Privacy Policy

Who we are

Rentdeck is operated by Ahamed Asard Althaf Ahamed, based in Sri Lanka ("Rentdeck", "we", "us", "our"). Rentdeck provides software that vehicle rental operators use to run their businesses. This Privacy Policy explains how we handle personal data when you use our website and application.

We handle personal data in two different roles. For the account details of the operator who signs up for Rentdeck, we act as a data controller. For the personal data that an operator enters about their own customers and drivers (for example, names, National Identity Card details, and driving licence details), we act as a data processor on that operator's behalf; the operator remains the data controller of that data. Section "Data that operators enter about others" below explains this further.

We process personal data in accordance with the Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025 (the "PDPA").

The personal data we collect

Operator account data. When you create and use a Rentdeck account, we collect your name, business name, mobile telephone number, and related account and settings information. We use your telephone number and one-time passcodes to sign you in.

Data that operators enter about others. Operators use Rentdeck to record information about their customers and drivers. This may include names, telephone numbers, National Identity Card numbers and images, driving licence numbers and images, photographs taken at vehicle handover and return, and the location and time at which those photographs were taken. Operators enter this data; we store and process it on the operator's instructions.

Transaction and usage records. We record bookings, deposits, payments, expenses, and similar operational entries that operators create, together with technical information generated when the application is used, such as device and log information.

Location data. Where an operator's workflow requires it, the application records the location at which a vehicle handover or return takes place, for the operator's own record.

Why we process personal data and our lawful basis

We process personal data to provide and operate the service, to authenticate users, to generate the documents and records operators rely on, to provide support, to take payment for the service, to keep the service secure, and to comply with our legal obligations. Depending on the data, our lawful basis is the performance of our contract with the operator, the operator's or the data subject's consent, our legitimate interests in operating and securing the service, or compliance with a legal obligation.

Data that operators enter about others

Where an operator enters personal data about their customers or drivers, that operator is the data controller for that data and is responsible for having a lawful basis to collect and use it, and for informing those individuals as required by the PDPA. Rentdeck acts as a processor and processes that data only to provide the service to the operator and on the operator's instructions. If you are a customer or driver of a rental operator and wish to exercise your rights over your data, please contact that operator, who controls it. We will assist the operator in responding to such requests.

How we store and protect personal data

Personal data is stored using the infrastructure of Cloudflare, Inc. We use encryption in transit, access controls, and audit logging of access to personal data. No method of storage or transmission is completely secure, but we take reasonable measures appropriate to the nature of the data we hold.

International transfer of personal data

Our infrastructure provider, Cloudflare, operates a global network, and personal data may be stored or processed on servers located outside Sri Lanka. Where personal data is transferred outside Sri Lanka, we take steps intended to ensure an appropriate level of protection consistent with the PDPA, including relying on appropriate safeguards, the performance of our contract with you, or your consent, as applicable.

How long we keep personal data

We keep personal data for as long as an operator's account is active and as long as needed to provide the service, and thereafter for any period required to comply with our legal obligations, resolve disputes, and enforce our agreements. Operators may request deletion of data as described below, subject to records we are required to retain.

Sharing personal data

We do not sell personal data. We share personal data only with service providers who help us operate the service, including our infrastructure provider (Cloudflare) and our SMS provider (Text.lk) for sending messages, and where we are required to do so by law. Payment for the service is currently made by direct bank transfer, and we do not collect card details. If we introduce online payment, it will be processed by our payment provider (PayHere), and we will update this policy accordingly.

Your rights

Subject to the PDPA, you have the right to be informed about how your personal data is processed, to access your personal data, to have inaccurate data corrected, to request erasure of your data, to withdraw consent where processing is based on consent, to object to or request restriction of certain processing, and to request a copy of your data in a portable form. To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka.

Children

Rentdeck is a business tool and is not directed at children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the effective date at the top of this page and, where appropriate, notify operators.

Contact us

For any question about this policy or to exercise your rights, contact us at hello@rentdeck.lk or on WhatsApp at +94 71 367 3679.