Skip to content
Rent RideRent Ride

Data processing agreement

Last updated 3 September 2026

This agreement applies where a business using Rent Ride puts personal data into its workspace and we process that data on its instructions. It forms part of the terms of service and takes effect automatically, so there is nothing to sign and nothing to request. Where this agreement and the terms of service conflict on the processing of personal data, this agreement governs.

Who is who

You are the controller

For the personal data you put into your workspace about your renters, your staff and your contacts, you decide what is collected and why. That makes you the controller, and the obligations that attach to a controller are yours.

We are the processor

Resurf LLC processes that data on your documented instructions and for no other purpose. We do not decide what goes in, we do not use it for our own ends, and we do not sell it or disclose it for anybody else’s marketing.

Where we are a controller instead

For your own account data, meaning who you are, what you pay, how you use the product, and our operational logs, we are the controller and our privacy policy applies rather than this agreement. The two do not overlap.

What we are instructed to do

Your instructions are: this agreement, the terms of service, and whatever you do through the product’s own features. We will not process personal data outside them.

  • Provide, maintain and support the service as described in the terms.
  • Store, retrieve, transmit and display the records you enter, and issue the documents the product issues.
  • Send the transactional messages the product sends to the recipients you record.
  • Act on a support request you make, only to the extent it requires it.
  • Comply with a legal obligation that applies to us. Where we are required to process beyond your instructions, we will tell you before we do unless the law forbids it.
  • We will tell you if we consider an instruction of yours infringes data protection law, and we may decline it.

The scope of processing

Subject matter and duration

Provision of the Rent Ride service, for as long as your account is open, and for the limited period afterwards described under deletion below.

Nature and purpose

Storage, organisation, retrieval, transmission, display, and deletion of rental records, so that a rental business can operate.

Categories of data subject

Your renters and prospective renters, your staff and any contact you record.

Categories of personal data

Name, email address, telephone number, postal address, date of birth, driving licence number, issuing country and expiry, booking and payment history, uploaded documents and images which may include identity documents, free-text notes, and whatever you choose to put in a custom field.

Disclosure outside the workspace, on your instruction

One feature discloses a renter’s data outside your workspace, and you should account for it in your own privacy notice. An invoice can be shared with the renter it is addressed to as a link carrying a long random token; anybody holding that link can open that invoice, without signing in, for ninety days. It shows the renter’s name, email address, telephone number and postal address, the booking and the amounts. Whether to send it, and to whom, is your decision.

Special category data

The service is not designed for it and our acceptable use policy prohibits entering it without a lawful basis. If you enter it anyway, you do so as controller, on your own basis, and you are responsible for the additional obligations that attach to it.

What we undertake

Confidentiality

Everybody we authorise to process personal data is bound by a duty of confidence that survives the end of their engagement, and access is limited to those who need it to operate the service.

Security

We maintain technical and organisational measures appropriate to the risk. These include encryption in transit and at rest; separation of each workspace from every other, enforced in the application on every query it makes; the anonymous public interface to our database closed off entirely rather than relied upon to refuse; private file storage that cannot be read by URL, reached only through short-lived signed links, with per-business policies enforced in the database for the buckets a browser uploads to directly and server-only access for the rest; role-based access within a workspace; and an audit trail on the plans that provide one.

Assistance with data subject requests

The product lets you find, correct and delete records yourself, which is how most of these requests are answered fastest. It does not currently offer a bulk export; where a request needs one, or cannot otherwise be satisfied through the product, write to us and we will provide a copy of your workspace data in a machine-readable format within thirty days, at no charge. If a data subject contacts us directly about your data, we will not respond substantively. We will pass it to you and tell you we have.

Assistance with your other obligations

Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance with security, breach notification, data protection impact assessments and prior consultation.

Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and in any event within seventy-two hours. The notification will describe what we know, the likely consequences, and what we are doing. Notifying your supervisory authority and your data subjects is yours to do, because that duty falls on the controller.

Records

We maintain a record of the processing we carry out on your behalf, and will make it available on reasonable request where you need it for your own compliance.

Subprocessors

You give general authorisation for us to engage subprocessors, subject to the following.

  • Every current subprocessor is named on our subprocessors page, which is kept current and forms part of this agreement.
  • Each is engaged under a written contract imposing obligations no less protective than those in this agreement, save where that page expressly states otherwise for a named service.
  • We remain fully liable to you for a subprocessor’s performance of those obligations.
  • We will give at least thirty days’ notice before engaging a new one, to customers who have asked to be notified.
  • You may object on reasonable data protection grounds within thirty days. If we cannot resolve the objection, you may terminate the affected service and receive a refund of fees paid for the unused remainder of the term. That is your entire remedy.

International transfers

  • Our database, file storage, application hosting and the mail we send on your behalf are in the United States.
  • The messages sent when somebody signs in, resets a password, accepts an invitation or changes an email address are relayed through a mail provider in Ireland, so those carry a recipient address into the European Union. Nothing else does.
  • Where you or your data subjects are in the European Economic Area, the United Kingdom or Switzerland, the European Commission’s Standard Contractual Clauses are incorporated into this agreement by reference, module two where you are a controller and we are a processor, and module three where you are yourself a processor.
  • For the United Kingdom, the Information Commissioner’s International Data Transfer Addendum applies to those clauses.
  • For Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Federal Data Protection and Information Commissioner is the competent authority.
  • Where the clauses require an option to be selected: the optional docking clause applies, notice of subprocessor changes is thirty days, the governing law is Ireland, and the forum is the courts of Ireland. Where a personal data breach must be notified under those clauses, the period is the one stated above.
  • For the purposes of the clauses, the description of processing is the scope section of this agreement and the technical and organisational measures are those described under what we undertake.

Audit

You have a right to verify our compliance, exercised proportionately.

  • We will make available the information reasonably necessary to demonstrate compliance with this agreement, including any third-party certifications or reports we hold.
  • Where that is genuinely insufficient for your regulator or your own obligations, you may audit once in any twelve-month period, on thirty days’ written notice, during business hours, without unreasonable disruption, and subject to confidentiality.
  • An audit may not include access to another customer’s data, to our production systems in a way that risks them, or to information whose disclosure would breach a duty we owe somebody else.
  • You bear your own costs and ours, unless the audit reveals a material breach of this agreement by us, in which case we bear ours.
  • A supervisory authority exercising a statutory power is not subject to these limits.

Return and deletion

  • Ending a subscription deletes nothing. The workspace becomes read-only and its records stay available to you, because a rental business may need to produce an agreement or an invoice long after it has stopped using our software.
  • We delete or irreversibly anonymise the personal data we process on your behalf when you ask us to, within thirty days of the request, except where law requires us to keep something. There is no automatic timetable, and we will not delete a workspace without being asked.
  • Before you ask for deletion, write to us for a copy of your data and we will provide it in a machine-readable format within thirty days. There is no self-serve export in the product today.
  • Data removed from the live service persists in our hosting provider’s encrypted backups until those age out on that provider’s ordinary cycle. It is not restored to the live service, and remains subject to this agreement until it is gone.
  • We will confirm deletion in writing on request.

Liability

This section is important and is not a formality.

  • Each party’s liability under this agreement is subject to the limitations and exclusions in the terms of service. This agreement does not create a second, separate or uncapped liability, and the caps there apply to claims under this agreement in aggregate with claims under the terms.
  • You are responsible for the lawfulness of the data you put into the service, for having a lawful basis for it, and for the notices and consents your data subjects are owed. We have no relationship with them through which we could provide either.
  • You will indemnify us against claims arising from your breach of this paragraph, including a claim by a data subject or a regulator that arises from your own act or omission as controller.
  • Nothing here limits liability that cannot be limited by law.

Regional terms

California

We are a service provider under the CCPA as amended. We do not sell or share personal information, do not retain, use or disclose it for any purpose other than performing the service, and do not combine it with data from another source except as permitted. We certify that we understand and will comply with these restrictions.

Other United States privacy laws

Where a state law imposes equivalent processor obligations, we undertake them on the same terms as this agreement, and this agreement is intended to satisfy any contract that law requires.

Getting in touch

Resurf LLC, 5830 E 2ND ST, STE 7000, Casper, Wyoming 82609, United States. Write to us about anything in this agreement, to be added to the subprocessor notification list, or to request a signed counterpart for a procurement process.

Data protection enquiries hello@rentride.app

privacy@rentride.app