Privacy policy
How Pick2Rent collects, uses, shares and protects personal data, and how you can exercise your rights under Tunisian law and the GDPR.
Version 2026-10-20.1 · Updated on 23 October 2026
This privacy policy explains how Pick2Rent (“we”, “us”) handles personal data when you visit pick2rent.com (the “Website”), contact us, subscribe to our newsletter, apply to become a partner or use a partner account on our platform (the “Services”). We apply Organic Law n° 2004-63 of 27 July 2004 on the protection of personal data (Tunisia) and, where you are in the European Union or the European Economic Area, the GDPR. This policy does not describe how our partners use the data of their own customers (see section 4).
- 1. Who is responsible for your data
- 2. The data we collect
- 3. Why we use your data and on what basis
- 4. Renters’ data: our role as processor
- 5. Who receives your data
- 6. International transfers
- 7. How long we keep your data
- 8. Your rights
- 9. Security
- 10. Minors
- 11. Cookies
- 12. Changes to this policy
- 13. Contact and complaints
1. Who is responsible for your data
Pick2Rent, based in Tunis, Tunisia, is the controller of the personal data described in sections 2 and 3: the data of Website visitors, people who contact us, newsletter subscribers, partner applicants and the staff of our partners who use a partner account. Full identification details are provided on request. For any question or request about your data, write to hello@pick2rent.com.
We act in two different roles:
- Controller. For the data listed in section 2, we decide why and how it is used.
- Processor. For the data of renters (our partners’ customers) entered through a partner’s account or booking website, the partner decides and we process the data on its behalf (section 4).
2. The data we collect
- Website visitors: technical data such as IP address, browser and device type, date and time of the visit and pages viewed; your language preference; your cookie choice. Analytics and advertising-measurement data are collected only with your consent.
- Contact and support: the name, e-mail address, topic and message you send through the contact form, and, if you choose to give them, your phone number, company and fleet size. The form creates a support ticket. Your IP address is used for anti-abuse rate limiting.
- Newsletter: your e-mail address and the confirmation of your subscription (double opt-in).
- Partner applications: company details, trade register extract, car-rental licence, bank account for payouts, and the identity and contact details of the people applying for the company.
- Partner accounts: details of the staff who use the portal (name, e-mail, role, login and security settings such as two-factor authentication), the audit log of changes made in the account, and your exchanges with our support team.
- Payments and billing: subscription and commission records, invoices, monthly statements, payment, refund, dispute and chargeback references, and bank details for payouts (stored encrypted). Card payments are processed by payment providers; we never store full card numbers.
We collect most of this data directly from you. Some of it, for example the details of a partner’s staff, is given to us by the partner. You are not obliged to give us your data, but we may be unable to reply to you or provide a service without the data needed for it.
3. Why we use your data and on what basis
| Purpose | Legal basis |
|---|---|
| Operate and secure the Website; prevent abuse such as spam and excessive requests (rate limiting) | Legitimate interests |
| Remember your language preference (strictly necessary cookie) | Necessary for the service you request; legitimate interests |
| Answer your messages and requests | Steps taken at your request before a contract; legitimate interests |
| Send our newsletter | Consent |
| Measure audience and the effect of our advertising (Google Analytics, Meta Pixel), where enabled | Consent |
| Review applications, onboard partners, provide the Services and support | Contract, including steps before entering into it |
| Bill subscriptions and commission; handle payouts, refunds and disputes | Contract |
| Keep accounting and tax records; answer authorities | Legal obligation |
| Protect accounts, prevent fraud and keep an audit log; send service messages (confirmations, security and billing notices) | Legitimate interests; contract |
| Establish, exercise or defend legal claims | Legitimate interests |
These bases apply in line with Tunisian law and, where relevant, the GDPR. Where we rely on consent, you can withdraw it at any time. We do not sell personal data, and we do not take decisions about you based solely on automated processing.
4. Renters’ data: our role as processor
Our partners use Pick2Rent to manage their rentals. When a partner, or a renter on the partner’s booking website, enters a renter’s data into the partner’s account, the partner is the controller and Pick2Rent is the processor. We process this data only on the partner’s documented instructions and under the processing clauses of the Partner terms.
Typical renter data includes identity and contact details, driving licence and ID documents (kept in private storage and accessed through signed links), and booking and payment references. We do not use renters’ data for our own purposes and we never sell it. A partner’s vehicles are never shown next to those of competitors: Pick2Rent is not a marketplace.
If you are a renter, the partner’s own privacy information explains how it uses your data, and you should send your requests to the partner. If you write to us, we will forward your request to the partner concerned.
5. Who receives your data
Your data is accessible to the members of our team who need it for their work. We also use service providers that act on our instructions. The main categories are:
| Category | Purpose | Providers |
|---|---|---|
| Cloud hosting | Run the Website and the platform on virtual servers | Our hosting provider (name provided on request) |
| CDN and file storage | Deliver content quickly and store files, including private documents | Bunny.net |
| E-mail delivery | Send transactional e-mails (confirmation links, notifications, account messages) and, where applicable, the newsletter | Brevo |
| Payment providers | Process online card payments, security-deposit holds and payouts for partners | Stripe, PayPal and local gateways such as Konnect, ClicToPay or Paymee, depending on the partner’s configuration |
| Analytics and advertising measurement (only with your consent) | Measure audience and the effect of campaigns | Google (Google Analytics 4, Google Tag Manager) and Meta (Meta Pixel) |
Payment providers act under their own terms and privacy policies and may be independent controllers for some purposes, such as meeting their legal and anti-fraud obligations. We may also share data with professional advisers, auditors, courts and authorities where the law requires it or to protect our rights, and with a successor if our business is transferred, subject to the same level of protection.
6. International transfers
Some of our providers are established, or process data, outside Tunisia (for example in the European Union or the United States). Where the law requires, we make sure that such transfers are covered by appropriate safeguards, such as data processing agreements, standard contractual clauses approved by the European Commission, adequacy decisions or, where applicable, your consent. We also obtain any authorisation required from the Instance Nationale de Protection des Données Personnelles (INPDP), the Tunisian data protection authority. You can ask us for information about these safeguards at hello@pick2rent.com.
7. How long we keep your data
| Data | Retention |
|---|---|
| Technical and anti-abuse data | Only as long as needed for security and operation of the Website. |
| Cookie choice | Stored in your browser until you change it or clear your browser data. |
| Contact messages and support tickets | Up to 2 years after the last exchange. |
| Newsletter subscriptions | Until you unsubscribe. We then keep only what is needed to respect your choice. Subscriptions never confirmed are deleted. |
| Partner applications not accepted | Up to 12 months after our decision. |
| Partner accounts, staff users and audit log | While the account is active. When a subscription ends or is cancelled, the account stays read-only and the partner can export all its data for 30 more days (a zip file of the datasets, prepared in the background and available for 7 days; reminders by e-mail after 20, 27 and 30 days). The company is then archived: the data is kept and nothing is deleted without an explicit request of the partner or a documented decision of our team. We delete or anonymise it on request, except records we must keep. |
| Invoices, commission, payout and other accounting records | 10 years, as required for accounting records under Tunisian law. |
| Renters’ data (as processor) | According to the partner’s instructions. It is returned to the partner through the export of its data (available for 30 days after the end of the subscription) and is deleted or anonymised on the partner’s request or according to its instructions, unless the law requires otherwise. |
| Backups | Overwritten on a regular cycle; deleted data disappears from backups at the end of that cycle. |
We may keep data longer where needed to handle a dispute or comply with a legal obligation, for as long as necessary. After the retention period, we delete or anonymise the data.
8. Your rights
Depending on the law that applies to you, you have the right to:
- access your personal data and obtain a copy;
- have inaccurate or incomplete data corrected;
- have your data erased, where the conditions set by law are met;
- restrict the processing of your data, where applicable;
- object to the processing, in particular for direct marketing;
- withdraw your consent at any time, without affecting what was done before;
- receive the data you provided in a structured, commonly used format (portability), where applicable.
To exercise a right, write to hello@pick2rent.com. We may ask for proof of identity to protect you against fraud. We reply within one month. If your request is complex, we will tell you why we need more time. Exercising your rights is free, unless a request is clearly unfounded or excessive. You can unsubscribe from the newsletter with the link in every e-mail, and change your cookie choice at any time with “Cookie settings” in the footer.
9. Security
We protect personal data with technical and organisational measures that include encrypted connections (TLS), encrypted storage of bank details, role-based access, two-factor authentication (available to partner users), an audit log of changes, backups, and private storage with signed links for documents. Access is limited to people who need it and who are bound by confidentiality. No system is completely secure, but if a breach is likely to affect you, we will inform you and the competent authority as the law requires.
10. Minors
Our Website and Services are intended for businesses and are not directed to people under 18. We do not knowingly collect their personal data. If you believe a minor has given us data, write to us and we will delete it.
11. Cookies
The Website uses a small number of strictly necessary cookies, such as the one that remembers your language. Analytics and marketing cookies are used only after you consent in the cookie banner, and only if we have enabled them. You can change your choice at any time with “Cookie settings” in the footer. See our Cookie policy for the full list.
12. Changes to this policy
We may update this policy, for example when our services or the law change. The page shows the current version and date. If a change significantly affects how we use your data, we will inform you by appropriate means, such as a notice on the Website or an e-mail to partners and subscribers.
13. Contact and complaints
For any question or request about your personal data, write to hello@pick2rent.com or use the contact form. Our support team is available Monday to Friday, 9:00 to 18:00 (Tunis time), and answers within one business day in French, Arabic and English.
If you think we have not respected your rights, you may lodge a complaint with the INPDP in Tunisia or, if you live in the European Union or the European Economic Area, with your local data protection authority. We would appreciate the chance to address your concern first.