Privacy policy

Who is responsible for your data

The controller of any personal data processed through RentIsle — the party that decides why and how it is processed — is the operator of the site:

Operator

[Operator — pending operator details]

Address

[Address — pending operator details]

Email

hello@rentisle.com

We have not appointed a data protection officer; the GDPR does not require one for a site of this size and kind. For anything to do with your data, write to hello@rentisle.com.

What happens when you open a page

RentIsle is a set of pre-built pages served by our hosting provider, Vercel. Like any web server, Vercel receives the technical data your browser sends with each request — your IP address, browser and device type (the user-agent string), the page you asked for, the page that linked you here (referrer, if your browser sends one) and the time — and records it in short-lived request logs.

Purpose and legal basis. Delivering the page you asked for and keeping the site available and secure (rate limiting, abuse detection). This is our legitimate interest in operating a working website (GDPR Article 6(1)(f)); we cannot serve a page without receiving the request. We do not use these logs to build profiles, and we do not export or keep them ourselves.

Everything a page needs — fonts, images, scripts, styles — is served from our own domain. No page loads code, fonts or images from an advertising network, a social network or any other third party, so opening a page here tells no one else that you did.

Cookies and browser storage: none

We set no cookies. We use no browser storage. There is nothing to consent to, so there is no banner.

RentIsle sets no cookies of any kind — not for analytics, not for advertising, not even a session cookie — and does not write to localStorage, sessionStorage or any other storage in your browser. Under Malta’s electronic-communications privacy rules (S.L. 586.01) a consent banner is only required when a site stores or reads information on your device beyond what is strictly necessary. We store nothing, so we ask for nothing.

Partner cookies after click-out. When you follow a partner link and land on the partner’s own site, that site will set its own cookies on its own domain — typically including one that records that you arrived from RentIsle, which is how a commission is attributed to us. Those cookies are set and controlled by the partner, under the partner’s privacy and cookie policy, not by us and not on our domain.

If we ever add anything that would store non-essential data in your browser, we will change this policy first and add a consent mechanism before it goes live.

What happens when you click a partner link

Some links on this site are affiliate links, always marked by our disclosure. Every affiliate link points first at an address on our own domain, of the form /go/{partner}, and our server redirects you to the partner. Here is exactly what happens in that step:

1. Your browser asks our server for the /go/ address. That address carries the partner’s name and three labels describing the link itself — the page it sat on, its placement, and the car class it concerned. A “book via” link on a company profile also carries the address of the partner page to open; a search deep link instead carries the search you entered — pickup location, dates, driver age and currency — so the partner can show you matching results.
2. Our server checks that the destination is on a short list of known partner domains. If it is not, nothing is sent anywhere and you see a plain “Not found” response.
3. Our server appends a tracking label to the partner URL. The label contains only the page, the placement and the car class of the link — it contains no name, no identifier, and nothing that could be tied to you.
4. You are redirected to the partner. Our part is over.

The partner is an independent controller. From the moment you arrive on a partner’s site, that partner decides what it collects and why — including its own cookies, any account you create and any booking you make. Our booking partners are DiscoverCars (discovercars.com), Localrent (localrent.com) and, for programmes that run through it, the Travelpayouts affiliate network (travelpayouts.com). Please read their privacy policies; we cannot answer for them. Links that go straight to a rental company’s own website are ordinary links: no /go/ step, no tracking label, no commission.

What comes back to us. If you go on to book, the partner reports the booking to us so it can pay the commission. That report identifies the booking by the partner’s own reference, the date, the amount and the tracking label described above. It does not include your name, contact details or payment details.

Legal basis. Our legitimate interest in earning the commissions that fund the site, and in preventing our redirect from being abused (Article 6(1)(f)). The click step processes no personal data beyond the request itself, which is covered above.

Analytics: one server-side event, no script

We use Plausible Analytics (Plausible Insights OÜ, Estonia; data hosted in the EU) in the most limited way it can be used. There is no Plausible script — or any other analytics script — in our pages, so nothing measures which pages you view or how long you stay, and nothing runs in your browser.

Instead, when you follow a partner link, our server — after it has redirected you — sends one event to Plausible’s API at https://plausible.io/api/event. The event is named “Outbound Click” and contains four things: that name; the /go/ address you requested without its query string, so the dates, driver age and pick-up location you searched for are removed before the event leaves our server; our site’s domain; and three labels — partner, page and placement.

What is not sent. Your IP address, your user-agent string, any cookie, any identifier, and the search itself — the dates, driver age and location from the link you followed are stripped from the address before it is sent. The request reaches Plausible from our server, not from your browser, so Plausible sees our server’s address, not yours. The result is a count of clicks per partner, page and placement — a statistic, not a record of you.

Purpose and legal basis. Knowing which pages and placements lead people to a partner is how we decide what to write and keep the site funded. This is our legitimate interest (Article 6(1)(f)); given what the event contains, it is doubtful any personal data is involved at all, but we describe it here so that nothing is hidden.

If you email us

If you write to us, we process your email address, whatever name you sign with and the content of your message, for the purpose of replying and dealing with what you raise — a question, a correction, a rights request. Our email is handled by an email service provider acting as our processor.

Legal basis. Our legitimate interest in answering people who contact us (Article 6(1)(f)); where you exercise a right under the GDPR, our legal obligation to respond (Article 6(1)(c)). You are never obliged to write to us or to give us any particular detail; if you leave something out, the only consequence is that we may not be able to help.

Retention. We keep correspondence for 12 months after the last message in the thread, then delete it, unless a legal claim or obligation requires us to keep it longer.

Who receives data

We do not sell personal data, share it with advertisers, or pass it to anyone for their own marketing. The complete list of recipients is short:

Vercel and Plausible process data only on our instructions under data-processing terms that meet Article 28 of the GDPR. Their own policies: Vercel privacy policy and Plausible data policy.

Transfers outside the EEA

Vercel serves pages from a global network of servers, so the request logs described above may be processed outside the European Economic Area, including in the United States. Those transfers rest on Vercel’s participation in the EU-U.S. Data Privacy Framework and on the European Commission’s Standard Contractual Clauses in Vercel’s data processing addendum (Article 46). A copy of that addendum, which incorporates the Standard Contractual Clauses, is published at vercel.com/legal/dpa.

Plausible stores its data in the EU. Where a booking partner is established outside the EEA, any transfer of your data after click-out is that partner’s responsibility and is described in its own policy.

How long we keep data

• Request logs — kept by Vercel for a short, fixed period defined in its own documentation, then deleted. We do not copy or keep them.
• Click events — kept by Plausible as aggregate statistics for as long as we hold an account there. They contain no identifier, so there is nothing in them to delete about a person.
• Email — 12 months after the last message in the thread, unless a legal claim or obligation requires longer.
• Commission statements from partners — for as long as Maltese tax and record-keeping rules require us to keep accounting records (currently 10 years). They contain no name, contact details or payment details about you, and we treat them as accounting records.

Your rights

Under the GDPR you have the right to:

• Access — ask whether we hold personal data about you and receive a copy (Article 15).
• Rectification — have inaccurate data corrected (Article 16).
• Erasure — have data deleted where there is no longer a reason to keep it (Article 17).
• Restriction — ask us to keep but stop using data while a question about it is resolved (Article 18).
• Portability — receive data you gave us in a machine-readable format (Article 20).
• Objection — object to processing based on legitimate interests, at which point we stop unless we can show compelling grounds (Article 21).

We rely on legitimate interests and legal obligation, not on consent, so there is no consent to withdraw. We make no decisions about you by automated means and do no profiling. To exercise any right, email hello@rentisle.com; we will answer within one month. In practice, because we hold almost nothing about anyone, the most common honest answer will be that we have no data about you at all.

Complaints. If you believe we have handled your data unlawfully you can lodge a complaint with Malta’s supervisory authority, the Information and Data Protection Commissioner (IDPC), at idpc.org.mt, or with the data protection authority in the EU country where you live or work. We would rather hear from you first, but you do not have to.

Changes to this policy

We will update this policy whenever what the site does with data changes — before the change goes live, not after. The “Last reviewed” date at the top is the date of the current text. Material changes will be flagged at the top of the page for a period after they take effect.