01General information
Beast Solutions OÜ (registry code 17428015, registered in Estonia) and its affiliated entities (collectively, "Beast", "we", "our", "us") provide digital tools that enable individuals ("Renters") to access vehicle-rental services through the website beast.rent and the Beast Rent mobile application (together, the "Beast Rent platform"). A list of affiliated entities is available at /entities.
This Privacy Notice ("Notice") explains how we collect, use, store, share and protect your personal data when you interact with the Beast Rent platform, including vehicle rental services, third-party integrations, customer support, marketing, and other digital services. It applies to every Renter regardless of geographic location.
While Beast implements appropriate measures to protect your personal data, local operators (the businesses or entities that offer vehicles through the platform) are the primary controllers of the personal data they process. They are responsible for compliance with applicable data-protection laws for that processing.
Definitions
- Beast Rent platform: the website, mobile application and associated digital tools provided by Beast, enabling Renters to search for, book, access and control vehicle rentals (including unlocking, locking and managing their bookings).
- Renters: individuals who use the Beast Rent platform to rent vehicles from local operators.
- Local operators (Platform Users): businesses or entities that use the Beast Rent platform to offer vehicle rentals to Renters and manage related operations.
If you provide personal data about a third party (for example a co-renter or additional driver), you must ensure you have the right to do so and that the third party is aware of this Notice and understands how their data will be used.
02Data controllers
For activities where Beast and a local operator jointly determine the means and purposes of processing (for example, jointly managing vehicle-usage data to optimise fleet management and ensure compliance with a rental agreement), Beast and the local operator act as joint controllers. The local operator is primarily responsible for handling data-subject requests related to the rental transaction; Beast handles requests related to processing necessary for the operation of the platform itself.
For rental-specific queries, refer to your rental agreement and contact the relevant local operator, as outlined in Section 08.
Beast remains a contact point for general data-protection inquiries at privacy@electricbeast.co.
03Categories and sources of personal data
The following categories of personal data may be collected and processed:
- Identity data: name, date of birth, contact details (email, phone), and any identification data provided during the rental process.
- Payment data: information related to payments and transactions (card details, transaction history).
- Verification data: data used to verify your identity, such as driving-licence information, biometric data (e.g. facial recognition), and the results of verification checks.
- Renter usage and driving data: data generated by the vehicle during the rental period (location, speed, distance, status) enabling the management and monitoring of vehicle usage.
- Communication data: details of your communications with Beast or local operators, including customer-support inquiries.
- Technical data: information about your interactions with the platform, such as device information, IP address and usage logs.
- Device data: device type, operating system, unique device identifiers, device settings, and geo-location data.
- Log data: automatically collected when you interact with the platform: IP addresses, browser types, access times, visited pages, time spent.
- Usage data: user roles, actions performed, error logs and other interaction details.
- Marketing data: marketing preferences, engagement, consents, and participation in promotions, surveys and marketing communications. This may include data obtained from publicly available sources (e.g. LinkedIn) or third parties.
Personal data may be collected directly from you or through your interactions with the platform, from local operators, from verification and payment service providers, or from other third-party sources as permitted by law.
04Legal bases and purposes of processing
We process personal data lawfully on one or more of the following bases under Article 6 GDPR:
- Performance of a contract: necessary for executing rental agreements and related services.
- Legitimate interests: improving services, enhancing security, providing customer support.
- Compliance with legal obligations: complying with applicable laws and regulatory requirements.
- Consent: where required for specific purposes such as marketing communications.
Purposes for which we process your personal data:
- Managing and fulfilling rental agreements and related transactions.
- Verifying your identity and ensuring the safety and compliance of vehicle operations.
- Providing customer support, including responding to inquiries and resolving issues.
- Conducting marketing activities where appropriate consent has been provided.
- Ensuring compliance with applicable legal and regulatory obligations.
Quick reference
The following pairs purpose, legal basis and the data used:
- Managing rental agreements · Performance of a contract · Identity data, payment data, vehicle system data.
- Customer support and inquiries · Legitimate interests, performance of a contract · Communication data, identity data.
- Verifying driver identity and eligibility · Legal obligation, legitimate interests · Verification data, identity data.
- Marketing and promotional activities · Consent, legitimate interests · Marketing data, communication data.
- Improving services and user experience · Legitimate interests · Device data, usage data, log data.
- Legal compliance · Legal obligation · All relevant data categories.
05Sharing of personal data
Personal data may be shared with the following categories of recipients:
Local operators
Local operators are primary controllers for rental transactions. They receive and process personal data as necessary to manage vehicle rentals and related services.
Where you rent vehicles from multiple local operators or transfer rental services across locations, personal data may be shared securely between the relevant operators. Such transfers are governed by strict agreements ensuring compliance with applicable data-protection laws.
Service providers
Third-party vendors that provide payment processing, identity verification, IT support and other services on behalf of Beast or local operators.
Regulatory and legal authorities
Data may be shared with public authorities, supervisory bodies or law-enforcement agencies to comply with legal obligations or in response to lawful requests.
Affiliated entities
Within the Beast group, to support business operations and service delivery.
Verification service providers
Entities that assist in verifying the identity and eligibility of Renters, such as driving-licence verification providers (currently Veriff).
Analytics and marketing partners
Third parties that provide analytics and marketing services, including advertising networks and social media platforms, to improve our services and run marketing activities.
Transfer of rights
In the event of a sale, merger, acquisition or other transfer of our assets, the rights and obligations under this Notice will transfer to the acquiring or successor entity. We will notify Renters of such changes by email or in-app notification.
Safeguards
Beast requires all third-party providers, including verification, marketing and analytics partners, to adhere to strict data-protection standards. These are enforced through binding data-processing agreements that specify the purposes of processing and require providers to implement robust technical and organisational safeguards (encryption, secure storage, access controls). For transfers outside the EU/EEA, Beast ensures compliance through Standard Contractual Clauses (SCCs) and additional safeguards where necessary.
Beast actively monitors third parties for ongoing compliance, including audits, assessments and reviews. Where a provider fails to meet these standards we reserve the right to terminate the agreement and take further necessary action (including reporting the non-compliance to relevant authorities or pursuing legal remedies).
06Data retention
Personal data is retained only for as long as necessary to fulfil the purposes outlined in this Notice or as required by applicable laws:
- Rental data: duration of the rental agreement plus an additional period required by local regulation, generally up to 3 years.
- Payment data: up to 7 years, to comply with financial and tax reporting obligations.
- Verification data: the period necessary to verify identity and eligibility, generally not exceeding 3 years.
- Communication data: up to 2 years after the last interaction.
- Marketing data: until consent is withdrawn or up to 3 years after the last marketing activity.
- Vehicle system data: up to 3 years from the date of collection, for operational and security purposes.
Once the retention period expires or data is no longer needed, it is securely deleted, unless retention is required to comply with ongoing legal obligations.
07Security and data protection
We employ appropriate technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure or destruction. These include data encryption, access-control mechanisms, regular security audits, employee training, and policies that govern data access and use.
All data processing is conducted under strict data-protection agreements with our service providers, ensuring that they adhere to our standards and applicable legal requirements.
08Your rights
Under applicable data-protection law you have the following rights:
- Right to access: submit a request specifying the data you wish to access; provide proof of identity and any further information needed to locate the data.
- Right to rectification: contact us with the specific details that need correction, with supporting documents if applicable.
- Right to erasure: submit a request stating the reasons (data no longer necessary, processing unlawful, etc.).
- Right to restriction: request a restriction citing specific circumstances, such as a dispute over data accuracy.
- Right to data portability: request a copy of your data in a structured, machine-readable format; specify the data categories you want to transfer and the new controller.
- Right to object: submit a request specifying the processing activity you object to and the reasons related to your situation.
- Right to withdraw consent: for processing based on consent, use the unsubscribe options provided in marketing communications or contact us directly.
Please contact the relevant local operator directly for data-subject requests related to your rental, or reach out to Beast at privacy@electricbeast.co. Additional information may be required to verify your identity and process your request.
09Cookies and tracking technologies
The Beast Rent platform uses cookies and similar technologies to enhance your experience and analyse usage. These may include necessary cookies (for site operation), functional cookies (to remember preferences), analytical cookies (to measure performance), and marketing cookies (to personalise ads and content). For details, see our Cookie Notice.
10Changes to this notice
This Notice may be updated periodically to reflect changes in our data-processing practices or changes in ownership resulting from a sale, merger, acquisition or other transfer.
Significant updates will be communicated to Renters through appropriate channels, such as email or in-app notifications. The latest version is published here. Please review this Notice periodically.
This Notice is governed by the laws of Estonia and applicable EU legislation. Any disputes arising under this Notice are subject to the exclusive jurisdiction of the Harju County Court in Estonia.