Privacy policy

Last updated 16 October 2026 · terms version 2026‑10‑16.2

In short: we use your information only to check your case and build your pack. We don't sell it or use it for advertising. Case data and uploads are deleted 60 days after delivery. We never store card numbers or ID documents.

1. Who is responsible

Appeal My Rental is a name used by Elbek, a Finnish sole trader. Business ID 3570992-5 (Finnish Trade Register). Address: Myllyväenkatu 10 D 3, 00920 Helsinki, Finland. Phone +358 40 757 0116. Email [email protected]. We have not appointed a data protection officer and are not required to.

2. What we collect

Contact details: name, email, phone (if you give it), country of residence.
Case details: the rental company, the country and branch, booking route, rental agreement number, dates, how you returned the car, what you were charged for and the amount, your card type and scheme (not the card number), your cover, what you have done so far, and your description.
Documents you upload: the company's claim or invoice, your photos and videos of the car, the rental agreement, the return report and the company's letters. Rental agreements often show your driving licence number and address. You can cover them before you upload; we do not need them.
Payment information from Stripe: that you paid, the amount, your email and your billing country. We never see your full card details.
Your consents and choices on the order page and any withdrawal, with date, time, IP address and browser type, as proof of what was agreed.
Where you found us: the partner code in the link you used, and the page of our site you came from, saved with your case.
When you opened your pack link or PDF, as proof of delivery.
Emails you send us.
Technical data: IP address and request logs, used for security.

We do not ask for, and do not keep, card numbers or ID documents. If an upload shows a full card number or an ID document, we delete it and ask you to send a version with those details covered.

3. Why we use it and on what legal basis

Checking your case before you pay: steps you ask for before a contract (GDPR art. 6(1)(b)).
Building and delivering your pack, answering you, handling refunds and withdrawals: performance of our contract (art. 6(1)(b)).
Keeping accounting and tax records: legal obligation (art. 6(1)(c)), under the Finnish Accounting Act and VAT rules.
Keeping proof of the contract, of the information we gave you and of the pack we delivered: our legitimate interest in being able to prove it if there is a dispute (art. 6(1)(f)).
Keeping the website secure and preventing abuse: our legitimate interest in running a safe service (art. 6(1)(f)).
Statistics on which partners and pages bring cases, and proof that we delivered your pack: our legitimate interest in running and improving the service and in handling disputes and chargebacks (art. 6(1)(f)).

We need the details marked as required to check your case and build your pack. Without them we can't provide the service.

We check your form answers against fixed rules before we send you a payment link. For most customers a person makes the decision. For customers living in Germany the check is automatic: our software checks the answers against the fixed rules in our terms (section 6) and sends the payment email or the answer that the pack does not fit. If an answer in your form was wrong, reply to our email: we correct it and run the check again.

The emails about your order are part of the service: the confirmation of your case, our answer, at most one payment reminder, the order confirmation, your pack, one follow-up email two weeks after delivery to ask whether the company replied, the confirmation of any withdrawal, and, if you ask for it, the "save and finish later" link. You can stop the follow-up email by replying "stop". We send no newsletters or advertising.

4. Other people in your documents

Your documents may name other people, such as another driver or a member of the rental company's staff. We use those names only to prepare your documents.

5. Who processes it for us

Our own server in Finland: case data and uploads.
Cloudflare (website delivery and security). Traffic passes through Cloudflare's network, including outside the EU.
Google Workspace (our email inbox).
Resend (sending our emails; EU region, Ireland, eu-west-1).
Stripe (payments; Stripe is also an independent controller for fraud prevention and legal compliance).

Where these providers process data outside the EU/EEA, they rely on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards. Each provider works for us under a data processing agreement. We never sell your data or use it for advertising.

6. How long we keep it

Case data and uploads: 60 days after we deliver your pack. If we never deliver a pack (you don't buy, or we decline your case), 60 days after you sent the form.
Emails with us, and our internal notes about your case: deleted from our case system 60 days after delivery (or after you sent the form, if we never deliver); copies in our mailbox are deleted after 12 months.
Proof of the contract (case reference, name, email, your consents and choices with date, time, IP address and browser type, the date your pack was opened, the terms version, any withdrawal, and the pack we delivered): 3 years after the end of the year of your order.
Accounting record of your payment (reference, date, amount, currency, country, payment ID; no case details): 6 years after the end of the financial year, as Finnish accounting law requires.
Backups of our server are kept for at most 14 days.

7. Your rights

You can ask for a copy of your data, and to correct, delete, restrict or object to its use, or receive it in a portable format. Email [email protected]. You can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority where you live (in the UK, the ICO).

8. Cookies and browser storage

Our only own cookie is "lang": if you pick a language in the menu, it remembers that choice for one year, so our homepage opens in your language. It holds nothing else and is not used for tracking. While you fill in the case form, your browser keeps a draft of your answers in its session storage so nothing is lost between steps; it is deleted when you close the tab or send the form. Our security provider Cloudflare may set a strictly necessary security cookie. We use no analytics, advertising or tracking cookies or storage. Our fonts are served from our own server.

If you choose "Save and finish later" on the case form, we store your unfinished answers (not your files) and your email address on our server for 14 days so the link we email you works, then delete them. The legal basis is your request (GDPR art. 6(1)(b)).

9. Press and partner contacts

We sometimes email journalists, bloggers and organisations about our service. We only use work or contact addresses that they publish themselves, and we keep the name, address, organisation and our correspondence for up to 2 years. The legal basis is our legitimate interest in telling people about the service (GDPR art. 6(1)(f)). If you don't want to hear from us, reply "stop" and we will not write again.