Privacy Policy

Ottuma ApS ("Ottuma," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our peer-to-peer rental platform (the "Platform").

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Danish data protection laws.

Ottuma ApS is the data controller responsible for your personal data. For questions about this policy or your data, contact us at privacy@ottuma.dk.

3.1 Information You Provide

• Account Information: Name, email address, phone number, and profile photo when you register.
• Verification Information: Government-issued ID and verification documents for identity verification.
• Listing Information: Equipment descriptions, photos, pricing, and availability when you list items for rent.
• Communication Data: Messages sent through our integrated messaging system.
• Payment Information: Payment method details processed securely through Stripe. We do not store full credit card numbers.

3.2 Information Collected Automatically

• Usage Data: Pages visited, listings viewed, search queries, and interactions with the Platform.
• Device Information: IP address, browser type, operating system, and device identifiers.
• Location Data: Approximate location derived from your IP address and, with your permission, precise location to show nearby listings.
• Cookies and Similar Technologies: See Section 8 for details.

We use your personal data for the following purposes:

• Platform Operation: To provide, maintain, and improve the Platform, including facilitating bookings, processing payments, and enabling communication between users.
• Identity Verification: To verify user identities and maintain platform safety.
• Communications: To send booking confirmations, rental reminders, support messages, and important account notifications.
• Marketing: With your consent, to send promotional communications about Ottuma. You may opt out at any time.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Analytics: To analyze usage patterns and improve the Platform experience.

Under GDPR, we process your personal data on the following legal bases:

• Contract Performance: Processing necessary to provide the Platform services you request.
• Legitimate Interests: Processing for platform security, fraud prevention, and service improvement, where such interests are not overridden by your rights.
• Consent: Processing based on your explicit consent, such as for marketing communications or precise location data.
• Legal Obligation: Processing required to comply with applicable laws.

We share your information only in the following circumstances:

• Between Users: When you book a rental, we share relevant information (name, contact details) between the Owner and Renter to facilitate the transaction.
• Service Providers: With third-party providers who help us operate the Platform, including Stripe (payment processing), Neon (database hosting), and Cloudflare (infrastructure). These providers are contractually bound to protect your data.
• Legal Requirements: When required by law, court order, or governmental authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

We do not sell your personal data to third parties.

We retain your personal data only as long as necessary to fulfill the purposes described in this policy:

• Account data is retained while your account is active and for up to 5 years after account closure to comply with legal obligations.
• Transaction and booking records are retained for 5 years per Danish accounting requirements.
• Messages are retained for 2 years after the last message in a conversation.
• Verification documents are retained for 3 years after account closure.

We use essential cookies required for Platform operation (session management, authentication, security). With your consent, we may also use analytics cookies to understand how users interact with the Platform.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality.

Under GDPR, you have the following rights:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Restriction: Request limitation of processing under certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw previously given consent at any time.

To exercise these rights, contact us at privacy@ottuma.dk. We will respond within 30 days. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), encryption at rest, access controls, and regular security assessments. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

Your data may be processed in countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or reliance on adequacy decisions.

The Platform integrates with third-party services, including Stripe for payment processing. These services have their own privacy policies governing the use of your data. We encourage you to review Stripe's privacy policy at stripe.com/privacy.

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Platform. The updated policy will be effective upon posting.

For privacy-related inquiries, contact us at:

Ottuma ApS
Email: privacy@ottuma.dk