Legal

Controller

The controller within the meaning of the GDPR is the service provider named in the imprint. For any data protection question, or to request access, correction or erasure, use the contact details given there. We are not required to appoint a data protection officer and have not appointed one.

What we do not do

So that the rest of this is read in proportion, here is what is ruled out:

• We do not sell data and do not pass it on for advertising.
• We set no advertising cookies and do no re-targeting.
• We build no profiles and take no automated decisions with legal effect.
• We send no newsletter without an explicit sign-up.

Inquiry basket and enquiry

The inquiry basket is the heart of the shop. While you are collecting, it sits on our server as a draft and is linked to your browser by a cookie. When you send it, we process:

• the chosen items with quantities and rental period,
• project name, occasion, guest count and notes, where given,
• the delivery address (street, postcode, town) and the chosen delivery option,
• your contact details: name, email address and telephone number,
• an optional floor plan you upload (PDF, JPG or PNG up to 20 MB).

The purpose is to prepare an offer and perform the rental contract. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps and performance of a contract). Without this information we cannot make an offer. If you send as a guest without an account, you receive a link to the status of your enquiry; of the access token it contains we store only a hash, and the link expires after 60 days.

Contact form

Through the contact form we process your first and last name, email address, telephone number, your details about occasion, date, place and guest count, your message, and any sketch you attach. The purpose is to answer you. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a contract, otherwise Art. 6(1)(f) GDPR — our legitimate interest in replying to enquiries.

Account, wishlist and projects

An account is optional. If you create one, we store your name, email address and a password held only as a cryptographic hash — we do not know it in clear text. You may add a company name, telephone number and delivery and billing addresses; a customer number is assigned automatically. Your wishlist, saved projects and enquiry history are linked to the account so that you can plan across several sessions. The legal basis is Art. 6(1)(b) GDPR. You can have the account deleted at any time.

Offers, contracts and invoices

Accepting an offer forms a rental contract. The resulting data — contract content, period, prices, delivery and billing details — is processed to perform the contract (Art. 6(1)(b) GDPR) and afterwards to meet our tax and commercial retention obligations (Art. 6(1)(c) GDPR together with § 132 BAO and § 212 UGB).

Email

Confirmations, offers and notifications are sent by email through an SMTP provider acting as our processor. Your email address and the content of the message are transmitted in the process. Email is an unencrypted transport medium; for confidential details, the telephone and the post remain open.

Hosting and server logs

The website runs on a server operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre. A processing agreement under Art. 28 GDPR is in place and the data does not leave the European Union. Opening a page necessarily produces connection data — IP address, time, address requested and browser identification. It is not evaluated on an ongoing basis and is consulted only for faults and suspected abuse; the logs are size-limited and continuously overwritten. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in secure and reliable operation. To protect against bulk submissions we also limit how many form submissions one sender may make; the address used for that is held only in memory and is not stored.

Cookies and local storage

Necessary cookies are set without consent because the service does not work without them (§ 165(3) TKG 2021). Everything else only after you agree. In detail:

• rentigo_basket — links your inquiry basket to you. Necessary, 90 days.
• Login session cookie — keeps you signed in. Necessary, ends with the session or when you sign out.
• rentigo_hero_basket_off — remembers that you closed the basket card on the home page. Necessary, ends with the session.
• Local storage "rentigo_consent_v1" — your cookie decision and when you made it, so we do not ask again. Valid for 182 days.
• Local storage "rentigo_consent_history_v1" — the history of your decisions, as a record. Stays in your browser.
• Google Analytics cookies (_ga, _ga_…) — only after your consent, lasting up to two years.

You can change your decision at any time via "Cookie settings" in the footer, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Google Analytics

We use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to understand which pages and products are viewed. Measurement starts only after your explicit consent — the legal basis is Art. 6(1)(a) GDPR together with § 165(3) TKG. Without consent no analytics cookie is set and no measurement takes place. Google truncates IP addresses; any transfer to the US is based on the EU standard contractual clauses and the EU-US Data Privacy Framework. You can withdraw your consent at any time via "Cookie settings" in the footer, with effect for the future.

Spam protection (reCAPTCHA)

We use Google reCAPTCHA to protect our forms from automated submissions. Your IP address and interaction data are transmitted to Google. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). The check runs only when a form is submitted.

Recipients

We pass data on only where it is necessary to provide the service or where we are obliged to. Recipients are the hosting provider, the email provider, our tax adviser and — for accepted orders — the transport companies we engage, in each case limited to what the delivery requires. Contracts under Art. 28 GDPR are in place with all processors. No data is passed on for advertising.

Transfers outside the EU

Hosting, database and backups are located exclusively within the EU. If you consent to Google services, processing by Google in the United States cannot be ruled out. Google Ireland Ltd. is the contracting party in the EU; the transfer relies on the European Commission's standard contractual clauses and on Google LLC's certification under the EU-US Data Privacy Framework. Even so, a level of protection fully equivalent to the European standard cannot be guaranteed with US providers; without your consent no such transfer takes place.

Retention

We delete as soon as the purpose falls away and no retention obligation stands in the way. Specifically:

• Baskets that were never sent: 90 days after the last change.
• Enquiries that did not lead to a contract: 24 months.
• Uploaded files with no associated enquiry: 24 months.
• Guest access links: 60 days.
• Invoice and accounting records: seven years (§ 132 BAO).
• Account data: until you have the account deleted.
• Backups: the last 14 days; a deletion takes effect there with that delay.

Your rights

You have the right at any time to access the data held about you (Art. 15), to have inaccurate data corrected (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Any consent you have given can be withdrawn at any time. An informal message to the address in the imprint is enough; we reply within one month.

Right to complain

If you believe the processing of your data infringes data protection law, you can complain to the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria, +43 1 52 152-0, dsb@dsb.gv.at, www.dsb.gv.at.

Do you have to provide data?

You are under no legal or contractual obligation to give us data. Without the fields marked as required in the enquiry and contact forms, however, we cannot prepare an offer or answer an enquiry. Creating an account is entirely voluntary.

Changes

We update this statement when the processing or the legal position changes. The version published here at the time applies.

Rental period & prices

All prices are per calendar day and exclude VAT. The minimum rental period is one calendar day; started days count in full.

Delivery & setup

Delivery, setup and collection take place within the agreed window. Access and floor space are provided by the renter.

Damage & loss

Ordinary wear is included. Damaged or missing items are charged at replacement value.

Cancellation

Free of charge until 14 days before the rental starts, tiered thereafter as stated in the offer.