Privacy Policy
Information on the collection, use, disclosure, retention, and protection of personal data
Last updated: 1 September 2026
Distinct roles
- Rentify is the controller for the Platform, intermediation, accounts, bookings, support, security, and its own obligations.
- The Provider identified before payment is normally an independent controller for data needed to perform the Main Service.
- Acceptance of the Terms does not replace separate consent for marketing or non-essential cookies.
1. Controller and data protection contact
The controller for Platform operations is Rentify SRL, IDNO 1026023031842, with its registered office at MD-2009, mun. Chișinău, sector Centru, str. Pantelimon Halippa 6/G, ap. (of.) 13a, Republica Moldova. For questions, requests, or incidents concerning personal data: support@rentify.md, +373 60 650 806.
If Rentify appoints a data protection officer or specialist contact, their details will be published here. Until then, requests are handled through the contacts above.
2. Legal framework
The processing of personal data is governed by Law no. 195/2024 on personal data protection. Rentify applies the principles of lawfulness, transparency, minimisation, accuracy, storage limitation, security, and accountability.
3. Who this Policy applies to
- visitors to the Platform;
- persons who create accounts, request offers, or make bookings;
- Customers, declared drivers, passengers, and contact persons;
- persons who contact support or submit complaints;
- representatives, drivers, guides, and personnel of Providers and partners.
4. Categories of data
| Category | Examples |
|---|---|
| Identification and contact | First and last name, email, telephone, country, language, account data, and relationship to the booked person. |
| Booking and travel | Service, Provider, vehicle, dates, times, locations, route, duration, passengers, flight, options, accessibility requirements, notes, and changes. |
| Eligibility and documents | Age, date of birth, driving licence, identity card, passport, and, only where necessary, temporary copies of documents. |
| Payment and refund | Amount, currency, method, date, transaction ID, status, refund, and masked data received from Paynet. Rentify does not store the full card number or CVV. |
| Communications and support | Emails, forms, chats, call notes, WhatsApp/Telegram, complaints, cancellations, incidents, and evidence. |
| Technical and security | IP address, browser, device, cookies, logs, session identifiers, version of accepted documents, acceptance date and time, and anti-fraud indicators. |
| Analytics and diagnostics | Page and product events, online identifiers, browser and device information, error diagnostics, and the internal account ID after sign-in. |
| Provider data | Legal details, representatives, licences, authorisations, insurance, qualifications, settlement accounts, and verification documents. |
5. Sources of data
- directly from the data subject or from a Customer booking for other persons;
- from the Provider, driver, guide, or their representative;
- from Paynet, the bank, and payment systems in the form of confirmations and masked data;
- automatically through the Platform, logs, and cookies, according to the user's choices;
- from public registers and official sources to verify Providers and authorisations where necessary.
6. Purposes and legal bases for processing
| Purpose | Principal legal basis |
|---|---|
| Account, offer, booking, and contracts | Performance of a contract and pre-contractual steps. |
| Disclosure of data to the Provider | Performance of contracts, pre-contractual steps, and the legitimate interest in intermediating the booking. |
| Payment, refund, and reconciliation | Performance of a contract, legal obligations, and legitimate interests in record keeping and fraud prevention. |
| Support, complaints, and disputes | Performance of a contract, legal obligations, and defence of rights. |
| Security, anti-fraud, and chargebacks | Legitimate interests, legal obligations, and defence of rights; decisions with significant effects are not made solely by automated means. |
| Accounting, tax, and archiving | Legal obligation. |
| Provider verification | Legitimate interest in the legality, safety, and quality of the network; legal obligations where applicable. |
| Product analytics and diagnostics | Consent for non-essential cookies and technologies. |
| Direct marketing | Separate optional consent or another basis expressly permitted by law. |
This Policy is a notice. “Acknowledgement” does not constitute consent to all processing. Data needed for a contract, payment, security, or legal obligations is not processed solely on the basis of consent.
7. The Provider and data-related roles
The Provider's identity is displayed before payment. Rentify discloses only the data required to verify eligibility and perform the booking. The Provider is normally an independent controller for data it uses under its own contract, for safety, insurance, tax, and its legal obligations.
In certain flows, Rentify and the Provider may jointly determine certain purposes, or one may process data on behalf of the other. The specific role is established by the cooperation agreement and communicated to the data subject where necessary.
8. Copies of documents and data that is sensitive in practice
Rentify requests copies of a driving licence, identity card, passport, or other documents only where verification cannot be completed by a less intrusive method and the document is required for the booking, safety, fraud prevention, or Provider obligations.
- Copies are uploaded through the secure channel identified by Rentify or sent directly to the Provider. Sending them by unprotected email, WhatsApp, or Telegram is not recommended.
- Rentify limits access to personnel who need the data and keeps access logs where the system permits.
- Rentify keeps the copy for profile verification and reuse in future bookings while the account is active and the copy remains necessary for those purposes. After the account is closed or the copy is no longer necessary, Rentify deletes it unless a dispute, suspected fraud, legal obligation, or documented Provider requirement justifies longer retention.
- Residual backup data is isolated and removed through the ordinary overwrite cycle; it is not used in current operations.
- Rentify does not request, and the Customer must not send, a full card number or CVV.
9. Data about other persons
If the Customer supplies data about passengers, drivers, or other persons, the Customer must have the right to disclose it, provide only the data needed, and inform those persons about this Policy. Children's data is supplied by a parent, representative, or person legitimately organising the journey.
10. Data recipients
- the Provider, driver, vehicle operator, guide, agency, or service organiser;
- Paynet Services S.R.L., banks, payment systems, and providers involved in anti-fraud and refunds;
- hosting, infrastructure, email, SMS, notification, security, support, signature, or secure-storage providers;
- WhatsApp and Telegram service providers where the Customer chooses those channels; messages may be processed under their policies;
- a service provider for product analytics and error diagnostics when analytics is active;
- accountants, lawyers, auditors, insurers, and consultants, to the extent necessary;
- authorities, courts, and law-enforcement bodies where there is a legal basis.
Rentify requires providers to meet confidentiality, security, and limited-use obligations according to their role and applicable law.
11. Paynet and card data
Payments are processed by Paynet Services S.R.L., NBM licence series no. 000586. Paynet's information and safeguards also apply on the payment page. Rentify receives confirmations, transaction IDs, amount, status, and masked data, but not the full card number or CVV.
13. International transfers
Some technology providers, communication services, and Providers may process data outside the Republic of Moldova. Rentify assesses providers, limits the data, uses appropriate clauses and safeguards under applicable law, and provides additional information on request to the extent permitted by law.
14. Retention periods
| Data | Period / criterion |
|---|---|
| Unconfirmed requests and offers without a contract | Up to 12 months unless a legal or anti-fraud reason requires a longer period. |
| Document copies held by Rentify | While the account is active and the copy remains necessary for profile verification and future bookings. After the account is closed or the copy is no longer necessary, it is deleted unless a dispute, suspected fraud, incident, or legal obligation justifies longer retention. |
| Account | While active and normally for up to 3 years after closure for security and defence of rights; mandatory data is retained separately. |
| Contracts, bookings, payments, and fiscal records | For the period required by civil, accounting, tax, and fraud-prevention law. |
| Complaints, support, and disputes | Until resolution and normally for 3 years after closure, or longer where there is litigation or a relevant statutory period. |
| Technical and security logs | Normally 12 months; longer where required to investigate an incident. |
| Product analytics | Browser identifiers may last up to one year. Server-side event retention follows the period configured for the analytics service. |
| Marketing | Until consent is withdrawn or the person unsubscribes; evidence of consent may be retained for a further 3 years for compliance. |
| Cookies and evidence of choice | The preference cookie lasts 183 days. Rentify does not currently create a separate account-level consent record. |
The periods are reviewed regularly. On expiry, data is deleted, anonymised, or isolated if continued retention is still mandatory.
15. Rights of the data subject
- information and access to data;
- rectification and updating;
- erasure, subject to the law;
- restriction or blocking where applicable;
- objection, including to direct marketing;
- withdrawal of consent without affecting earlier processing;
- data portability, subject to the law;
- not to be subject to a solely automated decision producing legal or similarly significant effects, subject to the law;
- lodging a complaint with the National Centre for Personal Data Protection and applying to a court.
A request must be sent to support@rentify.md. Rentify may request proportionate information to verify identity. The ordinary response period is one month from receipt of the request and may be extended subject to the law and notice to the person.
16. Automated decisions and fraud prevention
Rentify may use technical indicators to detect risk, such as data mismatches, repeated attempts, or Paynet signals. Rentify does not make decisions with legal or similarly significant effects on the Customer solely by automated means. A suspension or verification request may be reviewed by a person on request.
17. Security
- access controls and the need-to-know principle;
- authentication, logging, and access review;
- encryption of communications and infrastructure protection;
- backup, continuity, and restoration;
- confidentiality and data-protection agreements with providers and Providers;
- procedures for incidents, data-subject requests, and document deletion.
No system can guarantee absolute security. In the event of an incident, Rentify investigates, limits the effects, preserves evidence, and notifies the authority and individuals where required by law.
18. Marketing
Rentify sends promotional messages only on the basis of separate optional consent or another basis expressly permitted by law. An unsubscribe option is available in every message or by contacting Rentify. Operational messages about a booking, payment, contract, driver, cancellation, or security are not marketing.
19. Minors
The Platform is not intended for minors to enter contracts independently. Data about children travelling as passengers is provided by a parent, representative, or authorised person only to the extent required for the service. Rentify does not intentionally use children's data for advertising profiling.
20. Changes, contact, and supervisory authority
The Policy may be updated for legal, technical, or operational changes. The last updated date is displayed on the Platform, and material changes may be communicated by email or notification.
Rentify SRL; support@rentify.md; +373 60 650 806; MD-2009, mun. Chișinău, sector Centru, str. Pantelimon Halippa 6/G, ap. (of.) 13a, Republica Moldova.
Personal data complaints may be addressed to the National Centre for Personal Data Protection of the Republic of Moldova. Current details and procedures are available at datepersonale.md.