Privacy Policy – Racapp Platform

This Privacy Policy describes how Split Second Connect Limited ("SSC", "we", "our", or "us") collects, uses, and protects personal data when you use the Racapp Platform and its related services. We are committed to safeguarding the privacy and security of all users, including car rental vendors ("Vendors") and their end customers ("Customers").

To the extent applicable, this Privacy Policy shall be read together and complemented by the SLA and the Agreement found on the following link Service Level Agreement . All terms and definitions used in the SLA and the Agreement shall have the same meaning in this Privacy Policy.

Data Controller: Split Second Connect Limited, 192 Ledras Street, 3rd Floor, 1011, Nicosia, Cyprus

1. Scope

This Privacy Policy applies to the Racapp Platform, including the Back-Office Application provided to Vendors and the Front-Desk Website Add-On made available to Vendors' Customers. It governs all personal data processed by SSC in connection with the provision, support, and operation of the Platform and/or the Service.

2. Categories of Personal Data Collected

Depending on your relationship with us, we may collect and process the following categories of personal data:

Vendor Data: Contact details, login credentials, billing information, and communication records to the extent that this refers to physical persons.
Customer Data: First name, last name, email address, telephone number, residential or contact address, city, state, postcode, country or nationality, date of birth, reservation details, pickup and drop-off information, flight or travel details where provided, driving license data, ID or passport number, booking history, payment and billing information, notes or requests submitted during checkout, and images or copies of identity documents, passports, driving licenses, or related photographic data where requested, uploaded, or otherwise provided for a reservation.
Technical Data: IP addresses, access logs, and system usage data necessary for the secure operation of the Platform.
Support and Communication Data: Any information voluntarily provided when contacting us via email or other communication channels.

Where Customers use the customer-facing reservation flow made available by a Vendor, SSC may process Customer Data entered by the Customer, submitted by the Vendor, or uploaded through the Platform with the Customer's consent and/or as necessary to perform reservation and rental services. This may include identity verification, driver eligibility checks, prevention of fraud or misuse, preparation and performance of rental agreements, payment handling, support, and compliance with legal, regulatory, insurance, tax, accounting, or record-keeping obligations.

3. Purpose and Legal Basis for Processing

SSC processes personal data for the following purposes and under the corresponding legal bases:

Performance of Contract: To provide, maintain, and improve the Racapp Platform and its associated services for Vendors and Customers, including reservation checkout, rental agreement preparation, customer communications, and payment initiation.
Legitimate Interests: To ensure platform security, investigate technical issues, perform maintenance, and provide customer support (including, where necessary, limited access to Vendor databases to resolve incidents), and to prevent fraud, misuse, unauthorized access, or payment and reservation abuse.
Legal Obligations: To comply with applicable accounting, tax, legal, regulatory, insurance, and record-keeping requirements.
Consent: Where Customers or physical persons related to a Vendor voluntarily access the Services, accept applicable policies or terms, provide optional information, or upload identity documents, passports, driving licenses, images, or other verification materials. Consent may be withdrawn where processing is based solely on consent, without affecting processing that is necessary for contract performance, legal obligations, or legitimate interests.

4. Data Access and Support

In limited circumstances, SSC's authorized personnel or third parties on behalf of SSC may access Vendor databases for diagnostic or support purposes. Such access is performed only when strictly necessary to investigate or resolve a technical or operational issue. All such actions are covered by confidentiality obligations and are limited to the minimum data required for troubleshooting.

5. Data Processors and Third Parties

SSC engages carefully selected third-party service providers to support Platform operations. These include:

WorkOS – Provides authentication and authorization services. May access organization registration information, user identifiers, and email addresses.
PDFGate – Provides document rendering, PDF generation, and digital signing services. May access rendered versions of documents, agreements, and reports solely for processing.
Twilio – Provides one-time-password (OTP) and communication delivery services. May access user and customer email addresses and telephone numbers required for message transmission.
Mailgun – Provides email delivery services. May access user and customer email addresses required for outbound communication.
SendGrid – Provides email delivery and notification services. May access user and customer email addresses and communication metadata required for transactional messages.
Cloudflare – Provides security, networking, and storage services. May access user and customer data transmitted through the platform, including images that may contain identification documents, only as technically required for service delivery.
Amazon Web Services (AWS) – Provides cloud infrastructure and storage services. May access stored images that may contain customer identification documents, only as necessary for hosting and storage.
Microsoft Azure – Provides cloud infrastructure and platform services. May access system activity logs that may include user and customer activity metadata.
Sentry – Provides application monitoring and error-tracking services. May access activity and crash logs that could contain user or customer email addresses or telephone numbers.
Worldline / Saferpay – Provides online payment initiation, hosted payment page redirection, authorization and payment status handling, and payment security services. May process transaction identifiers, payment status, billing details, reservation references, payment method metadata, fraud or security metadata, and cardholder data submitted directly to the payment provider. SSC does not collect, store, process, or have access to full credit card numbers, card security codes (CVV/CVC), bank account credentials, or payment account login details.

All processors operate under written agreements with SSC and comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable EU data protection laws.

Where a Customer is redirected to or otherwise uses a third-party payment provider, the provider's applicable terms of service, privacy notices, security requirements, data processing terms, card network rules, and acquiring-bank requirements may also apply to the payment transaction.

Payment card and payment account details are entered directly into, and processed by, the applicable third-party payment provider. SSC may receive and process limited payment-related metadata, such as payment identifiers, transaction status, reservation references, payment method type, billing or reconciliation information, and payment provider response metadata, as necessary to operate the Platform and confirm payment status.

6. Data Retention

SSC retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Vendor and Customer data associated with an active account will be retained for the duration of the account's activity. Upon termination, data may be archived or deleted in accordance with SSC's retention policies and applicable legal requirements.

7. Data Location and International Transfers

All personal data processed by SSC is hosted within the European Union. Should data be transferred outside the EU, such transfers will only occur where adequate safeguards exist under Articles 44–49 of the GDPR, including Standard Contractual Clauses approved by the European Commission.

8. Data Subject Rights

SSC has taken appropriate measures to provide any information relating to your rights as well as the exercise of these rights. Under Chapter III of the GDPR you have the following rights:

A. Transparent information, communication and modalities for the exercise of your rights

You have the right to be provided with your data freely and in an intelligible and easily accessible form. Following your request, SSC shall provide information without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests. In that case, SSC will inform you for the reasons of the delay.

B. Information to be provided where personal data are collected from the data subject

You have the right to know the contact details of the agent who collects your data, the contact details of the Data Protection Officer ('DPO') that was appointed by SSC (if such appointment has taken place), the purposes of the processing for which the personal data are intended, the legal basis for the processing, the recipients or categories of recipients of the personal data and where applicable the fact that the controller intends to transfer personal data to a third country.

C. Right of access

You have the right to request and receive a copy of your personal data undergoing processing. However, for any further copies requested, SSC may charge you a reasonable fee that is based on administrative costs.

D. Right to rectification

You have the right to obtain from SSC without undue delay the rectification of inaccurate personal data concerning you.

E. Right to erasure ('right to be forgotten')

There is a right to ask for the erasure of your personal data and that they are no longer processed where the personal data are no longer necessary in relation to the purposes for which they are controlled or otherwise processed. Hence, in the cases where SSC retains and processes personal data in accordance with the provisions of Article 21 of the GDPR, SSC may object to such a request and may keep the relevant personal data that are required for SSC to comply with its legal obligations.

F. Right to restriction of processing

You have the right to restrict processing where the accuracy of the personal data is contested by you, the processing is unlawful and there is pending verification as to whether the legitimate grounds of SSC override those of your rights. Therefore, we ensure that SSC has in place a procedure where you have the right to restrict the processing of your personal data. Nonetheless, for those personal data that are necessary for compliance with a legal obligation, SSC may object to the restriction.

G. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to SSC, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

H. Right to object

You have the right to object to the processing of your personal data. However, if SSC lawfully processes such data under Article 6(1)(c), SSC will still have the right to process the data.

I. Automated individual decision-making, including profiling

You have the right not to be subject to a decision solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects.

9. Security Measures

SSC implements technical and organizational measures designed to protect personal data from unauthorized access, alteration, disclosure, or destruction. These include encryption, restricted access controls, secure data transmission, and audit logging. All personnel handling personal data are bound by confidentiality obligations.

10. Communications and Support

If you contact us via email or other support channels, we may retain communications for the purpose of responding to inquiries, improving service quality, and maintaining records of correspondence. Such data is not used for marketing purposes unless explicit consent is provided.

11. Updates to This Policy

SSC may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Updates will be published on the Racapp Platform. Continued use of the Platform after any update constitutes acceptance of the revised Privacy Policy.

End of Privacy Policy