Privacy Policy

1. Introduction

Leniqo Limited (“Leniqo”, “we”, “us” or “our”) is committed to protecting the privacy and personal data of all individuals who interact with our platform, website and services.

This Privacy Policy explains how we collect, use, store and share personal data in connection with our deposit-free rental protection platform, in compliance with the General Data Protection Regulation (GDPR) and applicable Irish and European data protection law.

Leniqo acts as an independent data controller for the personal data it processes. For further details on data controller roles, please refer to our Data Processing & Role Definition Statement.

2. Data Controller

The data controller responsible for processing your personal data is:

Leniqo Limited The Black Church, St. Mary's Place Dublin 7, Ireland (D07 P4AX) Company Number: 802949 Email: privacy@leniqo.com

3. Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity data: full name, date of birth, nationality;
• Contact data: email address, phone number, postal address;
• Identification documents: passport, driving licence, national ID (where required for verification);
• Booking and rental data: reservation details, contract numbers, rental dates, vehicle information;
• Financial data: deposit amounts, payment references, excess claim amounts;
• Trust and risk assessment data: behavioural scores, risk indicators, fraud signals;
• Technical data: IP address, browser type, device information, cookies and usage data;
• Communication data: correspondence with our support team, feedback and survey responses.

4. How We Use Your Data

We process personal data for the following purposes:

• Providing and administering the Leniqo platform and deposit-free rental services;
• Conducting trust, risk and behavioural assessments;
• Processing and managing excess claims and dispute resolution;
• Fraud prevention, detection and investigation;
• Recovery of outstanding amounts;
• Communicating with you about your bookings, claims or account;
• Complying with legal, regulatory and tax obligations;
• Improving our platform, services and user experience;
• Sending service-related notifications and updates.

5. Legal Basis for Processing

We rely on the following legal bases under Article 6 GDPR:

• Contract performance: processing necessary to fulfil our contractual obligations to you or our partners;
• Legitimate interests: fraud prevention, risk assessment, platform security and improvement of our services;
• Legal obligation: compliance with applicable laws, regulations and court orders;
• Consent: where you have given explicit consent for specific processing activities (e.g. marketing communications).

6. Data Sharing

We may share personal data with the following categories of recipients:

• Rental partners: to facilitate deposit-free bookings and excess claim resolution;
• Service providers: hosting, payment processing, communication and analytics providers acting as data processors under written agreements;
• Legal and compliance bodies: courts, regulators, law enforcement where legally required;
• Professional advisors: auditors, legal counsel and insurance providers where necessary.

We never sell personal data to third parties for marketing purposes.

7. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses or equivalent mechanisms approved by the European Commission.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Active bookings and claims: for the duration of the service relationship plus any applicable limitation periods;
• Financial and tax records: up to 7 years as required by Irish and European tax law;
• Trust and risk data: retained in accordance with our legitimate interest in fraud prevention, subject to periodic review;
• Marketing consent records: until consent is withdrawn.

After the applicable retention period, personal data is securely deleted or anonymised.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you;
• Right to rectification: request correction of inaccurate or incomplete data;
• Right to erasure: request deletion of your data where there is no compelling reason for continued processing;
• Right to restriction: request that we limit the processing of your data in certain circumstances;
• Right to data portability: receive your data in a structured, machine-readable format;
• Right to object: object to processing based on legitimate interests or for direct marketing;
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at privacy@leniqo.com. We will respond within 30 days.

10. Automated Decision-Making

Leniqo uses automated processing, including trust and risk scoring, to assess rental suitability and fraud risk. These assessments are based on objective data points and are subject to human review where they produce significant effects on individuals.

You have the right to request human intervention, express your point of view and contest any automated decision that significantly affects you.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. For further details, please refer to our Security page.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through our website or by email where appropriate. The latest version is always available at leniqo.com/privacy-policy.

13. Contact & Complaints

If you have questions about this Privacy Policy or wish to exercise your rights, please contact:

Leniqo Limited, Data Protection Email: privacy@leniqo.com

You also have the right to lodge a complaint with the Data Protection Commission (DPC), the Irish supervisory authority, at www.dataprotection.ie.