Data Processing Addendum
Last updated: September 20, 2026
This Data Processing Addendum ("Addendum") forms part of the Rentlica Terms of Service. It applies when Rentlica ("Processor") processes personal data on behalf of a rental company customer ("Controller") in the Service.
1. Roles
The Controller determines the purposes and means of processing renter, driver, booking, agreement, handover, damage, and related operational personal data. Rentlica processes that data only as Processor, except where Rentlica is Controller for account, billing, support, and website data as described in the Privacy Policy.
2. Subject matter and duration
The subject matter is hosting and processing the Controller's workspace data to provide the Service. Processing lasts for the term of the subscription and any permitted retention after it ends.
3. Nature and purpose
Processing includes storage, retrieval, display, transmission to destinations the Controller configures (including partner channels, API clients, and webhooks), generation of documents, capture of electronic signatures, and deletion. The purpose is to provide rent-a-car operations software instructed by the Controller.
4. Types of data and data subjects
Data subjects include the Controller's staff, renters, additional drivers, and travellers named on partner-channel reservations. Personal data may include identification and contact details, date of birth, driving licence details, booking and payment-status data the Controller stores, signature images and signing audit data, vehicle-condition photographs, and communications needed to perform a rental. Special-category data is not requested by the Service; the Controller must not upload it unless it has a lawful basis and has instructed us in writing.
5. Instructions
The Processor will process personal data only on documented instructions from the Controller, including the Terms, this Addendum, and configuration the Controller sets in the Service, unless Union or Member State law requires otherwise. The Controller warrants that its instructions are lawful.
6. Confidentiality
The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
7. Security
Taking into account the state of the art, costs, and the nature of the data, the Processor implements appropriate technical and organisational measures, including encryption in transit, access control by role, least-privilege credentials, and audit logging of changes. Object storage is used for files; a managed database is used for structured records.
8. Sub-processors
The Controller authorises the Processor to use sub-processors reasonably required to provide the Service, including authentication, payment, measurement (where the Controller or a website visitor has consented), error monitoring, managed database hosting, and object storage. Clerk (authentication), PayPal (payments), and Google Tag Manager (marketing measurement) are current named providers. The Processor will impose data-protection obligations on sub-processors no less protective than this Addendum. A current list is available from [email protected]. The Processor will give notice of intended changes to named sub-processors so the Controller can object on reasonable grounds.
9. International transfers
Where personal data is transferred outside the EEA, the Processor will ensure a valid transfer mechanism, such as an adequacy decision or standard contractual clauses, together with any supplementary measures reasonably required.
10. Assistance
Taking into account the nature of processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as possible, for data-subject requests, data-protection impact assessments, and consultations with supervisory authorities. Renters should normally contact the Controller; the Processor will not respond as if it were the Controller except to redirect the request.
11. Personal data breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data, with information reasonably available to help the Controller meet its own notification duties.
12. Return and deletion
During the subscription the Controller may export data via the features of the Service or by request. After the end of the Service, the Processor will delete or return Controller personal data within 90 days, unless Union or Member State law requires storage, or the Controller requests a longer retention of signed agreements and condition evidence that remains legally necessary. Backup copies fall out of rotation on the ordinary backup cycle.
13. Audits
The Processor will make available information reasonably necessary to demonstrate compliance with this Addendum. Audits are limited to once per 12 months unless a competent authority or a documented breach reasonably requires more, and must be conducted on reasonable notice, during business hours, without compromising other customers' security.
14. Liability and order of precedence
Liability under this Addendum is subject to the limitations in the Terms, except where a mandatory data-protection rule says otherwise. If there is a conflict about processing of personal data, this Addendum prevails over the Terms.
15. Contact
Processor contact for this Addendum: [email protected].