Rod Logo

Privacy Policy

Last updated: February 20, 2026

1. Introduction and Scope

Purpose of this Policy

Rod.tn ('Rod', 'we', 'us', or 'the Platform') is committed to protecting the privacy of its users. This Privacy Policy describes how we collect, use, store, and share personal data when you access or use the services available on www.rod.tn.

By creating an account or using any feature of the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

Who This Policy Applies To

This Policy applies to all individuals who interact with the Platform, whether as private clients seeking vehicle rental services or as representatives of professional rental agencies registered on Rod.tn.

This Policy does not apply to the independent data processing carried out by rental agencies once a booking request has been transmitted to them. Each agency acts as an independent data controller for the personal data it receives in the context of the rental contract.

Nature of the Platform

Rod.tn operates exclusively as a technical intermediary. Rod is not a party to any rental contract concluded between a client and an agency. Rod does not collect or process payments and does not charge commissions on transactions. The Platform's sole function is to facilitate the connection between clients and professional vehicle rental agencies.

2. Identity of the Data Controller

Data Controller

The data controller for personal data processed through the Platform is the company operating www.rod.tn , a SaaS platform dedicated to vehicle rental intermediation in Tunisia.

As data controller, Rod determines the purposes and means of processing personal data collected via the Platform for account management, booking transmission, security, and marketing activities as described in this Policy.

Contact

For any questions or requests relating to the processing of your personal data, you may contact us at: contact@rod.tn

Agencies as Independent Data Controllers

When a booking request is transmitted by Rod to a rental agency, the agency receives the client's personal data and becomes an independent data controller for that data. The agency is solely responsible for the processing it carries out in connection with the rental contract, including verification, contract execution, and any subsequent communication.

Rod cannot be held responsible for the data processing practices of rental agencies. Clients are encouraged to consult the privacy policies of the relevant agencies for further information.

3. Data Collected

Mandatory Data

In order to create an account and use the Platform's services, the following personal data is required:

  • First and last name
  • Email address
  • Phone number
  • Tax identification number (required only when acting on behalf of a legal entity)

Optional Data

Users may voluntarily provide the following additional information to facilitate booking requests:

  • National identity card number (CIN)
  • Date of birth
  • Driver's license number
  • Passport number
  • Postal address
  • Nationality

Rod does not collect, request, or store any scans, photographs, or digital copies of identity documents, driving licenses, or any other official documents. Only textual data entered directly by the user into the Platform's forms is processed.

Data Not Collected

Rod does not collect or process any banking, payment card, or financial data of any kind. All financial transactions, if any, occur directly between the client and the rental agency outside the Platform.

Rod does not collect biometric data, sensitive data within the meaning of applicable data protection legislation, or any data relating to minors.

4. Purposes and Legal Basis of Processing

Purposes of Processing

Your personal data is processed for the following purposes:

  • Account management: creation, authentication, and maintenance of your user account on the Platform.
  • Booking transmission: forwarding your booking request and associated personal data to the rental agency selected by you.
  • Communication facilitation: enabling communication between you and the relevant agency in connection with your booking.
  • Platform security and fraud prevention: detecting, investigating, and preventing fraudulent, abusive, or unauthorised use of the Platform.
  • Legal compliance: fulfilling our obligations under applicable Tunisian law and, where relevant, European data protection regulations.

Legal Bases for Processing

Processing of your personal data is grounded on the following legal bases:

  • Performance of a contract: processing necessary to provide the services you have requested, including account creation and booking transmission.
  • Consent: where you have freely and explicitly consented to specific processing, such as the use of cookies for advertising purposes or the transmission of data through Meta Pixel and the Meta Conversions API.
  • Legal obligation: processing required to comply with applicable legal or regulatory obligations.
  • Legitimate interest: processing carried out for the purposes of platform security, fraud prevention, and the improvement of the services offered by Rod.tn.

Tracking and Advertising Technologies

Rod.tn uses Meta Pixel and the Meta Conversions API (CAPI) to measure the effectiveness of its advertising campaigns, optimise audience targeting, and analyse user behaviour in aggregate. These technologies may involve the transfer of certain technical and behavioural data to Meta Platforms, Inc.

The use of cookies and similar tracking technologies is governed by our separate Cookie Policy, which is accessible on the Platform. By continuing to use the Platform, you acknowledge having been informed of these practices. You may withdraw your consent to non-essential cookies at any time via the cookie preference centre.

5. Data Sharing

Recipients of Personal Data

Your personal data may be shared with the following categories of recipients, strictly on a need-to-know basis:

  • The rental agency selected by you: only the data necessary to process your booking request will be transmitted to the agency you have selected. The agency acts as an independent data controller upon receipt of this data.
  • Our hosting provider(s): personal data is stored on secure servers provided by Amazon Web Services (AWS) and/or Hetzner Online GmbH, pursuant to data processing agreements that ensure compliance with applicable security and confidentiality standards.
  • Competent authorities: Rod may be required to disclose personal data to judicial, regulatory, or law enforcement authorities when required to do so by law, court order, or other legally binding instrument.

No Sale of Personal Data

Rod.tn does not sell, rent, or otherwise transfer personal data to any third party for commercial or marketing purposes.

No personal data is shared with advertising networks, data brokers, or third-party marketers, except to the extent strictly necessary for the operation of Meta Pixel and the Meta Conversions API as described in Section 4.

Agency Responsibility

Once a booking request has been transmitted to the selected rental agency, the agency assumes full and independent responsibility for the personal data it processes in connection with the execution and management of the rental contract. Rod declines all liability for the data processing practices of rental agencies.

6. Hosting and International Transfers

Hosting Infrastructure

The Platform and its associated data are hosted on secure cloud infrastructure provided by Amazon Web Services (AWS) and/or Hetzner Online GmbH. Both providers are recognised industry leaders in cloud security and comply with international data security standards.

We have entered into data processing agreements with our hosting providers to ensure that your personal data is processed in a manner consistent with this Policy and with applicable legal requirements.

International Transfers

The hosting infrastructure selected may result in the transfer of personal data outside of Tunisia. Where data is transferred to countries outside the European Economic Area (EEA) that have not been recognised as providing an adequate level of data protection, such transfers are subject to appropriate safeguards, including standard contractual clauses approved by the European Commission.

Users who are residents of the European Union or who benefit from GDPR protections are informed that their data may be processed on servers located in the European Union (Hetzner) or in jurisdictions outside the EEA (AWS), subject in both cases to appropriate contractual and technical safeguards.

Data Localisation

Rod.tn endeavours, to the extent technically and commercially practicable, to store personal data of Tunisian users within data centres located in Europe or in jurisdictions offering equivalent levels of protection.

Further information regarding our hosting providers and the location of data processing infrastructure is available upon request by contacting contact@rod.tn.

7. Data Retention

Retention Periods

Personal data is retained for the duration strictly necessary to fulfil the purposes for which it was collected. The following retention periods apply:

  • Account data: retained for as long as your account remains active on the Platform. Upon account deletion, personal data is erased or anonymised within a reasonable period, unless retention is required by applicable law.
  • Inactive accounts: accounts that have not recorded any activity for a prolonged period may be deactivated and their associated personal data deleted, subject to prior notification where reasonably practicable.
  • Technical and security logs: server logs and security-related event records are retained for a limited period for the purpose of ensuring platform security, investigating incidents, and fulfilling legal obligations, after which they are permanently deleted.

Post-Retention Processing

Upon expiry of the applicable retention period, personal data is either permanently deleted from our systems or irreversibly anonymised so that it can no longer be associated with an identified or identifiable natural person.

Notwithstanding the foregoing, Rod may retain certain data for a longer period where required by a legal obligation, judicial order, or legitimate interest in the context of pending or foreseeable legal proceedings.

8. Data Security

Technical and Organisational Measures

Rod.tn implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include, where applicable, encryption of data in transit and at rest, access controls and authentication mechanisms, and regular security monitoring.

Access to personal data within our organisation is restricted to personnel who require such access for the performance of their duties and who are subject to confidentiality obligations.

No Absolute Guarantee

Whilst Rod.tn takes its security obligations seriously and applies industry-standard practices, no method of electronic transmission or storage is entirely secure. Rod cannot guarantee absolute security and shall not be liable for any breach of security that is beyond its reasonable control.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, Rod will notify you in accordance with its obligations under applicable law.

User Responsibilities

You are responsible for maintaining the confidentiality of your account credentials. You must immediately notify Rod.tn at contact@rod.tn if you become aware of any unauthorised use of your account or any other security incident affecting your personal data.

9. User Rights

Your Rights Regarding Your Personal Data

Subject to applicable law, you have the following rights with respect to your personal data processed by Rod.tn:

  • Right of access: you may request confirmation of whether personal data concerning you is being processed and, if so, obtain a copy of that data.
  • Right to rectification: you may request the correction of inaccurate or incomplete personal data.
  • Right to erasure: you may request the deletion of your personal data where there is no overriding legitimate ground for continued processing.
  • Right to restriction of processing: you may request that processing of your personal data be restricted in certain circumstances.
  • Right to object: you may object to processing carried out on the basis of legitimate interest, including profiling, at any time.
  • Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

How to Exercise Your Rights

To exercise any of the rights listed above, please send a written request to: contact@rod.tn

We will endeavour to respond to your request within thirty (30) days. In some cases, we may require proof of your identity before processing your request. Where requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or to refuse to act.

Children's Privacy

The Platform is not intended for use by individuals under the age of eighteen (18). Rod.tn does not knowingly collect personal data from minors. If we become aware that personal data has been collected from a person under the age of eighteen without verifiable parental consent, we will take immediate steps to delete that data from our systems.

10. Modifications to the Policy

Right to Amend

Rod.tn reserves the right to modify this Privacy Policy at any time, in particular to reflect changes in applicable legislation, technological developments, or evolutions in our data processing practices.

Any material modification to this Policy will be communicated to registered users via email or through a prominent notice on the Platform prior to the modification taking effect. Continued use of the Platform following the publication of a revised Policy constitutes acceptance of the revised terms.

Version History

The date of the most recent update to this Privacy Policy is indicated at the top of this page. We encourage you to review this Policy periodically to remain informed of how we protect your personal data.

Where a new version of the Policy requires renewed consent for certain processing activities, we will seek such consent in accordance with applicable legal requirements before proceeding.

Governing Law

This Privacy Policy is governed by and construed in accordance with Tunisian law, in particular Law No. 2004-63 of 27 July 2004 on the protection of personal data and any subsequent amendments thereto. For users located in the European Union, this Policy is additionally designed to be compatible with the General Data Protection Regulation (EU) 2016/679 (GDPR). Any dispute arising in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts of Tunisia.