This agreement applies automatically to all fleet operators processing personal data within Base Rent. You remain the Data Controller of your renters’ and drivers’ personal data; Base Rent acts solely as your Data Processor. We will never use your customer data for our own commercial purposes or sell it to third parties.
1. Preamble & Scope
This Data Processing Addendum (“DPA”) supplements the Terms & Conditions entered into by and between Base Rent Technologies (“Processor” or “Base Rent”) and the car rental business entity (“Controller” or “Customer”) using the Base Rent platform.
This DPA governs the Processing of Customer Personal Data by Base Rent in connection with the provision of the rental management software (RMS), mobile damage inspection applications, website booking engines, and associated customer support services.
2. Definitions
Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement or under the GDPR:
- “Customer Personal Data”: Any personal data uploaded, submitted, captured, or otherwise processed through the platform by or on behalf of Customer regarding renters, drivers, or personnel.
- “Data Protection Laws”: All applicable privacy and data protection statutes, including Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, and Swiss Data Protection Act.
- “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, and “Personal Data Breach”: Shall have the meanings given in Article 4 of the GDPR.
3. Roles of the Parties
The parties acknowledge and agree that:
- Customer is the Controller: The Fleet Operator determines the purposes and means of processing renter data, including driver KYC verifications, contract terms, deposit amounts, and damage photo collection.
- Base Rent is the Processor: Base Rent processes Customer Personal Data solely on behalf of and in accordance with the documented instructions of the Customer for the purpose of delivering the platform services.
4. Customer Instructions
Base Rent shall process Customer Personal Data only in accordance with documented instructions from Customer, including with respect to transfers of personal data outside the EEA, unless required to do so by Union or Member State law to which Base Rent is subject. In such a case, Base Rent shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
5. Confidentiality of Personnel
Base Rent ensures that all employees, contractors, and agents authorized to process Customer Personal Data have committed themselves to strict confidentiality agreements or are under an appropriate statutory obligation of confidentiality. Access is granted strictly on a least-privilege, need-to-know basis.
6. Security Measures (TOMs)
Taking into account the state of the art, costs of implementation, and nature of processing, Base Rent implements and maintains technical and organizational measures (TOMs) specified in Annex 2 designed to ensure a level of security appropriate to the risk, including:
- Pseudonymization and encryption of personal data in transit (TLS 1.3) and at rest (AES-256);
- Continuous ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems;
- Ability to restore availability and access to personal data in a timely manner in the event of a physical or technical incident;
- A process for regularly testing, assessing, and evaluating the effectiveness of security measures.
7. Sub-processors
Customer grants Base Rent general authorization to engage sub-processors to assist in delivering platform infrastructure and communication capabilities. A list of approved sub-processors is set forth in Annex 3.
Base Rent enters into written data protection agreements with each sub-processor imposing obligations no less protective than those set forth in this DPA. Base Rent remains fully liable to Customer for the performance of each sub-processor’s obligations.
Base Rent shall notify Customer of any intended changes concerning the addition or replacement of sub-processors. Customer may object to a new sub-processor on reasonable data protection grounds within fourteen (14) days of notice.
8. Data Subject Rights (DSR)
Taking into account the nature of the processing, Base Rent assists Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to requests for exercising data subject rights under Chapter III of the GDPR (including access, rectification, erasure, and portability).
If Base Rent receives a request directly from a Customer’s renter or driver, Base Rent shall promptly notify the Customer and advise the data subject to submit their request directly to the Customer.
9. Incident & Breach Notification
Base Rent shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a confirmed Personal Data Breach impacting Customer Personal Data.
Such notification shall describe the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences, and the remedial measures taken or proposed to mitigate potential adverse effects.
10. Return & Deletion of Data
Upon termination of the Agreement, Base Rent shall, at the choice of the Customer, delete or return all Customer Personal Data and delete existing copies, unless applicable law requires storage of the personal data.
Customer is provided a thirty (30) day window following subscription expiration to export customer directories, fleet history, and contracts, after which all tenant records are cryptographically wiped from production systems.
11. Compliance Audits
Base Rent shall make available to Customer all information necessary to demonstrate compliance with Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, subject to reasonable advance written notice and standard non-disclosure agreements.
12. International Transfers & SCCs
To the extent that personal data originating from the EEA, UK, or Switzerland is transferred to a jurisdiction not recognized as providing an adequate level of protection, the parties agree that the European Commission’s Standard Contractual Clauses (Module 2: Controller-to-Processor) shall be incorporated herein by reference.
Annex 1: Details of Processing
A. Subject Matter & Nature of Processing
Provision of car rental operations management software (RMS), digital rental agreement generation, electronic signatures, lot damage documentation, and direct booking engine services.
B. Categories of Data Subjects
- Car rental customers (primary drivers and secondary authorized drivers);
- Emergency contacts and corporate billing liaisons;
- Customer employees, counter attendants, and station managers authorized to access the dashboard.
C. Types of Personal Data
- Identity & Verification: Full name, date of birth, driver’s license number, issuing state/country, license photos, and passport/national ID details for KYC compliance;
- Contact Information: Residential address, mobile phone number, and email address;
- Rental Records: Reservation dates, pickup/return branches, vehicle categories, payment amounts, and security deposit statuses;
- Proof of Condition: Timestamped lot walkaround photographs, vehicle damage location markers, and digital signatures captured on touchscreen glass;
- Telematics (optional): GPS geofence timestamps, fuel levels, and odometer readings where hardware integrations are enabled.
D. Duration of Processing
The duration of the Agreement plus thirty (30) days, unless otherwise required by statutory data retention laws.
Annex 2: Technical & Organizational Measures (TOMs)
| Control Objective | Implementation in Base Rent |
|---|---|
| Access Control | Role-based access control (RBAC), multi-factor authentication (MFA) support, hashed credential storage using modern cryptographic algorithms, and automated session timeouts. |
| Encryption | All network communications enforced via TLS 1.3. Databases, backups, and file storage vaults encrypted with AES-256 at rest. |
| Tenant Separation | Logical partition of customer data; tenant-isolated relational database queries preventing cross-customer access. |
| Availability & Backups | Multi-zone redundancy, automated point-in-time recovery (PITR) backups with automated recovery testing, and DDoS protection via Cloudflare. |
| Audit Trail | Immutable logging of key operational events (signature captures, damage edits, and user logins) with microsecond timestamps. |
Annex 3: Authorized Sub-processors
The following entities are authorized sub-processors of Base Rent Technologies:
| Sub-processor | Processing Role | Location | Transfer Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Edge CDN, DDoS Mitigation, Web Application Firewall (WAF) & DNS | USA / Global Edge | Data Privacy Framework / SCCs |
| Amazon Web Services (AWS) | Cloud Infrastructure, Managed Databases, Object Storage & Backups | EU (Frankfurt / Ireland) | ISO 27001, SOC 1/2/3, GDPR Art. 28 |
| Stripe Payments Europe, Ltd. | Payment Tokenization, Security Deposit Pre-Auth & Virtual POS | Ireland / EU | PCI-DSS Level 1 Service Provider |
| Twilio / Postmark | Transactional SMS, Pickup Directions & Email Delivery | USA / EU | SCCs & Binding Corporate Rules |