Only Rent Privacy Policy
Effective Date: March 1, 2026
OnlyRent. Only Rent Technology (S) Pte. Ltd.
Article 1 Purpose and Scope of This Policy
This Privacy Policy applies to the Only Rent platform (the "Platform") operated by Only Rent Technology (S) Pte. Ltd. (the "Company"). This Policy explains how the Platform collects, processes, uses, stores, and protects users' personal data. The Company is the data controller of the Platform. In collecting and processing personal data, the Company will comply with Singapore's Personal Data Protection Act (PDPA) and any mandatory data protection laws applicable in the user's jurisdiction, including but not limited to Taiwan's Personal Data Protection Act. If the laws of the user's jurisdiction contain mandatory provisions regarding personal data protection, such provisions shall prevail. If you have any questions, requests, or complaints regarding this Privacy Policy or the handling of personal data, you may contact the Company at support@onlyrent.sg. The Company will respond within a reasonable period. By using the Platform, you acknowledge that you have read and agreed to this Privacy Policy.
Article 2 Categories of Data Collected
The Platform may collect the following categories of data: • Identity data, including name, date of birth, national identification number, passport number, residence permit number, and other data capable of identifying an individual under applicable law; • Contact data, including mobile phone number, email address, and mailing address; • Account and transaction data, including service records, order details, payment records, refund records, and rating records; • Device and technical data, including IP address, device identifier, device model, operating system version, browsing records, cookie information, and application usage behavior records; • Location-related data (where authorized by the user), including location information actively entered or authorized by the user; • Customer service and communication data, including content of communications through customer service systems, email, or in-platform messages. Payment-related data is processed by third-party payment institutions, and the Platform does not store complete credit card or bank card information. Data sources include: information provided directly by users, technical data automatically generated during use of the Platform, and necessary verification information lawfully returned by third-party payment institutions or partner service providers. The Platform only collects and processes personal data to the minimum extent necessary to achieve specific processing purposes and avoids collecting excessive data unrelated to the services.
Article 2-1 Application Permission Usage
To provide complete functionality and a good user experience, the Platform's application may, after obtaining the user's consent, request the following device permissions based on actual functional needs: 1. Photo Library / Photo Access Permission (read storage) Used when a user publishes posts, skills, tasks, or other content, to select images from the device's photo library and upload them to the Platform for display or as supplementary content for transaction- or service-related data. 2. Camera Permission (CAMERA) Used when a user performs identity verification to take photos, or to capture images as records or supporting evidence during service performance, dispute handling, content upload, and other related functions. 3. Microphone Permission (RECORD_AUDIO) Used when a user records video or uses functions requiring audio recording, to simultaneously record audio in order to provide complete audiovisual content or as part of the function's operation. 4. Location Permission (LOCATION) Used to obtain the user's location information, in order to recommend nearby tasks, match service needs, confirm service addresses, optimize search results, provide map positioning functions, and assist with transaction security management. Users may choose whether to authorize precise or approximate location information according to their device settings. 5. Local Network Access Permission Used to detect the network connection status of the device and application, confirm whether service functions operate normally, assist with technical connection needs between devices or on local networks, and improve connection stability and service quality. Each of the foregoing permissions is activated only when the user actively uses the corresponding function. The Platform will not, without the user's permission, actively collect data unrelated to the foregoing permissions in the background. Users may manage, disable, or withdraw the foregoing permissions at any time through their device or operating system settings. However, if a user refuses to authorize, disables, or withdraws a specific permission, some Platform functions may not operate normally, be fully provided, or achieve their intended effect. The Platform uses data obtained through the foregoing permissions only to the extent necessary to achieve specific functional purposes, and collects, processes, uses, stores, and protects such data in accordance with this Privacy Policy and applicable laws.
Article 3 Legal Basis for Data Processing
The legal bases on which the Platform collects and processes personal data include: 1. performance of the contract between the user and the Platform; 2. compliance with legal obligations; 3. the user's express or implied consent; and 4. the Company's legitimate business interests in maintaining platform security, transaction order, and normal operations.
Article 4 Purposes of Data Use
The data collected by the Platform will be used for: identity verification, security management, transaction processing, payment integration, customer support, risk control, fraud prevention, dispute handling, legal compliance, data analysis, and operational optimization. The Platform may carry out content ranking, credit scoring, or risk assessment based on automated processing mechanisms in order to maintain transaction safety and service quality. Such automated processing may involve a comprehensive analysis of users' transaction history, rating history, performance records, or usage behavior data. Such automated processing does not constitute a decision producing final legal effects. If a user objects to any such result, the user may request manual review through customer service. Subject to the user's consent, the Platform may send marketing messages, push notifications, or emails. Users may disable marketing push notifications in the application settings or unsubscribe through the email unsubscribe mechanism. However, necessary notifications relating to transaction security, account risk, or system notices are not considered marketing communications.
Article 5 Third-Party Sharing, Technical Services, and Outsourced Processing
To provide complete services, the Platform may provide necessary data to third-party partners, including but not limited to: • third-party payment institutions; • cloud service providers; • data storage and server hosting providers; • map service API providers; • data analytics and system monitoring service providers; • push notification and communication service providers; and • competent authorities or judicial authorities lawfully entitled to access such data. The Platform may use third-party technical tools or software development kits (SDKs) to optimize system operation and user experience. Such third parties may only access necessary technical data within the scope of their services and must comply with confidentiality and data protection obligations. The Platform does not sell or lease users' personal data to any commercial third party.
Article 6 Cross-Border Data Transfers
User data may be stored or processed in Singapore, Taiwan, or other countries or regions that provide an appropriate standard of data protection. The Platform will adopt reasonable technical and organizational measures in accordance with applicable law to ensure the security and legality of cross-border data transfers.
Article 7 Data Retention Period and Account Deletion
The Platform will retain personal data for the period necessary to fulfill the purposes for which it was collected. Transaction and financial data required to be retained by law shall be kept for at least five (5) years or for a longer period if required by applicable laws and regulations. When a user requests deletion of an account, the Platform will terminate access to such account and will delete or anonymize the user's personal data within a reasonable period. However, data necessary for compliance with legal obligations, dispute handling, fraud prevention, or fulfillment of financial or tax retention obligations may be retained until the statutory retention period expires. Backup data may be deleted with delay due to technical operating cycles, but will be automatically cleared under the normal backup rotation mechanism.
Article 8 Data Security Measures and Security Incident Handling
The Platform adopts reasonable and appropriate technical and organizational measures to protect data security, including but not limited to: • encrypted transmission; • tiered access controls; • access monitoring; • data backup; and • regular security reviews. However, internet transmission is not absolutely secure, and the Platform cannot guarantee absolute security of data transmission. If a security incident occurs that may result in unauthorized access to, disclosure of, damage to, or loss of personal data, the Platform will conduct an investigation in accordance with applicable law and will notify the relevant competent authorities and affected users within the legally required time, including an explanation of the categories of data potentially affected and the remedial measures taken. However, if any data breach results from force majeure, unforeseeable or unavoidable malicious attacks by third parties, or causes not attributable to the Platform, the Platform shall not be liable for damages to the extent permitted by law.
Article 9 User Rights
Users may exercise the following rights in accordance with applicable law: • to inquire about or request access to personal data; • to request a copy of personal data; • to request supplementation or correction; • to request cessation of collection, processing, or use; • to request deletion; and • to withdraw consent. The Platform will handle such requests within a reasonable period, usually not exceeding thirty (30) days.
Article 10 Processing of Minors' Data
The Platform does not provide services to persons under the age of eighteen (18). If the Platform becomes aware that a minor has provided personal data without the consent of a legal guardian, the Platform will immediately cease processing such data and delete it.
Article 11 Cookies and Technical Identifiers
The Platform may use cookies, device identifiers, and similar technologies to improve user experience, conduct data analysis, and maintain security monitoring. Users may manage cookies through their device or browser settings. However, disabling certain technical features may affect the normal operation of some Platform services.
Article 12 Policy Amendments
The Platform may amend this Privacy Policy due to changes in law or operational needs. Material amendments will be notified to users through platform announcements, application notifications, or email. The amended policy will specify its effective date. Continued use of the Platform after the effective date of the amended policy shall constitute acceptance of the updated policy.