GDPR Compliance

1. Our Commitment to GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to all companies processing personal data of EU residents. Rentrovio is fully committed to GDPR compliance and has implemented robust measures to protect your personal data.

Key Principles We Follow

• Lawfulness, fairness, and transparency: We process data legally and transparently
• Purpose limitation: We collect data only for specified, legitimate purposes
• Data minimization: We collect only necessary data
• Accuracy: We keep data accurate and up-to-date
• Storage limitation: We retain data only as long as necessary
• Integrity and confidentiality: We protect data with appropriate security measures
• Accountability: We can demonstrate our compliance

2. Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Information

You have the right to be informed about how we collect and use your personal data. This information is provided in our Privacy Policy and this GDPR page.

Right of Access

You can request access to your personal data and receive:

• Confirmation that we process your data
• A copy of your personal data
• Information about how we use your data
• Details about data sharing and retention

Right to Rectification

You can request correction of inaccurate or incomplete personal data. We will update your information promptly upon verification.

Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data when:

• The data is no longer necessary for the original purpose
• You withdraw consent and there's no other legal basis
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restrict Processing

You can request restriction of processing when:

• You contest the accuracy of the data
• Processing is unlawful but you don't want erasure
• We no longer need the data but you need it for legal claims
• You've objected to processing pending verification

Right to Data Portability

You can receive your personal data in a structured, commonly used format and transmit it to another controller when:

• Processing is based on consent or contract
• Processing is carried out by automated means

Right to Object

You can object to processing based on:

• Legitimate interests (including profiling)
• Direct marketing (including profiling)
• Scientific, historical research, or statistical purposes

Rights Related to Automated Decision-Making

You have the right not to be subject to automated decision-making, including profiling, that produces legal effects or significantly affects you.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Consent

• Marketing communications
• Non-essential cookies
• Optional features and services

Contract Performance

• Account creation and management
• Service delivery
• Payment processing
• Customer support

Legal Obligation

• Tax and accounting requirements
• Anti-money laundering checks
• Regulatory compliance

Legitimate Interest

• Fraud prevention and security
• Service improvement and analytics
• Business operations and administration

4. Data Processing Activities

Categories of Personal Data

We process the following categories of personal data:

• Identity Data: Name, username, title, date of birth
• Contact Data: Email address, telephone numbers, addresses
• Financial Data: Bank account details, payment card information
• Transaction Data: Payment history, service usage
• Technical Data: IP address, browser type, device information
• Profile Data: Preferences, feedback, survey responses
• Usage Data: How you use our services
• Marketing Data: Communication preferences

Special Categories of Data

We do not intentionally collect special categories of personal data (sensitive data) such as:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Health data
• Biometric data
• Sexual orientation

5. Data Transfers

International Transfers

We may transfer your personal data outside the European Economic Area (EEA). When we do, we ensure adequate protection through:

• Adequacy Decisions: Transfers to countries with adequate protection
• Standard Contractual Clauses: EU-approved contract terms
• Binding Corporate Rules: Internal data protection rules
• Certification Schemes: Approved certification mechanisms

Safeguards

All international transfers include appropriate safeguards such as:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Contractual data protection obligations

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

Retention Periods

• Account Data: Duration of account plus 7 years for legal obligations
• Transaction Data: 7 years for accounting and tax purposes
• Marketing Data: Until consent is withdrawn or 3 years of inactivity
• Technical Data: 2 years for security and analytics purposes
• Support Data: 3 years after case closure

Deletion Process

When retention periods expire, we:

• Securely delete personal data
• Anonymize data for statistical purposes
• Archive data where legally required

7. Security Measures

We implement appropriate technical and organizational measures to ensure data security:

Technical Measures

• End-to-end encryption
• Secure data centers with physical security
• Regular security updates and patches
• Intrusion detection and prevention systems
• Secure backup and recovery procedures

Organizational Measures

• Data protection training for employees
• Access controls and need-to-know basis
• Regular security audits and assessments
• Incident response procedures
• Data protection impact assessments

8. Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee our GDPR compliance:

DPO Responsibilities

• Monitor compliance with GDPR
• Conduct data protection impact assessments
• Provide data protection training
• Serve as contact point for supervisory authorities
• Handle data subject requests

Contact Our DPO

9. Exercising Your Rights

How to Make a Request

To exercise your GDPR rights, you can:

• Use our online data request form
• Email our DPO at hello@rentrovio.com
• Contact our support team
• Send a written request to our address

Verification Process

To protect your privacy, we may need to verify your identity before processing requests. We may ask for:

• Account credentials
• Government-issued ID
• Additional verification questions

Response Times

• Standard Response: Within 1 month
• Complex Requests: Up to 3 months (with notification)
• Urgent Requests: Prioritized processing

10. Complaints and Supervisory Authority

If you're not satisfied with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority.

EU Supervisory Authorities

You can contact the supervisory authority in your country or where the alleged infringement occurred. Find your local authority at: European Data Protection Board

Before Filing a Complaint

We encourage you to contact us first so we can try to resolve your concerns directly:

• Email: hello@rentrovio.com
• Subject: GDPR Complaint
• Include: Details of your concern and desired resolution

11. Updates to GDPR Compliance

We regularly review and update our GDPR compliance measures to ensure continued protection of your rights. Updates may include:

• Policy and procedure updates
• New security measures
• Enhanced data subject rights tools
• Additional training and awareness programs

We will notify you of significant changes through our website or direct communication.