Legal

Privacy Statement

Which personal data we collect, why we process it, who we share it with, and the rights you have under the GDPR.

Last updated27 February 2026

In this document

1INTRODUCTION
2DATA CONTROLLER
3WHAT PERSONAL DATA DO WE COLLECT?
4WHY DO WE PROCESS YOUR PERSONAL DATA?
5WITH WHOM DO WE SHARE YOUR PERSONAL DATA?
6INTERNATIONAL TRANSFER OF DATA
7RETENTION PERIODS
8COOKIES AND TRACKING TECHNOLOGIES
9YOUR PRIVACY RIGHTS
10SECURITY OF YOUR DATA
11MINORS
12CHANGES TO THIS PRIVACY STATEMENT
13CONTACT
14APPLICABLE LAW

1. INTRODUCTION

Renttoo ("Renttoo", "we", "us") respects your privacy and is responsible for the processing of your personal data. This Privacy Statement describes how we collect, use, share and protect your personal data when you use our Platform (renttoo.nl).

This Privacy Statement is part of Renttoo's Terms and Conditions and complies with the General Data Protection Regulation (GDPR) and Dutch privacy legislation.

By using the Platform, you agree to the processing of your personal data as described in this Privacy Statement.

2. DATA CONTROLLER

Renttoo

Chamber of Commerce: 42011790
VAT: NL867934918B01
Email: support@renttoo.nl
Website: renttoo.nl

For questions about this Privacy Statement or your privacy rights, you can contact us via:

Email: support@renttoo.nl
Via the contact form on renttoo.nl/contact

3. WHAT PERSONAL DATA DO WE COLLECT?

3.1 Account and Profile Data

When you create an Account, we collect:

First and last name
Email address
Phone number
Password (stored encrypted via our authentication provider)
Profile photo (optional)
Address details (street, house number, postal code, city, country, and geographic coordinates for map display)
Language preference (determined by your browser/URL settings)

3.2 Verification Data (KYC/KYB)

In accordance with the Wwft (Anti-Money Laundering and Anti-Terrorist Financing Act), we collect via Stripe Identity (for Clients) and Stripe Connect (for Owners):

Identity document (ID card, passport or driver's license)
Selfie for identity verification
Business details (for Owners), including company name, KvK number, and tax ID
Bank account details (for Owners, for receiving payouts)

Important: These verification data are collected and stored by Stripe via Stripe Identity/Connect in accordance with their own privacy policy and Wwft obligations. Renttoo has access to this data via the Stripe dashboard insofar as necessary to comply with legal obligations, but the data is not directly stored with Renttoo. We store only verification session identifiers and status flags (verified/pending/failed).

3.3 Transaction and Payment Data

When placing a Booking, we collect:

Payment data (processed via Stripe, not stored with Renttoo)
Transaction history (amounts, dates, statuses, commission splits)
Payout data (for Owners, including payout amounts, methods, and arrival dates)
Invoice data (names, addresses, tax IDs, booking details)
Payment status and payment method type
Refund records (amounts, reasons, dates)

3.4 Product and Booking Data

When you offer a Product as an Owner or place a Booking as a Client:

Product descriptions, titles, and photos
Availability, calendar data, and price information
Booking details (date, time, duration, quantities, timezone)
Location data (address and geographic coordinates for pickup/delivery, with configurable privacy settings for address visibility)
Communication between Owner and Client via the Platform
Coupon and discount codes applied to bookings
Cart contents (listings saved for checkout)

3.5 Communication Data

Messages between Users via the Platform (including text content and file attachments)
Support and customer service communication (via contact form)
Email notifications (transactional emails related to bookings, payments, reviews, and damage claims)
Feedback, reviews (including ratings, text, and photos), and review responses
Reports submitted about other Users or content (including report reason and description)

3.6 Technical and Usage Data

When you use the Platform, we automatically collect:

Browser type and version (via user agent string)
Operating system and device information (via user agent string)
Timezone
Time and duration of visit
Pages you visit (URL paths and page titles)
Search queries and filter selections
Referrer (the page that led you to our Platform)

Behavioral Analytics: To improve our Platform, we collect detailed interaction data including:

Button clicks and their location on the page
Form submissions and form validation errors
Checkout steps completed and checkout abandonment
Listing views, bookmark actions, and cart operations
Map interactions (zoom level, marker clicks)
Booking workflow steps and payment flow progress
Account actions (profile updates, settings changes, deletion requests)

This data is linked to an anonymous session identifier (stored in your browser's session storage) and, if you are logged in, to your user account. All behavioral analytics data is stored in our own database (Supabase) and is not shared with external analytics services.

3.7 Marketing and Content Data

If you have given consent:

Preferences for marketing communication (managed via your Account settings)
Content you share (photos, videos, reviews)
Google account information (if you log in via Google)

3.8 Team and Company Data

If you register as a company owner and create a team:

Employee or team member email addresses (for invitations)
Team member roles and permissions
Company entity details (legal name, KvK number, tax ID, business address)

3.9 Damage Claim Data

When a damage claim is submitted:

Damage description and date of damage
Claimed amount and item value
Photographic evidence (before/after photos, up to 5 files per claim)
Objection text and supporting documents (if applicable)
Claim status and payment status

4. WHY DO WE PROCESS YOUR PERSONAL DATA?

4.1 Performance of Contract

We process your data to:

Create and manage your Account
Offer and maintain the Platform
Facilitate Bookings between Owners and Clients
Process payments and make payouts
Enable communication between Users
Provide customer service
Process damage claims under Renttoo Borgvrij

Legal basis: Performance of contract (Article 6(1)(b) GDPR)

4.2 Legal Obligations

We process your data to comply with:

Wwft obligations: Identity verification (KYC/KYB) and transaction monitoring
Tax obligations: Retention of transaction data (7 years)
Tax legislation: VAT payment and filing
Legal obligations: Cooperation with authorities in criminal investigations

Legal basis: Legal obligation (Article 6(1)(c) GDPR)

4.3 Legitimate Interest

We process your data for:

Security and fraud prevention: Protection of the Platform and Users against fraud, abuse and illegal activities
Platform improvement: Analysis of usage patterns and behavioral analytics to improve the Platform (see Section 3.6)
Marketing: Direct marketing (if you have not objected)
Legal protection: Protection of our rights and interests in disputes

Legal basis: Legitimate interest (Article 6(1)(f) GDPR)

We process your data with your consent for:

Marketing emails and communications
Use of your content in marketing materials
Cookies for preference storage (see Section 8)

Legal basis: Consent (Article 6(1)(a) GDPR)

You can withdraw your consent at any time by contacting us or via your Account settings.

4.5 Automated Decision-Making

The Platform uses limited automated decision-making:

Instant Booking: When an Owner enables "Direct Booking" for a Product, bookings are automatically confirmed upon payment without manual approval by the Owner. This is a feature chosen by the Owner and does not involve profiling.
Refund thresholds: Refunds above €500 require manual approval by Renttoo staff.

No decisions with significant legal effects are made solely through automated processing. Damage claims are always assessed by Renttoo staff.

5.1 Other Users

We share relevant data with other Users to facilitate transactions:

For Owners: Name, profile photo, reviews and contact details of Clients who have placed a Booking
For Clients: Name, profile photo, reviews, contact details and Product information of Owners

5.2 Service Providers (Processors)

We share your data with trusted service providers who help us offer the Platform:

Stripe (Payment Provider)

Payment processing (card, iDEAL)
Identity verification (Stripe Identity for Clients)
Business verification and payouts (Stripe Connect for Owners)
Fraud detection and prevention
Privacy Policy: https://stripe.com/nl/privacy
Data location: Global, with EU Standard Contractual Clauses

Supabase (Database and Authentication Provider)

User account storage and authentication
Database hosting for all Platform data (listings, bookings, messages, transactions, reviews)
File storage (user avatars, listing images, review photos, message attachments, damage claim evidence)
Real-time data synchronization
Privacy Policy: https://supabase.com/privacy
Data location: EU (Netherlands region)

Resend (Email Delivery Service)

Sending transactional emails (booking confirmations, payment receipts, review notifications, damage claim updates, team invitations, password resets)
Email delivery tracking
Privacy Policy: https://resend.com/legal/privacy-policy
Data location: See Resend privacy policy for details

Mapbox (Map and Location Service)

Interactive map rendering on listing pages and search results
Display of listing locations
Privacy Policy: https://www.mapbox.com/legal/privacy
Data transmitted: Listing coordinates, map viewport, browser information
Data location: United States (with Standard Contractual Clauses)

Vercel (Hosting and Content Delivery)

Application hosting and global content delivery
Server-side rendering and API route execution
Privacy Policy: https://vercel.com/legal/privacy-policy
Data location: Global CDN with EU primary region

Google (Authentication Provider)

OAuth login ("Sign in with Google")
We receive your Google email address and display name when you sign in via Google
Privacy Policy: https://policies.google.com/privacy

All these service providers are contractually obligated to use your data only for the purposes for which we have shared them and to take appropriate security measures.

5.3 Authorities and Legal Obligations

We may share your data with:

Police and Justice: In case of suspicion of criminal offenses (theft, fraud, identity fraud)
Tax Authority: For tax audits and filings
Other government agencies: If legally required

5.4 Collection and Legal Services

In case of non-payment or disputes, we may share your data with:

Collection agencies
Bailiffs
Lawyers and legal advisors

5.5 Business Transfer

In the event of a merger, acquisition or sale of (part of) our activities, your data may be transferred to the new owner, provided they comply with the same privacy obligations.

In all other cases, we only share your data with your explicit consent.

6. INTERNATIONAL TRANSFER OF DATA

Some of our service providers may process data outside the European Economic Area (EEA). In such cases, we ensure that appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs): Model contract provisions approved by the European Commission
Adequacy decisions: Countries with an adequate level of protection
Other appropriate safeguards: In accordance with GDPR requirements

Specific transfers:

Stripe: Global processing with EU SCCs
Mapbox: United States, with EU SCCs
Vercel: Global CDN, EU primary region with appropriate safeguards
Supabase: EU (Netherlands) — no transfer outside EEA
Resend: See their privacy policy for data location details

For more information about the international transfer of your data, please contact us.

7. RETENTION PERIODS

We do not retain your personal data longer than necessary for the purposes for which they were collected, unless there is a legal obligation to retain data longer.

7.1 Specific Retention Periods

KYC/KYB Verification Data

Retention: 5 years after deletion of your Account or after execution of the transaction
Legal basis: Wwft Article 33(3)
Storage: Via Stripe Identity/Connect, not directly with Renttoo

Transaction Data

Retention: 7 years after the transaction
Legal basis: Tax legislation (VAT Act, General Tax Act)

General User Data

Retention: Up to 30 days after deletion of your Account
Exception: Ongoing transactions or disputes may justify a longer retention period

Marketing Data

Retention: Until you withdraw your consent or unsubscribe from marketing

Customer Service Communication

Retention: 2 years after last contact, unless there is a dispute

Behavioral Analytics Data

Retention: Analytics event data is retained for the purpose of Platform improvement. Events older than 24 months may be anonymized or deleted.

Damage Claim Data

Retention: Damage claim records (including evidence photos) are retained for 7 years after resolution, in line with tax and legal obligations.

7.2 Deletion

After the retention period expires, your data will be securely and permanently deleted or anonymized, unless there is a legal obligation to retain data longer.

8. COOKIES AND TRACKING TECHNOLOGIES

8.1 What are Cookies?

Cookies are small text files that are placed on your device when you visit the Platform. We use cookies and similar technologies to:

Make the Platform function properly
Remember your preferences

We also use browser storage mechanisms (localStorage and sessionStorage) for storing user interface preferences.

8.2 Types of Cookies We Use

Functional Cookies (Necessary)

Required for the functioning of the Platform
Storage of login data and preferences
Legal basis: Legitimate interest
Opt-out: Not possible (necessary for functionality)

Our Platform uses a minimal number of cookies. No third-party analytics or marketing cookies are used. For a detailed list of all cookies and browser storage items, please see our Cookie Policy.

You can manage your cookie preferences via:

The cookie banner on the Platform
Your browser settings

Note: Disabling certain cookies may limit the functionality of the Platform.

9. YOUR PRIVACY RIGHTS

Under the GDPR, you have the following rights regarding your personal data:

9.1 Right of Access

You have the right to know which personal data we process about you and why.

9.2 Right to Rectification

You have the right to have incorrect or incomplete data corrected. You can update most of your data directly via your Account settings.

9.3 Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your data, unless:

There is a legal obligation to retain data (e.g., Wwft, tax legislation)
There are ongoing transactions or disputes
There is a legitimate interest in retaining data

You can request account deletion via your Account settings (Settings > Account > Delete Account). A 30-day grace period applies during which you can cancel the deletion request.

9.4 Right to Restriction of Processing

You have the right to restrict the processing of your data when:

You dispute the accuracy of data
The processing is unlawful
You have objected to processing

9.5 Right to Data Portability

You have the right to receive your data in a structured, commonly used and machine-readable format (JSON) and to transfer it to another service provider. You can download your data via Settings > Security > Privacy > "Download my data".

9.6 Right to Object

You have the right to object to:

Processing based on legitimate interest
Direct marketing (you can always unsubscribe via Settings > Security > Privacy > Marketing Communications toggle, or via the unsubscribe link in our emails)

When processing is based on consent, you have the right to withdraw this consent at any time. You can manage your privacy preferences via Settings > Security > Privacy.

9.8 Right to Complain to Authority

You have the right to file a complaint with the Dutch Data Protection Authority (AP) if you believe we are not processing your data correctly.

Dutch Data Protection Authority

Website: www.autoriteitpersoonsgegevens.nl
Phone: 088 - 1805 250

9.9 Exercising Your Rights

To exercise your rights, you can:

Contact us via support@renttoo.nl
Submit a request via the contact form on renttoo.nl/contact
Adjust your data via your Account settings (where possible)

We will respond to your request within 30 days. In complex cases, this may be extended by 2 months, of which we will inform you.

For verification, we may ask you to provide additional information to confirm your identity.

10. SECURITY OF YOUR DATA

We take appropriate technical and organizational measures to protect your personal data against:

Unauthorized access
Loss or destruction
Alteration or disclosure
Other forms of unlawful processing

Security measures we take:

Data encryption (in transit via HTTPS and at rest via our database provider)
Access control and authentication (including Row Level Security policies)
Regular security reviews
Limited access to data (need-to-know basis)
Staff training on privacy and security
Incident response procedures

Important note: Despite our efforts, we cannot guarantee absolute security. No method of transmission over the internet or electronic storage is 100% secure.

Your responsibility: We recommend that you:

Use a strong password
Do not share your Account with others
Sign out after use on shared devices
Contact us immediately if you suspect unauthorized access

11. MINORS

The Platform is not intended for persons under 18 years of age. We do not knowingly collect data from minors. If we discover that we have collected data from a minor without parental or guardian consent, we will immediately delete this data.

12. CHANGES TO THIS PRIVACY STATEMENT

We may adjust this Privacy Statement from time to time to reflect:

Changes in our services
Changes in legislation
User feedback

For important changes, we will notify you via:

Email (if available)
A notification on the Platform
Update of the "Last updated" date at the top of this Privacy Statement

We recommend that you consult this Privacy Statement regularly to stay informed about how we process your data.

Last updated: February 27, 2026

13. CONTACT

For questions, comments or requests regarding this Privacy Statement or your privacy rights, you can contact us: