Cookie policy

Who we are

Rentrium is established in Greece, with its registered office at Χρήστου Λαδά 34, 11147, Αττική. ΑΦΜ 803418067, ΔΟΥ ΚΕΦΟΔΕ Αττικής.

You can reach us at support@rentrium.gr.

1. What this covers

This policy explains what we store on your device when you use Rentrium, and what it is used for.

It covers cookies, and also the other ways a site can keep information on your device: local and session storage in your browser, and the storage the Rentrium app uses on your phone. Greek law on this point is written in terms of storing or gaining access to information on your terminal equipment rather than in terms of the word “cookie”, so everything of that kind is listed here whatever the technology.

2. The cookies we set

Rentrium’s own code sets five cookies, a sixth only when a member of our staff is signed in to your account to help with a request, and, for two hours, one more for each payment for which you leave our site for certain payment providers’ pages. All are first-party: they are set by this site, they are not shared with any other site, and they are not sent to any other domain.

Staying signed in

Two cookies keep you signed in — one for customer accounts and one for rental-company staff. Each holds your sign-in token and lasts ten days. Without them you cannot stay signed in, and they are not used for anything else. A third cookie exists only while a member of our staff is signed in as an account to help with a request: it holds that staff member’s own session so they can return to it, it lasts one hour rather than ten days, and it is removed the moment they return.

They are not marked HttpOnly, because the page’s own code has to read the token out of the cookie in order to send it to our servers. The token is encoded rather than encrypted, so anyone who can read the cookie can read what is inside it: your account identifier, your email address, your first name and your last name — and, for rental-company staff, the roles held on that account.

Signing out does not remove the cookie from your device. Its contents are overwritten with an empty session and its lifetime is reset to a further ten days, so what remains holds no token and no personal data. It stays until it expires or until you clear your browser’s cookies. Signing out also clears the token in your browser only — the token itself is not cancelled on our servers and remains valid until it expires, ten days after it was issued.

Remembering your language and appearance

Two more cookies remember which of our seven languages to show you and whether you prefer the light or dark appearance. Each lasts twelve months. They are written only at the moment you press the language or appearance switch: they hold exactly the choice you have just made and nothing else, and until you make a choice they are not there at all. That is why they are not part of the question we put to you — you can delete them whenever you like from your browser’s settings.

Remembering your answer

The fifth records your answer to the question we put to you about your recent searches. It holds a single character — whether you said yes or no — for six months, and nothing else: no identifier, no timestamp, nothing that could be joined to you. We keep it because a record that you refused is the only thing that stops us asking again on every page, so it is written whichever way you answer. It is strictly necessary for that purpose and is not itself part of the choice.

Recognising your return from a payment

When you leave our site to pay on the page of certain payment providers — a customer for a booking, or a rental company for an invoice of ours or for a subscription period it pays ahead — we set a cookie for that payment. The cookie’s value is a random string that says nothing about you; its name contains the beginning of our internal number for the payment. The page’s own code cannot read the cookie (it is HttpOnly), and your browser sends it only to the part of our site that receives you when the provider sends you back. It lasts two hours. When you come back, it is how we know that it is you returning from that payment, so that we take you — and not anybody else who holds the order number the provider gave that payment — to your own booking or invoice and, if you cancelled on the provider’s page, can close the unpaid order there at once. Without it, whoever returns from paying for a booking is shown a general page instead of the booking. It is strictly necessary for that purpose and is not part of the choice.

3. Other storage on your device

Your browser also holds your last six searches — region, vehicle type, dates and times, with no name and no email address — so the search form can offer them back to you. We keep them only if you allow us: that is the subject of the question we put to you when you arrive. If you refuse, your recent searches still appear while you are on the site, but they are not stored anywhere — and anything already stored is deleted. They have no expiry and stay until you clear your browser’s site data. Rental-company staff have two small items remembering which navigation groups they left open and whether first-run setup is still outstanding.

During a Google sign-in, two one-time random values are held for the length of the visit to protect the sign-in against cross-site request forgery. They are discarded when you close the tab.

When you add a photograph to a booking on the website using the booking reference, your browser keeps, in that tab, a one-time key for removing it and which booking it belongs to, so that you can remove it within the 15 minutes allowed. Both are discarded when you close the tab, and they are used for nothing else.

When you leave a booking on the website for a payment provider’s page, your browser keeps, in that tab, the booking’s reference and the address of its payment page, so that if you come back to our page before paying you are taken back to your booking and can continue to the payment, rather than starting a second booking. Both are discarded when you close the tab or as soon as the booking is no longer waiting for payment, they are not used after 30 minutes, and they are used for nothing else.

One item is no longer used: an older version of the company portal kept its light or dark setting in the browser. Nothing writes or reads it now, but it is still on the device of anybody who used the portal before this policy was published, and it goes when site data is cleared.

None of these holds a sign-in token.

4. Third parties

When you pay online — a customer for a booking, or a rental company for an invoice of ours or for a subscription period it pays ahead — our site sends your browser to the payment page of the payment provider that takes that payment: for a booking, the rental company’s own provider. It does so with a redirect, or with a form that submits itself, and you enter your card details there. That page is the provider’s, not ours: it may set its own cookies or other storage, for fraud prevention and to make its forms work; we do not control them, and the provider’s own disclosure governs them. No payment provider’s script is loaded on our own pages.

If you choose to continue with Google to sign in, your browser is sent to Google to authenticate, and Google receives your IP address, your browser details and the fact that you are signing in to Rentrium. This is a redirect rather than an embedded script: no Google code runs on our pages, and nothing from Google loads unless you press that button.

5. What we do not use

Rentrium runs no analytics, no tag manager, no advertising pixel, no session recording, no heat-mapping, no A/B testing service and no error-reporting service.

We do not load fonts, scripts, stylesheets or images from any third-party network. Every font and every map tile is served from our own servers, which is a deliberate choice made for exactly this reason.

Apart from the payment provider’s page and the Google sign-in redirect described above, using Rentrium causes your browser to contact no server other than ours. We build no advertising profiles, we sell and share no browsing data, and we do not track you across other websites.

6. What we ask you, and what we do not

Storing something on your device, or reading something already on it, is allowed without asking you only where it is strictly necessary to provide the service you actually asked for. That rule is why everything above is listed and not only the cookies: it applies to any storage on your device, whether or not what is stored is personal data.

The two sign-in cookies are written only when you sign in, because you asked to sign in and we cannot keep you signed in without them. The two preference cookies are written only at the moment you press the language or appearance switch, because by pressing it you asked us to remember exactly that. The record of your answer is written because otherwise we would have to ask again on every page. The payment-return cookie is written only when you leave our site to pay, because without it we could not tell, when you come back, that it is you returning from that payment. None of them is part of the choice we put to you.

Storing your recent searches is not strictly necessary, so we ask. When you first arrive we ask whether we may keep them on your device. Refusing is one click, exactly like accepting; both answers sit side by side, neither is presented as the one we prefer, and nothing on the site is withheld if you refuse. Until you answer, nothing is stored, and if you refuse, anything already stored is deleted.

You can change your mind at any time from the cookie policy link in the footer of every page. Every browser also lets you see the cookies a site has set, delete them and block them; look for “Cookies and site data” under privacy settings.

7. The mobile app

The app does not use cookies. It stores your sign-in token in the operating system’s secure storage — the Android Keystore or the iOS Keychain — along with your language and appearance preferences and your last five searches.

It also keeps a cache on disk of images it has downloaded, and of map tiles where a map is shown. Photographs of vehicle damage, photographs added to a booking and your profile picture are deliberately kept out of that cache.

If you have used “Download my data”, the app wrote that file into its temporary folder in order to hand it to the sharing menu. It holds everything the export holds. The operating system clears that folder from time to time; the app does not delete the file itself.

To add a photograph to a booking, the app prepares a temporary copy of it on your phone, and it deletes that copy once the upload has finished or been abandoned.

Signing out of the app deletes the sign-in token. It does not clear anything else in this list, which goes when you uninstall the app or clear its data from your device’s settings.

8. Changes

If this policy changes we will publish the new version here and update the date at the top. Where a change is significant we will say so on the site.