Privacy policy

This is a translation; the Romanian version prevails.

This policy explains which personal data we process through Kondito, in what capacity, for what purpose and what rights you have. The service is provided by CDP PIXEL AGENCY SRL.

1. Who we are and in what capacity we process data

CDP PIXEL AGENCY SRL is the controller for the data of accounts created in Kondito (the client company and its users), for billing and for website visits.

For the data rental companies enter about their own customers (names, phone numbers, identity documents, contracts, handover and return photos), the rental company is the controller and CDP PIXEL AGENCY SRL is the processor, acting only on its instructions, as described in section 8.

2. What data we process

Account data: company name, tax ID, address, email and phone; users' names, emails and roles; the activity log (sign-ins, important changes).

Payment data: payments are processed by Stripe; we only receive the card brand, the last 4 digits and the subscription status, never the full card details.

Data entered by rental companies: customers, rentals, contracts, photos of vehicles and machines (with time, the phone's GPS location and the file's digital fingerprint) and, optionally, data read automatically from ID cards, driving licences and registration papers.

Technical and visit data: IP address and server logs for security; Google Analytics statistics on the website and the campaign that brought you to us (the utm parameters in the link), only with your consent (see the Cookie policy).

3. Purposes and legal bases

Providing the service and the subscription (performance of a contract, Art. 6(1)(b) GDPR).

Invoicing and accounting records (legal obligation, Art. 6(1)(c)).

Security, abuse prevention and the activity log (legitimate interest, Art. 6(1)(f)).

Emails about the account, the subscription and in-app notifications (performance of a contract); website visit statistics (consent, Art. 6(1)(a), which you can withdraw at any time).

4. Automatic document reading

When a user runs automatic reading, the document image is sent to the artificial intelligence provider (Anthropic) only to extract the fields. The values go into a form that the user checks before saving.

By default the ID document image is not kept. A company can keep it only by explicitly enabling that option. The reading log keeps usage and which fields were found, without the personal values.

5. Who we share data with

We use the following providers (processors), each only for the stated purpose: Hetzner Online GmbH, Germany (hosting and storage, in the EU); Stripe (payments); Resend (sending emails); Anthropic (automatic document reading, only on request); Google (website statistics, only with consent).

Some providers may process data outside the European Economic Area (for example in the USA). In those cases the transfer relies on the EU-U.S. Data Privacy Framework adequacy decision or on the European Commission's standard contractual clauses.

We do not sell personal data and do not use it for advertising.

6. How long we keep data

Account data: while the account is active and then for at most 12 months, unless you ask for earlier deletion.

Inspection photos: by default 24 months after the rental is closed (configurable by the company between 6 and 120 months); each product's main gallery is kept while the product exists.

Accounting documents: for the period required by tax law (currently 5 years). Security logs: at most 12 months.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Write to us at info@kondito.com.

If you are a customer of a rental company that uses Kondito, please address your request to that company first; we will help it answer.

You have the right to lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro).

8. Processing on behalf of rental companies (Art. 28 GDPR)

For their customers' data, rental companies instruct us through their use of the service. We process this data only to provide the service, keep it confidential, separate it per company and apply appropriate security measures (encryption in transit, role-based access, activity log, backups).

We only use the providers listed in section 5 and announce any change in advance. We notify the company without undue delay of a personal data breach and help it answer data subject requests.

When the contract ends, the company can export its data; after that we delete it, except what the law requires us to keep.

9. Security

Connections are encrypted (HTTPS), each company's data is isolated, files have no public addresses, and shared report links expire and can be revoked.

10. Introductory emails to companies (Art. 14 GDPR)

We may send car and equipment rental companies one email introducing Kondito, followed by at most one follow-up. We only use the contact address the company published on its own website, together with the company name, the city and the page we took the address from.

The legal basis is our legitimate interest in presenting the service to the companies it is built for (Art. 6(1)(f) GDPR). For each email we keep the date it was sent, whether it was delivered or rejected, whether the link in it was opened and whether you replied. Emails are sent through Resend and the data is hosted by Hetzner in the EU (section 5).

You can object at any time, with one click on the unsubscribe link in the email or by replying to it; after that we do not write to you again. We keep the data for at most 12 months after the last email. If you unsubscribed or the address was rejected, after that period we keep only the email address, so that we do not write to you again by mistake. The other rights in section 7 apply as well.

11. Changes

We may update this policy. Important changes are announced by email or in the application before they take effect.