This policy explains what personal data Tooleasing uses to operate the marketplace, keep it safe, and support applicable EU and Dutch rules for online platforms.
1. Data Controller
Tooleasing is an online marketplace for local rentals of tools, equipment, and related services. In this policy, references to "Tooleasing", "we", "our", or "us" mean Tooleasing B.V.. For privacy questions or formal requests, contact info@tooleasing.nl.
KVK: 42128781
2. What We Collect
We process data needed to run accounts, listings, payments, and support, including:
- Account and profile data: name, email address, language preference, login details, and profile information.
- Identity verification data: phone number, Stripe Identity session and report references, verification status, timestamps, and any error reason. In Stripe's hosted flow, Stripe may collect images of your identity document, a live selfie, biometric facial characteristics, and data extracted from the document such as name and date of birth.
- Listing data: title, description, photos, location, availability, pricing, deposits, operator-service data, accessories, and category information.
- Rental and service data: request dates, payment state, refundable deposits, condition reports, handover PINs, return information, event history, and support or issue records.
- Communication data: rental chat messages, support messages, issue reports, and other communications needed for booking coordination, support, safety, and dispute handling.
- Business or trader data: information needed to determine whether a user is acting as a private or business supplier and to support marketplace compliance duties.
- Promotion and ranking data: information about promoted listings, promotion payments, and the parameters needed to order results and label paid placements properly.
- Search and referral data: search queries, filters, saved searches, result counts, and referral codes used to understand supply gaps and send user-requested alerts.
- Technical data: logs, browser and device information, security signals, and basic analytics needed to detect abuse and keep the service reliable.
- Cookies and local storage: language and analytics preferences, temporary signup and preview state, listing drafts, and PWA-install signals needed for your choices and requested browser features.
3. How We Use Personal Data
We use personal data to:
- create and secure accounts;
- verify identity, reduce fraud and abuse, and determine eligibility for rental payments, pickup, or payouts;
- publish, display, moderate, and rank listings;
- process rentals and operator-service bookings;
- handle payments, promotions, refunds, and any refundable deposits;
- operate pickup, handover, return, and dispute workflows;
- provide, secure, and where needed review rental chat and other booking communications for support, safety, fraud review, or disputes;
- investigate fraud, deception, unsafe listings, and policy violations;
- support transparency duties that can apply to online marketplaces;
- send transactional emails, important service updates, and support responses.
- send requested alerts when new supply matches a saved search and record referral attribution.
4. Legal Bases
Where GDPR applies, we process personal data on one or more of the following grounds:
- Contract: to provide Tooleasing, manage bookings, support payments, and deliver support.
- Legitimate interests: to moderate the marketplace, prevent abuse, improve ranking quality, review issues, and protect users.
- Legal obligations: where we must retain or use data to comply with tax, consumer-law, platform, or enforcement requirements.
- Consent: where we request optional permission separately.
- Identity verification: we process verification status to perform the contract and for our legitimate interest in preventing fraud and protecting users. Stripe requests permission in its hosted flow to collect and use biometric data. Where the law requires explicit consent for our processing, we rely on that consent.
5. Stripe Identity and Biometric Verification
Tooleasing uses Stripe Identity for document verification and a required live selfie match. Stripe checks the identity document, compares the selfie with the document photo, and returns a verification result. Authorised Tooleasing staff and Stripe can access submitted verification data where needed for verification, fraud review, support, or legal compliance.
Our application database does not store a separate copy of the raw identity-document or selfie images. We store Stripe session and report references, status, timestamps, and an error reason. Stripe stores raw verification data on our behalf and may also process certain data for its own legal obligations. Read the Stripe Privacy Policy.
If you cannot or do not wish to use the selfie check, contact info@tooleasing.nl before starting to ask what alternatives are available. An alternative cannot always be offered where verification is required by the payment provider or law.
A Stripe result can automatically determine whether a payment, pickup, or payout step becomes available. If a rejection blocks access to such a step and you believe the result is wrong, you can contact info@tooleasing.nl to request human review and an explanation.
6. EU and Dutch Marketplace Compliance
Tooleasing also uses personal and listing data to support rules that can apply to online marketplaces in the EU and the Netherlands, including data protection, consumer-law transparency, ranking transparency, paid-placement disclosure, and platform rules relevant to business users.
- We may process information to determine whether a supplier acts as a private user or as a business or trader.
- We may retain business identification or contact details where needed for compliance, moderation, or support.
- We may retain promotion-payment and ranking data so paid placements remain properly labeled and reviewable.
- We may keep moderation, safety, and suspension records to support platform safety, fairness, and legal accountability.
7. Service Providers, Payments, and Analytics
We use carefully selected providers: Vercel for hosting and deployment, Supabase for authentication, database, and storage, Stripe for payments, Connect payouts, and identity verification, Resend for transactional email, Mapbox for maps and location features, Cloudflare Turnstile for bot and abuse prevention, and, after consent, Google Analytics 4 for usage statistics. These providers process only the data needed for their function under applicable agreements and privacy terms.
Full payment-card details are not stored by Tooleasing. We may retain payment metadata, checkout status, promotion purchases, refund state, and other operational records needed to confirm transactions, investigate issues, and manage the platform.
Only with your consent, we load Google Analytics 4 to measure page views and privacy-safe names of important marketplace actions. We do not send email addresses, support references, or free-text content to Google Analytics. Google may process pseudonymous identifiers and browser, device, and approximate-location information. Advertising storage, ad personalisation, and Google Signals remain disabled. You can change your choice at any time through Analytics settings in the footer.
9. Retention and Security
We use the following retention periods or, where a fixed period is not appropriate, the following criteria:
- Account, profile, and listing data: while the account is active and afterwards until open transactions, complaints, safety reviews, and legal obligations have been resolved.
- Rental, payment, chat, condition, and evidence data: for the rental and afterwards for as long as needed for refunds, chargebacks, tax and accounting duties, disputes, fraud review, or legal claims.
- Identity verification: local session, report, and status metadata for as long as needed for account eligibility, fraud and safety purposes, and applicable obligations. Raw documents and selfies are retained by Stripe under Stripe settings and applicable obligations and may be deleted through redaction or deletion requests where permitted.
- Support, moderation, and security data: until the matter is resolved and afterwards for as long as reasonably needed for repeat violations, platform safety, or legal accountability.
- Saved searches and referrals: until you remove them, close the account, or the data is no longer needed for the requested feature.
- Google Analytics: according to the configured GA4 retention period. Withdrawing consent stops future analytics storage on your device and future measurement.
- Browser storage: language and consent cookies remain until they expire or you remove them. Temporary session data ends with the browser session; listing drafts remain locally until you submit them or clear browser storage.
We then delete or anonymise data unless longer retention is legally required or needed for an active dispute. We use technical and organisational security measures including access control, logging, authenticated systems, and managed provider integrations.
10. Your Rights and Complaints
Depending on your location, you may have rights of access, correction, deletion, restriction, objection, and data portability. Where processing is based on consent, you can withdraw that consent for the future at any time.
You can update some data directly in your account. For formal requests, contact info@tooleasing.nl. For an identity verification request, state that it concerns Stripe Identity so we can assess whether the Stripe session can be redacted. Deletion may be limited where retention is legally required or needed for fraud review, payments, or legal claims.
If you are based in the EEA, you may also lodge a complaint with your local supervisory authority. In the Netherlands, that is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
11. International Transfers and Changes
Some Tooleasing providers may process data outside your home country. Where required, we rely on appropriate safeguards for international transfers. We may update this policy from time to time; if changes are material, we will update the date on this page and notify users where appropriate.