Privacy policy

1Who the controller is

2When we are controller and when we are processor

Renterus has two different roles depending on the type of data:

As controller

We decide why and how the data is processed, and this policy applies in full, in these cases:

• the user account data that you register and manage yourself (identification, contact details, credentials, preferences);
• the data of customer companies and of their representatives and contacts, in order to contract, invoice and provide the service;
• the technical and security data of the Platform (access logs, devices, errors);
• support requests and the marketing communications you agree to receive;
• visitors to our websites.

As processor, on behalf of a company

The companies that subscribe to Renterus use it to manage their relationships with third parties. The data generated within those relationships is processed by Renterus on behalf of, and following the instructions of, the company, which is the controller. For example:

• employees’ working-time records (time tracking), including the location of each clock-in, schedules, holidays and absences;
• contracts, payslips and other employment documents that the company shares with its employees;
• documents signed through the Platform and their signature evidence;
• the company’s guest, booking and customer data, including identity verification and traveller registration;
• owner data (statements, bank accounts, invoices);
• transfers: passenger data and the driver’s location during the trip;
• work and cleaning reports, key management, chat and the company’s internal notes;
• the invoices the company issues to its customers.

For this data, the company decides the purpose and legal basis and must inform you (normally through its own privacy policy or the information it gives you as an employee, customer or guest). If you want to exercise your rights over this data, contact the company first. If you write to us, we will forward your request to the company that is the controller and help it to deal with it, as required by Article 28 GDPR.

The terms on which we act as processor are set out in the Data processing agreement, which forms part of the Terms of use and contracting.

3What data we process as controller, why and for how long

The data we process as controller, the purpose, the legal basis and the retention period of each processing activity are as follows:

The data marked as mandatory in forms is needed to provide the service; if you do not provide it, we will not be able to deal with the request or create the account.

When a company invites you to the Platform, we obtain some of your data from it (name, email or phone) in order to send you the invitation. From then on, you manage your own account.

4Location data in the mobile app

The Renterus mobile app accesses the device’s precise location (latitude and longitude coordinates obtained from GPS) only for the following features. Except for key lockers, explained below, we process location data on behalf of the company you work for or with which you contract the service, which is the controller.

Time tracking

When you clock in or out, the device’s location at that moment is saved to prove where the record was made. The app does not track your location between clock-ins.

Transfer service

• When a driver starts a trip, the app shares their real-time location with the customer of that transfer so that they can follow the journey. Sharing is started by the driver.
• While the trip is in progress, sharing can continue with the app in the background or with the screen off. A foreground service that shows a visible notification for as long as it lasts is used for this.
• Background location is used exclusively to track the trip and only while a trip is active. Background location is not collected outside a trip in progress.
• Sharing stops automatically when the trip ends.

Other features

If you grant permission, location is also recorded when starting and finishing work and cleaning reports and when signing documents, as evidence of where they take place.

If you are a guest and use the key lockers, the app may use your location to sort the lockers by distance. That location is only used to calculate the distance and is not saved.

Recipients, purposes and control

• During a transfer, the driver’s location is shared with the customer of that transfer. The location of clock-ins is seen by the company you work for and, where the law requires it, may be made available to the Labour Inspectorate.
• Renterus does not sell location data, does not use it for advertising and does not share it with third parties for purposes other than those described.
• The legal basis is determined by the company that is the controller. Generally, it is the performance of the contract or service and compliance with the legal obligation to record working time. In addition, access to location requires the permissions you grant in your device’s operating system.
• The data is kept for as long as needed for those purposes and the legal periods (for example, 4 years for working-time records, Art. 34.9 of the Spanish Workers’ Statute), and then deleted or anonymised.
• You can grant or withdraw location permissions at any time in the device settings. Withdrawing them may prevent you from using time tracking or trip tracking.

5Push notifications and other device permissions

Push notifications. If you allow it, the app receives notifications (new messages, documents awaiting signature, changes to bookings or transfers, working-time reminders, etc.). To send them we generate a device identifier that is passed to the notification services of Expo, Google (Firebase Cloud Messaging) and Apple (APNs). You can turn them off whenever you like in the device settings.

Camera, photos and microphone. They are only used when you use them: to attach photos or documents (for example, in the chat, in incidents or when scanning a document) or to record voice notes in work reports.

Biometric unlock (Face ID / fingerprint). If you turn it on, unlocking happens on your device using its own mechanisms. Renterus does not receive or store your biometric data.

WhatsApp and email. Some notifications and verification codes may be sent by email or by WhatsApp to the number recorded on the Platform.

6Artificial intelligence assistant (Erus)

The Platform includes Erus, an artificial intelligence assistant you can ask questions from the chat in the app and on the web: for example, about your schedule, your clock-ins, your holidays or your payslips or, if you manage a company, about your team, your invoices or your properties. Using it is optional.

To answer you, Erus looks up on the Platform only the data you already have access to with your permissions and sends your question and that data to OpenAI, which generates the answer. OpenAI acts as processor, does not use this data to train its models and only keeps it temporarily, for up to 30 days, to prevent abuse.

We keep your chat history with Erus while your account is active, so that you can look back at it, and a log of the queries it makes, for security purposes, for the period stated for security logs. If you write to the Renterus WhatsApp number, your message is also saved in that history.

Erus’s answers are for guidance only and do not lead to decisions about you; check important data in the relevant section of the Platform. When Erus looks up data from your relationship with a company (for example, your clock-ins or your payslips), Renterus processes it on behalf of that company, like the rest of that data.

7Recipients and suppliers (processors)

We do not sell personal data. We only disclose it to third parties when needed to provide the service, when the company that is the controller instructs us to or when the law requires it (for example, to the Spanish Tax Agency, the courts or the police).

To provide the service we use the following suppliers, which act as processors (or sub-processors, when we process data on behalf of a company) and with which we have signed the commitments required by Article 28 GDPR:

In addition, when a company connects the Platform to another service (for example, a booking channel), the necessary data is disclosed to that service, which the company has chosen, and according to its instructions.

We will keep this list up to date. Customer companies will be notified of changes in advance under the Data processing agreement.

8International transfers

Some of the suppliers above are located in the United States or may access the data from there. We only make these transfers with appropriate safeguards, under Chapter V GDPR:

• the European Commission’s adequacy decision on the EU-US Data Privacy Framework, for certified suppliers;
• or, failing that, the standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR), with any supplementary measures that are needed.

The safeguard for each supplier located outside the European Economic Area, or that may access the data from outside it, is as follows:

• Google, Apple, Expo and Sentry: they are certified under the EU-US Data Privacy Framework.
• WhatsApp: the service is provided by WhatsApp Ireland Limited; its transfers to WhatsApp LLC and Meta Platforms, Inc. rely on the EU-US Data Privacy Framework.
• OpenAI: the service is provided by OpenAI Ireland Limited; its transfers to other OpenAI entities outside the EEA rely on standard contractual clauses.
• Amazon Web Services: the service is provided by Amazon Web Services EMEA SARL and the images are processed in Ireland; any access from outside the EEA relies on the standard contractual clauses in its data processing addendum and on the EU-US Data Privacy Framework.
• Su: the service is provided by STAAH Limited, in New Zealand, a country which the European Commission considers to offer an adequate level of protection (Art. 45 GDPR).

ADW Europe, MongoDB Atlas, Redsys and Verifacti process the data within the European Economic Area. You can ask us for a copy of the safeguards by writing to legal@renterus.com.

9Automated decisions

Renterus does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

When a company uses guest identity verification, document reading and facial comparison are support tools that the Platform offers to that company. The company is the controller of that processing and of the decisions it takes with the result. Neither of them decides on its own: if verification fails, the guest can try again or enter their details manually, and the company can review them.

10Your rights and how to exercise them

You can exercise the following rights at any time:

• Access: find out whether we process your data and get a copy.
• Rectification: correct inaccurate or incomplete data. You can change much of it yourself in “My Details” on the web or “Personal Details” in the app.
• Erasure: ask us to delete your data when it is no longer needed, among other cases. To delete your account, follow the steps in Delete your account.
• Objection: object to processing based on legitimate interest and, always, to marketing communications.
• Restriction: ask us to keep the data without processing it while a complaint is resolved.
• Portability: receive the data you have given us in a structured, commonly used format, or have us send it to another controller.
• Withdraw your consent at any time, without affecting the lawfulness of earlier processing.
• Not to be subject to automated decisions, under Article 22 GDPR.

How to exercise them. Write to legal@renterus.com with the subject “Data protection”, or by post to the address in section 1. Say which right you want to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will reply within one month, which may be extended by two further months if the request is complex, in which case we will let you know.

Data we process on behalf of a company. If your request concerns data from your relationship with a company (working-time records, clock-in locations, signed documents, bookings, etc.), send it to that company, which is the controller. If we receive it, we will forward it and help the company to reply to you.

11Complaints to the supervisory authority

If you think we have not processed your data properly, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your country of residence in the European Union. We would be grateful if you wrote to us first so that we can try to resolve it.

12Security

We apply technical and organisational measures appropriate to the risk to protect the data: encrypted communications, passwords stored with hashing algorithms, permission-based access control, separation of each company’s data, activity logs, backups and staff confidentiality commitments.

Renterus has an information security management system certified to UNE-EN ISO/IEC 27001:2023 by OCA Instituto de Certificación (certificate no. 34/5700/25/05280, valid until 23 May 2028). The database runs on a three-node cluster and, in addition, a daily backup is made.

No system is infallible. If a security breach occurs, we will act and give notice in accordance with Articles 33 and 34 GDPR.

13Minors

The Platform is aimed at companies and professionals and is not intended for use by children under 14. Data about minors that a company may record (for example, accompanying guests) is processed by Renterus on behalf of that company, which is responsible for doing so on the appropriate legal basis.

14Cookies and local storage

new.renterus.com only uses technical cookies needed for the service to work, such as the user session (user_token), language (lang) and visual theme (theme). It also saves preferences in the browser’s local storage. These cookies are exempt from consent under Article 22.2 LSSI-CE. The details of each one are in the Cookie policy.

Some screens load Google Maps, which may set its own cookies or collect technical data under Google’s policy. Information about the cookies of www.renterus.com is in its Cookie policy.

15Changes to this policy

We may update this policy to adapt it to legal or service changes. The version in force is the one published on this page, with the version and date in its header. If the changes are significant, we will let you know through the Platform or by email.