EQrento
Mobile Application Privacy Policy
Effective date / last-updated date: 15th July, 2026
This Privacy Policy (hereinafter: the “Policy”) provides information on the processing of your personal data in connection with your use of the EQrento mobile application (hereinafter: the “App”). The App is the mobile client of the EQrento equipment-rental management service, which also operates at the website addresses https://eqrento.com/ and https://eq-rento.com/ (the App and that service together: the “Service”). The App is distributed via the Google Play store. This Policy applies to personal data processed through the App; where you also use the EQrento website, the privacy information published there applies in addition to this Policy.
Data Controller
The controller of your personal data is SOLTIX sp. z o.o., with its registered office at Gen. Wł. Sikorskiego 19 Street, Zielona Góra (65-454), Poland, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court in Zielona Góra, 8th Commercial Division of the National Court Register (KRS) number 0001036416, REGON: 52534598800000, VAT ID (NIP): 9292077160, with share capital of PLN 10,000 (hereinafter: the “Controller”).
Contact with the Controller
For all matters related to the processing of personal data, including requests to delete your account or your data, you may contact the Controller using the following means:
- by e-mail: [email protected],
- by post: SOLTIX, ul. Gen. Wł. Sikorskiego 19, 65-454 Zielona Góra, Poland.
Users of the App and Types of Accounts
The App is a professional tool addressed to businesses operating in the equipment-rental sector (a B2B tool). Two types of accounts are used in the App:
- business (company) accounts – held by the Controller’s business clients and managed by a person designated by the client (the “Company Administrator”);
- individual user accounts – created for the employees, associates or drivers of a business client, established and managed under the business client’s account by the Company Administrator.
The type of account affects, among other things, the procedure for deleting an account and data (see the section “Deletion of an Account and Data”).
Roles of the Parties (Controller and Processor)
With respect to the registration data of account holders, billing data, communication with the Controller and the technical operation of the App, the Controller acts as the controller of personal data within the meaning of the GDPR.
Where a business client, its Company Administrator or individual users enter into the App data concerning the client’s own business, customers, counterparties, equipment or other third parties (for example within handover / return protocols), the business client is the controller of such data, and the Controller (SOLTIX) processes it as a processor acting on the client’s behalf and on its documented instructions, under a separate data processing agreement. In such cases, the privacy notice of the relevant business client governs that data.
Personal Data Protection Measures
The Controller applies modern organisational and technical safeguards in order to ensure the highest possible protection of your personal data and guarantees that it processes such data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”), the Polish Act of 10 May 2018 on the Protection of Personal Data, as well as other provisions concerning personal data protection.
Information on the Processed Personal Data
The use of the App requires the processing of your personal data. Below you will find detailed information regarding the purposes and legal bases of the processing, as well as the period of processing and the obligatory or voluntary nature of providing the data.
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Conclusion and performance of the Agreement for the use of the App (creation and maintenance of business and individual user accounts). |
| Art. 6(1)(b) GDPR (processing is necessary for the performance of the Agreement for the use of the App concluded with the data subject or in order to take steps prior to entering into a contract). |
Providing the aforementioned personal data is a condition for the conclusion and performance of the Agreement for the use of the App (providing it is voluntary, but the consequence of failing to do so will be the inability to create and use an account). The Controller will process the aforementioned personal data until the limitation period for claims arising from the Agreement for the use of the App expires. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Providing the functionalities of the App, in particular creating and managing rental, handover and return protocols and other records entered by users. |
| Art. 6(1)(b) GDPR (processing necessary to provide the functionalities of the App under the Agreement). Where such data concerns third parties and is entered by a business client, the business client is the controller of that data and the Controller acts as a processor (see “Roles of the parties” above). |
Providing the aforementioned data is voluntary but necessary to use the relevant functionalities of the App (the consequence of not providing it is the inability to create a protocol or record with full content). The Controller will process the aforementioned data for the duration of the account / Agreement and until the applicable limitation periods for claims expire, subject to the rules on deletion described below and, where the Controller acts as a processor, in accordance with the business client’s instructions. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Providing location-based and transport / logistics functionalities of the App (e.g. presenting position on a map, transport and route features, linking a location to a task or protocol). |
| Art. 6(1)(b) GDPR (processing necessary to provide the functionality requested under the Agreement) and / or Art. 6(1)(a) GDPR (your consent expressed through the device’s location permission). |
Providing location data is voluntary; you grant access through your device’s permission settings and may withdraw it at any time in the device settings. Withdrawing access, or disabling background location, will result in the inability to use the location-based and transport functionalities of the App. The Controller processes location data for the time necessary to provide the functionality and, for location recorded within a protocol / task, together with that record. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Enabling you to take photographs and attach images (e.g. documenting the condition of equipment within protocols). |
| Art. 6(1)(b) GDPR (functionality provided under the Agreement) and / or Art. 6(1)(a) GDPR (consent expressed through the camera / photos device permission). |
Providing this data is voluntary; access is granted through device permissions and may be withdrawn at any time in the device settings, which will result in the inability to use the photo-documentation functionalities. Photographs attached to a protocol / record are stored together with that record for the periods indicated above. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Ensuring the proper, secure and stable operation of the App, providing technical support and improving the App. |
| Art. 6(1)(f) GDPR (legitimate interest of the Controller consisting in ensuring the security, stability and continuous improvement of the App and diagnosing errors) and, to the extent necessary to provide the App, Art. 6(1)(b) GDPR. |
Providing this data is voluntary but necessary for the proper and secure operation of the App; part of the data is recorded automatically when the App is used. The Controller will process the aforementioned data until an effective objection is raised or the purpose of processing is achieved. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Sending push notifications relating to the operation of the App (e.g. new tasks, rentals, returns, messages) and, subject to your consent, other notifications. |
| Art. 6(1)(b) GDPR (notifications necessary to provide the service / functionality) and Art. 6(1)(f) GDPR (legitimate interest in informing users about events relevant to the use of the App); Art. 6(1)(a) GDPR (consent) where notifications require it. |
Sending notifications requires the notification permission on your device, which you can enable or disable at any time in the device or App settings. Disabling notifications will result in the inability to receive them; it does not prevent the use of the remaining functionalities of the App. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Conducting complaint proceedings. |
| Art. 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case the obligation to respond to a complaint). |
Providing the aforementioned personal data is a condition for receiving a response to the complaint and exercising the rights arising from the provisions on liability for non-conformity of the service with the Agreement (providing it is voluntary, but the consequence of failing to do so will be the inability to receive a response to the complaint and exercise the aforementioned rights). The Controller will process the aforementioned personal data for the duration of the complaint procedure, and in the case of exercising the client’s rights, until they are time-barred. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Handling inquiries submitted by users. |
| Art. 6(1)(f) GDPR (legitimate interest of the Controller consisting in responding to the received inquiry). |
Providing the aforementioned personal data is voluntary but necessary in order to receive a response to the inquiry (the consequence of failing to do so will be the inability to receive a response). The Controller will process the aforementioned personal data until an effective objection is raised or the purpose of processing is achieved (whichever occurs first). | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Conducting verification proceedings and handling reports and appeals regarding decisions on inadmissible content. |
| Art. 6(1)(c) GDPR (processing necessary for compliance with legal obligations of the Controller, in particular to ensure a mechanism for reporting inadmissible content (Art. 16 of Regulation 2022/2065 – Digital Services Act (“DSA”)) and to handle complaints (Art. 20 DSA)). |
Providing the aforementioned personal data is a condition for receiving a response to the report or exercising the rights arising from the DSA (providing it is voluntary, but the consequence of failing to do so will be the inability to receive a response and exercise the aforementioned rights). The Controller will process the aforementioned personal data for the duration of the procedure, and in the case of exercising the user’s rights, until they are time-barred. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Fulfilment of tax obligations (e.g. issuing VAT invoices, storing accounting documentation). |
| Art. 6(1)(c) GDPR (processing necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations arising from tax law). |
Providing the aforementioned personal data is voluntary but necessary for the Controller to fulfil its tax obligations (the consequence of failing to do so will be the Controller’s inability to fulfil the aforementioned obligations). The Controller will process the aforementioned personal data for a period of 5 years from the end of the year in which the tax payment deadline for the previous year expired. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Fulfilment of obligations related to personal data protection. |
| Art. 6(1)(c) GDPR (processing necessary for compliance with a legal obligation of the Controller, in this case obligations arising from personal data protection regulations). |
Providing the aforementioned personal data is voluntary but necessary for the proper performance of the Controller’s obligations arising from personal data protection regulations, including the realisation of the rights granted to you by the GDPR (the consequence of failing to do so will be the inability to properly realise the aforementioned rights). The Controller will process the aforementioned personal data until the limitation periods for claims regarding violations of personal data protection regulations expire. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Establishment, investigation of, or defence against claims. |
| Art. 6(1)(f) GDPR (legitimate interest of the Controller consisting in the establishment, investigation of, or defence against claims that may arise in connection with the performance of Agreements concluded with the Controller). |
Providing the aforementioned personal data is voluntary but necessary for the establishment, investigation of, or defence against claims (the consequence of failing to do so will be the Controller’s inability to take the aforementioned actions). The Controller will process the aforementioned personal data until the limitation periods for claims that may arise in connection with the performance of Agreements concluded with the Controller expire. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Analysis of your activity in the App. |
| Art. 6(1)(f) GDPR (legitimate interest of the Controller consisting in obtaining information about your activity in the App). |
Providing the aforementioned personal data is voluntary but necessary for the Controller to obtain information about your activity in the App (the consequence of failing to do so will be the Controller’s inability to obtain the aforementioned information). The Controller will process the aforementioned personal data until an effective objection is raised or the purpose of processing is achieved. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Administration of the App. |
These data are saved automatically in so-called server logs each time the App is used (administering it without server logs and automatic recording would not be possible). | Art. 6(1)(f) GDPR (legitimate interest of the Controller consisting in ensuring the proper operation of the App). |
Providing the aforementioned personal data is voluntary but necessary to ensure the proper operation of the App (the consequence of failing to do so will be the inability to ensure the App works properly). The Controller will process the aforementioned personal data until an effective objection is raised or the purpose of processing is achieved. | ||
Profiling
The Controller analyses the activity and diagnostic data described above in order to maintain, secure, develop and improve the App. This may involve automated analysis of such data; however, the Controller does not use the App for advertising profiling and does not embed third-party advertising or cross-app tracking technologies in the App. Any automated processing carried out in connection with the App does not produce legal effects concerning you or similarly significantly affect your situation. The legal basis for this processing is Art. 6(1)(f) GDPR (the Controller’s legitimate interest in the proper operation and improvement of the App). You may object to processing based on legitimate interest at any time.
Device Permissions Requested by the App
To provide its functionalities, the App may ask you to grant the following device permissions. Each permission is optional at the operating-system level and can be granted or revoked at any time in your device settings; revoking a permission may disable the related functionality of the App:
- Camera – to take photographs for protocols and equipment documentation;
- Photos / media / storage – to attach images and save files related to protocols;
- Location (precise; and background location where you enable transport / driver features) – to provide map, location and transport functionalities;
- Notifications – to deliver push notifications about events relevant to your use of the App;
- Network / internet access – to connect the App with the EQrento service.
Recipients of Personal Data
The recipients of selected personal data may be the following external entities cooperating with the Controller to ensure the best standards and quality of the App’s operation:
- OVH sp. z o.o., ul. Swobodna 1, 50-088 Wrocław, Poland - provision of hosting and IT infrastructure on which the App’s back-end and data are operated;
- The OpenStreetMap Foundation, The OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom - provider of map data and map tiles displayed in the App; when maps are loaded, your IP address and information about the map area requested may be transmitted in order to display the map.
Furthermore, personal data may also be transferred to public or private entities if such an obligation results from generally applicable laws, a final court judgment, or a final administrative decision.
The Controller also uses the Google Play store to distribute the App; Google, as the store operator, processes data relating to the download and operation of the App on the basis of, and in accordance with, its own terms and privacy policy.
Transfer of Personal Data to Third Countries
The Controller stores personal data processed through the App primarily within the European Economic Area (in particular on OVH infrastructure located in Poland / the EU). If, in order to display maps, data (including your IP address) is transmitted to the OpenStreetMap Foundation established in the United Kingdom, such transfer takes place on the basis of the European Commission’s decision confirming an adequate level of personal data protection in the United Kingdom. You may obtain from the Controller a copy of any data transferred to a third country.
Your Rights
In connection with the processing of personal data, you have the following rights:
- Right to information: about what personal data concerning you is processed by the Controller and to receive a copy of such data (so-called right of access). The issuance of the first copy of data is free of charge; for subsequent copies, the Controller may charge a fee.
- Right to rectification: if the processed data becomes outdated or incomplete (or otherwise incorrect), you have the right to request its rectification.
- Right to erasure: in certain situations, you may request the Controller to delete your personal data, e.g. when:
- the data is no longer necessary for the purposes for which the Controller informed you;
- you have effectively withdrawn your consent to data processing, provided the Controller has no right to process the data on another legal basis;
- the processing is unlawful;
- the necessity to delete data results from a legal obligation imposed on the Controller.
- Right to data portability: in cases where personal data is processed by the Controller based on consent or for the purpose of performing an Agreement, you have the right to transfer your data to another controller.
- Right to withdraw consent: in cases where personal data is processed by the Controller based on your consent, you have the right to withdraw this consent at any time (withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal).
- Right to restriction of processing: if you consider that the processed personal data is incorrect, its processing is unlawful, or the Controller no longer needs specific data, you may request that for a specified, necessary time (e.g. to check the correctness of data or pursue claims), the Controller performs no operations on the data other than storing it.
- Right to object: you have the right to object to the processing of personal data based on the Controller’s legitimate interest. In the event of an effective objection, the Controller will cease to process personal data for the aforementioned purpose.
- Right to lodge a complaint: you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if you consider that the processing of personal data violates the provisions of the GDPR.
Deletion of an Account and Data
You can have your account and the associated personal data deleted as follows:
- Individual user accounts (employees, associates, drivers): these accounts are created and managed by the Company Administrator of the relevant business client. To have an individual account and its data deleted, please contact your Company Administrator, who can deactivate or delete the account within the App. You may also, at any time, contact the Controller directly (see “Contact with the Controller”) to request the deletion of your personal data.
- Business (company) accounts: the account holder (or the Company Administrator) may request closure of the account and deletion of data by e-mailing the Controller.
- Requests to the Controller: regardless of your account type, you may submit a request to delete your account and / or personal data by e-mail to [email protected]. Please provide information enabling us to identify your account (e.g. the e-mail address linked to the account and the name of the business client).
Upon receiving a valid request, the Controller will delete or irreversibly anonymise your personal data, except for data that the Controller is required or entitled to retain for a limited period on the basis of the law (for example accounting and tax documentation) or in order to establish, investigate or defend legal claims; such data will be deleted after the relevant retention periods expire. The Controller handles deletion requests without undue delay and, in any event, within 30 days of receiving a request (this period may be extended where permitted by law, in which case you will be informed of the extension).
Where the Controller processes data as a processor on behalf of a business client (for example data entered by the client into protocols about third parties), such data is deleted in accordance with the instructions of that business client and its own privacy policy.
Deleting (uninstalling) the App from your device removes the App and locally stored data from that device, but does not by itself delete your account or the data stored on the Controller’s servers – to delete these, please use one of the methods described above.
Local Storage and Similar Technologies
The App does not use browser “cookies”. To function correctly, the App stores limited information locally on your device, such as your login / session token, application settings and preferences, and cached content necessary for the App to operate. The App does not use third-party advertising or cross-app tracking technologies. You can clear locally stored data by logging out, clearing the App’s data in your device settings, or uninstalling the App. (“Cookies” and similar technologies continue to apply when you use the EQrento online service, as described in the privacy information published there.)
Data Security
The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or destruction, including encryption of data transmission (TLS), access-control and authentication mechanisms, and measures to ensure the ongoing confidentiality, integrity and availability of processing systems.
Children
The App is a professional business (B2B) tool intended for adult users acting in a professional capacity. The App is not directed to children and the Controller does not knowingly collect personal data from children under the age of 16. If you believe that a child has provided personal data through the App, please contact the Controller so that the data can be deleted.
Changes to this Privacy Policy
The Controller may update this Policy, for example to reflect changes in the App’s functionalities or in legal requirements. The current version of the Policy is made available within the App and on the App’s Google Play listing. Where changes are material, the Controller will inform users by appropriate means before the changes take effect.
Final Provisions
In matters not regulated by this Privacy Policy, generally applicable provisions on personal data protection shall apply.