RO
Sign In

Privacy Policy

Last updated: March 9, 2026

1. Introduction

S.C. Inchiriaza Duba S.R.L. (hereinafter referred to as "the Operator", "we" or "the company"), headquartered in Bucharest, Romania, operates the online platform inchiriaza-duba.com / rent-a-van.app (hereinafter referred to as "the Platform"), an intermediary service (marketplace) connecting vehicle owners with individuals seeking to rent vehicles.

We are committed to protecting the confidentiality of your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018 on personal data protection.

This policy explains what data we collect, for what purposes we process it, how we store it, with whom we share it and what your rights are.

2. Data collected

We collect the following categories of personal data:

2.1 Data provided by Users

  • Full name
  • Email address
  • Phone number (optional but recommended)
  • Password (stored encrypted, never accessible in plain text)
  • Profile photo (optional)

2.2 Listing data (Owners)

  • Vehicle details (make, model, year, features)
  • Vehicle photos
  • Pickup address
  • Prices and availability

2.3 Booking data

  • Booking details (dates, times, prices, booking status)
  • Booking history

2.4 Payment data

  • Billing information (processed by Stripe Inc., not stored on our servers)
  • Transaction history (amounts, dates, status)
  • Stripe Connect details for Owners (managed by Stripe)

2.5 Data generated on the Platform

  • Messages exchanged between Users through the internal messaging system
  • Public reviews and ratings
  • IP address and technical device data (collected automatically)

3. Purpose of processing

Your data is processed for the following purposes:

  • Creating and managing your user account
  • Publishing and managing vehicle listings
  • Processing and managing bookings between Owners and Renters
  • Processing payments via Stripe and transferring funds to Owners via Stripe Connect
  • Facilitating communication between Owners and Renters through the messaging system
  • Displaying public reviews and ratings
  • Sharing contact information between parties after booking confirmation
  • Communicating booking status (confirmation, rejection, completion)
  • Sending notifications via email
  • Ensuring platform security and fraud prevention
  • Fulfilling legal and fiscal obligations

4. Data shared between Users

As a marketplace platform, certain data is shared between Owners and Renters to facilitate the rental process:

4.1 Before booking confirmation

  • Renter can see: Owner's name, public reviews and rating, vehicle details, general location area
  • Owner can see: Renter's name, public reviews and rating

4.2 After booking confirmation

  • Renter receives: exact pickup address, Owner's phone number (if provided)
  • Owner receives: Renter's phone number (if provided)

By creating an account and using the Platform, you agree to the sharing of this information within the context of the booking process.

5. Legal basis for processing

Data processing is based on:

  • Performance of the intermediary agreement and facilitation of bookings (Art. 6(1)(b) GDPR)
  • Legal obligations, including fiscal obligations (Art. 6(1)(c) GDPR)
  • Legitimate interest of the operator for platform security, fraud prevention and service improvement (Art. 6(1)(f) GDPR)
  • Your consent, where required (Art. 6(1)(a) GDPR)

6. Payment processing via Stripe

All payments on the Platform are processed by Stripe Inc. ("Stripe"), a third-party payment service provider. Your payment data (card number, expiration date, CVV code) is collected and processed directly by Stripe and is not stored on our servers.

Owners who wish to receive payments must set up a Stripe Connect account. Data provided during the Stripe Connect process (including banking and identity information) is managed exclusively by Stripe, in accordance with Stripe's Privacy Policy.

We only store transaction references (Stripe identifiers, amounts, dates and payment status) necessary for managing bookings and commissions.

7. Messaging and communications

Messages exchanged between Users through the Platform's internal messaging system are stored on our servers to ensure service functionality and to be available in case of disputes between Users.

The Operator may access message content for the purpose of dispute resolution, investigating fraudulent activity or ensuring compliance with the Terms and Conditions.

8. Reviews and public content

Reviews and ratings left by Users are public and visible to all visitors of the Platform. These include: the User's name, rating, review text and publication date.

By publishing a review, you agree that it will be publicly visible. Reviews may only be removed by the Operator if they violate the Platform's rules.

9. Data storage and security

Data is stored on secure servers provided by Supabase (cloud infrastructure, data centers in the EU). We implement appropriate technical and organizational measures for data protection, including password encryption, secure connections (HTTPS/TLS) and role-based access control.

Personal data is retained for the duration of your account and for a maximum period of 3 years from the last interaction, or as required by applicable law. Messages are retained for the duration of both participants' accounts. Reviews are retained for the duration of the author's account or until manually removed by the Operator.

10. Data sharing with third parties

Your data may be shared with:

  • Stripe Inc. (payment processor and Stripe Connect services)
  • Supabase Inc. (database and authentication provider)
  • Resend (transactional email service provider)
  • Cloudflare Inc. / Vercel Inc. (hosting and CDN providers)
  • Other Users of the Platform (as described in section 4 of this policy)
  • Public authorities, based on legal obligations

We do not sell, rent or share your data with third parties for marketing purposes.

11. Data transfers outside the EU/EEA

Some of our service providers (Supabase, Stripe, Resend) may transfer data to the United States. These transfers are carried out on the basis of Standard Contractual Clauses approved by the European Commission or the EU-US Data Privacy Framework.

12. Your rights

Under GDPR, you have the following rights:

  • Right of access to personal data
  • Right to rectification of inaccurate data
  • Right to erasure ("right to be forgotten") - please note that account deletion may involve removal of associated reviews and messages
  • Right to restriction of processing
  • Right to data portability
  • Right to object
  • Right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal
  • Right to lodge a complaint with ANSPDCP (Romanian National Supervisory Authority for Personal Data Processing)

To exercise your rights, contact us at: contact@inchiriaza-duba.com

We will respond within a maximum of 30 days from receipt of your request.

13. Cookies

Our platform uses essential cookies required for authentication and user session functionality. We do not use marketing or third-party tracking cookies.

14. Policy modifications

We reserve the right to modify this privacy policy at any time. Modifications take effect on the date of publication on the Platform. Users will be notified by email regarding significant changes.

15. Contact

For any questions regarding this privacy policy or the processing of your personal data, you can contact us at:

  • Email: contact@inchiriaza-duba.com
  • Company: S.C. Inchiriaza Duba S.R.L.
  • Address: Bucharest, Romania

You also have the right to contact ANSPDCP (Romanian National Supervisory Authority for Personal Data Processing) if you believe that the processing of your data violates GDPR provisions.