Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

FM-Handel UG (haftungsbeschränkt)
Lohweg 3
35633 Lahnau
Email: Rent@fm-handel.de

2. Booking and contract processing

When you submit a rental enquiry or complete a booking, we process in particular your name, email address, telephone number, customer type and, for business customers, business details; the rental items and period; pickup or delivery method and, where applicable, delivery address; price, payment and deposit information; and the associated declarations and timestamps.

Purpose and legal basis: handling your enquiry, checking availability, preparing, concluding and performing the rental contract, and complying with statutory record-retention duties. The legal basis is Art. 6(1)(b) GDPR and, where a legal duty applies, Art. 6(1)(c) GDPR.

Retention: we retain data for as long as required for the enquiry and contract. We then keep records subject to statutory retention periods and delete or anonymise other data when no claims or legitimate interests require further retention.

3. Service providers

3.1 Stripe — payment processing and stored payment method

We use Stripe to process payments. The data processed includes your name, email address, booking data, amount and payment data. Complete card details are stored exclusively by Stripe; we neither receive nor store them.

On the basis of your authorisation under Section 3a of our Terms and Conditions, your payment method is retained by Stripe beyond the individual payment transaction so that we can process the rental security and any due flat-rate charges and damages claims under the rental contract. The legal basis is Art. 6(1)(b) GDPR (performance of the rental contract).

Before a charge for flat-rate charges or damages, you will receive prior notification in text form; the charge will be made no earlier than seven days afterwards and will not be made if you object.

Retention ends six months after return of the rental item or, for cancelled bookings, six months after the agreed end of the rental period; the stored payment method is then deleted. You may replace the stored payment method or revoke the authorisation at any time (Section 3a(7) of the Terms).

3.2 Resend – transactional email

We use Resend for booking, payment, cancellation and withdrawal confirmations and other messages necessary to perform the contract. This involves processing your name, email address, booking and contract information, and technical delivery data under Art. 6(1)(b) GDPR.

3.3 Geoapify – delivery route

When you enter a delivery address and request a calculation, the address is sent before the contract is concluded to Geoapify (KEPTAGO LTD, Cyprus). Geoapify geocodes the address and calculates the road route so that we can determine the delivery area and fee. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps requested by you).

3.4 Vercel – hosting

Vercel Inc. hosts and delivers the website. It processes technical connection and log data such as IP address, browser and device information, access time and requested resource. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure, reliable operation of the site.

3.5 Supabase – database

Supabase processes booking, customer, contract and evidence records. The project is configured in the EU Central / Frankfurt region. The legal basis follows the relevant operation, in particular Art. 6(1)(b), (c) and (f) GDPR.

4. International transfers

Stripe, Resend, Vercel and Supabase may transfer personal data to, or make it accessible from, recipients outside the European Economic Area, particularly in the United States. Transfers are made in accordance with Arts. 44 et seq. GDPR, in particular under an adequacy decision for certified recipients (EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses together with required supplementary safeguards. Geoapify provides EU-bound processing for the EU API used; subprocessors may nevertheless need to be considered depending on the service concerned.

5. Cookies, local storage and server logs

We use only technically necessary cookies and local storage, in particular for secure admin authentication, display preferences and storage of the cookie-notice acknowledgement. The legal basis is § 25(2) no. 2 TDDDG and, where personal data is processed, Art. 6(1)(f) GDPR. We do not use analytics, marketing or tracking cookies or advertising networks.

Technical server logs are processed for troubleshooting, attack prevention and reliable operation. Application logs are designed not to contain names, email addresses, addresses or payment data. The legal basis is Art. 6(1)(f) GDPR.

6. No automated decision-making

We do not use solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

7. Your rights and right to complain

Subject to the statutory requirements, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21). You may withdraw consent at any time with future effect. Contact Rent@fm-handel.de.

You may also complain to the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany, email: poststelle@datenschutz.hessen.de, or another competent supervisory authority.

8. Security

We use appropriate technical and organisational safeguards, including TLS encryption, role-based access restrictions, database row-level security, server-protected credentials and a separately protected admin area.