Data Processing Agreement (DPA)

For data transmitted to the Rental Company for the purpose of entering into and performing a rental agreement (Customer identity, contact details, request details), each party determines the purposes and means of the processing it carries out on its own behalf and acts, unless stated otherwise, as an independent controller. For matchmaking operations carried out via the Platform, the parties may act as joint controllers; the points of contact and allocation of obligations are then as described in this DPA. [To be confirmed based on your counsel's analysis.]

• Subject matter: governing the sharing of personal data necessary for matchmaking and rentals.
• Purposes: allowing the Customer to send a request to a Rental Company, the Rental Company to respond and perform the rental, and the Publisher to operate the Platform (security, fraud prevention, support, statistics).
• Nature of processing: collection, transmission, consultation, storage and, where applicable, deletion.

• Data subjects: Customers (individuals or professionals) sending a request; where applicable, designated drivers.
• Data: identity (first and last name), contact details (email, phone), request content (dates, vehicle, city), and any data voluntarily provided. [Specify whether additional data — ID document, driving license — is collected by the Rental Company during the rental; such data is then the sole responsibility of the Rental Company.]
• No sensitive data: no sensitive data within the meaning of Article 9 GDPR is transmitted by the Publisher.

The DPA applies for the entire duration of the service relationship. Each party retains data for the periods necessary for its purposes and legal obligations (in particular commercial limitation periods and accounting obligations), then deletes or anonymizes it.

Each party undertakes, for the processing for which it is responsible, to:

• process data only for the purposes described and have an appropriate legal basis (performance of the contract, legitimate interest, consent where applicable);
• comply with the principles of data minimization, accuracy and storage limitation;
• inform data subjects of the processing and their rights (privacy notice / privacy policy);
• implement appropriate technical and organizational measures (Article 32 GDPR);
• maintain, if required, a record of processing activities.

Once the Rental Company has received the data, it becomes responsible for it for rental-related purposes. It undertakes in particular to: use Customer data only to respond to their request and perform the rental, excluding any non-consented marketing; not transfer it to unauthorized third parties; and respond directly to requests to exercise rights concerning it. The Rental Company indemnifies the Publisher against any claim resulting from its failure to comply with applicable regulations.

Each party implements security measures appropriate to the risk: access control, encryption of data in transit, logging, backups, and awareness training for authorized personnel. Access to data is limited to persons who need to know it.

The Publisher uses providers (hosting, emailing, payment) acting as processors for its own processing; it ensures that they offer sufficient guarantees and are bound by obligations consistent with Article 28 GDPR. The list of main sub-processors is available on request: [host], [emailing: Resend], [payment: Stripe]. The Rental Company does the same for its own sub-processors.

Any transfer of data outside the European Union is only made to a country ensuring an adequate level of protection or on the basis of appropriate safeguards (European Commission standard contractual clauses). [Specify any transfers related to the providers used.]

Data subjects exercise their rights (access, rectification, erasure, objection, restriction, portability) with the party responsible for the relevant processing. The parties assist each other within a reasonable time when a request falls under the other party's responsibility, and forward misdirected requests to each other without delay.

In the event of a data breach likely to result in a risk to individuals, the party concerned carries out the required notifications (supervisory authority within 72 hours, data subjects where applicable) and informs the other party without undue delay when the breach affects shared data, in order to enable a coordinated response.

At the end of the relationship, each party ceases to use shared data for common purposes and deletes or anonymizes it, subject to retention periods required by law. The Rental Company remains responsible for data it has collected directly from its Customers as part of rentals.

Upon reasonable and justified request, each party provides the other with the information necessary to demonstrate compliance with this DPA and cooperates with the competent supervisory authorities.

For any question relating to this DPA: Publisher — [DPO email / GDPR contact]; data protection officer: [where applicable, DPO contact details]. The privacy policy describes the processing carried out by the Publisher.