EN
Log in Sign up
Legal information

Privacy policy

As of 1 Nov 2026Version datenschutz-2026-11-01 Deutsche Fassung
This English translation is provided for information. The German version is legally binding. Read the German version

This policy explains which personal data we process when you use Rentlo in the browser (rentlo.de) or in the Rentlo app, why we need it, on which legal basis we process it, how long we keep it and which rights you have. This version applies from 1 November 2026.

At a glance

Marketplace: You rent from commercial rental companies. The rental company is your contracting party and receives the data it needs for the rental, contact details only after payment.

No sale of data, no third-party tracking: We do not sell data and do not use third-party analytics trackers (no Google Analytics, no Meta pixel, no tracking SDKs in the app).

Hosted in Germany: Rentlo runs on servers in Germany. We load fonts and program libraries from our own server. In access logs we shorten your IP address.

Only with your consent: Google Maps, Google ads in the Shorts feed (non-personalised only), push notifications and the AI search with Claude by Anthropic (only your search text goes to the USA).

Partners and interfaces: Hyghsoft operates Rentlo technically on our behalf. We do not pass anything on automatically to HyghFleet, ConnectPro or other partners. Booking data only goes to your rental company's software via the partner API if it has connected it and we have approved the access.

Pay securely: You enter payment details directly with Stripe. We never see card numbers.

You are in control: You trigger data export and account deletion yourself in your account. You can withdraw consent at any time in the settings.

Contents

1. Controller and contact

The controller is M2 Innovations GbR (Rentlo), Meisenweg 8, 53119 Bonn, Germany, represented by the partners Melik Dogru and Melih Deniz.

For all questions about data protection and to exercise your rights, contact us at datenschutz@rentlo.de. Further contact options are listed in the legal notice.

2. Overview: what we process and why

Purpose Examples of data Legal basis (GDPR)
Providing website and app, security shortened IP address, time, page, browser Art. 6(1)(f)
Customer account and sign-in name, email, password hash, sign-in service Art. 6(1)(b)
Request, booking, sharing with the rental company vehicle, period, price, documents Art. 6(1)(b), (c)
Payment, down payment, deposit amount, payment method, status, reference Art. 6(1)(b), (c), (f)
Chat, reviews, Shorts, Club messages, reviews, likes, points Art. 6(1)(b), (f)
Maps, Google ads, push, AI search IP address, device identifier, search text Art. 6(1)(a) (consent)
Newsletter and waiting list email, times of consent Art. 6(1)(a)
Reports under the DSA, tax and retention obligations reporter data, records Art. 6(1)(c)

Details are set out in the following sections.

3. Accessing the website and app, server logs, security

Each time you access Rentlo, our server processes technically necessary data: IP address, date and time, address accessed, status code, amount of data transferred, referring page and browser identifier. We need this data to deliver content, keep operations stable and fend off attacks (for example limiting mass requests and temporarily blocking suspicious IP addresses).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure and functional operation.

In the access logs we only store the IP address in shortened form (for IPv4 without the last byte, for IPv6 only the first 48 bits) and delete the logs after 14 days at the latest. We store security events such as failed sign-ins with the full IP address for 90 days, because otherwise we could not detect attacks on accounts.

4. Hosting, technical service providers and backups

Rentlo runs on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Germany. Development, maintenance and technical operation are handled by Hyghsoft (owner Samet Gülhan, Gelsenkirchen, Germany). Both process data exclusively on our behalf and according to our instructions (Art. 28 GDPR). Hyghsoft staff only access data to the extent necessary for operation, troubleshooting and security; changes made via administrative functions are logged.

We back up the database daily. Backups are only used for recovery after a failure and are overwritten when their retention period expires.

4a. Hyghsoft, HyghsoftID, HyghFleet and ConnectPro at a glance

Hyghsoft is our technology partner. Because Hyghsoft also offers its own services, here is where data goes and in which role:

Service What happens Role Data flow from Rentlo
Operation of Rentlo Development, maintenance, troubleshooting and security of the platform (no. 4) Hyghsoft is our processor (Art. 28 GDPR) only as far as necessary for operation and troubleshooting, on our instructions
HyghsoftID Sign-in to Rentlo with your Hyghsoft account (no. 6) Hyghsoft is responsible for the HyghsoftID account itself none: we receive name, email address and an identifier; Hyghsoft only learns that and when you sign in to Rentlo
HyghFleet (fleet management) Software rental companies use to manage their business contract between rental company and Hyghsoft; Hyghsoft is the rental company's processor only via the partner API if the rental company has connected HyghFleet and we have approved the access (no. 9a)
GPS and black boxes Telematics for rental companies' vehicles contract between rental company and Hyghsoft none; Rentlo does not receive location or telematics data either
ConnectPro Network for rental companies, presented in the rental company area independent provider none

Legal bases: for operation Art. 28 GDPR in conjunction with the legal bases of the respective processing, for HyghsoftID Art. 6(1)(b) GDPR, for the partner API no. 9a.

5. Cookies and storage on your device

Without your consent we only use cookies and device storage that are strictly necessary for the service you have requested, for example for sign-in, protecting forms and your settings (section 25(2) no. 2 TDDDG).

Optional functions only store or read information on your device after your consent (section 25(1) TDDDG, Art. 6(1)(a) GDPR):

  • Maps: displaying maps with Google Maps (see no. 7).
  • AI search: transmission of your search text to Anthropic for the AI search "Ask Rentlo" (see no. 8); we remember your choice on your device.
  • Advertising: ads from Google in the Shorts feed, non-personalised only (see no. 15a), plus a counter on your device so that you do not see an ad too often and a marker so that a video view is only counted once.

The banner offers "Necessary only" with equal prominence next to "Accept all"; you can also choose each category individually. We store your choice on your device and additionally on our server as proof (no. 15a). You can change or withdraw it at any time: on the website via "Cookie settings" at the bottom of every page, in the app under Profile › Privacy. All entries with name, purpose and storage period can be found under Cookies and storage.

5a. Rentlo app for Android and iOS

The Rentlo app for Android and iOS shows the same content and functions as rentlo.de; rental companies also manage their vehicles and bookings in it. This privacy policy applies to the app; in addition, the following applies.

No tracking or analytics SDKs: The app contains no third-party analytics or tracking libraries (for example no Google Analytics, no Firebase Analytics, no Meta SDK). We do not track you across other providers' apps or websites.

Ads in the app: The app from Google Play or the App Store contains Google's ad SDK AdMob. It only becomes active once you consent to the "Advertising" category in the privacy settings. We then only request non-personalised ads; Google uses your device's advertising ID for frequency capping, fraud prevention and billing (no. 15a). You can reset or delete the advertising ID in your device settings.

Permissions: The app only asks for a permission when you use the related function. You can revoke any permission at any time in your device settings; the other functions of the app remain usable.

  • Camera: to take photos or videos you want to upload, for example your driving licence and ID (no. 10), photos for the handover report (no. 12) or, as a rental company, vehicle photos and Shorts (no. 15).
  • Photos and media: to select and upload existing images or videos. The app only receives the files you select.
  • Microphone: only if you record a video with sound in the app, for example a vehicle video or a Short. The sound is stored as part of the video and treated like the video.
  • Location: only while you use the app and only if you tap "My location" to find vehicles near you (no. 7). We do not store the location in your account.
  • Notifications (push): only if you switch them on (no. 20).

AI search: We ask once in the app's consent banner (category "AI search") whether your search text may be sent to Anthropic, not for every search (no. 8).

Paying in the app: Payments in the app are processed via Stripe just like on the website (no. 11), even if you pay with Apple Pay, Google Pay, Klarna or Revolut Pay, for example. There are no purchases via the app stores (in-app purchases).

Blocking and reporting: In the app you can block other users and rental companies, in the chat, on comments and in the menu of a Short. You can then no longer send each other messages, and you no longer see their Shorts, comments and reviews. We store the block with your account until you lift it (Settings › Blocked users) or delete your account. The blocked contact is not notified; if they try to write to you, they only see that this is not possible. We handle reports from the app as described in no. 17.

App stores: Google (Google Play) and Apple (App Store) are themselves responsible for downloading and updating the app and process data in accordance with their own privacy notices. At most we receive aggregated statistics and crash reports from the stores without names or account data.

Legal bases: Art. 6(1)(b) GDPR (use of the app functions); access to camera, photos, microphone and location is strictly necessary for the function you request (section 25(2) no. 2 TDDDG); push notifications, Google ads via AdMob and sharing with Anthropic for the AI search only with your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG); for blocking Art. 6(1)(b) and (f) GDPR (protection against harassment).

6. Customer account and sign-in

For your account we process your first and last name, email address and password (only as a secure hash). Voluntarily or for certain functions, your phone number, address, date of birth, "driving licence since", language and notification settings are added. We need your date of birth and years of holding a licence to check the minimum age and licence period of vehicles.

For every sign-in we store the IP address and device. You can see these sessions in your account and sign out other devices. Two-factor sign-in is optional for you.

On registration we store, as proof, that you agreed to the terms, took note of the privacy policy and confirmed that you are at least 18 years old, each with the text version, time, IP address and browser identifier.

We check new passwords against known data breaches. Our server only transmits the first five characters of a hash of your password to the "Pwned Passwords" service (Have I Been Pwned). Neither your password nor your email address leaves our server.

Sign-in with Google: If you sign in with Google, we receive your name, email address and a Google identifier from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google learns that you are signing in to Rentlo. Google is responsible for processing at Google.

Sign-in with Apple: If you use "Sign in with Apple", we receive an Apple identifier and, if you share them, your name and email address from Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). If you choose "Hide my email", we only receive a relay address from Apple. Apple is responsible for processing at Apple.

Sign-in with HyghsoftID: HyghsoftID is Hyghsoft's shared sign-in account, which you can also use for other Hyghsoft services (for example HyghFleet). Sign-in uses the standard OpenID Connect procedure with Hyghsoft's sign-in service (hyghfleet.com/hyghsoftid). We receive your name, your email address, whether it is verified, and an identifier that we link to your Rentlo account. A new Rentlo account is only created once you have accepted the terms of use. Hyghsoft is responsible for your HyghsoftID account itself and learns that and when you sign in to Rentlo. Data from your Rentlo account (for example bookings, messages or payments) is not sent to Hyghsoft.

Legal bases: Art. 6(1)(b) GDPR (user agreement, sign-in method of your choice); for security logs and proof Art. 6(1)(f) GDPR (protection of accounts, proof of consent).

6a. Move from the previous Rentlo platform

Until October 2026, the previous Rentlo platform ran on the software of the service provider Sharetribe Oy (Helsinki, Finland) as our processor. When moving to the new platform, we transferred accounts, profiles, listings, bookings and reviews so that you can continue where you left off. If you had an account, you confirm it the first time you sign in with a code we send you by email and set a new password; we did not transfer passwords. The contract with Sharetribe has ended; no more data flows there.

Legal bases: Art. 6(1)(b) GDPR (continuation of your user agreement) and Art. 6(1)(f) GDPR (seamless continued operation). If you do not want to continue using your transferred account, you can delete it at any time (no. 26).

7. Search, location and maps

For searching "near you" you can share your location. We only use it to calculate distances for this search and do not store it in your account; on the website your device remembers the chosen place or location rounded to about one kilometre (entry rentlo-geo) until you change it.

If you have not shared your location, we derive an approximate place at city level from your IP address once (for example "approx.: Cologne") so that we can show vehicles near you first. For this we use a database on our own server (DB-IP "IP to City Lite", db-ip.com, licence CC BY 4.0); we do not pass your IP address to third parties for this and store neither the IP address nor the derived place. You can change the place at any time or share your exact location. The legal basis is our legitimate interest in relevant search results (Art. 6(1)(f) GDPR). We also credit DB-IP at the bottom of the pages that use the approximate place.

We only show locations of vehicles and rental companies publicly rounded to two decimal places (accurate to about one kilometre). Our server calculates distances from the exact values. You see the exact pick-up address and the licence plate in your booking as soon as it has been paid or the down payment has been made.

We display maps with Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Only when you consent does your device load the map directly from Google. Google receives, among other things, your IP address, browser data and the map section and can store information on your device. Processing by Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework. With the same consent we suggest addresses via Google Places when you enter a delivery address; for this the text you enter is sent to Google together with your IP address. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time. Google is responsible for further processing, see policies.google.com/privacy.

8. AI search "Ask Rentlo"

The AI search "Ask Rentlo" turns your search text into search filters. Before we send anything to a third party for this, we ask you once whether you agree (in the consent banner as the category "AI search", also with "Accept all"). Only with your consent do we send the search text together with the current date to Anthropic (Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA), provider of the Claude language model. The same applies to questions you enter in the question field on our help pages: only if you agree to the AI answer do we send your question together with matching excerpts from our FAQ to Anthropic; otherwise we only show matching FAQ entries from our own search. We do not send account or device data (including your location); please do not enter personal information in the search text. Without consent, after withdrawal or if the service is unavailable, only our own search parser on our server evaluates your text.

Anthropic processes the text as our processor (Art. 28 GDPR) under its commercial terms including a data processing addendum. Anthropic does not use the data to train its models and only stores it briefly for abuse detection, after which it is deleted. We base the transfer to the USA on the European Commission's standard contractual clauses.

We store your decision on your device (also as the cookie rentlo_consent for all Rentlo pages) and, if you are signed in, in your account; it then also applies on your other devices and in the app. You can change it at any time and withdraw your consent with effect for the future, on the website via "Cookie settings", in the app under "Privacy settings" (in the profile, when signed in under Settings), entry "AI search with Claude". The legal basis is your consent (Art. 6(1)(a) GDPR).

8a. Language and automatic translation

Language selection: Rentlo is available in German and English. Which language we show you depends on your choice (switch, stored as the entry rentlo-lang on your device), otherwise on the language stored in your account and otherwise on your browser's language setting. We also send you emails and notifications in this language. The legal basis is Art. 6(1)(b) GDPR; the device entry is strictly necessary for the requested function (section 25(2) no. 2 TDDDG).

Translation of rental company texts: If a vehicle or rental company description is missing in your language, we have the rental company's text translated automatically and label the result as "Automatically translated". For this we only send the description text, from which we first remove contact details, to Anthropic (no. 8) as a processor. We do not send customer data for this. The legal basis is Art. 6(1)(b) GDPR towards the rental company (terms for rental companies no. 6a) and Art. 6(1)(f) GDPR (understandable offers for customers). We store translations until the rental company changes or deletes the text.

9. Request, booking and sharing with the rental company

For a request or booking we process the vehicle, period, pick-up time, chosen protection packages and extras, delivery address (if chosen), mileage packages, payment type (online or cash), the price calculation, the accepted version of the rental terms and terms of use, your message to the rental company and the history of the booking. If you reach a booking via a Short, an ad, a search or a shared link, we store this origin with the booking.

Before payment, the rental company sees your first name and the first letter of your last name, your Club rank, whether your account has been verified and how many rentals you have had on Rentlo, as well as the documents you attach to the booking (no. 10). Your full name, your contact details (phone, email), the exact pick-up or delivery address and the licence plate only become visible once the booking has been paid or the down payment has been made.

The rental company processes this data for the rental contract under its own responsibility. If you name an additional driver, please inform them of this policy.

Individual offers: If a rental company sends you an individual offer, we store its content (vehicle, period, price, kilometres, deposit, services and message), validity and status and, if you accept it, the resulting booking. Offers via link can be accessed via an unguessable address that is blocked for search engines; anyone who knows the link sees the vehicle, period, price and rental company; a delivery address is only visible to you and the rental company. The legal basis is Art. 6(1)(b) GDPR.

Legal bases: Art. 6(1)(b) GDPR; for retention Art. 6(1)(c) GDPR (section 257 HGB, section 147 AO); for resolving disputes Art. 6(1)(f) GDPR.

9a. Partner API: sharing with the rental company's software

Rental companies can connect their own software (for example fleet management, calendar or accounting, including HyghFleet by Hyghsoft or software from other providers) to Rentlo via our partner API. The rental company must apply for access; only after our team has reviewed and approved it can it create access keys. We then transmit the booking data from no. 9 to this software at the rental company's request, to the same extent the rental company sees in its rental company area, either on request or automatically with every status change (webhook). Before payment, this is the booking number, period, vehicle, your first name with the initial of your last name, verification status and number of your rentals; after payment, additionally your full name, your phone number, pick-up, delivery and return address, licence plate, protection package and mileage information. We do not transmit data of other rental companies or data on your usage behaviour.

The rental company is responsible for processing in its software and for selecting its software provider; the software provider (for example Hyghsoft for HyghFleet) processes the data as the rental company's processor, not for Rentlo. Legal bases: Art. 6(1)(b) GDPR (performance of the rental contract) and Art. 6(1)(f) GDPR (efficient processing at the rental company). We keep transmission logs for 90 days.

10. Driving licence and ID

For a rental you upload an identity document (ID card or passport) and your driving licence in your profile. Uploading is sufficient for a request; our team may additionally check the documents and mark your account as verified. The rental company checks them before accepting, at the latest before handover, and confirms this in Rentlo; we store the time and account of this confirmation. The files are stored securely and not publicly on our server and can only be accessed by you, by our team with special authorisation and by the rental company of a booking to which you have attached the documents.

Scanner: You capture your ID and driving licence with our scanner, front and back separately (passport: photo page). The quality check (sharpness, light, glare) runs only in your browser; we only receive the captured images, without location and camera data. On a computer you can continue on your phone via a QR code; the link is valid once and for 15 minutes, and we only store it as a hash. If you upload a document again, we delete older, not yet checked files of the same type; copies attached to bookings are kept until they are deleted as described in the next paragraph.

The legal basis is Art. 6(1)(b) GDPR (checking identity and driving entitlement before a vehicle is handed over). You can delete the documents in your profile at any time. At the latest when your account is deleted, we delete all copies of ID documents and driving licences, including those attached to bookings.

11. Payment and deposit

Payments, down payments and online deposits are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) via Stripe Connect: you pay Stripe, and Stripe pays the rental price minus our service fee to the rental company. You enter your payment details, such as your card number, directly with Stripe; we only receive the amount, payment method, status and a reference. An online deposit is reserved on your payment method (usually one day before the start of the rental) and released after return or, in the case of documented damage, collected in full or in part. How we collect the details for rental companies' payout accounts and transmit them to Stripe is described in no. 22.

You see the available payment methods when paying, currently card, Apple Pay, Google Pay, Klarna, Revolut Pay, iDEAL, Bancontact and eps. If you choose one of them, the respective provider processes your data for the payment under its own responsibility in accordance with its privacy notices, for example Apple (Apple Pay), Google (Google Pay), Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden), Revolut Bank UAB (Konstitucijos ave. 21B, Vilnius, Lithuania) or your bank (iDEAL, Bancontact, eps).

Stripe is independently responsible for fraud prevention and statutory checks (for example against money laundering) and may also transfer data to the USA for this purpose. More at stripe.com/privacy. Legal bases: Art. 6(1)(b), (c) and (f) GDPR.

11a. Cash payment and deposit on site

If you choose cash payment for a vehicle, you pay 10 % online via Stripe (no. 11) as a down payment; you pay the rest in cash to the rental company at pick-up. We store with the booking that you pay in cash and the amounts of the down payment and the remaining amount. If you leave the deposit on site (for example in cash, by debit or credit card or with a vehicle title), the rental company processes the necessary data under its own responsibility; we only learn the chosen type of deposit. The legal basis is Art. 6(1)(b) GDPR.

12. Handover and return report

At handover and return, you and the rental company document mileage, fuel or battery level, damage and photos. When uploading, we remove location and camera data (EXIF/GPS) from the photos. Please only photograph the vehicle, not people. The purpose is the fair clarification of damage and billing; the legal bases are Art. 6(1)(b) and (f) GDPR. We delete report photos 12 months after return unless a dispute is open.

13. Chat and contact filter

We store messages between you, rental companies and our customer service so that you can coordinate and we can help with problems. We notify the other side of a new message by email or notification. Our team only reads chats if you involve us or there is a specific reason, such as suspected fraud.

In the chat you can report or block a contact (nos. 5a and 17).

Until a booking has been paid, an automatic filter replaces phone numbers, email addresses, links and messenger names in chat messages with the notice "[Contact details visible after payment]". This protects you and the rental companies from fraud outside the platform and secures processing via Rentlo. Only for messages filtered in this way do we store the original text separately; only our trust and safety team can view it, and we delete it after 90 days. Messages with our customer service are not filtered.

Legal bases: Art. 6(1)(b) GDPR for the chat, Art. 6(1)(f) GDPR for the contact filter (protection against fraud and circumvention of the platform). We keep chats for 3 years after the last activity.

14. Reviews

After a completed rental you can review the rental company. We publish the review with your first name and the first letter of your last name. We only check reviews for impermissible content such as contact details or insults, never by the number of stars. The rental company can reply publicly. Legal bases: Art. 6(1)(b) and (f) GDPR. If you delete your account, we replace the name with "Former customer". How we handle reviews is explained under Review policy.

15. Shorts: watching, likes, comments and sharing

In the Shorts feed we show videos and image series from rental companies and from Rentlo as well as advertising labelled as "Ad" (no. 15a).

We only count views, clicks and shares of Shorts as daily totals per Short, without IP address or account. We store likes, saved Shorts, following rental companies and comments with your account so that you can find them again and they can be displayed. So that you see Shorts you have already watched less often, your device remembers which Shorts you have watched (only the Short identifiers, for at most 21 days, locally in the browser or app). If you are signed in, we also store with your account which Shorts you watched and when, and delete these entries after 120 days. We only use this for the order in the feed. Comments are public with your display name. If you block a rental company or another user, you no longer see their Shorts or comments (no. 5a).

Legal bases: Art. 6(1)(b) GDPR (use of the functions); for daily totals Art. 6(1)(f) GDPR (improving the service and billing ads). We store likes, saved items and follows until you remove them or delete your account. Comments are anonymised when the account is deleted, unless they are the subject of an ongoing report or moderation.

If a rental company uploads a Short, we store the video, images, cover image, text, stickers and the confirmation of its rights. Uploaded files are checked for malware and stored without metadata. Rentlo may also show rental companies' content on social media and in advertising for Rentlo (terms for rental companies no. 6). Recognisable people may only appear in it with their consent, which the rental company obtains.

In the Shorts feed we show an advertisement labelled as "Ad" after a fixed number of videos. For each ad you can see under "Why am I seeing this?" who paid for it and by which criteria it was selected.

Ads from Rentlo and directly booked advertising partners (including rental companies) are selected only by context (language, region selected in the search, vehicle category, app or website), without a user profile. For billing and abuse protection we count impressions and clicks as daily totals per campaign. To prevent double counting and showing ads too often, we form a daily changing, non-reversible check value from your account or your IP address and browser identifier, which we delete after 3 days at the latest; we do not store the IP address itself for this. If you book via an ad, we store the origin "Ad" with the booking. Advertising partners only receive aggregated figures (impressions, clicks, requests and bookings per campaign), never data of individual persons. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is financing the service through advertising, correct billing and protection against click fraud.

Google ads (Google AdSense or Google Ad Manager on the website, Google AdMob in the app; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) are only loaded if you consent to the "Advertising" category in the cookie settings (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Without consent, your device does not load any code from Google, and you only see ads from Rentlo and directly booked advertising partners. We only request non-personalised ads. Google nevertheless sets cookies or uses device storage and device identifiers for frequency capping, fraud prevention and billing and processes your IP address, including in the USA (Google LLC is certified under the EU-US Data Privacy Framework). Google is responsible for further processing; details at policies.google.com/technologies/ads.

Proof of your choice: We store your decision on your device and additionally on our server with a random identifier, the chosen category, the time, the version of the banner and, if you are signed in, your account, without IP address and browser identifier. This serves as proof of consent (Art. 7(1), Art. 6(1)(c) GDPR); we delete the entry after three years.

Withdrawal: You can withdraw your consent at any time with effect for the future, on the website via "Cookie settings" at the bottom of every page, in the app under Profile › Privacy settings. After that we no longer load Google ads and delete the advertising entries on your device.

16. Votes in Shorts (Love-o-Meter and poll)

Some Shorts contain stickers for voting: the "Love-o-Meter" (a value from 0 to 100) and the "Poll" (one of two to four answers). You can only vote with an account, once per sticker; you can change or withdraw your vote.

We store your vote with your account, the sticker and the time. We only show results in aggregated form (number, average or share per answer) and only once a sticker has at least 5 votes; before that, customers and rental companies only see that there are still few votes. The rental company never sees who voted how. Accounts with rental company or staff access cannot vote. Our moderation team sees results without personal reference and can remove an account's votes and block voting in the event of misuse.

The legal basis is Art. 6(1)(b) GDPR (use of the voting function). We store your vote until you withdraw it, the Short or sticker is deleted or you delete your account. Your votes are included in your account's data export.

17. Reports of content (Digital Services Act)

You can report illegal content or violations of our rules via the reporting form, even without an account. We process your name, your email address, the reported content, your explanation, your statement that you are acting in good faith and a hash of your IP address to fend off mass reports. We store reports in the app (Shorts, comments, chats and reviews) with your account; for a report from the chat, our team sees the reported or last message of the other side.

We confirm receipt and inform you of our decision. If content of another user is affected, we inform them of the decision and its reasons; we do not pass on your name and email address, unless this is necessary to handle an infringement and you have been informed beforehand (for example for copyright infringements). If there are indications of a criminal offence threatening the life or safety of persons, we inform the competent authorities (Art. 18 DSA).

The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16 to 18 DSA. We delete the IP hash after 7 days and the name and email address of the reporting person 6 months after the procedure has been closed.

18. Rentlo Club, vouchers and gift kilometres

In the Club we store points, rank, your Club benefits (for example Club vouchers), credit, kilometre credit and your invitation code. We use your date of birth for double points if your rental starts in your birthday week (up to 3 days before or after your birthday). If you buy a gift voucher or give kilometres as a gift, we process the order, the payment and, if you provide them, the name and email address of the recipient only to deliver the code. If you share your invitation code, we do not contact the invited person ourselves; if they sign up, we see that they came via your code in order to credit you with the points.

The legal basis is Art. 6(1)(b) GDPR. We keep order and payment records in accordance with the statutory periods (no. 25).

19. Search alert and calendar subscription

Search alert: For an availability or price alert we process your email address, language, search criteria and matches found and write to you at most once every six hours. Without an account you confirm the alert via a link (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR), for signed-in customers Art. 6(1)(b) GDPR. We delete unconfirmed alerts after 7 days and ended alerts 30 days after they end.

Calendar subscription: In your account you can create a secret calendar link that your calendar service retrieves regularly. It contains your rentals with booking number, vehicle, period and status. The chosen calendar service processes the content under its own responsibility. You can revoke the link at any time. The legal basis is Art. 6(1)(b) GDPR.

20. Emails, push notifications, newsletter and waiting list

We send booking, account and security emails to perform the contract (Art. 6(1)(b) GDPR) via IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) as a processor. We keep sending logs for 12 months and email content for 90 days.

Push notifications: In the app we send notifications about bookings, messages and, for rental companies, new requests if you switch them on. Delivery runs via Google Firebase Cloud Messaging (Google Ireland Limited) and on Apple devices additionally via the Apple Push Notification Service (Apple). For this we store a device identifier (push token) with your account; the notification itself only contains a short text. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). You can switch notifications off at any time in the app or in your device settings. We delete notifications in your account 180 days after they have been read, at the latest after 12 months; deregistered device identifiers after 90 days.

Feedback after the rental: After a rental we occasionally ask you by email for a short rating of your experience. The legal basis is our legitimate interest in the quality of our service (Art. 6(1)(f) GDPR). You can object at any time via the link in each of these emails.

Newsletter and waiting list are only sent with your consent using the double opt-in procedure (Art. 6(1)(a) GDPR). As proof we store the times of sign-up and confirmation, the consent text and hashes of IP address and browser identifier. We only count clicks on links as totals per link; we do not measure opens. You can unsubscribe at any time via the link in every email; after that, a hash of your address remains on a block list so that we no longer send you anything. We delete unconfirmed sign-ups after 30 days.

21. Customer service and best price guarantee

If you contact us or report a lower price, we process your information to handle it (Art. 6(1)(b) GDPR). For a justified best price report we credit the difference as credit; for this it may be necessary to show the rental company the reported comparison offer (without your contact details). We keep customer service cases for 3 years after closure.

22. For rental companies

For the rental company account we process company and contact person data, legal form, register and tax information, contact details, pick-up locations, vehicles including licence plates, rental terms, payment and deposit types, reviews, revenue, payout data and verification documents (for example ID and business registration). Profile, listings and Shorts are public. We show customers the company name, legal form, representatives, business address, business contact details, register and VAT ID in the legal notice of the rental company profile, in the "Contracting party" booking step and in the booking because the law requires it (Art. 246a and 246d EGBGB). Before approval, our team checks the business or register document and the ID; the scanner under no. 10 applies accordingly to capturing them. If you confirm for a booking that you have checked the customer's ID and driving licence, we store the time and account. For individual offers we store content, validity and status (no. 9).

Payouts via Stripe: For payouts we set up a connected account with Stripe for you. Rentlo collects the required details itself in its own wizard and transmits them to Stripe via Stripe's interface (know your customer): company details (name, legal form, register and tax number, VAT ID, address, phone), business profile (industry, description, website, statement descriptor), details of the representative, of owners with 25 percent or more and of directors (name, date of birth, home address, email, phone, nationality, job title, ownership), copies of ID, business or register document and, if needed, proof of address or bank account, the bank account (IBAN, account holder) and the time, IP address and browser identifier of your acceptance of the Stripe Connected Account Agreement. If Stripe later asks for more, we automatically send what we already have and only ask you for what is missing. If an account exceptionally cannot be set up via the interface, Stripe collects the details in a Stripe form embedded in the rental company area; we then only receive the status of your account (for example whether payouts are possible and which details are still missing). We store these details encrypted and only as long as you use the payout account (deleted at the latest with your rental company account, unless statutory retention obligations apply); documents are stored protected and are only visible to our review team. Stripe additionally checks identity and company under its own responsibility (no. 11). Legal bases: Art. 6(1)(b) GDPR (paying out your earnings) and (c) GDPR (statutory checks, for example under anti money laundering law).

Platform Tax Transparency Act: We report information about you and your revenue annually to the Federal Central Tax Office (Art. 6(1)(c) GDPR).

Trust score: From reviews, response time, acceptance and cancellation rate of the last 180 days, verification status, experience and profile completeness, we automatically calculate a trust score with badges that appears on the profile. You only receive statistics on vehicles and Shorts in aggregated form, without data of individual customers.

Content and advertising: Rentlo may also use images, videos, sounds and texts you upload on social media, in paid advertising, in the newsletter and on its own website and app (terms for rental companies no. 6). For this we upload the content to the operators of the respective networks (for example Meta, TikTok, Google/YouTube), who process it under their own responsibility and partly in the USA. If the content contains personal data (for example you or employees in a video), we rely on Art. 6(1)(b) GDPR and the consents you obtain for people shown; if a person withdraws their consent, we no longer use the content in new advertising materials. We do not pass customer data to social networks for advertising (no customer lists, no tracking pixel). If you run ads under "Advertise", we process ad content, budget, duration, review decisions and campaign billing.

Team and partner API: If you give employees their own access, we process their names, email addresses, roles and sign-ins. For the partner API we store access keys (only as a hash), webhook addresses, usage counters and transmission logs (90 days).

Legal bases: Art. 6(1)(b) GDPR; for legal obligations Art. 6(1)(c) GDPR (for example Platform Tax Transparency Act, Digital Services Act); for the trust score and logs Art. 6(1)(f) GDPR. We log administrative actions of our team for 24 months. Details are in the terms for rental companies.

22a. Partners and partner pages

On Rentlo and in the rental company area we present partners, for example Hyghsoft with HyghFleet and GPS and black boxes (software and telematics for rental companies), Central Car (franchise), ConnectPro (network for rental companies) or partners for buying cars. If you click on a link to a partner, its privacy notice applies there.

Partner enquiries: If you fill in the enquiry form on a partner page, we store your details (name, email address, optionally phone, company, city and your message) together with a hash of your IP address and browser identifier to prevent misuse, create a case in our customer service and forward the enquiry to the partner you addressed it to; the form tells you so. Legal basis is Art. 6(1)(b) GDPR (handling your enquiry). We treat the enquiry like a customer service case (no. 21).

Beyond that we do not pass any data on to partners. We do not transmit any data of our own accord to ConnectPro, HyghFleet or black box providers (no. 4a).

23. Recipients

Your data is only received by those who need it for the respective purpose:

  • the rental company of your booking (nos. 9 and 10) and, at its request, its software via the partner API (no. 9a),
  • our processors: Hetzner (hosting in Germany), Hyghsoft (development and operation), IONOS (email delivery) and Anthropic (AI search and AI answers on help pages only with consent and only the text entered; translation of rental company texts),
  • Stripe (payment and payout) and the provider of the payment method you choose, for example Apple, Google, Klarna, Revolut or your bank (no. 11),
  • partners to whom you address an enquiry via a partner form (no. 22a),
  • operators of social networks and ad networks, insofar as Rentlo publishes rental companies' content there (no. 22),
  • Google (maps and ads only with consent, sign-in with Google, push notifications), Apple (sign-in with Apple, push notifications on Apple devices) and Hyghsoft as provider of HyghsoftID (sign-in),
  • the calendar service you choose for the calendar subscription,
  • tax advisers, authorities (for example the Federal Central Tax Office) and courts, insofar as there is a legal obligation or it is necessary to defend legal claims.

24. Transfers to third countries

We process your data in the EU, stored in Germany. Transfers to the USA are possible with Google, Apple, Stripe and Anthropic, and for rental companies' content also with the social networks used (no. 22). Hyghsoft, Hetzner and IONOS process data only in Germany. They are based on the adequacy decision for the EU-US Data Privacy Framework insofar as the recipient is certified, otherwise on the European Commission's standard contractual clauses. Transfers to rental companies in Switzerland are covered by the European Commission's adequacy decision for Switzerland.

25. How long we keep data

Data Retention period
Customer account, profile, favourites, Club until the account is deleted
Copies of ID, driving licence and business licence until you delete them, at the latest until account deletion
Details for payouts via Stripe (rental companies, encrypted) as long as the payout account is used, at the latest until the rental company account is deleted, unless statutory retention obligations apply
Bookings 6 years after the end of the rental, then anonymised; invoice and payment references up to 10 years (section 147 AO, section 257 HGB); after account deletion only pseudonymised
Report photos and chat images 12 months after return, longer only if a dispute is open
Chats 3 years after the last activity
Customer service cases 3 years after closure
Original text of filtered chat messages 90 days
Votes in Shorts until withdrawn, until the Short or sticker is deleted or your account is deleted
Automatic translations of rental company texts until the rental company changes or deletes the text
Likes, saved items, follows, blocks until you remove them or delete your account
Decision on the AI search until you change it or delete your account (on the device until you delete the app data)
Proof of your cookie and advertising consent 3 years (on the device 12 months)
Check value against double counting of ads at most 3 days
Notifications in the account, push identifiers read 180 days, otherwise 12 months; deregistered identifiers 90 days
Partner API transmission logs 90 days
Reports under the DSA reporter data 6 months after closure, IP hash 7 days
Newsletter, waiting list until unsubscribed; unconfirmed 30 days
Search alerts unconfirmed 7 days, ended 30 days after the end
Access logs (shortened IP) 14 days
Security events 90 days
Email delivery content 90 days, sending logs 12 months
Log of administrative actions of our team 24 months

If deletion is not yet possible due to statutory retention obligations, we restrict the data from any other use.

26. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)); the lawfulness of processing carried out until then remains unaffected. You can trigger data export and account deletion directly in your account under "Account"; instructions are under Delete account. For everything else, an email to datenschutz@rentlo.de is enough.

Right to object (Art. 21 GDPR): If we process data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons; we will then no longer use your data for advertising.

27. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country in which you live or work. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany. In Austria the Data Protection Authority (Barichgasse 40-42, 1030 Vienna) is responsible, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern).

28. Obligation to provide data, automated decisions

Information required for account and booking is mandatory; without it we cannot conclude the contract. Solely automated decisions with legal effect within the meaning of Art. 22 GDPR do not take place. Only contractual requirements such as minimum age, years of holding a licence and availability as well as content via the filters from no. 13 and the terms of use are checked automatically. The AI search (no. 8) only sets search filters that you can see and change. On request our team checks personally.

29. Notes for Switzerland and Austria

For persons in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies; you have the rights under no. 26 accordingly. For persons in Austria, the Austrian Data Protection Act (DSG) also applies.

30. Changes to this privacy policy

We adapt this privacy policy when our service or the legal situation changes. The version published here with the date stated below applies. We also inform you by email of material changes that affect you as a registered user.

Version: datenschutz-2026-11-01 · As of: 1 Nov 2026