inaccurate or incomplete personal data we hold about you.

10.3. Right to Erasure ("Right to be Forgotten"):

You have the right to request deletion of your personal data in certain circumstances, such as when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal ground for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Step-by-step deletion instructions are provided in Section 15.

10.4. Right to Restriction of Processing:

You have the right to request that we restrict processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing.

10.5. Right to Data Portability:

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

10.6. Right to Object:

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. If you object to marketing, we will stop processing your data for that purpose.

10.7. Right to Withdraw Consent:

Where processing is based on your consent, you have the right to withdraw that consent at any time. This includes consent for:

• Marketing communications
• Use of optional cookies and tracking technologies
• Optional platform features that require explicit consent

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

10.8. Right to Lodge a Complaint:

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your residence, place of work, or place of the alleged infringement if you believe that processing of your personal data violates GDPR.

Our lead supervisory authority in Portugal is:
Comissão Nacional de Proteção de Dados (CNPD)
Website: www.cnpd.pt
Email: geral@cnpd.pt

You may also contact the supervisory authority in your country of residence if different from Portugal.

10.9. Exercising Your Rights:

To exercise any of these rights, please contact us at admin@rentprog.com with "Data Subject Rights Request" in the subject line. We will respond to your request within one month, though this may be extended by two additional months in complex cases.

We may need to verify your identity before processing your request to ensure the security of your personal data.

11. Children's Privacy

Our services are not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us immediately at admin@rentprog.com, and we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to registered users
• Displaying a prominent notice on our platform

We encourage you to review this Privacy Policy periodically. Your continued use of our services after changes have been made constitutes your acceptance of the updated policy.

Previous versions of this Privacy Policy are available upon request.

13. Data Controller and Data Processor Roles

It is important to understand the different roles we may play in data processing:

13.1. As Data Controller:

For platform users (rental business owners/operators), we act as a data controller for:

• Account information and credentials
• Billing and payment data
• Usage analytics and platform interactions
• Marketing preferences and communications

13.2. As Data Processor:

For end customers (renters), we act as a data processor on behalf of our clients (rental businesses) who are the data controllers. In this capacity:

• Our clients determine the purposes and means of processing
• We process data only on documented instructions from our clients
• Our clients are responsible for obtaining consent and providing privacy notices to their customers
• We assist our clients in responding to data subject rights requests

To the extent we use materials under Section 3.6, our client instructs us to anonymise only the selected materials immediately before such use. We act only on a documented client instruction incorporated into the applicable DPA in accordance with Article 28(3)(a) GDPR, as set out in Terms Section 11.5. The instruction covers access to the selected materials, working copies, removal or masking of identifying information, removal of metadata and audio, verification of anonymisation and deletion of intermediate copies. It also records the client's authorisation to use the fully anonymised output for RentProg development and improvement. Our controller role for platform account data in Section 13.1 does not extend that authorisation to identifiable renter data or permit model training on such data.

By using our services, our clients provide a general authorization for the engagement of sub-processors, including payment processors, hosting and infrastructure providers, and AI service providers described in Section 6 of this Privacy Policy. We will inform clients of intended changes concerning the addition or replacement of sub-processors by updating this Privacy Policy, giving them the opportunity to object to such changes. A current list of sub-processors is available upon request at admin@rentprog.com.

If you are a renter and have questions about how your data is processed, you should contact the rental business directly. However, you may also contact us at admin@rentprog.com.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Data Controller:
RENTPROG, UNIPESSOAL LDA
Registered in Portugal
Commercial Registry Number: 519104528
Tax Identification Number (N.I.P.C.): 519104528

Registered Office:
Estrada Nacional 2, 7
Carvoeira
3360-179 Penacova
Portugal

Email:
admin@rentprog.com

Website:
https://rentprog.com/en/privacy

We aim to respond to all inquiries within 30 days in accordance with GDPR requirements.

15. Data Deletion Instructions

15.1. Rental Businesses (Platform Users):

• To stop sharing WhatsApp data with RentProg, disconnect WhatsApp in your company settings in RentProg, or remove RentProg from the business integrations in your Meta Business settings. We then stop using and delete the access token for your WhatsApp Business Account.
• To delete your RentProg account and its data, including CRM message history, send an email to admin@rentprog.com from the email address of your account with "Data Deletion Request" in the subject line.

15.2. Renters and Other Customers of Rental Businesses:

The rental business you communicated with controls your data. Please contact it directly to request deletion. You may also email us at admin@rentprog.com with "Data Deletion Request" in the subject line, the name of the rental business and the phone number you used. We will pass your request to the rental business and help it fulfil the request.

15.3. What Happens Next:

We will confirm receipt of your request and may need to verify your identity. We will respond within one month, as described in Section 10.9. Data we must keep by law, such as transaction records (see Section 5), is retained only for the required period and then deleted.