Effective Date
This Data Processing Statement is effective as of July 7, 2026.
It supplements the Rental Flow Privacy Policy and describes how Rental Flow Inc. (“we”, “us”, “our”) processes personal data as a data processor on behalf of its customers in connection with the Rental Flow platform (“Service”).
Roles and Responsibilities
For the purposes of applicable data protection laws including the General Data Protection Regulation (GDPR) and the Personal Information Protection and Electronic Documents Act (PIPEDA):
You (the Rental Flow customer / tenant) are the “Data Controller” — you determine the purposes and means of processing personal data entered into the platform.
Rental Flow Inc. is the “Data Processor” — we process personal data on your behalf, in accordance with your instructions, solely to provide and operate the Service.
Data We Process on Your Behalf
As a data processor, we process the following categories of personal data that you enter into the platform:
End-User Account Data
Names, email addresses, roles, and authentication data for users you invite to your Rental Flow tenant account.
Customer Contact Data
Company names, contact names, email addresses, phone numbers, and billing addresses for customers you enter into the platform for rental management purposes.
Rental Transaction Data
Rental order details, equipment assignments, site addresses, purchase order numbers, invoice data, and payment status information.
Inspection and Equipment Data
Equipment specifications, maintenance records, inspection reports, and photos uploaded during inspections.
Purposes of Processing
We process your personal data only for the following purposes, as instructed by you:
Providing, operating, and maintaining the Rental Flow platform.
Syncing data to your connected QuickBooks Online account when you initiate sync operations.
Sending invoices, statements, contracts, and notifications on your behalf.
Providing customer support and troubleshooting.
Ensuring platform security, fraud prevention, and compliance with legal obligations.
Legal Basis for Processing (GDPR)
Under the GDPR, our processing of personal data as a data processor is based on:
Article 6(1)(b) — Processing necessary for the performance of a contract (providing the Service you have subscribed to).
Article 6(1)(c) — Processing necessary for compliance with legal obligations.
Article 6(1)(f) — Processing necessary for the legitimate interests of operating a secure and functional platform, subject to your rights.
Article 28 — Processing conducted under a data processing agreement between the Data Controller and Data Processor.
Data Subject Rights
As a Data Controller, you are responsible for responding to data subject rights requests from individuals whose data you have entered into the platform. We will assist you in fulfilling these requests where reasonably possible.
Data subjects may have the following rights under the GDPR:
Right of Access
The right to obtain confirmation that personal data is being processed and a copy of that data.
Right to Rectification
The right to have inaccurate personal data corrected.
Right to Erasure (“Right to be Forgotten”)
The right to have personal data deleted, subject to legal retention requirements.
Right to Restrict Processing
The right to request that processing be limited under certain circumstances.
Right to Data Portability
The right to receive personal data in a structured, machine-readable format.
Right to Object
The right to object to processing based on legitimate interests or for direct marketing.
Subprocessors
Rental Flow engages the following categories of subprocessors to deliver the Service. Each subprocessor is bound by written agreements that provide at least the same level of data protection as described in this statement:
Cloud Infrastructure Provider
Hosts the application servers, databases, and file storage. Data is stored in encrypted volumes within secure data centers.
QuickBooks Online (Intuit)
Receives invoice and customer data when you initiate a QuickBooks sync. Processing is governed by your direct relationship with Intuit.
DocuSign
Receives contract document data when you send a contract for electronic signature. Processing is governed by your direct relationship with DocuSign.
Email Delivery Provider
Transmits emails (invoices, statements, notifications) on your behalf. Email content is processed for delivery purposes only.
International Data Transfers
Your data may be processed and stored on servers located in countries other than your own, including Canada and the United States. Where personal data is transferred outside of the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or other legally recognized transfer mechanisms.
We work with our subprocessors to ensure that international transfers comply with applicable data protection laws.
Data Retention and Deletion
We retain personal data for as long as your account is active or as needed to provide the Service. Upon account termination, we will delete your data within a reasonable period, subject to legal retention requirements and any data export you may request.
QuickBooks and DocuSign OAuth tokens are purged immediately upon disconnection of the respective integration.
Security Measures
We implement appropriate technical and organizational measures to protect personal data, including encryption in transit and at rest, role-based access control, tenant data isolation, secure credential storage, and continuous security monitoring.
For full details, please refer to our Security page.
Data Breach Notification
In the event of a personal data breach affecting your data, we will notify you without undue delay and provide relevant information about the breach, the measures taken, and any steps you may need to take.
We maintain incident response procedures to detect, contain, and remediate data breaches in accordance with GDPR Article 33 and other applicable breach notification requirements.
Contact
For questions about this Data Processing Statement or to exercise data subject rights, please contact:
Rental Flow Inc.
Email: privacy@rentalflow.ca