RentGo Express
Legal

Privacy Policy

Last updated: 10 August 2026

This Privacy Policy explains how RentGo Express (operated by Aquilum Wave Technologies SHPK) collects, uses, and protects your personal data. It applies to visitors of rentgoexpress.com and to Customers and Suppliers using the Platform.

1. Who we are (Data Controller)

Aquilum Wave Technologies SHPK is the data controller responsible for your personal data.

2. What personal data we collect

When you make a booking

  • Full name, email address, phone number
  • Pickup and drop-off location and dates
  • Vehicle and extras selected
  • Payment information (processed by our payment provider — we do not store card numbers)
  • Any messages you send to the Supplier through the Platform

When you visit the Platform

  • Your IP address, browser type, device information, and language preference
  • Pages you visit and actions you take (via analytics — see Cookies Policy)
  • Referring website, if any

When you apply to become a Supplier

  • Company name, legal name, NIPT, email, phone
  • Fleet size, years in business, primary city of operation
  • Contact person's name, role, email, phone

3. Why we use your data (legal bases)

We process your data on the following legal bases under GDPR:

  • Contract performance — to process your booking, coordinate with the Supplier, send confirmations, handle refunds, and provide customer support.
  • Legal obligation — to comply with Albanian tax, accounting, and consumer protection laws.
  • Legitimate interests — to prevent fraud, maintain security, improve the Platform, and communicate service updates. We balance these against your privacy rights.
  • Consent — for marketing emails, optional analytics cookies, and any use of data beyond what's necessary. You can withdraw consent at any time.

4. Who we share your data with

The Supplier

When you book, we share your name, contact details, and booking details with the Supplier so they can accept the booking and coordinate pickup. The Supplier is a separate data controller for the rental itself and has its own privacy practices.

Service providers (processors)

  • Hosting: Contabo GmbH (Germany)
  • Email delivery: Hostinger
  • Payment processing: Paysera, Raiffeisen Bank (raiAccept) — they receive card details directly; we only receive tokens and receipts
  • Analytics: Plausible or Google Analytics (optional, based on your consent)

Each processor has a signed agreement with us and can only use your data to provide the service we've contracted them for.

Legal disclosures

We may share data with law enforcement, courts, or regulators if legally required, or to defend our legal rights.

We do not sell your data.

5. International data transfers

Some of our processors are based outside Albania (in the EU/EEA or elsewhere). When we transfer your data internationally, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions.

6. How long we keep your data

  • Booking data: 7 years, to comply with Albanian tax and accounting law.
  • Account data (if you created an account): until you delete your account, plus 30 days for backups.
  • Supplier applications: 2 years, or until approved (then merged into the supplier's account).
  • Support communications: 3 years.
  • Analytics data: 14 months (or as configured), aggregated and anonymised where possible.

7. Your rights

Under GDPR (and Albanian data protection law), you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Erase your data (right to be forgotten), subject to legal retention obligations
  • Restrict or object to processing
  • Data portability — receive your data in a machine-readable format
  • Withdraw consent at any time (for anything based on consent)
  • Complain to a supervisory authority — in Albania, this is the Commissioner for the Right to Information and Protection of Personal Data (idp.al). If you're in the EU, you can also complain to your local DPA.

To exercise any of these rights, email privacy@rentgoexpress.com. We respond within 30 days.

8. Security

We use industry-standard measures to protect your data: HTTPS everywhere, encrypted database backups, password hashing with Argon2, role-based database access, and multi-tenant isolation with row-level security. We restrict access to personal data to employees who need it for their role.

No system is 100% secure. If a data breach occurs that affects your rights and freedoms, we will notify you and the supervisory authority within 72 hours, as required by GDPR.

9. Cookies

We use cookies and similar technologies for essential functions (session, security), preferences (language, currency), and optionally for analytics. See our Cookies Policy for details and how to manage them.

10. Children's data

The Platform is not intended for children under 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with a revised "Last updated" date. If changes materially affect how we use your data, we will notify you by email where feasible.

12. Contact

For any privacy question or to exercise your rights, contact us at privacy@rentgoexpress.com.