Privacy Policy

1. Data controller

The controller of your personal data is GDrent, based in Sławkowice, 32-020, Poland (“GDrent”, “we”). For any questions regarding personal data protection, contact us at kontakt@gdrent.pl or by phone: +48 518 173 746 (Łukasz), +48 797 980 063 (Mateusz).

We have not appointed a Data Protection Officer — the scale of our business does not trigger this requirement under Article 37 GDPR. Please direct all data protection matters to the e-mail address above.

2. What data we process and why

Rental customer data (name, address, national ID/PESEL or company tax ID, phone, e-mail, driving licence details, rental agreement data, booking history, payment data) — processed to conclude and perform the rental agreement, issue sales documents, and pursue potential claims.

Data from public forms (contact form, “For businesses”, “Long-term rental”) — name/company name, e-mail, phone, message content — processed to respond to your inquiry and prepare an offer.

GPS location data of GDrent fleet vehicles (SinoTrack ST901 devices) — processed to manage the fleet, ensure vehicle safety, settle mileage/mileage limits under the rental agreement, and respond to alerts (e.g. leaving a designated zone, prolonged inactivity). Monitoring concerns the vehicle and is not used as an employee-monitoring tool beyond what is necessary for the purposes above.

Data of contractors and customers with portal access (login data, company data, assigned vehicles) — processed to provide portal functionality (GPS tracking, documents, invoices, service schedule).

Technical data (IP address, session identifier, system event logs) — processed to ensure system security, detect abuse, and maintain accountability of actions in the system (audit log).

3. Legal basis for processing

Conclusion and performance of the rental agreement — Article 6(1)(b) GDPR (processing necessary for the performance of a contract or to take steps prior to entering into a contract).

Issuing sales documents, tax and accounting settlements — Article 6(1)(c) GDPR (legal obligation, arising in particular from accounting and VAT regulations).

Responding to inquiries from the contact form — Article 6(1)(a) GDPR (consent given when submitting the form — a consent checkbox).

Fleet GPS monitoring, establishing or defending against legal claims, ensuring system security — Article 6(1)(f) GDPR (legitimate interest of the controller).

4. Data retention period

Data related to the rental agreement and sales documents — for the duration of the agreement, and afterwards for the period required by tax and accounting law (generally 5 years, counted from the end of the calendar year in which the tax obligation arose).

Raw GPS points (exact route, speed at a given moment) — retained for 30 days after being recorded, then permanently deleted. After that period we keep only aggregated data (daily/monthly mileage, driving/idle time, average speed/fuel consumption), which does not allow the exact route to be reconstructed.

Data from contact forms not related to a concluded agreement — for 12 months from the last contact, unless you withdraw your consent earlier.

Customer/contractor portal account data — for as long as the account is active, and after closure for the period indicated above for sales documents (where applicable).

5. Data recipients

Your data may be entrusted to entities that provide services necessary for our business, in particular: hosting and infrastructure providers (Railway, Vercel), file/photo storage (Cloudflare R2), map provider (Mapbox), e-mail delivery provider (Resend), and our accounting office. Each of these entities processes data solely on our documented instructions and only to the extent necessary for the service provided.

We do not sell your personal data or share it with third parties for marketing purposes.

Data may be disclosed to public authorities where required by applicable law (e.g. at the request of a court or law enforcement).

6. Data transfers outside the European Economic Area

Some of the providers we use (e.g. hosting, e-mail delivery) may process data on servers located outside the EEA, including in the USA. In such cases, the providers ensure an adequate level of data protection, in particular through standard contractual clauses approved by the European Commission.

7. Your rights

Under GDPR you have the right to: access your data, rectify it, erase it, restrict its processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing carried out before its withdrawal).

If you have a customer portal account, you can exercise some of the above rights yourself (export your data, request its deletion) — in other cases, contact us at kontakt@gdrent.pl. We respond to requests without undue delay, no later than within one month.

You also have the right to lodge a complaint with the Polish Data Protection Authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) if you believe that the processing of your data infringes GDPR.

8. Cookies

Our website uses cookies necessary for its proper operation (e.g. maintaining your login session, remembering your chosen light/dark theme and site language). We do not use cookies for advertising purposes or to track you across other websites.

You can manage cookies through your browser settings, including blocking them — this may, however, limit the website's functionality (e.g. prevent you from logging into the portal).

9. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

10. Data security

We apply appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), role-based access control, logging of key operations in an audit log, and regular security updates to the system.

11. Changes to this privacy policy

This privacy policy may be periodically updated, in particular in connection with changes in the law or the scope of services we provide. The current version is always available at this address, together with the date of its last update.