Skip to content Skip to footer

Launching a car rental business from scratch may sound like a huge challenge, especially if you’ve never managed a fleet before or worked in the transport industry. The idea of buying vehicles, dealing with insurance, building a customer base, and handling the day-to-day operations can seem overwhelming. But, with the right planning, smart use of technology, and a clear understanding of your market, it can be not only achievable but highly profitable.

Car rental is one of those businesses that re-invents itself time and time again in response to change. It’s weathered recessions, embraced new technologies, and adapted to shifting customer attitudes — and each time, it’s come out transformed. If you’re new to the business today, that’s a great advantage: you’re free to start with new vehicles, new business models, and new customers’ expectations already in focus.

Success comes from combining a clear strategy with a realistic, step-by-step plan you can actually follow. Forget generic “work hard and never give up” slogans — here we’re talking about specific actions that can move your business forward from day one. The most successful rental companies are those that base decisions on data, market insight, and constant adaptation.

In this guide, we’ll go through each stage of building a rental business — from choosing the right business model to launching and growing your operations. You’ll learn how to steer clear of the common mistakes that eat into profits, how to build a brand people trust, and how to make smart investments that keep paying off. This isn’t a dry, theory-heavy piece — it’s a practical roadmap built on real-world results from businesses that are thriving right now.

Is a car rental business still profitable in 2025?

In short: yes — but only if you approach it the right way. The car rental industry will be worth more than $100 billion by 2025 as business and leisure travel recover and car subscription and peer-to-peer rental take off in popularity.

Technology has completely changed the game. Mobile booking apps, contactless pick-up and drop-off, and automated ID verification are no longer optional extras — they’re the norm. Customers now expect to book a car as easily as ordering food or calling a taxi. If you can’t provide that seamless experience, they’ll simply choose a competitor who can.

The market is also diversifying. On one side, big corporate brands dominate with large fleets and established processes. On the other, smaller niche players are carving out highly profitable segments — from luxury rentals in tourist cities to fully electric fleets in eco-conscious markets.

Take Lisbon, for example. A small company there built its entire fleet from electric vehicles. At first, they targeted tourists who wanted to drive sustainably, but soon discovered that almost half their customers were locals curious about EVs before committing to buy one. By partnering with dealerships, those short test drives turned into long-term rentals — and a steady, dependable stream of income.

In Dubai, the story is completely different. Here, high-end exotic cars like Lamborghinis and Ferraris are in constant demand, with rental prices sometimes exceeding $1,000 a day. While these vehicles require significant investment and maintenance, the margins are enormous if managed properly.

But not every business gets it right. In Los Angeles, a traditional rental company ignored the shift to mobile-first bookings. Most of their business came from walk-ins and phone calls. As competitors moved online, their customer base shrank rapidly. It took them a costly rebranding and tech overhaul to catch up. The lesson is clear: adaptability is not optional — it’s survival.

Another significant reason why the car rental industry is attractive in 2025 is the increase in electric mobility infrastructure. Most European, Asian, and North American cities are quickly deploying EV charging stations so that rental firms could easily manage their electric fleet operations. Indeed, in certain regions — namely parts of Norway or the Netherlands — governments will pay for 30–50% of the purchase of electric vehicles for business use. Buying cars costs less, and it also makes the company look eco-friendly — something many travelers care about.

Customers are also starting to expect a lot more flexibility. Increasing numbers of travelers blend business and travel — the “digital nomads” — and they need car rental services that will match their shifting itineraries. This has spawned multi-week rental options that allow customers to interchange vehicles mid-rental, extend with no penalty, or exchange vehicles based on travel arrangements. Companies that provide this sort of flexibility tend to garner higher retention and favorable word-of-mouth.

From the technology perspective, dynamic pricing and automatic fleet maintenance reminders through artificial intelligence are beginning to become part of the industry. Previously reserved for big business, however, many current rental software programs make them available within the reach of mid-sized and small operations. These companies often run with smaller teams yet still deliver faster service.

Step 1 — Define your business model

Your business model will determine all other decisions you will make — from purchasing vehicles to obtaining customers.

The traditional model involves owning or leasing your vehicles, determining your own policies on rental, and handling customer relationships yourself. You get to call the shots on quality, branding, and pricing — but it comes with a hefty upfront cost, ongoing maintenance bills, and a bigger role in the day-to-day running of the business. If you possess capital and want to create a solid and identifiable brand name, then this is an ideal option.

The peer-to-peer (P2P) model is leaner on capital. You bring car owners and renters together and take a commission on each deal. Since you don’t possess the vehicles yourself, you have lower costs but also more limited quality and availability control. This option is favorite among newcomer entrepreneurs wanting to try things out before purchasing their own fleet.

The subscription or corporate model focuses on long-term rentals — months instead of days. Customers pay a recurring fee for continuous access to a car. Businesses like it because the costs are predictable, and they avoid the stress of managing their own fleet. The hard part is landing the deals — it takes strong relationships and careful contract management. The tricky part is making the sales — you’ll need to build solid relationships and stay on top of contracts.

Others employ a hybrid method. One operator in Melbourne began with five vehicles of their own and supplemented them with vehicles provided by private owners. They provided the insurance and maintenance and took bookings for commission. That way, they expanded fast but also retained control over quality of service.

As you select your model, consider where you see yourself in the future. Will you be operating a small locally-based business with a loyal following of customers, or will you be growing into several cities? What you decide will guide everything from the size of your fleet to your tech budget and marketing strategy.

Step 2 — Do market research

Market research is your compass. Without it, you risk investing in the wrong vehicles, choosing the wrong location, or setting prices that don’t match demand.

Start with your competitors. Browse their websites, talk to them directly, or try renting a car to experience their service for yourself. Look at their reviews — patterns of complaints often point to opportunities. If customers constantly complain about hidden fees, you can stand out by offering transparent pricing.

Next, take time to understand your customers. Tourists often care about convenience: easy booking, airport delivery, and flexible return times. Locals might rent for weekend trips, moving, or while their own car is in repair. Corporate clients usually want premium vehicles, flexible contracts, and invoicing options.

The right location can be the difference between your business thriving or struggling. Airports bring steady traffic but can involve high fees or exclusivity contracts. City centers draw in a steady mix of locals and tourists. Suburban areas can work if you offer delivery.

Real-world example: In Santorini, one rental company charges 15% more than competitors yet stays fully booked all summer. Their secret? Free hotel delivery, almost-new cars, and a no-hidden-fees policy. In Chicago, another company doubled weekend bookings by offering “road trip” packages with unlimited mileage and suggested itineraries.

Don’t guess — use data. Google Trends can show seasonal interest in car rentals in your area. Tools like SEMrush can reveal which competitors get the most online traffic. The more you know, the fewer costly mistakes you’ll make.

Step 3 — Write a business plan

Your business plan is more than a formality — it’s your blueprint. It should cover your mission, target audience, fleet strategy, pricing model, marketing, and financial projections.

Break down startup costs in detail: vehicle acquisition, insurance, licenses, office or lot rental, marketing, salaries, and tech tools. Then estimate monthly operating expenses. Knowing your break-even point will help you price effectively and set realistic goals.

Plan for multiple scenarios. A best-case plan might assume rapid growth; a worst-case plan accounts for slower adoption or seasonal drops. If your realistic plan still shows profit, you’re on the right track.

A simple SWOT analysis — strengths, weaknesses, opportunities, threats — can highlight areas to watch. For example, your strength might be a unique luxury fleet, but your weakness could be low brand recognition.

Step 4 — Register and license your business

This step is more than simple paperwork — it’s what makes your business legally real and gives your brand its identity. The legal structure you choose will determine how you pay taxes, what liability protection you have, and even how attractive you are to investors or partners.

Licensing overview in popular markets:

  • United States: Most small rental businesses choose an LLC (Limited Liability Company) for liability protection and simpler taxes. A business license is required, and some states require a specific “Vehicle Rental License.” Check local DMV and state regulations.
  • United Kingdom: Register as a Limited Company (Ltd) with Companies House, obtain a Standard National Operator’s Licence if renting larger vehicles, and ensure vehicles meet MOT and insurance standards.
  • Germany: The standard form is GmbH (Gesellschaft mit beschränkter Haftung). You must register with the local trade office (Gewerbeamt) and may need a passenger transport licence (Personenbeförderungsschein) for chauffeur services.
  • Other EU countries: Many require VAT registration and adherence to local roadworthiness inspections.
  • International operations: If you plan to work across countries, check bilateral agreements and local transport ministry rules.

In the US, most small rental businesses opt for an LLC (Limited Liability Company) because it provides liability protection while keeping tax filing relatively simple. In the UK, the equivalent would be a Limited Company (Ltd), and in Germany, the standard choice is a GmbH. Every setup has its own rules and price tag, so it’s wise to get advice from an accountant or lawyer before you choose.

Registration does more than make your business official — it also establishes your brand’s identity. The name you choose should be easy to remember, relevant to your market, and available both as a web domain and on social media platforms. Securing these early is essential; you don’t want to find your perfect name is already taken once you start advertising.

Some regions require special permits to operate a car rental business, especially if you plan to rent out certain vehicle types (luxury, commercial, or electric). You might also need zoning approval if you’ll be storing your fleet on-site. And don’t forget — if you plan to operate in multiple cities or states, you may need to register in each one.

Example: A startup in Barcelona registered their company as an SL and also trademarked their brand name and logo. It protected them legally and established their image so hotels and travel agencies felt more at ease working with them as an established name that could be trusted.

Step 5 — Understand legal and insurance requirements

The car rental business is high-risk by nature. You’re handing over expensive assets to strangers, and even with careful screening, accidents happen. That’s why understanding your legal and insurance obligations is non-negotiable.

Most countries set a minimum renter age (often 21–25) and require a valid driver’s license. If you serve international travelers, you may also need to check for an International Driving Permit (IDP). Security deposits — usually via credit card — are standard to cover potential damages or unpaid fees.

From an insurance standpoint, there are four core coverages you’ll need:

  • Liability insurance — covers damage to other people or property.
  • Collision coverage — covers damage to your own vehicles.
  • Personal accident coverage — covers injuries to the driver and passengers.
  • Roadside assistance — keeps your vehicles moving and customers satisfied.

Every policy must be individually created for business rental use – you will not be able to insure business rentals privately. There are certain specialty fleet policies provided by certain insurance companies that come equipped with theft tracking via GPS and also low premiums on vehicles equipped with advanced safety features.

Case study: A Miami rental company reduced disputes dramatically by photographing every vehicle before and after rental. They linked these photos directly to the digital contract, so if a customer claimed damage was pre-existing, they could prove otherwise instantly. This simple process saved them thousands annually in repair disputes.

Step 6 — Acquire your fleet

Your fleet is both your biggest asset and the main reason customers choose you. The cars you choose send a message about your brand — budget-friendly, eco-conscious, adventurous, or luxury.

Popular rental models by category (2025 trends):

  • Economy: Toyota Corolla, Hyundai Elantra, Ford Focus.
  • SUV / Crossover: Toyota RAV4, Hyundai Tucson, BMW X5.
  • Luxury sedans: Mercedes-Benz S-Class, BMW 7 Series, Audi A8.
  • Sports / Exotic: Porsche 911, Lamborghini Huracán, Ferrari F8 Tributo.
  • Electric: Tesla Model 3, Polestar 2, BMW iX, Hyundai Ioniq 5.
  • Utility / 4×4: Toyota Hilux, Ford Ranger, Jeep Wrangler.

When deciding, think about:

  • Customer profile — who you’re targeting and what they value.
  • Location — urban vs rural, tourist hotspot vs corporate hub.
  • Seasonality — if your location has high and low seasons, tailor your fleet accordingly.

Acquisition options:

  • Buying outright — higher initial cost, but you own the asset and can sell later.
  • Leasing — predictable monthly payments, often with maintenance included.
  • Long-term rental — minimal commitment, but more expensive per month.

Example: In Monaco, a luxury-focused company keeps a fleet of Ferraris, Lamborghinis, and Rolls-Royces. In contrast, a budget-friendly rental in rural Canada focuses on 4x4s and pickups, which are in constant demand for outdoor activities and rough terrain.

Pro tip: Start small — three to ten vehicles — and use booking data to see which models perform best. Scaling too fast can lead to unused cars eating up your profits.

Step 7 — Choose the right car rental software

In 2025, the backbone of a rental company is software. It looks after your bookings, keeps your vehicles organized, handles contracts automatically, processes payments, and shows you the numbers you need to make confident decisions.

Look for a cloud-based system that will operate smoothly on desktop and on phone. Multi-language support is necessary if you have foreign customers. Compatibility with payment options like Stripe or PayPal permits smooth checkouts, while features like automatic reminders, damage documentation, and scheduling of work save time and reduce errors.

Example: A mid-size rental business in Berlin implemented TopRent.app and reduced their manual admin hours by 60%. Automated confirmations of bookings and contracts along with an integrated inspection checklist gave staff more time to attend to customer care and not paperwork.

Step 8 — Set up operations

Operations are where strategy meets reality. Whether you have a physical office or operate entirely online, your processes should be clear, consistent, and easy for both customers and staff to follow.

Define how you’ll handle pick-up and return inspections, fuel and mileage policies, and cleaning. Decide your policy for late returns — will you charge per hour, per day, or offer a grace period?

Sometimes it’s the smallest touches that leave the biggest mark. Some firms provide a free water bottle and map of the city in every car. Others provide USB charging points or child seats free of charge. Small extras like these can turn first-time customers into loyal regulars.

Delivery services are another differentiator. Offering to drop off and pick up vehicles at hotels, airports, or customer homes can open you up to new market segments and justify higher rates.

Step 9 — Create a marketing plan

Marketing is not a one-time effort — it’s a constant process of attracting and retaining customers.

Online, your website should be optimized for local SEO so people searching “car rental [your city]” find you easily. Google Ads targeting airport arrivals can be highly effective. Social media, especially Instagram and TikTok, is ideal for showcasing your cars in action — scenic drives, happy customers, and behind-the-scenes content all perform well.

Offline, partnerships can be gold. Hotels, travel agencies, event planners, and tour operators can be long-term partners who regularly send business your way. In return, you might offer them a commission or exclusive discount codes for their guests.

Example: A Bali rental posts daily Instagram stories of customers driving along stunning coastal roads. This constant visibility keeps them top-of-mind for anyone planning a trip.

Step 10 — Launch and grow

When you’re ready to launch, consider a soft opening. This lets you test your systems on a small base of customers, sort out bugs and glitches and get feedback before going full tilt. Offering early-bird discounts or free extras can help attract those first crucial bookings.

As you grow, track variables like car usage rate, revenue per car, and repeat book rate. These will guide your next action — maybe it’s growing your fleet size, experimenting with new marketing programmes, or making your service more memorable for your customers.

Growth doesn’t have to mean just more cars. You could expand into new locations, add specialized vehicles (like camper vans or luxury sports cars), or offer new services like chauffeur-driven rentals or corporate fleet packages.

Common challenges and how to avoid them

Every hiring business has issues. Robbery and damage are two of the greatest perils, but the use of GPS tracking, secure storage, and proper inspections can minimize them considerably. False bookings are another issue; the adoption of real-time identity verification and safe payment options is necessary.

Seasonality can be tricky — in low-demand months, consider pivoting part of your fleet to long-term rentals for locals, delivery services, or ride-hailing drivers.

Pricing mistakes can quietly erode profits. Monitor competitors regularly and adjust your rates dynamically based on demand and season.

Beyond theft, damage, and fraud, another challenge is fleet underutilization — when too many cars sit idle for long periods. This can be due to poor demand forecasting, an unbalanced fleet mix, or weak marketing during low seasons. To combat this, some rental companies form short-term partnerships with ride-hailing drivers, delivery couriers, or even film production companies that need vehicles for shoots. These short-term arrangements ensure your vehicles stay on the road — and revenue in the books — even in slower business times.

Another oft-overlooked problem is employee training. Poorly trained employees will create backlogs in the rental process, misuse customer disputes, or overlook necessary inspection information. Money spent on regular training programs will increase efficiency as well as satisfaction on the part of the customers. A properly trained staff will upsell insurance products, provide premium upgrades, and resolve issues on the spot — all of which boost profitability.

Regulatory changes can also catch new operators off guard. For instance, some cities are introducing low-emission zones or congestion charges that affect where certain vehicles can operate. Staying updated on local legislation and adjusting your fleet or pricing accordingly is essential to avoid unexpected fines or operational limitations.

Today, a good reputation isn’t just nice to have — it’s a must for success. One negative review on Google or TripAdvisor can influence dozens of potential customers. Actively monitoring feedback, responding to complaints promptly, and using positive reviews in your marketing can turn reputation into a competitive advantage.

Final thoughts — is this business right for you?

Car rental operations hardly come close to being a passive business. It involves operational discipline as well as customer focus and quick adaptability. But it becomes profitable and fulfilling business for those entrepreneurs who enjoy building systems, exploiting technology, and delivering very good experiences.

If you’re considering this path, remember that the most successful rental businesses in 2025 are not necessarily the largest fleets or the ones with the lowest prices — they are the ones that understand their market deeply and deliver an experience customers remember for the right reasons. That might mean offering pristine vehicles and luxury extras, or it could mean providing budget-friendly cars with unbeatable convenience.

The business thrives where you can adapt quickly and be nimble. You begin with a few vehicles in one spot and a couple of years later you have operations in a series of cities or you have a profitable niche market such as luxury vehicles, electric vehicles, or campervans designed for adventurers. Scalable as it is, the rental model allows you to increase your fleet and offerings as you build your customers and back each move with tangible data from the real world.

In the end, every time you talk to a customer, think of it as a chance to start a relationship that lasts. A single satisfied renter can return multiple times, refer friends, and leave reviews that attract dozens of new customers. In the competitive 2025 market, loyalty is worth as much as new acquisition — sometimes more.

If you’re ready to take the next step, explore TopRent.app — a cloud-based platform that helps you manage your fleet, automate tasks, and grow with confidence.

Visit www.toprentapp.com to get started today.

TopRentApp
Privacy Overview

We care about your privacy

1. PRIVACY POLICY

INFORMATION FOR THE PROCESSING OF PERSONAL DATA
(Articles 13 and following of European Regulation 679/2016)

Dear data subject,

Oxygen S.R.L. is a company specialized in the field of Information Technology.

With this document (hereinafter referred to as the “Privacy Policy”), we aim to renew our commitment to ensuring that the processing of personal data collected through this website (hereinafter referred to as the “Website”), carried out in any manner, whether automated or manual, is fully compliant with the safeguards and rights recognized by Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR” or “Regulation”) and other applicable regulations regarding the protection of personal data.

The term “personal data” refers to the definition contained in Article 4, point 1) of the Regulation, which states that “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (hereinafter referred to as “Personal Data”).

The Regulation requires that, before proceeding with the processing of Personal Data – understood as any operation or set of operations performed with or without the use of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction – it is necessary for the person to whom such Personal Data belongs to be informed about the reasons why such data is required and how it will be used.

In this regard, this Privacy Policy – prepared based on the principle of transparency and all the elements required by Articles 13 and following of the Regulation – aims to provide you, in a simple and intuitive manner, with all the useful and necessary information so that you can provide your Personal Data knowingly and informed, and at any time, request clarification and/or rectification.

A. DATA CONTROLLER

The company that will process your Personal Data for the main purpose described in Section B of this Privacy Policy and will therefore act as the data controller, as defined in Article 4, point 7) of the Regulation, which states that the data controller is “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data” is:

– Oxygen S.R.L. (hereinafter referred to as the “Data Controller”), with registered office at Via Bellosguardo, 12, VAT number 16000861001, 00134 – Rome (RM) (hereinafter referred to as the “Registered Office”).

B. PURPOSES

Your personal data is collected and processed by the Data Controller for purposes strictly related to the use of the Website and its informational services. Additionally, your personal data may also be used in various processing operations (such as storage, archiving, processing, etc.) that are compatible with these purposes. In particular, your personal data may be processed for the following purposes:

a) To respond to inquiries;
b) To enable the provision of services requested by you;
c) To comply with legal obligations;
d) To send promotional and direct marketing communications, including newsletters and market research.

The legal basis for the processing of personal data for the purposes described in points a), b), and c) is Article 6(1)(b) and (c) of the GDPR, as the processing is necessary to respond to the data subject’s requests, provide the requested services, and fulfill a legal obligation of the Data Controller. The provision of personal data for these purposes is optional, but failure to provide such data may result in the inability to activate the services provided by the website or respond to requests.

The legal basis for the processing of personal data for the purpose described in point d) is Article 6(1)(f) of the GDPR. The Data Controller may carry out this activity based on its legitimate interests, regardless of your consent, and until your objection or limitation (as provided in Section G, point d) of this Privacy Policy) to such processing, as further explained in Consideration 47 of the Regulation, which considers it a legitimate interest to process personal data for direct marketing purposes. This will also be possible based on the assessments made by the Data Controller regarding the potential prevalence of your interests, rights, and fundamental freedoms requiring the protection of personal data over its legitimate interest in sending direct marketing communications.

Contact methods for direct marketing activities may be both automated and traditional. However, as better specified in Section G, you will have the option to withdraw your consent, even partially, for example by consenting only to traditional contact methods.

Regarding contact methods involving the use of your phone contacts, please note that the Data Controller’s direct marketing activities will be carried out after verifying your possible registration with the Register of Oppositions, as established under the provisions of Legislative Decree September 7, 2010, No. 178 and subsequent amendments.

The personal data required for the above-mentioned purposes will be those indicated in the contact form, including but not limited to: name, surname, email address, and phone numbers.

C. RECIPIENTS TO WHOM YOUR PERSONAL DATA MAY BE DISCLOSED

Your personal data may be disclosed to specific recipients who are considered to be recipients of such personal data.
Indeed, Article 4, point 9) of the Regulation defines the recipient of personal data as “a natural or legal person, public authority, agency, or another body to whom the personal data are disclosed, whether a third party or not” (hereinafter referred to as the “Recipients”).
In order to correctly carry out all the processing activities necessary to achieve the purposes described in this Privacy Policy, the following Recipients may be involved in the processing of your personal data:

  • Third parties who carry out part of the processing activities and/or activities connected and instrumental to the same on behalf of the Data Controller. These parties have been appointed as data processors, which, according to Article 4, point 8) of the Regulation, means “a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller” (hereinafter referred to as the “Data Processor”).
  • Individual persons, employees, and/or collaborators of the Data Controller, who have been entrusted with specific and/or multiple processing activities related to your personal data. These individuals have been given specific instructions regarding the security and proper use of personal data and are defined, in accordance with Article 4, point 10) of the Regulation, as “persons authorized to process personal data under the direct authority of the Data Controller or the Data Processor” (hereinafter referred to as the “Authorized Persons”).

If required by law or to prevent or suppress the commission of a crime, your personal data may be communicated to public entities or the judicial authority without being considered Recipients. In fact, according to Article 4, point 9) of the Regulation, “public authorities that may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be considered recipients”.

D. DATA RETENTION PERIOD

One of the principles applicable to the processing of your personal data concerns the limitation of the retention period, as regulated in Article 5(1)(e) of the Regulation, which states that “personal data shall be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1), subject to the implementation of appropriate technical and organizational measures required by this Regulation to safeguard the rights and freedoms of the data subject.”

In light of this principle, your personal data will be processed by the Data Controller only for the time necessary to achieve the purposes described in Section B of this Privacy Policy.

In particular, regarding the purposes described in Section B points a), b), and c), your personal data, subject to legal obligations, will be processed for a period of time equal to the minimum necessary, as indicated in Consideration 39 of the Regulation, which is 3 months from the contact request.

Regarding the processing carried out for the purpose described in Section B point d) of this Privacy Policy, the Data Controller may lawfully process your personal data for one year.

E. WITHDRAWAL OF CONSENT

As provided by the Regulation, if you have given your consent to the processing of your personal data for one or more purposes for which it was requested, you may revoke it in whole or in part at any time without affecting the lawfulness of the processing based on consent before its withdrawal.

The methods for revoking consent are very simple and intuitive. You just need to contact the Data Controller using the contact channels provided in this Privacy Policy, specifically in Section G point g).

G. RIGHTS

As provided in Article 15 of the Regulation, you have the right to access your personal data, request its rectification and updating if incomplete or inaccurate, request its erasure if the collection was made in violation of a law or regulation, as well as object to the processing for legitimate and specific reasons.

In particular, we hereby inform you of all your rights that you may exercise at any time against the Data Controller.

a. Right of access

You have the right, in accordance with Article 15(1) of the Regulation, to obtain from the Data Controller confirmation of whether or not your personal data is being processed and, if so, access to such personal data and the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom your personal data has been or will be disclosed, particularly recipients in third countries or international organizations; d) where possible, the envisaged retention period for the personal data or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the Data Controller rectification or erasure of personal data or restriction of processing concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You can find all this information within this Privacy Policy, which will always be available to you in the Privacy section of the Website.

b. Right to rectification

You can obtain, in accordance with Article 16 of the Regulation, the rectification of your personal data that is inaccurate. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

c. Right to Erasure

You have the right, in accordance with Article 17(1) of the Regulation, to obtain the erasure of your personal data without undue delay, and the Data Controller shall have the obligation to erase your personal data if one of the following reasons applies: a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; b) you have withdrawn your consent on which the processing is based, and there is no other legal ground for the processing; c) you have objected to the processing pursuant to Article 21(1) or (2) of the Regulation, and there are no overriding legitimate grounds for the processing; d) the personal data have been unlawfully processed; e) the erasure of personal data is required to comply with a legal obligation under EU or Member State law.

In some cases, as provided in Article 17(3) of the Regulation, the Data Controller is entitled not to proceed with the erasure of your personal data if their processing is necessary, for example, for the exercise of the right to freedom of expression and information, for the performance of a legal obligation, for reasons of public interest, for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, or for the establishment, exercise, or defense of legal claims.

d. Right to Restriction of Processing

You have the right to obtain the restriction of processing, in accordance with Article 18 of the Regulation, in the following cases: a) if you contest the accuracy of your personal data (the restriction will be in place for the period necessary for the Data Controller to verify the accuracy of the personal data); b) if the processing is unlawful, but you oppose the erasure of your personal data and request the restriction of their use instead; c) even if the Data Controller no longer needs the personal data for processing purposes, they are required for the establishment, exercise, or defense of legal claims; d) if you have objected to the processing pursuant to Article 21(1) of the Regulation, pending the verification whether the legitimate grounds of the Data Controller override yours.

In case of restriction of processing, your personal data will be processed, except for storage, only with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of substantial public interest. You will be informed before the restriction is lifted.

e. Right to Data Portability

You can, at any time, request and receive, in accordance with Article 20(1) of the Regulation, all your personal data processed by the Data Controller in a structured, commonly used, and machine-readable format or request their transmission to another data controller without hindrance. In this case, it is your responsibility to provide us with all the exact details of the new data controller to whom you intend to transfer your personal data, providing us with written authorization.

f. Right to Object

In accordance with Article 21(2) of the Regulation and as reiterated in Consideration 70, you can object, at any time, to the processing of your personal data when it is carried out for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

g. Right to Lodge a Complaint with the Supervisory Authority

Without prejudice to your right to seek administrative or judicial remedies, if you believe that the processing of your personal data carried out by the Data Controller is in violation of the Regulation and/or the applicable law, you can lodge a complaint with the competent Supervisory Authority for the Protection of Personal Data.

To exercise all your rights as identified above, you simply need to contact the Data Controller using the following methods:
– Sending an

email to the email address info@toprent.app;
– Sending a registered letter to the legal address of Oxygen S.R.L.

H. DATA PROCESSING LOCATIONS

Your personal data will be processed by the Data Controller within the territory of the European Union.

If, for technical and/or operational reasons, it becomes necessary to involve entities located outside the European Union, we inform you in advance that such entities will be appointed as Data Processors in accordance with Article 28 of the Regulation, and the transfer of your personal data to such entities, limited to the performance of specific processing activities, will be regulated in accordance with the provisions of Chapter V of the Regulation.

All necessary precautions will be taken to ensure the total protection of your personal data, basing such transfers on: (a) adequacy decisions of the recipients’ third countries expressed by the European Commission; (b) appropriate safeguards expressed by the third-party recipient in accordance with Article 46 of the Regulation; (c) the adoption of binding corporate rules; (d) the use of standard contractual clauses approved by the European Commission.

In any case, you can request further details from the Data Controller if your personal data has been processed outside the European Union by requesting evidence of the specific safeguards implemented.