Written agreement (Art. 28)
With the contract you receive the data processing agreement: what we process and why, measures, suppliers, help with your customers' requests and return of the data.
Regulations
The rules we follow for your customers' data
NoloForWeb holds your customers' identity documents, driving licences, contracts and fines. Here are the rules we follow to protect them, what the product does for each one and which reports to the authorities it handles for you.
GDPR plus Italian, Spanish and Maltese law No card numbers stored Data hosted in the European Union
Legal framework
The rules that apply
The rental company is the controller of its customers' data; NoloForWeb processes it on the company's behalf as a data processor.
| Rule | What it governs | How we apply it |
|---|---|---|
| Regulation (EU) 2016/679 (GDPR) | Processing of personal data across the Union | Data processor under a written agreement (Art. 28), security measures (Art. 32), notice of any breach (Art. 33) |
| Italian Privacy Code, Spanish LOPDGDD, Maltese Data Protection Act | National rules that complete the GDPR | Those of your company's country apply; the supplier is based in Spain |
| ePrivacy Directive and cookie guidelines | Cookies and tracking tools | On the website Google Analytics runs only with consent; the rental system uses no profiling cookies |
| PCI DSS | Security of payment card data | Card numbers, expiry dates and codes are not stored: they stay with Nexi and Stripe |
| Regulation (EU) 2024/1689 (AI Act) | Use of artificial intelligence | The operator confirms every AI proposal; no creditworthiness assessment; generated content is disclosed |
This page describes how the product applies the rules: it is not legal advice and does not replace your data protection adviser.
GDPR in the product
How we apply it, article by article
Security (Art. 32)
One database per company, passwords stored only as a hash, two-factor sign-in for users, permissions by role and branch, a log of sign-ins and changes.
No card data
Card numbers, expiry dates and security codes are not stored: they stay with Nexi and Stripe. An automated test stops anyone reintroducing them.
Data in the European Union (Chapter V)
The system is hosted by Aruba in the Union. Data leaves the Union only through services you switch on, such as AI, with the safeguards the GDPR requires.
Rights and portability (Arts. 15-20)
You view, correct and delete data in the system; the administrator exports everything to Excel at any time, with a code sent by email.
Breaches (Arts. 33-34)
If an incident happens we tell you straight away what happened and which data is involved, so you can assess notifying the authority within 72 hours.
Mandatory reports
What it sends to the authorities for you
This is data the law requires you to send: it goes from your company's database straight to the public body, using your credentials, which are stored encrypted.
| Obligation | Rule | Country |
|---|---|---|
| CaRGOS: the customer's document details to the State Police | Decree-Law 113/2018 and Ministerial Decree of 29/10/2021 | Italy |
| User on the registration certificate for rentals over 30 days | Art. 94(4-bis), Highway Code | Italy |
| Driver details for fines | Art. 126-bis, Highway Code | Italy |
| E-invoicing through SdI | Presidential Decree 633/1972 and Law 205/2017 | Italy |
| SES.HOSPEDAJES: the rental records register | Real Decreto 933/2021 | Spain |
| Notice of the renter to the DGT | Orden INT/3215/2010 | Spain |
| Driver details for fines | Art. 11, Real Decreto Legislativo 6/2015 | Spain |
Country-by-country rules are described on the “Compliance by country” page.
Questions from data protection advisers
Who is the controller of my customers' data?
You, the rental company. NoloForWeb processes it on your behalf as a data processor (Art. 28 GDPR), and with the contract you receive the data processing agreement.
Do you process health or criminal data?
The service does not ask for it (Arts. 9 and 10 GDPR). The most sensitive data are documents, driving licences and fines, which the law requires you to collect. If health details appear in a note or an accident report, keep them to the minimum.
Is the risk score an automated decision?
No. It is a suggestion calculated with fixed rules and the operator always decides, so it is not an automated decision under Art. 22 GDPR. It should still be mentioned in the privacy notice you give your customers.
How long is data kept?
You decide, as controller: tax and sector retention periods take precedence over deletion while they last. When the service ends we hand you a copy and then delete the data; backup copies expire by themselves within 15 days.
Are you ISO 27001 certified?
No. The security measures are described one by one on the “Trust and security” page, together with the suppliers that receive data, and on request we answer your adviser's security questionnaire.
Need the data processing agreement?
Ask us for the agreement, the service contract and the current supplier list: we send them before you sign.