Privacy Policy

This policy explains what personal data NetRent collects, why we collect it, who we share it with and what rights you have. It covers our website netrent.is and the NetRent platform at app.netrent.is.

1. Who we are

NetRent ehf. (kt. 510626-1330), Iceland, builds software that car rental companies use to manage their fleet, bookings and pricing. You can reach us about anything in this policy at netrent@netrent.is.

We follow the EU General Data Protection Regulation (GDPR) as it applies in Iceland through Act no. 90/2018 on Data Protection and the Processing of Personal Data.

2. Our two roles

NetRent handles personal data in two different roles, and the role decides who is responsible for it.

Controller. For our website, for the user accounts of rental company staff, and for our own sales and support contacts, NetRent decides how the data is used. This policy covers that data in full.

Processor. Rental companies (our customers) enter data about their own renters into NetRent: names, contact details, driver's license details, bookings and payments. For that data the rental company is the controller and NetRent processes it only on their instructions, under a Data Processing Agreement signed with each customer. If you rented a car from one of our customers and have a question about your data, contact that rental company first. We will help them answer you.

3. What we collect

Account data. When a rental company invites you to NetRent, we store your name, email address, the company and role you belong to, and your sign-in details. Passwords are stored only as secure hashes.

Sign-in data from Google or Microsoft. If you sign in with Google or Microsoft, we receive your name, email address, profile picture and a unique account identifier from that provider. Section 4 has the details.

Usage and technical data. Our servers log technical information such as browser type, pages requested, timestamps and IP addresses, used for security and troubleshooting. We use Web Analytics, which counts page visits without cookies and without tracking you across sites.

Error reports. When something breaks in the app, an error report is sent to our monitoring service. These reports exclude IP addresses, and any screen recording attached to an error has all text and form inputs masked.

Communications. If you email us or ask for a demo, we keep the messages and the contact details you give us.

Customer business data. Fleet, booking, pricing and renter data that rental companies enter. We process this as a processor (section 2).

4. Google and Microsoft sign-in

NetRent offers "Sign in with Google" and "Sign in with Microsoft" so staff can use the work account they already have. From Google we request only the basic sign-in scopes: openid, email and profile. That gives us your name, email address, profile picture and Google account ID, and nothing else. We cannot read your Gmail, Google Drive, Calendar, contacts or any other Google data.

We use this information only to sign you in, match you to the account your company created for you, and show your name and picture inside NetRent. We do not sell it, use it for advertising, share it with third parties except the service providers listed in section 7 that host our platform, or use it to train AI models.

NetRent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove NetRent's access at any time from your Google account at myaccount.google.com/permissions or from your Microsoft account settings. You will then need another sign-in method to use NetRent.

5. Why we use your data

Providing the platform and signing you in, data used account data, sign-in data. Legal basis (GDPR art. 6): Performance of our contract with your employer, and our legitimate interest in giving their staff access.
Keeping the platform secure and fixing errors, data used usage data, error reports. Legal basis: Legitimate interest in a secure, working service .
Sending account emails (invites, password resets), data used: name, email address. Legal basis: Performance of contract.
Answering questions and demo requests, data used: Communications. Legal basis: Steps taken at your request before a contract, or legitimate interest.
Bookkeeping and invoicing, data used: Customer company contact and billing details. Legal basis: Legal obligation.
Processing renter data for rental companies, data used: Customer business data. Legal basis: On the rental company's instructions (they hold the legal basis)

We do not use personal data for automated decisions that have legal or similarly significant effects on you.

6. Cookies

The app at app.netrent.is uses only cookies that are strictly necessary: one to keep you signed in and one to remember which rental company you are working in. These do not require consent. We do not use advertising or cross-site tracking cookies. If we ever add non-essential cookies to netrent.is or the app, we will ask for your consent first.

7. Service providers

We use a small number of EU service providers (subprocessors) to run NetRent. Each is bound by a data processing agreement.
Google and Microsoft identity providers, only if you choose to sign in with them and data location is per their own policies

We update this list when we add or change a provider.

8. Transfers outside the EEA

We keep the platform's database and customer data in the EU. Where a provider handles data in the United States, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

9. How long we keep data

• Account data: as long as your company's NetRent agreement is active. When a rental company removes you or ends its agreement, we delete your account data within 90 days.

• Customer business data: as set out in the customer's Data Processing Agreement. By default we return or delete it within 90 days after the agreement ends.

• Error reports: up to 90 days.

• Server logs: short-lived, usually a few days.

• Invoices and bookkeeping records: 7 years, as required by the Icelandic Bookkeeping Act no. 145/1994.

• Sales and support emails: up to 3 years after our last contact, unless you become a customer.

10. Security

All traffic to NetRent is encrypted with TLS. Each rental company's data is kept separate at the database level, so one customer can never see another's data. Staff access within a company is limited by role, our own access to production systems is restricted to the people who need it, and we have had the platform independently penetration tested. No system is perfectly secure, so if we become aware of a breach that affects your data, we will notify you and the relevant authority as GDPR requires.

11. Your rights

You have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format. To use any of these rights, email netrent@netrent.is. We answer within one month.

For renter data held on behalf of a rental company, send your request to that company. If you send it to us, we will forward it to them.

If you are unhappy with how we handle your data, you can complain to the Icelandic Data Protection Authority, Persónuvernd, or the authority in your own EEA country. We would appreciate the chance to sort it out with you first.

12. Children

NetRent is a business tool and is not meant for anyone under 18. We do not knowingly collect data from children.

13. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects how we use your data, we will tell our customers by email before it takes effect.

14. Contact

NetRent ehf., Iceland - netrent@netrent.is