PRIVACY POLICY
Rentcroo E-Services Philippines, Inc. · Peer-to-Peer & Commercial Equipment Rental Marketplace
Effective Date
January 1, 2026
Last Revised
July 2026
Jurisdiction
Republic of the Philippines
Governing Law
Data Privacy Act (RA 10173)
I.PREAMBLE & SCOPE
This Privacy Policy (“Policy”) constitutes a legally binding agreement between Rentcroo E-Services Philippines, Inc. (“Company,” “we,” “us,” or “our”) and any individual or entity (“User,” “you,” or “your”) accessing or utilizing the Rentcroo equipment rental platform, including the website at rentcroo.com and associated web applications, mobile applications, and API services (“Platform”).
This Policy governs the collection, processing, storage, and disclosure of Personal Information and Sensitive Personal Information as defined under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations (IRR), and all applicable circulars and advisories issued by the National Privacy Commission (“NPC”) of the Philippines.
II. INFORMATION COLLECTION
A. Account and Profile Information
When you register an account, the Company collects:
1. Basic Identifiers: Full legal name, date of birth (for 18+ age verification), residential address, email address, mobile telephone number, and public marketplace username/handle (used in public listings and chats to prevent unwarranted exposure of your legal identity).
2. Authentication Credentials: Salted and cryptographically hashed passwords (via bcrypt; we never store plaintext passwords) or WebAuthn/Passkey public credential IDs for biometric logins. Where you choose social login (Google/Apple), we retain only the provider name, unique provider subject ID, and verified email address to securely link your account.
3. Commercial Lessor & Business Profile Data:Where you register as a commercial lessor or enterprise vendor, we collect business name, registered corporate address, DTI / SEC registration certificates, Mayor's Business Permits, Taxpayer Identification Number (TIN), and BIR Certificate of Registration (Form 2303).
B. Identity Verification (KYC) Data
To prevent fraud, theft, and unauthorized high-value machinery operation, we require identity verification before participating in rental bookings. During the Know-Your-Customer (“KYC”) process, we collect:
1. Government-Issued Identification:Philippine Passport, PhilSys National ID, Driver's License, UMID/SSS Card, or PRC License.
2. Proof of Address / Billing: Utility bill, barangay certificate of residency, or lease contract.
3. Equipment Ownership Proof: For gated categories (heavy equipment, vehicles, high-end cinema packages), purchase invoices, official receipts, or serial number registration.
4. Facial Selfie & Liveness Video Challenge: A live photographic or video capture of your face, typically taken while presenting your physical ID document. A facial image is classified as Sensitive Personal Information under Section 3(l) of the DPA and is managed under strict technical encryption and access isolation.
Because facial biometric photographs and government ID numbers constitute Sensitive Personal Information, Section 13 of the Data Privacy Act requires your separate, explicit, and informed consent. Before submitting verification photos, you are presented with a dedicated consent acknowledgment. Every KYC submission is reviewed by trained human verification officers in compliance with NPC guidelines. You may withdraw consent and request document purge at any time by emailing support@rentcroo.com, subject to statutory 7-year audit retention mandates for executed rental contracts.
C. Equipment Rental, Cart & Handover Data
1. Booking Configurations: Equipment selections, multi-item cart bundles, project batch references, rental schedules, delivery preferences, jobsite addresses, and designated site contact phone numbers.
2. Handover & Return Verification OTPs: Ephemeral 6-digit cryptographic Handover OTPs and Return OTPs used for physical custody transfer verification.
3. Condition Audit Evidence: Timestamped and geotagged condition photos, operating hour meter readings, checklist notes, and return inspection reports.
4. Damage Claims & Dispute Evidence: Claim incident descriptions, repair estimates, and mediation documentation.
D. Payment, Escrow & Payout Data
Online payment transactions are processed securely through licensed payment gateways (including PayMongo). Card and e-wallet credentials (GCash, Maya, Debit/Credit Card) are entered on PCI-DSS certified gateway checkout pages; Rentcroo does not store raw credit card numbers or wallet PINs. We retain:
1. Transaction Identifiers: PaymentIntent IDs, checkout session references, and gateway receipt codes.
2. Escrow & Deposit Balances: Amount breakdown (rental fee, refundable security deposit, protection plan fee, marketplace service fee), and 24-hour return inspection settlement logs.
3. Lessor Payout Account Details: Verified recipient GCash/Maya numbers, bank account names, masked account numbers, and BIR 1% withholding tax credit statements (Form 2307).
E. Communications & In-App Messaging
The Platform provides an in-app messaging system connecting renters and lessors for equipment logistics. We store message text, uploaded attachment photos (up to 15MB), read receipts, timestamps, and customer support correspondence.
F. Automatically Collected Technical & Geolocation Data
When you access the Platform, we automatically collect IP addresses, browser user agent, operating system, approximate city/municipality (derived from IP), and precise device GPS coordinates onlywhen you explicitly grant location permissions on the “Near Me” search or jobsite delivery picker.
G. Cookies and Session Storage
The Platform uses secure HTTP cookies and browser storage to maintain authenticated sessions and protect account state:
| Cookie / Storage Key | Type | Purpose | Duration |
|---|---|---|---|
| auth_token | HttpOnly, Secure Cookie | Cryptographically signed session token for authenticated user sessions. Strictly necessary. | 30 days / Session |
| cf_clearance / Turnstile | Third-party Cookie | Cloudflare bot detection and DDoS mitigation protection. | Up to 1 year |
| rentcroo_cart (session) | Server Database & Local Cache | Persists draft equipment cart items and custom rental date selections across sessions. | Until checkout / cleared |
III. PURPOSE AND LEGAL BASIS FOR PROCESSING
A. Primary Purposes (Contractual and Legal Necessity)
- Creating and managing user accounts, verifying identity, and maintaining platform security.
- Executing peer-to-peer and commercial equipment rental agreements.
- Administering payment processing, escrow holding, and automated 24-hour return inspection settlement.
- Coordinating pickup, jobsite drop-offs, and issuing 6-digit Handover verification OTPs.
- Complying with Philippine tax regulations (BIR Form 2307 issuance and 1% withholding tax).
- Complying with the Data Privacy Act of 2012, AMLA requirements, and law enforcement court orders.
B. Legitimate Interests
- Preventing equipment theft, fraudulent reservations, and multi-accounting abuse.
- Platform performance telemetry, error reporting, and system reliability diagnostics.
- Investigating damage claims, disputed condition logs, and mediation cases.
C. Automated Processing & Profiling Disclosures
In compliance with Section 25(g) of the DPA IRR, we disclose that equipment search ranking and risk-scoring algorithms may flag high-risk anomalies for manual officer review. No verification or account suspension decision is made purely by automated algorithms; every critical account decision is reviewed by a human compliance officer.
IV.THIRD-PARTY SERVICE PROVIDERS & SUB-PROCESSORS
All third-party service providers engaged by Rentcroo are bound by strict Data Processing Agreements requiring confidentiality and compliance with the Philippine Data Privacy Act:
| Service Provider | Role / Category | Data Processed |
|---|---|---|
| PayMongo Philippines, Inc. | Payment Gateway & Processing | Transaction amounts, payment method types (GCash/Maya/Card), payer billing names. |
| Cloudflare, Inc. | DNS, CDN, DDoS & Turnstile | IP addresses, HTTP request telemetry, bot verification challenges. |
| Managed Cloud Database | Encrypted Database Storage | Encrypted user accounts, rental listings, booking histories, and inspection records. |
| Transactional Email & SMS Gateway | Transactional Notifications | User phone numbers and email addresses for OTP delivery and booking alerts. |
V.DATA SECURITY MEASURES & BREACH PROTOCOL
A. Technical & Organizational Safeguards
- Encryption in Transit & at Rest: TLS 1.3 encryption for all network transmissions; AES-256 encryption for database records and identity verification files.
- Role-Based Access Control: Strict principle of least privilege; customer KYC files are restricted exclusively to authorized compliance personnel.
- Authentication Security: Salted bcrypt password hashing and support for FIDO2/WebAuthn biometric passkeys.
B. Personal Data Breach Management (NPC Circular 16-03)
In the event of a confirmed security incident or personal data breach meeting the risk threshold defined in NPC Circular 16-03:
- The Company shall notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach.
- Affected data subjects shall be notified within thirty (30) calendar days, detailing the nature of the breach, affected data categories, and recommended remediation measures.
VI. YOUR RIGHTS UNDER THE DATA PRIVACY ACT
Under Republic Act No. 10173 and its IRR, you are guaranteed the following statutory rights:
1. Right to Be Informed
To know how your personal data is collected, processed, and disclosed.
2. Right to Access
To request copies of your personal data in our possession.
3. Right to Object
To opt out of direct marketing, profiling, or non-essential processing.
4. Right to Erasure / Blocking
To request deletion of your account and personal data (subject to legal retention periods).
5. Right to Rectification
To dispute and correct inaccurate or outdated information in your profile.
6. Right to Data Portability
To obtain an electronic, machine-readable copy of your personal data.
Submit a written request to our Data Protection Officer at support@rentcroo.com. Please include your registered email and a clear description of the right you wish to exercise. Requests are acknowledged within 5 business days and resolved within 15 to 30 calendar days.
If you believe your data privacy rights have not been honored, you may file a formal complaint before the National Privacy Commission under NPC Circular No. 2020-01 within one (1) year from the date of the incident:
• NPC Website: www.privacy.gov.ph
• NPC Complaints Email: complaints@privacy.gov.ph
• Address: 5th Floor Delegation Building, PICC Complex, Roxas Boulevard, Pasay City, Metro Manila
VII. DATA RETENTION AND DISPOSAL SCHEDULE
We retain personal information only for as long as necessary to fulfill the operational, legal, tax, and regulatory purposes for which it was collected:
| Data Category | Standard Retention Period | Legal / Operational Basis |
|---|---|---|
| Rental Transactions & Invoices | 10 Years | Bureau of Internal Revenue (BIR) accounting and tax audit regulations. |
| KYC & Government ID Files | 7 Years after account closure | Anti-fraud, dispute limitation periods, and DPA compliance. |
| In-App Chat Messages & Photos | 3 Years | Mediation and dispute resolution records. |
| Technical & Access Logs | 180 Days | Cybersecurity analysis and intrusion detection. |
VIII. CROSS-BORDER DATA TRANSFERS
Certain cloud infrastructure and Content Delivery Networks (including Cloudflare) operate globally. All cross-border transfers are executed in strict accordance with the NPC's guidelines on cross-border data flows, governed by Standard Contractual Clauses that guarantee equivalent privacy protections as mandated by the DPA.
IX.MINORS & AGE REQUIREMENTS (18+)
The Platform is strictly intended for individuals who are at least eighteen (18) years of age with full legal capacity to enter into binding equipment rental contracts. We do not knowingly collect personal data from minors under 18.
X. AMENDMENTS TO THIS POLICY
We may update this Privacy Policy from time to time to reflect operational or legal updates. Material revisions will be highlighted on the Platform and communicated via email at least thirty (30) days prior to taking effect.
XI. DATA PROTECTION OFFICER CONTACT INFORMATION
For any questions, clarifications, or requests concerning this Privacy Policy, please contact our Data Protection Officer:
Legal Entity Name
PJ Candelaria Online Shop
Trade Name / Business Style
Rentcroo Marketplace PH
Operating the Rentcroo rental marketplace platform under the registered trade name “Rentcroo Marketplace PH”.
Data Protection Officer
Office Address
205 J.P. Rizal St., Batingan, Binangonan, Rizal, Philippines