Privacy Policy

equipments.rent (“the Platform,” “we,” “us”) is operated by equipments.rent Technologies Inc., a corporation registered with the Securities and Exchange Commission of the Philippines.

We are the Personal Information Controller (PIC) for the data described in this policy, as defined under Republic Act No. 10173 (the Data Privacy Act of 2012, “DPA”) and its Implementing Rules and Regulations.

For privacy questions or to exercise your rights under the DPA, contact our Data Protection Officer at privacy@equipments.rent.

We collect data in three categories:

a) Information you provide directly: name, email address, mobile number, business name, address, role (Renter / Lessor / Both), and account preferences.

b) Identity verification (KYC) documents: government-issued IDs, business permits, SEC/DTI registrations, BIR certificates. Submitted only when you complete KYC and stored encrypted in private storage.

c) Transactional and usage data: listings you post, requests you submit, bids placed, rentals booked, payments processed, reviews left, in-app messages, IP address, device type, browser, pages visited, and timestamps.

We do not collect sensitive personal information (as defined under Sec. 3(l) of the DPA) such as race, marital status, religious or political affiliation, health, or genetic data — unless you voluntarily disclose it in a message or KYC document.

We process your data only when at least one of the following lawful bases applies:

Contractual necessity — to operate the Platform, match renters with lessors, process bids and payments, generate invoices, and deliver notifications about your transactions.

Legal obligation — to verify identity (Anti-Money Laundering Act, Bureau of Internal Revenue rules), retain records for tax and audit purposes, and respond to lawful orders from Philippine authorities.

Legitimate interest — to prevent fraud, abuse, and platform manipulation; to investigate disputes; to improve service quality through aggregate analytics.

Consent — for marketing emails, SMS notifications beyond transactional alerts, and any optional data we ask you to share. You may withdraw consent at any time.

We use your data to: create and authenticate your account; display your listings and bids to other users; route bid notifications and payment confirmations; verify your identity for KYC; process payments via PayMongo; send transactional emails and in-app notifications; detect fraud or abusive behavior; comply with PH legal obligations; and aggregate anonymized insights to improve the Platform.

We do not sell your personal data to advertisers, data brokers, or third parties for their independent marketing purposes.

We share data only with parties who help us operate the Platform, under contractual obligations to protect your data and use it only for the stated purpose:

Other users: when you place a bid or post a listing, your name (or company name), KYC verification status, average rating, and message contents become visible to the counterparty.

Payment processor: PayMongo Pte. Ltd. processes all transactions. They receive amounts, payer details, and reference numbers. See PayMongo’s privacy policy for their data handling.

Email and SMS providers: Resend (transactional email) and Semaphore PH (SMS) receive only the destination address, message content, and a delivery identifier.

Cloud infrastructure: Supabase (Postgres + Storage) and Vercel (hosting) store your data on encrypted infrastructure. Both providers are bound by Data Processing Agreements.

Authentication: Google OAuth (if you sign in with Google) receives a unique identifier on each login.

Legal authorities: we will disclose data when compelled by a valid Philippine subpoena, court order, or written demand from a government agency acting within its mandate.

We retain personal data only for as long as needed for the purposes described:

Active accounts — for the lifetime of your account.

Closed accounts — basic identity and transaction records are retained for 10 years as required by BIR record-keeping rules and Anti-Money Laundering law.

KYC documents — retained for 5 years after account closure or last transaction.

Marketing consent records — retained until you withdraw consent, plus 1 year for audit.

Server logs and analytics — anonymized after 90 days.

You may request earlier deletion under Section 11 below; we will comply unless retention is required by law.

We apply organizational, physical, and technical safeguards proportionate to the data’s sensitivity, in line with NPC Circular 16-01:

All traffic is encrypted with TLS 1.3 (HTTPS only). Database fields are encrypted at rest (AES-256). KYC documents are stored in private buckets with signed-URL access. Access to production data is limited to authorized personnel with multi-factor authentication. We log administrative actions and review them regularly. We perform security reviews before significant feature releases.

No system is perfectly secure. If we discover a personal data breach that creates a real risk of serious harm to you, we will notify you and the National Privacy Commission within 72 hours as required by the DPA.

We use cookies sparingly. Specifically:

Strictly necessary cookies — session token (NextAuth), CSRF protection. These cannot be disabled without breaking sign-in.

Functional cookies — your active company context, language preference. These improve usability but the site works without them.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking.

You can clear cookies in your browser settings at any time. Doing so will sign you out.

Some of our infrastructure providers operate servers outside the Philippines (Vercel and Supabase use the Singapore region by default). When data is transferred abroad, we ensure the recipient provides an adequate level of protection through contractual safeguards (Data Processing Agreements with standard contractual clauses).

The Platform is not directed at persons under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact privacy@equipments.rent and we will remove the account.

As a data subject, you have the following rights under the DPA:

Right to be informed of how your data is processed.

Right of access — request a copy of your personal data we hold.

Right to rectify inaccurate or incomplete data.

Right to erasure or blocking — request deletion when data is no longer needed, processing was unlawful, or you withdraw consent.

Right to data portability — receive your data in a structured, machine-readable format.

Right to object to processing (e.g. marketing).

Right to damages for inaccurate, false, unlawfully obtained or unauthorized use of your data.

Right to file a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights have been violated.

To exercise any right, email privacy@equipments.rent with proof of identity. We respond within 15 business days.

We may update this policy as we add features or in response to legal changes. Material changes will be communicated via email and posted on this page with a new “Last updated” date at least 14 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance.

Data Protection Officer

equipments.rent Technologies Inc.

Email: privacy@equipments.rent

For complaints not resolved by us, you may contact the National Privacy Commission at complaints@privacy.gov.ph or +63 2 8234-2228.