Privacy Policy

This policy describes how LEXIO RENT processes personal data in connection with its web solution: the lexio.rent website (presentation pages, contact and demo request forms, open-data explorers) and the management application available at app.lexio.rent.

Lexio is management software for professional vehicle rental businesses — cars, vans, motorcycles, motorhomes. It covers bookings, fleet scheduling, photographic check-in/check-out reports with electronic signature, contracts, and Factur-X invoicing (EN 16931 standard).

The Lexio mobile application is covered by a separate policy, available at lexio.rent/politique-de-confidentialite-application-mobile. Where the same data is processed through both channels — check-in/check-out photographs, for example — both documents should be read together.

Company name

LEXIO RENT, société par actions simplifiée (French simplified joint-stock company)

Registered office

36 rue Scheffer, 75016 Paris, France

SIREN

101 951 754

SIRET (registered office)

101 951 754 00015

Trade and Companies Register (RCS)

Paris 101 951 754

Intra-Community VAT number

FR15 101 951 754

APE/NAF code

62.01Z — Computer programming

Chairman and publication director

Shane Lu

Chief Executive Officer

Samuel Abid

Email

contact@lexio.rent

Phone

+33 7 68 34 97 45

Lexio acts in two distinct capacities, which do not carry the same obligations. This distinction governs how the rest of this document should be read.

When Lexio acts as a processor, it processes data only on the documented instructions of the rental-business customer. It does not use that data for any purpose of its own: no marketing, no resale, no model training, no database enrichment.

Practical consequence for renters: if you are the customer of a rental business that uses Lexio and you wish to exercise your rights over your data, contact that rental business first — it is the controller. Lexio can only act on its instructions and will redirect you to it. Its identity appears on your rental contract.

The processing described below is that for which Lexio itself determines the purposes. It concerns website visitors, prospects, and rental-business customers.

The website's audience measurement is covered in the "Cookies and trackers" section.

The data below is entered, imported, or generated by the rental-business customer through Lexio. That customer is the data controller; Lexio hosts and returns it on its behalf.

The purposes, legal bases, and retention periods for this data are determined by the rental business, not by Lexio. The following sections detail the processing operations that call for particular attention: photographs, electronic signature, identity documents, and geolocation.

Lexio makes it possible to produce a joint check-in/check-out report at vehicle pickup and return, in the form of timestamped photographs covering the vehicle's different areas, compared between pickup and return.

These photographs primarily depict the vehicle. They may nonetheless incidentally capture personal data: a licence plate, the silhouette or face of a person present during the inspection, contents visible inside the cabin. It is for the rental business, as data controller, to limit the shots taken to what is necessary to record the vehicle's condition.

Photographs are stored on Lexio's servers located in Paris, with restricted access and encryption at rest.

The check-in/check-out report and the contract are signed by the renter on a touchscreen. This signature constitutes a simple electronic signature within the meaning of Regulation (EU) No 910/2014, known as eIDAS. At this level, the signature is admissible as evidence and cannot be dismissed solely on the ground that it is electronic; it does not, however, benefit from the presumption of reliability attached to a qualified electronic signature.

The signature is retained together with the elements that accompany it and give it evidentiary weight: the timestamped photographs, the contract, and the associated metadata.

Lexio offers an assisted scanning function for identity documents — national identity card, driving licence, passport — which automatically extracts the information needed to pre-fill the customer record: first and last name, date of birth, nationality, document number, and its expiry date.

These documents do not fall within the special categories of data under Article 9 of the GDPR, but the CNIL strictly regulates their collection: it must be limited to what is necessary to verify the driver's identity, and retaining a full copy of the document must be justified. It is for the rental business, as data controller, to ensure this proportionality.

Vehicle position tracking is an optional feature, included in the Pro and Business plans. When a rental business activates it, the positions of its fleet's vehicles are reported and displayed on a map.

This processing is subject to a specific regime. Where vehicles are driven by the rental business's employees, geolocation constitutes a means of monitoring employee activity: it requires the employer to provide prior, individual notice to employees, to consult the works council (comité social et économique) where one exists, to record the processing in the record of processing activities, and, in most cases, to carry out a data protection impact assessment. The CNIL prohibits tracking outside working hours, requires that employees be able to disable the device during breaks, and does not permit the use of position data to monitor compliance with speed limits.

These obligations rest on the rental business, as data controller, not on Lexio. Activating the feature does not amount to compliance.

Data is neither sold, nor rented, nor transmitted for advertising purposes. It is accessible to Lexio staff who need it, and to the technical service providers listed below, within the limits of their assignment.

Where the data resides. Lexio's servers are located in Paris, France: the application's business data — accounts, renters, contracts, check-in/check-out photographs, signatures, invoices — is hosted and remains stored there. The public lexio.rent website, by contrast, is served by Cloudflare Workers, which run from the point of presence closest to the visitor on a global network: data from simple browsing on the presentation pages therefore passes through this network, some of whose points of presence are located outside the European Union. This distinction is deliberately explicit: storage of business data is in France, delivery of the showcase website is not.

Service providers involved on the lexio.rent website:

The website's audience measurement does not appear in this table, and that is not an oversight: it is run by software that Lexio operates itself, on its own infrastructure located in France. No third-party provider is involved, and no traffic data is transmitted outside Lexio. The "Cookies and trackers" section describes it in detail.

Service providers involved in the management application:

Optional integrations — payment collection, forwarding invoices to an accounting firm, syncing the schedule to an external calendar — are only active if the rental-business customer enables them. Data transmitted to these services is then transmitted under that customer's responsibility, and it is for that customer to inform the data subjects concerned.

Data may also be disclosed to administrative or judicial authorities where required by law.

Some of the service providers listed above are established in the United States or operate from a global network. The corresponding processing therefore involves a transfer of data outside the European Union. The application's business data, however, remains stored in France.

Transfers to Sentry are governed by the standard contractual clauses adopted by the European Commission.

To find out the basis applicable to another service provider, or to obtain a copy of the safeguards in place, write to contact@lexio.rent.

Data is not kept beyond what is necessary for the purposes described in this document, nor beyond the periods required by law, in particular for accounting and tax purposes. The period applicable to a data category not listed in the table above can be obtained on request at contact@lexio.rent.

For data processed on behalf of a rental-business customer, the retention period is set by that customer, who is the data controller.

No cookie is placed on your browser by the lexio.rent website, or by its service providers. No third-party cookie, no advertising network, no social-network button, and no advertising identifier is called on the website.

When you respond to the consent banner — whether you accept everything, refuse everything, or customize your choice — we record your response. This is what allows us not to show you the banner again on every page or every visit. This response is stored in your browser: it is not transmitted to any server, including ours, and is not linked to any account.

Two pieces of information are thereby written to your browser's local storage. Local storage is a tracker within the meaning of Article 82 of the French Data Protection Act (loi Informatique et Libertés), on the same footing as a cookie: we therefore mention it explicitly rather than limiting ourselves to the word "cookie."

Audience measurement relies on Rybbit, software that Lexio operates itself on its own infrastructure, located in France. The script is served from the lexio.rent domain, and the measurements are received by that same server: they pass through no third-party provider and do not leave Lexio's infrastructure. The resulting statistics are aggregated; they are not resold, cross-referenced with other websites, or used for advertising or profiling purposes.

You may revisit your recorded choice at any time by clearing the site's data in your browser settings, which brings the banner back.

The measures below are those actually implemented and verifiable on the service.

• Encryption of communications: all exchanges with lexio.rent are encrypted over TLS. The website requires the browser to use the secure protocol for two years, including subdomains (HSTS).
• Browser sandboxing: content security policy restricting script sources, prohibition on displaying the website in a third-party frame, window isolation, blocking of risky file-type interpretation.
• Neutralization of sensitive interfaces: camera, microphone, and geolocation are disabled on the public website by header.
• Rate limiting on public forms, to prevent automated submissions.
• Encryption at rest and restricted access for stored photographs.
• Access to data limited to staff whose role requires it.

No security measure provides an absolute guarantee. Lexio does not present its service as offering end-to-end encryption: data is encrypted in transit and at rest, but remains technically accessible to the service so that it can be processed, displayed, and returned.

In accordance with Regulation (EU) 2016/679 and the French Data Protection Act (loi Informatique et Libertés), you have the following rights over your data:

• Access: obtain confirmation that your data is being processed and receive a copy of it
• Rectification: have inaccurate or incomplete data corrected
• Erasure: request the deletion of your data, within the limits of legal retention obligations
• Restriction: request that processing be frozen while a verification is carried out
• Portability: receive the data you provided in a structured, machine-readable format
• Objection: object to processing based on legitimate interest, and at any time to direct marketing
• Post-mortem directives: define what happens to your data after your death

To exercise these rights, write to contact@lexio.rent or to LEXIO RENT, 36 rue Scheffer, 75016 Paris, France. A response will be sent to you within one month of receiving the request, extendable by two months in case of complexity, in which case you will be informed. Proof of identity may be requested if there is reasonable doubt as to your identity.

If you are the customer of a professional business using Lexio, address your request to that business: it is the controller of your data. Its identity appears on your rental contract.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French data protection authority:

Address

CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

Website

www.cnil.fr

The Lexio web solution is intended for professional use and is aimed at adult users. Lexio does not knowingly collect data concerning minors under the age of fifteen.

Since renting a vehicle requires holding a driving licence, the renters whose data is processed in the application are adults. If you nonetheless find that data concerning a minor has been submitted, write to contact@lexio.rent so that it can be remedied.

This policy may change, in particular where a feature is added, a technical service provider changes, or regulations evolve. The date of the last update appears at the top of the document.

In the event of a material change, rental-business customers are notified by email. As regards subsequent subprocessors, they have the right to object provided for in Article 28.2 of the GDPR.

For any question relating to the protection of your data or to this policy:

Company name

LEXIO RENT

Email

contact@lexio.rent

Phone

+33 7 68 34 97 45

Address

36 rue Scheffer, 75016 Paris, France