Mon–Fri 10–18, Sat 10–14
040 55555 30 Kiitoradankuja 8, 01530 Vantaa
Book a car Suomi

Privacy policy

This is the privacy policy and description of the data file of Ri-Lease Auto Center Oy in accordance with the EU General Data Protection Regulation (GDPR). Drawn up on 29 October 2026. Last updated on 30 October 2026.

1. Controller

Ri-Lease Auto Center Oy
Kiitoradankuja 8
01530 Vantaa, Finland
Business ID: 0572136-8

2. Contact person

info@rilease.fi
+358 40 55555 30

3. Name of the register

Customer and rental register of Ri-Lease Auto Center Oy.

4. Purpose of processing personal data

Personal data is processed for car rental bookings, making and managing rental agreements, invoicing and maintaining, developing and communicating customer relationships. The legal basis is the rental agreement, legal obligations (e.g. accounting) and the controller’s legitimate interest in managing the customer relationship.

The data is not used for automated decision-making or profiling.

5. Data content of the register

The register contains:

  • name
  • e-mail address
  • phone number
  • address
  • booking details: rented car, pick-up and return time, price and payment method
  • rental agreement details, such as driving licence details and any damage reports
  • messages sent with the contact form
  • other information related to the customer relationship

Booking and invoicing data is kept for the period required by the Accounting Act. Other data is kept as long as it is necessary for the customer relationship.

6. Regular sources of data

The data is received from the customer: from the booking form and contact form on the website, by e-mail, by phone, from rental agreements, at the pick-up and return of the car and in other situations where the customer provides their data. Credit information may be checked with the customer’s permission.

7. Disclosure of data and transfers outside the EU or EEA

Data is disclosed only to parties needed to manage the rental, such as the insurance company in case of damage and the authorities when required by law. Data is not transferred outside the EU or EEA.

8. Principles of protecting the register

The register is handled with care, and data processed in information systems is protected appropriately. When register data is stored on Internet servers, the physical and digital security of the hardware is taken care of appropriately. The controller ensures that stored data, server access rights and other information critical for the security of personal data are handled confidentially and only by employees whose work requires it.

9. Right of access and right to rectification

Everyone in the register has the right to check the data stored about them and to demand that incorrect data is corrected or incomplete data completed. Requests must be sent to the controller in writing. The controller may ask the person making the request to prove their identity. The controller replies within the time set in the GDPR (usually within one month).

10. Other rights related to the processing of personal data

A person in the register has the right to request the deletion of their personal data from the register (“right to be forgotten”), unless the law requires the data to be kept. Data subjects also have the other rights under the GDPR, such as restricting the processing of personal data in certain situations and the right to lodge a complaint with the Data Protection Ombudsman. Requests must be sent to the controller in writing. The controller may ask the person making the request to prove their identity. The controller replies within the time set in the GDPR (usually within one month).