Privacy Policy
Privacy Policy
Last updated: June 2026
Data Controller
My Greatest Rentals, registered with the Dutch Chamber of Commerce under number 68538715 and having its registered office at Afmijnstraat 24, 1187 ZZ Amstelveen, Netherlands, acts as the data controller for the processing of personal data described in this Privacy Policy.
About our privacy policy
MY GREATEST RENTALS cares deeply about your privacy. We therefore only process data that we need for (improving) our services, and we handle the information we collect about you and your use of our services with care. We never make your data available to third parties for commercial purposes.
This privacy policy applies to the use of the website and the services offered through it by MY GREATEST RENTALS. The effective date of this policy is June 2026; the publication of a new version invalidates all previous versions. This privacy policy describes what data about you we collect, what this data is used for, on what legal basis, and with whom and under what conditions this data may be shared with third parties. We also explain how we store your data, how we protect it against misuse, how long we retain it, and what rights you have regarding the personal data you have provided to us.
If you have any questions about our privacy policy, you can contact us via our privacy contact point; the contact details can be found at the end of this privacy policy.
About the processing of data
Below you can read how we process your data, where we (have it) stored, which security techniques we use, on what legal basis (in accordance with Article 6 GDPR) the processing takes place, and who has access to the data.
Webshop software - Shopify
Our webshop is built using Shopify software. Personal data that you make available to us for the purposes of our services is shared with this party. Shopify has access to your data in order to provide us with (technical) support; they will never use your data for any other purpose. Under our agreement with them, Shopify is required to take appropriate security measures, including SSL encryption and a strong password policy. Shopify is a certified processor of credit card data. Shopify uses cookies to collect technical information about your use of the software; no personal data is collected and/or stored via these cookies. Shopify observes the applicable statutory retention periods for (personal) data.
For transfers of personal data to the United States, Shopify relies on Standard Contractual Clauses (SCCs), as approved by the European Commission under Article 46(2)(c) GDPR.
Legal basis: performance of the contract (Article 6(1)(b) GDPR).
Booking management - BTA Booking App
To manage rental bookings, availability, and scheduling, we use the BTA Booking App. Customer booking data - including name, contact details, event date(s), rental period, and rented items - is shared with this processor solely for the purposes of managing bookings and planning delivery and collection.
BTA Booking App stores data within the European Economic Area (EEA) and applies appropriate technical and organisational security measures, including encryption of data in transit and at rest, and access restrictions limited to authorised personnel. To the extent that data is transferred outside the EEA in connection with this service, this is done exclusively on the basis of Standard Contractual Clauses (SCCs), as approved by the European Commission under Article 46(2)(c) GDPR.
Legal basis: performance of the contract (Article 6(1)(b) GDPR).
Email communication - Gmail
We use Gmail (Google) for our regular business email correspondence. Google processes personal data as a processor for the provision of email services and has implemented appropriate technical and organisational security measures to prevent misuse, loss, and corruption of your and our data as far as possible. We treat all our email correspondence as confidential.
Legal basis: performance of the contract and legitimate interest in efficient business communication (Article 6(1)(b) and (f) GDPR).
Payment processing - Mollie
To process (part of) the payments in our webshop, we use the Mollie platform. Mollie processes your name, address, and city of residence, as well as your payment details, such as your bank account or credit card number. Mollie has taken appropriate technical and organisational measures to protect your personal data. Mollie reserves the right to use your data to further improve its services and, in that context, to share (anonymised) data with third parties. All the safeguards described above regarding the protection of your personal data also apply to the parts of Mollie's services for which they engage third parties. Mollie does not retain your data for longer than is permitted under statutory time limits.
Legal basis: performance of the contract (Article 6(1)(b) GDPR).
Shipping and logistics - we deliver ourselves
If you place an order with us and choose delivery and/or collection, we handle this ourselves. We do not use the services of third parties for the delivery and/or collection of your order. Your delivery address and contact details are used solely for the planning and execution of delivery and collection.
Legal basis: performance of the contract (Article 6(1)(b) GDPR).
Invoicing and bookkeeping - Moneybird
We use Moneybird's services to keep our records and accounts. We share your name, address, and city of residence, as well as details relating to your order. This data is used to administer sales invoices. Your personal data is transmitted and stored securely. Moneybird is bound by confidentiality and will treat your data as confidential. Moneybird does not use your personal data for purposes other than those described above.
Legal basis: legal obligation to maintain proper records (Article 6(1)(c) GDPR, in conjunction with the statutory tax retention obligation).
Purpose of the data processing
General purpose of the processing
We use your data solely for the purposes of our services. This means that the purpose of the processing is always directly related to the order/booking you place with us. We do not use your data for (targeted) marketing without your consent. If you share data with us and we wish to use this data to contact you at a later time - other than at your request or in order to perform the agreement - we will ask for your explicit consent. Your data is not shared with third parties other than the processors named in this policy and as required to comply with accounting and other statutory obligations. All such third parties are bound by confidentiality on the basis of an agreement with us, an oath, or a statutory obligation.
Automatically collected data
Data automatically collected by our website is processed for the purpose of further improving our services. This data (for example, your IP address, web browser, and operating system) is generally not, on its own, personal data that is directly traceable to you, but may become so in combination with other data.
Cooperation with tax and criminal investigations
In certain cases, MY GREATEST RENTALS may be required, on the basis of a statutory obligation, to share your data in connection with a tax or criminal investigation by a government authority. In such a case, we are obliged to share your data, but we will object to this to the extent permitted by law.
Legal basis: legal obligation (Article 6(1)(c) GDPR).
Retention periods
We retain customer account and booking data necessary for the performance of the agreement for the duration of the customer relationship and for up to 2 years following your last booking, unless a longer retention period is required by law or you submit a valid erasure request earlier. After this period, your customer profile is automatically deleted or anonymised.
Financial data and invoices are retained for 7 years, in accordance with the Dutch statutory tax retention obligation. Other personal data is deleted within one month of receipt of a valid erasure request, unless we are legally required to retain it for longer. After the applicable retention period has expired, staff no longer have access to your customer profile and the documents we have produced in connection with your booking.
Your rights
Under applicable Dutch and European law (GDPR), you, as a data subject, have certain rights regarding the personal data processed by us or on our behalf. Below, we explain what these rights are and how you can exercise them. To prevent misuse, we will, in principle, only send copies of your data to the email address already known to us. If you wish to receive the data at a different email address, or by post, for example, we will ask you to verify your identity. We keep records of handled requests; in the case of an erasure request, we keep only anonymised records. You will receive all copies of data in the machine-readable format we use within our systems. You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) if you suspect that we are misusing your personal data.
Right of access
You always have the right to view the data we process (or have processed) that relates to you personally or is traceable to you. You can submit such a request to our privacy contact point. You will receive a response to your request within one month. If your request is granted, we will send a copy of all data to the email address known to us, together with an overview of the processors that hold this data, indicating the category under which we have stored it.
Right to rectification
You always have the right to have the data we process (or have processed) that relates to you personally or is traceable to you corrected. You can submit such a request to our privacy contact point. You will receive a response to your request within one month. If your request is granted, we will send a confirmation to the email address known to us that the data has been corrected.
Right to restriction of processing
You always have the right to have the processing of the data we process (or have processed) that relates to you personally or is traceable to you restricted. You can submit such a request to our privacy contact point. You will receive a response to your request within one month. If your request is granted, we will send a confirmation to the email address known to us that the data will no longer be processed until you lift the restriction.
Right to data portability
You always have the right to have the data we process (or have processed) that relates to you personally or is traceable to you transferred to another party. You can submit such a request to our privacy contact point. You will receive a response to your request within one month. If your request is granted, we will send copies of all data about you that we have processed, or that has been processed on our behalf by other processors or third parties, to the email address known to us. In all likelihood, we will no longer be able to continue providing services to you in such a case, as the secure linking of data files can no longer be guaranteed.
Right to erasure ('right to be forgotten')
You have the right to request the deletion of the data we process (or have processed) that relates to you personally or is traceable to you, in accordance with Article 17 GDPR. This right applies, among other things, where the data is no longer necessary for the purposes for which it was collected, where you withdraw your consent, or where you successfully object to the processing. You can submit such a request to our privacy contact point. You will receive a response to your request within one month.
We assess each erasure request in light of Article 17 GDPR and our applicable statutory retention obligations. To the extent we are legally required to retain certain data (such as financial records), we will not delete that data, but will restrict its processing to the purpose of that legal obligation.
Right to object and other rights
In certain cases, you have the right to object to the processing of your personal data by or on behalf of MY GREATEST RENTALS. If you object, we will immediately suspend the processing of your data pending resolution of your objection. If your objection is justified, we will provide you with copies of the data we process (or have processed) and will then permanently cease processing. You also have the right not to be subject to automated individual decision-making or profiling. We do not process your data in a manner to which this right applies. If you believe this is nevertheless the case, please contact our privacy contact point.
Cookies
Our website uses several categories of cookies. In accordance with the Dutch Telecommunications Act (Cookie Act) and the GDPR, we inform you below about each category, its purpose, and the applicable legal basis.
Necessary / functional cookies - Shopify
Our webshop, built on Shopify, places functional cookies that are necessary for the website to work, such as remembering the contents of your shopping cart and securing your session during checkout. No consent is required for these cookies, as they are strictly necessary to provide the service you have requested.
Legal basis: necessary for the performance of the contract / exemption from the consent requirement under the Cookie Act (Article 11.7a(3) of the Dutch Telecommunications Act).
Analytics cookies - Google Analytics
Our website places cookies from the US company Google as part of the 'Analytics' service. We use this service to monitor and obtain reports on how visitors use the website. This processor may be required, under applicable laws and regulations, to provide access to this data. We have not authorised Google to use the analytics information obtained for other Google services.
Google Analytics has been configured in a privacy-friendly manner in accordance with the guidance of the Dutch Data Protection Authority: IP addresses are anonymised before being stored, and Google Signals (which could link data to your Google account) is disabled. Analytics data is retained for no longer than 14 months, after which it is automatically deleted.
Legal basis: consent (Article 6(1)(a) GDPR). These cookies are only placed after you have given your consent via the cookie banner on our website.
Marketing and tracking cookies - Pinterest
Our website uses a Pinterest tracking pixel/tag, which allows us to measure how visitors arrive at our website from Pinterest and how they use it, and which enables personalised advertisements to be shown. These cookies are only placed after you have given your consent.
Legal basis: consent (Article 6(1)(a) GDPR).
Third-party cookies
To the extent that other third-party software solutions used on our website make use of cookies, this will be stated in this privacy policy as soon as such cookies are implemented. We aim to obtain your consent via a cookie banner before any non-essential cookies are placed.
The cookies and tracking technologies listed above under 'Cookies' (Shopify, Google Analytics, and Pinterest) are the cookies we currently actually use on our website. Should we implement other tracking technologies in the future (such as Meta/Facebook Pixel, Google Ads, Klaviyo, or similar services), we will update this privacy policy beforehand and, where required, request your renewed consent.
Data breaches
In the unlikely event of a breach of the security of personal data (a data breach), and where this is likely to result in a risk to the rights and freedoms of data subjects, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay, and in any event no later than 72 hours after becoming aware of it, in accordance with Article 33 GDPR.
Where the data breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay, in accordance with Article 34 GDPR. We have established internal procedures to detect, assess, and report data breaches within the statutory time limits.
Data Protection Officer (DPO)
Given the nature and scale of its services, My Greatest Rentals is not legally required to appoint a Data Protection Officer (DPO) as referred to in Article 37 GDPR. Our processing activities do not involve large-scale, systematic monitoring of data subjects, nor large-scale processing of special categories of personal data.
Questions about privacy and the processing of personal data can be directed to our privacy contact point, as stated under 'Contact details' at the end of this privacy policy. This contact point is not a formally appointed DPO within the meaning of Article 37 GDPR, but the central point of contact within our organisation for all privacy-related requests and questions.
Changes to the privacy policy
We reserve the right to amend our privacy policy at any time. However, you will always find the most recent version on this page. If the new privacy policy affects the way in which we process data already collected about you, we will notify you of this by email.
Contact details
My Greatest Rentals
Business address: Afmijnstraat 24, 1187 ZZ Amstelveen, Netherlands
Phone / WhatsApp: +31 6 33 811 527
Email: info@mygreatestrentals.com
Contact person for privacy matters: Nair Fonseca
For questions about privacy and the processing of your personal data, you can contact us via: info@mygreatestrentals.com
