VAU S.r.l. rental privacy notice

Draft last updated: 19 July 2026

This notice explains how VAU S.r.l. processes personal data specifically to assess rental eligibility and to provide, charge for and protect its electric-moped rental service. The general VAU platform account and unrelated platform features are covered by the platform operator's separate privacy notice.

1. Controller and contact

The controller for the rental processing described in this notice is:

VAU S.r.l.
Via Linfano 52, 38062 Arco (TN), Italy
Trade Register / REA: TN-246813
VAT number: IT02746520226
Email for privacy requests: info@myvau.com
Telephone: +39 349 2910298

2. Data we use, purposes and legal bases

Rental operation

Main personal data

Purpose

GDPR legal basis

Rental eligibility and licence verification

name, date of birth, contact details, licence attributes and expiry, verification result, Veriff session reference and review record

confirm identity, age, licence validity and eligibility; prevent identity misuse

steps to enter into and performance of the rental contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); fraud and safety interests (Art. 6(1)(f))

Telephone verification and operational messages

telephone number, OTP and delivery/status logs

secure access and send messages necessary for a booking, ride, safety event or payment

contract (Art. 6(1)(b)); security interests (Art. 6(1)(f))

Reservation, package and ride

customer and rental reference, Vehicle identifier, offer and accepted terms version, commands, start/end time, package use, service and parking zones

create and perform the rental; calculate time and price; provide support

contract (Art. 6(1)(b))

Location and Vehicle operation

Vehicle position, route and telemetry linked to the active rental; device location where the App requires it; lock and command events

locate and operate the Vehicle, enforce service and parking areas, safely end the ride, investigate loss, misuse or an incident

contract (Art. 6(1)(b)); safety, asset-protection and claims interests (Art. 6(1)(f)); legal obligations where applicable (Art. 6(1)(c))

Condition and parking evidence

start/end photographs, time, location, reported defects and results of a technical or human review

validate parking and return; identify pre-existing or rental damage; handle cleaning, missing equipment and disputes

contract (Art. 6(1)(b)); evidence and claims interests (Art. 6(1)(f))

Payments

amount, currency, tax, Stripe customer/payment identifiers, authorisation and transaction status, receipts, refunds, reversals and chargebacks; VAU does not receive full card details

collect ride and package prices, later authorised charges, refunds and debts; prevent payment fraud

contract (Art. 6(1)(b)); accounting and payment obligations (Art. 6(1)(c)); fraud and claims interests (Art. 6(1)(f))

Accidents, damage, theft, fines and RCA matters

incident description and evidence, Vehicle data, persons involved, witnesses, police/authority and insurance records, repair and recovery documents

protect people and property; manage RCA and third-party claims; establish or defend liability; process official fines and tolls

contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); vital interests in an emergency (Art. 6(1)(d)); claims and asset-protection interests (Art. 6(1)(f))

Support, abuse prevention and legal compliance

correspondence, device and access records relevant to rental, IP address, security events and complaint records

answer requests; secure the service; investigate fraud or misuse; comply with authorities and defend legal rights

contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); security and claims interests (Art. 6(1)(f))

Data marked as required in the rental flow is needed to check eligibility, enter into or perform the rental, or comply with law. Without it, VAU may be unable to permit a rental. Marketing is not required for rental and, if used, is subject to a separate optional choice and the right to withdraw it at any time.

3. Identity documents and Veriff

3.1 Identity and driving-licence verification is provided through Veriff OÜ. You submit the original documents, images and other verification material requested in the Veriff flow directly to Veriff. Veriff explains the data and checks it uses, its processing and retention, and your related choices and rights in the notice presented before submission and in Veriff's Privacy Notice.

3.2 VAU does not download or keep its own copy of the original driving-licence images, selfie or other original verification material. VAU receives and retains only the minimum information needed to make and evidence the rental-eligibility decision, such as the verification result, necessary identity and licence attributes, expiry, session reference, timestamps and any manual-review outcome. If verification does not confirm eligibility, you may request a human review through VAU support.

4. Location, telemetry and photographs

4.1 VAU Vehicles contain positioning and telematics equipment. When Vehicle data is linked to your active rental it is personal data. The App may also use your device location where necessary to find a Vehicle, start or end a ride, verify a permitted area or support you. The permission requested by the device and the actual rental function determine whether device location is collected.

4.2 VAU uses these data to operate and recover the Vehicle, apply service and parking areas, investigate a reported incident, theft or misuse, and support a claim. VAU does not describe identifiable route data as anonymous. Statistical data is used only after it has been aggregated or anonymised so that it is no longer reasonably linkable to you.

4.3 Required rental photographs must show only what is reasonably necessary to verify the Vehicle's condition and parking. Avoid deliberately photographing unrelated people, documents, homes or other private information.

5. Payments and later charges

Payments are provided through Stripe. Stripe receives the card and transaction information required to create a payment method, authenticate and process payments, store the payment method where you request it, process refunds and chargebacks, and support fraud and regulatory checks. VAU receives payment identifiers and status, not full card details. Where you have accepted a card-on-file mandate, rental-related amounts established after a ride may be submitted as off-session charges as described in the Rental Terms. See the Stripe Privacy Center.

6. Who receives rental data

VAU discloses only data reasonably necessary for the relevant purpose to:

• the technology provider operating the digital platform for VAU's rental service, which processes merchant-specific rental data on VAU's instructions and may use infrastructure subprocessors under appropriate data-processing terms;

• Veriff, for identity and driving-licence verification;

• Dexatel, for telephone verification and necessary operational communications;

• Stripe, for payment-method and transaction processing;

• the RCA insurer, claims handlers, repair, recovery and professional advisers where an incident or claim requires it; and

• police, courts, municipalities, tax bodies and other competent authorities where required by law or necessary to handle a fine, incident or legal claim.

VAU does not sell rental personal data. A provider may act as an independent controller for its own legal, regulatory, security or fraud-prevention duties; its own privacy notice applies to that processing.

7. International transfers

Some technology providers or their subprocessors may process data outside the European Economic Area. Where an adequacy decision does not apply, VAU or its processor uses an appropriate GDPR transfer mechanism, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required. You may request information about the applicable safeguard from VAU.

8. Retention and deletion

VAU applies data minimisation and keeps rental data only for the shortest period needed for the stated purpose, subject to mandatory retention and unresolved claims:

• original documents, images and other verification material submitted in the Veriff flow: received and retained by Veriff as explained in its Privacy Notice; VAU does not keep its own copy;

• minimum eligibility result and necessary licence attributes: while the verification remains valid and is needed to permit rentals, then deleted or anonymised when no longer necessary, unless an open fraud, safety or legal matter requires restricted retention;

• detailed ride events and routine Vehicle telemetry linked to you: normally up to 90 days after the rental; an incident-related segment may be isolated and kept until the incident or claim is finally closed;

• live location association: during the rental and a short operational review period; retained longer only where needed for a reported incident, theft, fine, payment dispute or legal claim;

• start/end photographs: until the return and condition review is complete and normally no more than 90 days, unless linked to a dispute, damage, fine or claim;

• OTP, access and security logs: normally 30 to 90 days, unless needed to investigate abuse or a claim;

• payment, invoice and accounting records: for the period required by Italian law, generally up to 10 years;

• incident, damage, theft, fine, RCA, complaint and debt evidence: until the matter is finally closed and for any applicable limitation period; and

• backups: overwritten or deleted on a rolling cycle, normally within 90 days, subject to secure isolation and restoration controls.

Deleting the general platform account does not automatically erase records that VAU must retain for a completed rental, payment, official fine, RCA matter or legal claim. When the retention ground ends, the data is deleted or irreversibly anonymised.

9. Your rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time for processing that actually relies on consent, without affecting earlier lawful processing. You may also request human intervention and contest a qualifying automated decision.

Send a request to info@myvau.com. VAU may need to verify your identity before acting on it. You may lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali, at garanteprivacy.it.

10. Security and changes to this notice

VAU and its processors use proportionate technical and organisational measures intended to protect rental data. No system can eliminate every risk.

VAU may update this notice when rental processing changes or the law requires it. Material changes will be communicated before they take effect where required. A new purpose that requires consent will not be introduced merely by changing this notice; separate consent will be requested.