Privacy Policy

1. Who This Privacy Policy Applies To

This Privacy Policy may apply to:

• KeyFleet subscribers and their authorized users;
• prospective subscribers;
• KeyFleet Agents and referral partners;
• visitors to our public website;
• renters, drivers, customers, guarantors, representatives, or other individuals whose information is processed through a subscriber's KeyFleet account;
• individuals who contact KeyFleet for support or other inquiries.

2. KeyFleet and Subscriber Privacy Responsibilities

2.1 KeyFleet as Personal Information Controller

KeyFleet may act as a Personal Information Controller when we determine the purpose and means of processing personal data for our own legitimate business purposes, including:

• creating and administering KeyFleet accounts;
• managing subscriptions and billing;
• operating the KeyFleet Agent Program;
• providing support and communicating with users;
• protecting the Service against fraud, misuse, and security threats;
• maintaining business, accounting, and compliance records;
• improving and administering the Service.

2.2 Subscriber as Personal Information Controller

A car rental business using KeyFleet generally determines why renter, customer, driver, and rental-related information is collected and how that information will be used in its rental operations.

Accordingly, the subscriber generally acts as the Personal Information Controller for personal data it collects from or about its customers, renters, drivers, guarantors, employees, and other individuals.

Subscribers are responsible for:

• having an appropriate lawful basis for processing personal data;
• providing appropriate privacy notices;
• obtaining consent where consent is required by law;
• collecting only information reasonably necessary for legitimate purposes;
• restricting access to authorized personnel;
• responding to applicable data-subject requests;
• complying with applicable privacy and data protection requirements.

2.3 KeyFleet as Personal Information Processor

Where a subscriber uses KeyFleet to collect, store, organize, access, transmit, or otherwise process renter or customer information, KeyFleet generally processes that information on behalf of the subscriber in order to provide the Service.

In these circumstances, KeyFleet generally acts as a Personal Information Processor and processes the information according to the subscriber's use of the Service, applicable contractual terms, documented instructions, and applicable law.

3. Personal Data We May Process

3.1 Account and User Information

• name;
• email address;
• mobile or telephone number;
• username and authentication information;
• company or organization affiliation;
• role, permissions, and account settings;
• communications and support requests.

3.2 Business and Subscriber Information

• business name;
• business address;
• business contact information;
• tax or registration information where provided;
• fleet and vehicle information;
• branches and operating locations;
• subscription plan and account status;
• billing and transaction records.

3.3 Renter and Customer Information

Depending on the subscriber's configuration and rental requirements, information processed through KeyFleet may include:

• full name;
• email address and telephone number;
• residential or billing address;
• date of birth where legitimately required;
• booking and rental information;
• pickup and return information;
• driver information;
• emergency contact details where collected;
• payment and reservation records;
• rental agreements, receipts, invoices, and related documents;
• notes or information entered by the subscriber in connection with the rental.

3.4 Uploaded Identification and Verification Requirements

Subscribers may configure KeyFleet to allow renters or authorized users to upload documents required for legitimate rental verification or transaction purposes.

These documents may include:

• driver's licenses;
• government-issued identification documents;
• proof-of-address documents;
• billing statements;
• photographs or images of required documents;
• signed rental-related forms;
• other verification documents legitimately required by the rental business.

These documents may contain personal data and, depending on their content, information that is subject to additional protection under applicable privacy laws.

3.5 Payment Information

KeyFleet may process subscription billing information and payment transaction records. Where a third-party payment provider such as PayMongo is used, payment credentials handled directly by that provider are subject to the provider's own privacy and security practices.

KeyFleet does not intend to store complete payment-card credentials when payments are processed directly by the applicable payment provider.

3.6 Technical and Usage Information

We may automatically collect:

• IP address;
• browser type;
• device and operating-system information;
• login and security events;
• usage information;
• approximate location derived from IP address;
• cookies and similar technologies;
• audit and activity logs.

3.7 Information From Third Parties

We may receive information from:

• payment processors;
• services connected or integrated with KeyFleet;
• referral and Agent Program participants;
• authorized business partners;
• other sources where collection is permitted by law.

4. Why We Process Personal Data

Depending on the context, personal data may be processed for purposes including:

• creating and administering accounts;
• providing the KeyFleet platform;
• processing rental inquiries, bookings, and reservations;
• allowing subscribers to verify renter requirements;
• managing vehicles and rental operations;
• generating invoices, receipts, rental documents, and reports;
• processing subscription payments;
• administering referrals and Agent commissions;
• providing customer support;
• maintaining security and preventing fraud or abuse;
• maintaining audit logs and transaction records;
• complying with legal and regulatory requirements;
• protecting the rights, property, and security of users and KeyFleet;
• improving and maintaining the Service.

5. Lawful Bases and Subscriber Responsibility

The lawful basis applicable to a particular processing activity depends on the circumstances, the type of information involved, the purpose of processing, and applicable law.

Processing may, where appropriate, be based on:

• performance of a contract or steps requested before entering into a contract;
• compliance with a legal obligation;
• a legitimate purpose or interest permitted by applicable law;
• consent where consent is required or appropriate;
• another lawful basis permitted under applicable law.

KeyFleet does not represent that consent is the appropriate lawful basis for every processing activity.

Subscribers remain responsible for identifying and documenting the appropriate lawful basis for the personal data they collect through their rental operations.

6. Renter Documents and Verification Information

Uploaded renter requirements are intended to be used only for legitimate rental-related purposes, such as:

• identity verification;
• driver eligibility verification;
• proof-of-address verification;
• booking review and approval;
• rental documentation;
• fraud prevention;
• dispute handling;
• other legitimate requirements associated with the rental transaction.

Subscribers must not use renter documents obtained through KeyFleet for unrelated marketing, unauthorized profiling, identity misuse, resale, or any other purpose that is incompatible with the purpose for which the information was collected.

7. When Personal Data May Be Disclosed

KeyFleet does not sell personal information.

Personal data may be disclosed when reasonably necessary to:

• Subscribers and Authorized Users: where information relates to their rental operations and they are authorized to access it;
• Service Providers and Subprocessors: providers supporting hosting, infrastructure, payments, communications, security, monitoring, support, or other necessary platform functions;
• Payment Providers: where necessary to process applicable transactions;
• Professional Advisers: such as legal, accounting, security, or compliance advisers where reasonably necessary;
• Authorities: where required by applicable law, lawful court order, regulatory request, or other legally valid process;
• Business Transfers: in connection with a lawful merger, acquisition, restructuring, financing, or transfer of business assets, subject to applicable protections;
• With Authorization: where the applicable individual or controller has authorized the disclosure.

8. Service Providers and Subprocessors

KeyFleet may engage third-party providers that process information necessary to deliver the Service.

We seek to select providers appropriate to the nature of the services involved and require appropriate privacy, confidentiality, and security commitments where applicable.

Subscribers acknowledge that providing a cloud-based Service may require the use of hosting, payment, communications, monitoring, and other infrastructure providers.

9. International Processing and Data Transfers

Some service providers used to operate KeyFleet may process or store information outside the Philippines.

Where cross-border processing occurs, KeyFleet will seek to implement safeguards appropriate to the nature of the information, applicable contractual arrangements, and applicable privacy requirements.

10. Cookies and Similar Technologies

KeyFleet may use cookies or similar technologies for:

• Essential purposes: authentication, session management, security, and core functionality;
• Functional purposes: remembering settings and preferences;
• Analytics: understanding platform performance and usage where implemented;
• Marketing: where such technologies are implemented and any required consent has been obtained.

Browser settings may allow you to restrict certain cookies. Disabling essential cookies may prevent parts of the Service from functioning correctly.

11. Data Retention

Personal data should not be retained longer than reasonably necessary for the purpose for which it was collected, subject to legitimate business, contractual, security, dispute-resolution, accounting, regulatory, and legal requirements.

11.1 Account and Subscriber Records

KeyFleet may retain subscriber and account information while an account remains active and for a reasonable period following termination where necessary for account closure, recovery, legal compliance, disputes, accounting, fraud prevention, or other legitimate purposes.

11.2 Renter and Booking Records

Retention of renter and booking information may depend on the subscriber's legitimate rental, contractual, accounting, legal, and dispute-resolution requirements.

Subscribers are responsible for establishing appropriate retention periods for personal data they control.

11.3 Uploaded IDs and Verification Documents

Identification and verification documents should be retained only for as long as reasonably necessary for the applicable rental transaction, verification, fraud prevention, dispute resolution, contractual requirements, or applicable legal obligations.

Where retention controls are made available by KeyFleet, subscribers should configure them according to their lawful operational requirements.

11.4 Backups and Technical Copies

Deleted information may remain temporarily in backups, logs, or recovery systems until those copies are overwritten or securely removed according to applicable operational procedures.

12. Security

KeyFleet seeks to maintain reasonable and appropriate organizational, physical, and technical safeguards considering the nature of the information processed and associated risks.

Measures may include, where applicable:

• authentication and authorization controls;
• role-based or permission-based access restrictions;
• tenant and account isolation controls;
• secure transmission of data;
• restricted administrative access;
• logging and monitoring;
• secure software-development practices;
• file-upload validation and restrictions;
• backup and recovery procedures;
• security incident-response procedures.

No online system can be guaranteed to be completely secure. Users and subscribers must also maintain appropriate security over their own accounts, devices, passwords, users, and permissions.

13. Access to Uploaded Renter Documents

Subscriber users should access renter documents only where necessary for legitimate rental-related duties.

Subscribers are responsible for assigning appropriate user roles and permissions and removing access when it is no longer required.

KeyFleet personnel should not access subscriber-controlled renter information except where reasonably necessary for authorized support, security, maintenance, legal compliance, investigation of misuse, or another legitimate platform purpose.

14. Personal Data Breaches and Security Incidents

KeyFleet maintains procedures intended to identify, investigate, contain, mitigate, and respond to security incidents affecting personal data.

Where a personal data breach is subject to mandatory notification under applicable law, KeyFleet and/or the applicable Personal Information Controller will take steps to provide required notifications to the National Privacy Commission and affected data subjects within the period required by law.

Where KeyFleet acts as a processor for subscriber-controlled data, KeyFleet will seek to notify and cooperate with the applicable subscriber as reasonably necessary for the subscriber to satisfy its legal obligations.

15. Your Privacy Rights

Subject to applicable law and the circumstances of the processing, individuals may have rights including:

• the right to be informed;
• the right to access personal data;
• the right to object to certain processing;
• the right to correct inaccurate or incomplete data;
• the right to erasure or blocking where legally available;
• the right to damages where provided by law;
• the right to data portability where applicable;
• the right to lodge a complaint with the National Privacy Commission;
• other rights provided under applicable privacy law.

These rights are not absolute and may be subject to lawful limitations, including legal retention duties, contractual requirements, establishment or defense of legal claims, security requirements, and other grounds allowed by law.

16. Exercising Privacy Rights

If You Are a KeyFleet Subscriber, User, or Agent

You may contact KeyFleet regarding personal data that KeyFleet controls directly.

If You Are a Renter or Customer of a KeyFleet Subscriber

If your personal information was collected by a car rental business using KeyFleet, please contact that business first because it generally determines why your renter information is processed.

KeyFleet may assist the subscriber in responding to valid requests where appropriate and permitted.

Before fulfilling certain requests, identity verification may be required to protect personal data from unauthorized disclosure.

17. Children and Minors

KeyFleet is intended primarily for businesses and individuals legally able to engage in applicable rental and contractual activities.

Subscribers must not knowingly use KeyFleet to collect personal information from minors unless the collection is lawful, necessary, properly disclosed, and subject to any required consent or authorization.

18. Third-Party Websites and Services

The Service may contain links to third-party websites or services. Their privacy practices are governed by their own policies and are not controlled by this Privacy Policy.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Service, business practices, legal requirements, security requirements, or processing activities.

For material changes, we may provide notice through appropriate channels, which may include:

• the KeyFleet website;
• email;
• an in-app notification;
• another reasonable communication method.

Where applicable law requires consent before beginning a new or materially different processing activity, we will seek the required consent before undertaking that processing.

The "Last Updated" date at the top of this page indicates when this Privacy Policy was last materially revised.

19A. Rental Agreements, Access Methods, and Electronic Signing

Subscribers may use KeyFleet to build reusable contract templates, generate agreements using booking data, view or print agreements, and, where their subscription and company settings allow, share and electronically sign them. The subscriber generally acts as the Personal Information Controller for renter agreement information; KeyFleet generally processes that data on the subscriber's behalf, while acting as a controller for independently determined account, platform-security, billing, and compliance purposes.

19A.1 Contract Records

Depending on the features used, agreement records may contain the contract template and version, renter and booking details, vehicle, rental schedule, financial terms, names and roles of signatories, signature drawings or other signing data, printed names, signing dates, signing status, affirmative signing consent, and records of revisions or cancellations. These records may contain personal information and must not be used for unrelated purposes.

19A.2 Two Ways to Access an Agreement

Customer Portal: Where the subscriber's plan enables the Customer Portal, a renter may access their booking and agreement through an authenticated customer session. Access and signing events may be associated with the account, customer record, session, and contract version.

Protected share link: Where enabled, a subscriber may send a contract link and a separate six-digit access PIN to a renter. The renter can review and, if electronic signing is enabled, sign the agreement without logging into the Customer Portal. KeyFleet may record link verification, failed attempts, applicable security restrictions, session activity, and signing events. A successful PIN entry shows use of the access credentials; it does not mean KeyFleet has independently confirmed the holder's government identity or that the intended renter personally signed.

These methods are distinct from the electronic signature itself. Both may support consent and transaction evidence, but they provide different levels of assurance. Subscribers should choose additional identity checks when the transaction's circumstances or applicable law require them.

19A.3 Security and Signing Evidence

Depending on the implemented feature and configuration, the Service may record timestamps, IP addresses, browser or user-agent information, verification method, access or signing outcomes, contract-version identifiers, consent acknowledgments, and relevant audit or integrity information. Such information may be used for transaction administration, platform protection, fraud investigation, lawful claims, and dispute resolution. KeyFleet should not expose plaintext PINs or raw share tokens in routine signing evidence or logs.

19A.4 Privacy Notice, Consent, and Disclosure

Consent to electronically sign a rental agreement is different from consent to process personal data. Processing must have an appropriate lawful basis, and the relevant subscriber must provide any additional transaction-specific privacy notice required by law. Signing information may be made available to authorized rental-business users and signatories, service providers under appropriate safeguards, and lawful authorities where required or permitted. KeyFleet does not sell signing records or use signature images for unrelated advertising.

19A.5 Retention, Requests, and Disputes

Agreements and signing evidence should be retained no longer than necessary for legitimate rental, legal, accounting, security, or dispute purposes, subject to applicable obligations, preservation needs, and the retention arrangements with the subscriber. Requests to access, correct, restrict, or delete data will be handled according to applicable law. A correction or disputed statement may be recorded separately rather than silently altering the content of an already signed contract version. Platform access may change after subscription expiry, but lawful preservation duties and applicable data-subject rights continue to apply.

20. Contact Us