RODO notice for rentals
This is a translation provided for convenience. The legally binding version of this document is the Polish one.
This document explains exactly what happens to your data at the moment you collect a bike — when we ask for identification. It fulfils the information obligation under Article 13 GDPR and supplements the Privacy policy.
1. Who processes the data
The controller is Black-Ebike Viktor Holovatiuk, ul. Zeusa 1, 01-497 Warszawa, NIP 5223353620. Contact: golovatiuk2302@gmail.com.
2. Why we ask for a document at all
We hand over equipment worth several thousand złoty, unsupervised, for several days. Verifying identity is a condition of entering into the rental agreement — it establishes who we are contracting with and allows us to pursue claims if the bike is not returned or comes back damaged.
We do not do this "just in case": the scope of data is limited to what the agreement requires.
3. What we record
| Data | Purpose | Legal basis |
|---|---|---|
| Name and surname | party to the rental agreement | Art. 6(1)(b) GDPR |
| Phone number | contact about the rental, return reminders | Art. 6(1)(b) GDPR |
| E-mail address (if you provide it) | confirmations and documents | Art. 6(1)(b) GDPR |
| Type and number of the identity document | identification of the lessee, protection of property | Art. 6(1)(b) and (f) GDPR |
| PESEL number, where necessary for unambiguous identification | establishing identity when pursuing claims | Art. 6(1)(f) GDPR |
| Bike details and rental period | performance of the agreement | Art. 6(1)(b) GDPR |
What we do not do: we do not copy documents "for the record", we do not keep photographs of documents longer than securing that particular rental requires, and we do not use this data for marketing.
4. How this data is protected
- Document data is stored encrypted, in a separate part of the system.
- Access is limited to the authorised member of staff handling the handover and return.
- This data never appears in messages sent by messenger or SMS — those contain only the booking number and a link to the system.
- This data is not written to technical logs.
5. How long we keep it
- For the duration of the rental agreement.
- After the rental ends — until claims under the agreement become time-barred.
- Accounting records containing the data — 5 years from the end of the tax year, as tax law requires.
- A photograph of a document, if taken as security for a cash deposit, is deleted immediately after the bike is returned and the deposit settled.
After those periods the data is permanently deleted.
6. Who we share it with
No one beyond the parties we need to run the business: the hosting and IT infrastructure provider and the accounting office — in both cases under a data processing agreement. Data may be disclosed to the Police or other authorised bodies if they request it on a legal basis — for example in a case concerning a stolen bike.
7. Your rights
You have the right to access your data, rectify it, restrict processing, object to processing based on our legitimate interest, and have the data erased once the purpose of processing has ended. A full description of these rights and how to exercise them is in the Privacy policy.
You may also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
8. Do you have to provide this data
Providing the data is voluntary, but without it we cannot conclude the rental agreement or hand over a bike — it is a condition of entering into the contract within the meaning of Article 13(2)(e) GDPR.