Easy Rental OS – Privacy Policy

1. Quick Summary (At a Glance)

Easy Rental OS is a B2B platform for car rental agencies.

Agencies are usually the Controller (or "business") for their own customers' and drivers' data. We act mainly as a Processor or Service Provider for that data.

We are the Controller for:

Agency account and admin user data (e.g., owners, staff)

Billing and subscription information

Our own website and app usage analytics

We collect:

Account and business data from agencies and their staff

Rental operational data (bookings, contracts, vehicles, etc.)

Driver/end-customer data that agencies choose to enter

Usage, device, log, and integration data

Support communications and feedback

We use this data to:

Provide and operate the Service

Support agencies and their authorized users

Secure and improve the platform

Handle billing and legal obligations

We share data with:

Subprocessors and service providers (hosting, email, analytics, etc.)

Payment processors, messaging providers chosen by agencies, and professional advisers

Authorities where required by law, and in business transactions

We do not "sell" personal data as that term is commonly defined in data protection laws.

Data may be processed in the United States and other countries. We use appropriate safeguards for international transfers where required by law.

Agencies are responsible for:

Their own privacy notices and consents

Lawful use of Easy Rental OS for driver/end-customer data

Managing access, permissions, and retention settings in their workspace

You can contact us at hello@punctum-systems.com for privacy questions or to exercise rights where we are Controller.

The rest of this Privacy Policy provides more detail.

2. Scope of This Privacy Policy

This Privacy Policy applies to:

The Easy Rental OS Service (web app and PWA)

Any related websites, dashboards, and admin portals we operate

Our communications with you, including support channels, emails, and in-app messages

This Privacy Policy does not apply to:

Third-party services you or your agency connect to Easy Rental OS (e.g., messaging gateways, payment processors, or integrations), which are governed by their own privacy policies and terms

How agencies, as Controllers, handle their own customers' and drivers' personal data outside the Service

If you are a driver or end-customer of an agency using Easy Rental OS, please review that agency's own privacy notice, which governs how they use your data.

3. Relationship to Our Terms of Service

Your use of the Service is also governed by our Terms of Service ("Terms").

Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms.

This Privacy Policy focuses on privacy and data protection.

In case of a conflict between this Privacy Policy and the Terms regarding privacy matters, this Privacy Policy will generally govern how we handle personal data, while the Terms govern overall use of the Service, including limitations of liability, disclaimers, and other contractual provisions.

This Privacy Policy is separate from and does not replace any Data Processing Addendum (DPA) or similar agreements we may enter into with agencies where required by law (for example, under the GDPR).

4. Roles: Controller vs. Processor / Service Provider

4.1 Where Agencies Are Controllers (Businesses)

For most end-customer and driver data entered into the Service by an agency, the agency is the:

"Controller" under laws such as the EU/UK General Data Protection Regulation ("GDPR") and similar laws; or

"Business" under certain U.S. state privacy laws and similar frameworks.

This includes, for example:

Driver contact details

Identity verification records (confirmation that agency staff have personally inspected identity documents in person; the identity documents themselves are not stored by Easy Rental OS)

Rental history, bookings, and related operational records

In these cases, we act as a Processor or Service Provider on behalf of the agency and process that data only:

As necessary to provide and maintain the Service, and

As instructed by the agency, consistent with our agreements and applicable law.

4.2 Where Punctum Systems Is Controller

We act as a Controller (or "business") for personal data we collect and use for our own purposes, including:

Agency account and admin user data:

Names, roles, work email addresses, phone numbers

Login details and security credentials (stored and protected appropriately)

Business/workspace data:

Agency legal and trade names

Branches and location data, workspace configuration settings

Billing and subscription data:

Billing contacts, invoicing records, payment status (but not full card details)

Website/app analytics and usage data:

Logs, diagnostic information, and usage metrics we use to operate, secure, and improve the Service. Website analytics on our marketing site are only collected after you give explicit consent. We use Google Analytics 4 with consent-mode controls so analytics cookies and data collection are disabled until you accept.

Communications with us:

Support tickets, feedback, surveys, and other interactions

For this data, we decide the purposes and means of processing and are responsible for complying with applicable Controller obligations.

4.3 Data Processing Addendum (DPA)

Where required by law (for example, for agencies in the European Economic Area or similar jurisdictions), we may enter into a Data Processing Addendum (DPA) or similar agreement.

This Privacy Policy is not that DPA.

The DPA will govern, among other things, our Processor/Service Provider obligations for end-customer/driver data, including international transfers, security, and assistance with data subject requests.

5. Information We Collect

We collect different types of information depending on how you use the Service and your relationship with us.

5.1 Information We Collect Directly from Agency Users

These are data we collect from agency owners, administrators, staff, and other authorized users ("Authorized Users"):

Account data

Name

Work email address

Phone number (if provided)

Role or job function

Login credentials and authentication data (e.g., password hashes, security tokens, 2FA details where enabled)

Business and workspace data

Agency name and trade name

Branch names and locations

Workspace configuration settings (e.g., pricing rules, rental policies, templates, notifications and communication preferences)

Billing and subscription data

Billing contact information

Subscription plan details

Invoices, payment status, and transaction references

Tax-related identifiers where required

Support and communications data

Emails, chats, and messages with our support team

Feedback and survey responses

Notes from calls or meetings (where applicable)

5.2 Information Agencies Upload or Record About Their End-Customers and Drivers

Agencies decide what data to collect about their own customers and drivers and upload or record in Easy Rental OS. This may include:

Driver identification and contact data

Name

Phone number

Email address

Postal address or location details (if collected by the agency)

Identity verification records

Confirmation that an agency staff member has personally inspected a customer's identity document in person

The timestamp of the verification check and the identifier of the staff member who performed it

The document category seen (e.g., driving licence, passport), if the agency chooses to record this

Note: The identity document itself — including images, document numbers, or any data extracted from the document — is not uploaded to or stored by Easy Rental OS. Agencies are solely responsible for their identity verification compliance under applicable law.

Rental and operational data

Booking and reservation details

Rental contracts and related documentation

Rental history, including dates, vehicles, and return status

Damage reports and photos

Fees, charges, and invoices, including payment status (but not full card data stored by us)

Supporting documents and media

Vehicle condition images and inspection photos

Any other images or files the agency chooses to upload

Signatures

Electronic or digital signatures collected through the Service if the agency enables this feature

This information is controlled by the agency. We process it as a Processor/Service Provider on behalf of the agency.

5.3 Information Collected Automatically

When users access the Service or our websites, we automatically collect certain information, such as:

Usage, device, and log data

IP address

Device type, operating system, and browser type

App version and configuration

Dates and times of access, session duration

Feature usage data and interaction logs

Diagnostic, crash, and error logs

Approximate location derived from IP address (for security, localization, and analytics)

Cookies and similar technologies

Cookies, web beacons, local storage, and similar technologies (see the "Cookies and Similar Technologies" section below)

5.4 Integration and Connected Services Data

If an agency connects third-party services to Easy Rental OS (for example, messaging gateways, maps, or payment processors), we may receive:

Integration tokens and API keys (stored securely and with restricted access)

Service-specific identifiers (e.g., account IDs, conversation IDs)

Configuration metadata for the integration

Minimal logs necessary to operate, troubleshoot, and secure the integration

The use of data by those third-party services is governed by their own privacy policies and terms.

6. How We Use Personal Data (Purposes of Processing)

We use personal data for the following purposes, depending on our role (Controller or Processor) and the context:

Provide, operate, and administer the Service

Create and manage accounts and workspaces

Enable users to log in, manage vehicles, create bookings, and process rentals

Provide core platform functionality and features

Configure workspaces and manage agencies and Authorized Users

Set up agency-specific configurations, pricing, and templates

Manage roles and permissions within agency workspaces

Onboard and support new agencies and users

Process rental operational workflows

Handle bookings, reservations, and rental agreements

Manage vehicle details, damage logs, and return processes

Generate and manage rental contracts, invoices, and related records

Send operational notifications (e.g., booking confirmations, reminders)

Provide support and respond to requests

Answer support tickets and resolve technical issues

Communicate about service updates, incidents, and product changes

Analyze feedback and surveys to improve the Service

Security, fraud prevention, and service integrity

Monitor usage for suspicious or abusive activity

Detect and prevent fraud, unauthorized access, and misuse

Protect the safety, rights, and property of users, agencies, and Punctum Systems

Billing, subscription management, and account-related communications

Process subscription fees through payment processors

Send billing communications (invoices, payment reminders, plan changes)

Manage account status, renewals, and trial periods

Analytics, product development, and improvement

Analyze how the Service is used to improve stability, performance, and usability

Develop new features and enhancements

Use aggregated or de-identified data where reasonably possible for analytics and reporting

Use identifiable usage data where necessary for diagnostics, debugging, security, and support

Legal compliance and enforcement

Comply with applicable laws, regulations, and legal processes

Enforce our Terms of Service and other agreements

Respond to lawful requests from authorities

Establish, exercise, or defend legal claims

We process personal data where we have a valid legal basis under applicable law, such as:

Performance of a contract (e.g., providing the Service to agencies)

Legitimate interests (e.g., securing and improving the Service, preventing fraud)

Compliance with legal obligations

Consent, where required and obtained (e.g., for certain cookies or marketing communications in relevant jurisdictions)

7. Sharing and Disclosure of Personal Data

We do not sell personal data for monetary compensation or for cross-context behavioral advertising as those terms are commonly understood under applicable privacy laws.

We may share personal data in the following circumstances:

7.1 Subprocessors and Service Providers

We use trusted subprocessors and service providers to help us operate and support the Service, such as:

Cloud hosting, database, and storage providers

Email delivery and notification services

Logging, monitoring, and error tracking services

Analytics and performance measurement tools

Customer support and helpdesk platforms

Security and identity tools

A current list or description of our subprocessors is available at: Supabase.com

These providers are contractually required to:

Use personal data only to provide services to us, and

Implement appropriate security measures.

7.2 Payment Processors

For subscription and billing payments, we use third-party payment processors.

Card details are processed directly by the payment processor and are not stored by us in full.

We may receive limited information from the payment processor, such as:

The last few digits of a card number,

Card type and expiry month/year,

Transaction confirmation, and

Payment status.

7.3 Messaging and Communication Providers

If agencies enable third-party messaging or communication integrations (e.g., SMS, WhatsApp gateways, or external email providers), we may share:

Relevant contact data (e.g., phone numbers, email addresses)

The content of messages or notifications to be sent

Integration identifiers or tokens as necessary to operate the integration

Agencies are responsible for:

Complying with the terms and policies of those third-party providers, and

Ensuring their messaging practices comply with applicable laws (e.g., consent requirements for marketing messages).

7.4 Professional Advisers

We may share personal data with professional advisers where necessary, such as:

Lawyers and legal advisers

Auditors and accountants

Consultants

These parties are typically bound by confidentiality obligations.

7.5 Legal, Regulatory, and Safety Disclosures

We may disclose personal data to third parties, including public authorities, when we believe in good faith that it is reasonably necessary to:

Comply with applicable laws, regulations, or legal processes

Respond to valid subpoenas, court orders, or lawful requests

Protect the rights, safety, or property of Punctum Systems, our users, agencies, or the public

Detect, prevent, or investigate fraud, security issues, or other illegal or harmful activities

7.6 Business Transfers

If we are involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, personal data may be transferred as part of the transaction, subject to appropriate protections.

We will require any acquiring or successor entity to respect this Privacy Policy or a substantially similar policy.

You will be notified through the Service, our website, or other appropriate means if such a transfer materially affects how your personal data is handled.

8. International Data Transfers

We are based in the United States (New Mexico), and we may process and store personal data in the United States and other countries.

Data may be transferred to countries that may have different, and in some cases less protective, data protection laws than the laws of your home country.

Where required by applicable law (for example, for transfers from the EEA or Switzerland), we implement appropriate safeguards, such as:

Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent mechanisms; and/or

Other lawful transfer mechanisms recognized under applicable law.

Agencies and users may request more information about our international transfer mechanisms and safeguards by contacting hello@punctum-systems.com.

9. Data Retention

We retain personal data for as long as needed to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

9.1 Agency and Workspace Data

For data associated with an agency's workspace:

We retain the data for as long as the agency's account is active and the Service is being provided.

After an account is terminated or closed, we generally:

Retain workspace data for a limited export and backup window (typically around 60 days), to allow agencies to export their data or restore their account if needed.

After this period, we delete or anonymize the data in accordance with our standard retention schedules, unless we are legally required, or reasonably need, to keep it longer (for example, to comply with legal obligations or to protect our rights).

9.2 Logs, Diagnostics, and Security Data

Usage logs, diagnostic logs, and security-related data are kept for a commercially reasonable period that enables:

Security monitoring

Troubleshooting

Analytics

Compliance with legal or regulatory requirements

Retention periods for these categories can vary depending on the type of log and applicable legal requirements.

9.3 Other Retention Considerations

In some cases, we may retain data longer when:

Necessary to comply with legal obligations (e.g., tax and accounting records)

Necessary to establish, exercise, or defend legal claims

Required by contracts with agencies or third parties

When personal data is no longer needed, we will delete it or take steps to properly anonymize or aggregate it.

10. Security

We take the security of personal data seriously and implement technical and organizational measures designed to protect it against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include, as appropriate:

Encryption in transit

Use of protocols such as TLS to encrypt data transmitted between your device and our systems

Access controls and authentication

Role-based and least-privilege access to production systems

Strong authentication mechanisms for administrative access

System and data protection

Regular backups and tested recovery processes

Monitoring and logging of key systems

Use of firewalls and other protective technologies

Organizational practices

Staff training on data protection and security practices

Confidentiality obligations for employees and contractors

Internal policies and procedures for incident response and data handling

Despite our efforts, no system can be completely secure, and we cannot guarantee absolute security of your information. If you believe that your account or data may have been compromised, please contact us immediately at hello@punctum-systems.com.

11. Your Rights and Choices

Your rights and choices may differ depending on whether we act as Controller for your data and which laws apply to you.

11.1 Rights of Agency and Admin Users (Where We Are Controller)

Where we act as a Controller, and subject to applicable law, you may have the right to:

Access: Request confirmation whether we process your personal data and receive a copy.

Rectification: Ask us to correct or update inaccurate or incomplete personal data.

Deletion: Request deletion of your personal data, subject to legal and contractual limitations.

Restriction: Ask us to restrict the processing of your personal data in certain circumstances.

Objection: Object to certain processing activities based on our legitimate interests, where permitted by law.

Data portability: Request a copy of certain personal data in a structured, commonly used, and machine-readable format, and request that we transfer it to another Controller where technically feasible and legally required.

Marketing communications: Opt out of marketing emails by following the unsubscribe link in those emails, or by contacting us. We may still send non-marketing, service-related communications.

Some information may need to be retained for:

Legal compliance (e.g., tax and accounting records)

Security or fraud prevention

Our legitimate business needs (e.g., enforcement of agreements)

We may ask you to verify your identity before responding to your request, and we will respond within the timeframes required by applicable law.

To exercise your rights, please contact us at hello@punctum-systems.com.

Where applicable (for example, in the EEA or other jurisdictions with similar laws), you may also have the right to lodge a complaint with a supervisory authority if you believe we have not handled your personal data lawfully. We encourage you to contact us first so we can address your concerns.

11.2 Rights of Drivers and End-Customers (Where Agencies Are Controllers)

If your personal data has been entered into Easy Rental OS by an agency (for example, as a driver or rental customer), the agency is generally the Controller of that data.

You should contact the agency directly to exercise your rights of access, correction, deletion, objection, or any other data subject rights.

We will support the agency, as required by law or contract, by:

Helping them respond to your request

Implementing any necessary changes in the Service

If you contact us directly about data for which we are only a Processor, we may:

Refer your request to the relevant agency, and/or

Inform you that we cannot act on your request without the agency's instructions.

12. Cookies and Similar Technologies

Easy Rental OS and our websites use cookies and similar technologies to operate and improve the Service.

12.1 Types of Cookies and Technologies We Use

Essential cookies

Required for the Service to function properly

Used for authentication, security, and session management

For example, keeping you logged in, preventing fraud, and enabling core features

Preference or feature cookies

Remember your settings and choices (e.g., language, layout, or workspace preferences)

Help provide a more customized and convenient experience

Analytics cookies and similar tools

Collect information about how users interact with the Service and our websites

Help us understand usage patterns, improve features, and troubleshoot issues

May be set by us or by third-party analytics providers

We may also use similar technologies, such as local storage and web beacons, for similar purposes.

12.2 Your Choices

Depending on your browser, device, and region, you may be able to:

Configure your browser to block or delete cookies, although this may affect Service functionality.

Use in-app or website cookie settings or banners (where available) to manage preferences, particularly for non-essential cookies.

In certain regions, we may seek your consent for non-essential cookies (such as some analytics cookies). You can withdraw your consent at any time through the available cookie settings or by adjusting your browser settings.

13. Children

Easy Rental OS is a B2B platform intended for use by car rental agencies and their staff, not by individuals acting as private consumers.

The Service is not directed to children and is not intended for individuals under 18 years old, or under the age of majority in their jurisdiction, whichever is higher.

We do not knowingly allow children to create accounts on the Service.

Agencies should not use the Service to collect or process children's personal data, except where this is legally permitted and appropriate safeguards are in place under applicable law. Agencies are responsible for ensuring that their use of the Service for any such data is lawful.

If you believe we have collected personal data from a child in violation of this section, please contact us at hello@punctum-systems.com, and we will review and, where appropriate, delete the information.

14. Agency Responsibilities as Controllers

Agencies using Easy Rental OS act as Controllers (or "businesses") for the personal data of their drivers and end-customers they upload to the Service. As such, agencies are responsible for:

Lawful basis and compliance

Determining the appropriate legal basis for processing personal data under applicable laws (e.g., consent, contract, legitimate interests)

Ensuring that their collection and use of personal data through the Service complies with all relevant laws and regulations

Privacy notices and transparency

Providing clear and accurate privacy notices to their drivers and end-customers

Explaining how they use Easy Rental OS as part of their rental process

Consents and permissions

Obtaining any required consents or permissions (e.g., for marketing communications, certain types of document storage, or data sharing)

Managing records of such consents as needed

Data subject rights

Responding to data subject requests (e.g., access, deletion, correction, objection) from their customers and drivers

Using Service features and/or contacting us to help fulfill these requests where we act as their Processor

Data minimization and retention settings

Limiting the personal data stored in Easy Rental OS to what is necessary and relevant

Configuring retention, export, and deletion practices consistent with legal requirements and their internal policies

Managing access and permissions

Managing Authorized Users, roles, and permissions within their workspace

Ensuring that only appropriate staff have access to specific data

Promptly removing access for staff who leave or no longer need it

Identity verification

Verifying, authenticating, and validating customers' identity documents in person before completing any rental — Easy Rental OS records only a confirmation that this verification occurred; the identity document itself is not stored by the Service

Ensuring that their identity verification practices comply with all applicable laws and regulations in the jurisdictions where they operate

Use of integrations and third parties

Ensuring that their use of integrations (e.g., messaging gateways, payment providers) complies with those providers' terms and applicable laws

Notifying their customers and drivers of any relevant third-party services they use

We provide tools and settings within Easy Rental OS to support agencies in fulfilling these responsibilities but do not control how agencies choose to use the Service.

15. Consistency with Terms of Service

This Privacy Policy is part of, and is incorporated by reference into, our Terms of Service.

The Terms govern your overall use of the Service, including any limitations of liability, disclaimers, and other contractual terms.

This Privacy Policy explains how we handle personal data and is intended to be consistent with the Terms.

If you have questions about how any part of this Privacy Policy interacts with the Terms of Service, please contact us at hello@punctum-systems.com.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

Changes in our Service or business practices

Changes in applicable laws or regulatory guidance

Technical or security updates

When we make material changes, we will take appropriate steps to notify you, which may include:

Posting the updated Privacy Policy in the Service and/or on our website

Updating the "Effective Date" at the top of this page

Providing in-app notifications or sending emails to account owners or administrators, where appropriate

Your continued use of the Service after any such update constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you should stop using the Service.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of personal data, you can contact us at:

Privacy matters and data protection requests: hello@punctum-systems.com

General support and Service questions: hello@punctum-systems.com

Postal mail: Punctum Systems Holdings LLC 1209 Mountain Road PL NE, STE R, Albuquerque, NM 87110, USA

We will review and respond to your inquiry within a reasonable time frame and in accordance with applicable law.