Privacy Policy

This Privacy Policy describes how Renta, operating the Renta peer-to-peer vehicle sharing marketplace (“Renta”, “we”, “us”, “our”), collects, uses, discloses, stores, and protects personal data in connection with the website at [domain] and any related applications, APIs, and communications (collectively, the “Platform”). Renta connects individuals and businesses who list cars, motorbikes, and scooters (“Owners”) with individuals who wish to rent them (“Renters”). This Policy applies to Owners, Renters, guest checkout users, and visitors to the Platform. It is issued in compliance with Republic Act No. 10173 (the Data Privacy Act of 2012), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). For personal data whose purposes and means of processing we determine, Renta acts as a Personal Information Controller (PIC). Our Data Protection Officer can be reached at [email protected], Puerto Princesa City, Palawan, Philippines.

By creating an account, completing a guest booking, listing a vehicle, or otherwise using the Platform, you acknowledge this Policy. Where processing depends on your consent, we obtain it separately and specifically at the point of collection, and you may withdraw it as described in Your rights below.

We collect personal data directly from you, automatically through your use of the Platform, and from third parties where described below.

Account and profile data comprises your full name, email address, mobile number, password (stored only as a salted cryptographic hash), profile photograph where supplied, preferred language, and role (Owner, Renter, or both). Guest checkout users are not required to create an account, but we collect the same contact data and booking details necessary to fulfil the reservation, and we associate that data with the booking record rather than a persistent profile unless you later register.

Identity and eligibility data is collected to verify that a Renter is legally entitled to operate the vehicle requested and that an Owner is entitled to list it. This includes a copy and the number of your driver’s license, its issue and expiry dates and restriction codes, date of birth, and, where we require additional verification, another government-issued identification document and a live selfie for face-matching against the document photograph. Government-issued identifiers and images of them constitute sensitive personal information under Section 3(l) of the Data Privacy Act and are processed only on the bases permitted by Section 13 of that Act, principally your consent and the necessity of establishing, exercising, or defending legal claims. Biometric templates derived from selfie matching, if any, are used solely for verification and are not used to identify you elsewhere.

Vehicle and listing data supplied by Owners includes make, model, year, plate number, OR/CR details and registration validity, photographs, pricing, availability calendars, pick-up and drop-off locations, insurance information, and condition notes. Although much of this relates to property rather than a person, it is linked to an identifiable Owner and is treated as personal data.

Booking and transaction data includes reservation dates and times, pick-up and return details, rental price, deposits, fees, cancellation history, and payment status. Payments are made through GCash or manual bank transfer. We receive and store transaction reference numbers, the payer’s account name, amounts, timestamps, and any payment proof image you upload. We do not collect or store full bank account credentials, GCash PINs or one-time passwords, and the Platform does not process payment card numbers. Owners who receive payouts provide the account name and account or wallet identifier to which payouts should be sent.

Location data includes the pick-up and drop-off locations associated with a booking and, if you grant the relevant device permission, approximate or precise device location used to show nearby vehicles. We do not continuously track a Renter’s location during a rental unless a tracking feature is expressly offered, disclosed at the time, and enabled by you and the Owner.

Communications data includes messages exchanged between Owners and Renters through the Platform, messages sent to our support channels, reviews and ratings, and records of reports, disputes, and damage or incident claims, including photographs and descriptions you submit.

Technical and usage data is collected automatically and includes IP address, device and browser type, operating system, language and time-zone settings, referring URLs, pages and features accessed, timestamps, session identifiers, and diagnostic logs. We use cookies and similar technologies as described in Cookies below.

Data from third parties may include confirmation of payment from your bank or e-wallet provider, authentication data if you sign in using a third-party identity provider, and information from public registries or our verification vendors used to confirm the validity of a license or registration.

We process personal data only for specified and legitimate purposes and only on a lawful basis under Sections 12 and 13 of the Data Privacy Act.

Creating your account, publishing a listing, processing a reservation, coordinating pick-up and return, recording payment confirmation, and enabling communication between the parties to a booking

Contractual necessity

Processing identity documents, selfie images, and precise location

Your consent

Fraud prevention, platform security, abuse detection, dispute resolution, enforcement of our Terms of Service, and improvement of the Platform

Legitimate interests

Compliance with Philippine law, including tax, anti-money-laundering, and lawful requests from courts and regulators

Legal obligation

Direct marketing communications, where we send them

Your consent

Consent is requested at the point of collection. We balance our legitimate interests against your rights and freedoms and do not pursue them where those interests are overridden. You may decline marketing communications at any time without affecting your use of the Platform.

We do not sell personal data. We do not use sensitive personal information for advertising or for any purpose incompatible with the verification, safety, and dispute purposes for which it was collected.

Disclosure between Owners and Renters is limited to what is necessary for a confirmed or pending booking. Upon a Renter’s reservation, the Owner receives the Renter’s name, contact number, the rental dates, the pick-up arrangements, and confirmation that identity and license verification has been completed. Owners are not given the Renter’s license image or number unless the Owner has a legitimate need to inspect the original document at hand-over, in which case inspection occurs in person and the Owner is prohibited from copying, photographing, or retaining it. Conversely, Renters receive the Owner’s display name, the vehicle details, and the pick-up location and contact details needed to complete the rental. Each Owner, once in receipt of Renter data, independently determines how that data is handled for purposes outside the Platform and is responsible under the Data Privacy Act as an independent PIC for any such handling; our Terms of Service require Owners to use Renter data solely to fulfil the booking, to secure it, and to delete it when no longer needed.

We engage Personal Information Processors (PIPs) who process data on our behalf and under written data-processing agreements that bind them to our instructions, to confidentiality, and to appropriate security measures. These include cloud hosting and database providers, authentication and storage infrastructure, email and SMS delivery providers, identity verification vendors, mapping and geolocation services, error monitoring and analytics tools, and customer-support tooling. Payment institutions such as GCash operators and banks act as independent controllers of the payment data they process under their own privacy notices.

We may disclose personal data where required by law, subpoena, court order, or lawful request of a government authority; to protect the rights, property, or safety of Renta, our users, or the public; to law enforcement and insurers in connection with accidents, theft, or suspected criminal activity involving a rented vehicle; and to a successor entity in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this Policy and will notify you of any material change in controller identity.

We retain personal data only for as long as necessary for the purposes for which it was collected, to comply with legal obligations, and to establish, exercise, or defend legal claims.

Account data

[24] months after account closure

Identity document images and selfie data

Within [90] days after the last booking relied on

Transaction and payment records

[10] years

Messages and booking records

[24] months after the booking concludes

Server and security logs

No more than [12] months

Identity document images and selfie data are deleted or irreversibly anonymized within the period above unless a claim, dispute, or legal hold requires longer retention. Transaction and payment records are retained to satisfy tax and accounting requirements under Philippine law, and account data is retained after closure to handle disputes and fraud investigations. Data that has served its purpose is securely disposed of through deletion or irreversible anonymization, and backups are overwritten on their normal rotation schedule.

We implement organizational, physical, and technical safeguards appropriate to the nature of the data and the risks of processing, consistent with Sections 20 and 21 of the Data Privacy Act and NPC Circular 16-01. Technical controls include TLS encryption for data in transit, encryption at rest for databases and file storage, row-level access policies restricting each user to their own records and to booking data they are a party to, private object storage with short-lived signed URLs for identity documents and payment proofs, salted password hashing, role-based access control with least-privilege administrative access, multi-factor authentication for administrative accounts, audit logging of access to sensitive records, and routine vulnerability management and dependency patching. Organizational controls include confidentiality undertakings for personnel with data access, privacy and security training, vendor due-diligence, and documented incident response procedures.

No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for notifying us promptly of any suspected unauthorized access to your account.

Under Section 16 of the Data Privacy Act, you have the right to:

• be informed of whether and how your personal data is processed;
• access your personal data and the recipients to whom it has been disclosed;
• object to processing, including direct marketing, profiling, and processing based on consent or legitimate interest;
• dispute inaccuracy or error and have it corrected;
• suspend, withdraw, or order the blocking, removal, or destruction of your personal data upon substantiated grounds, including where it is incomplete, outdated, false, unlawfully obtained, or no longer necessary;
• obtain a copy of your data in an electronic or structured, commonly used format where processing is by electronic means; and
• be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your data.

You may also lodge a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights have been violated.

To exercise any of these rights, contact our Data Protection Officer using the details under Contact. We may require reasonable proof of identity before acting on a request and will respond within [fifteen (15)] business days. Withdrawal of consent or erasure requests do not affect the lawfulness of processing carried out before withdrawal, and we may retain data that we are required or permitted by law to keep, in which case we will inform you of the basis. Withdrawal of consent to identity verification will prevent you from renting or listing vehicles, as verification is a condition of the service.