Librent Terms of Service

Translation notice. This English translation is provided for information only and is pending legal review. The Polish version is the binding version and prevails in the event of any discrepancy.

These Terms of Service set out the rules for the provision of electronically supplied services by DydlakCloud Dawid Dydliński (hereinafter the "Service Provider"), conducting business in the form of Indywidualna działalność gospodarcza (CEIDG), NIP (Tax ID) 6423227346, REGON (Statistical No.) 387752266, with its registered address at ul. Zebrzydowicka 12 lok. 5, 44-200 Rybnik, within the Librent service (hereinafter the "Service"), and set out the rights and obligations of the Service Provider and the Users.

§ 1. Definitions

• Service — the Librent web application available at https://dydlak.cloud, enabling the management of equipment rental, customers, bookings and the calendar.
• Service Provider — DydlakCloud Dawid Dydliński, the operator of the Service, providing electronically supplied services.
• User — a natural person, a legal person or an organisational unit without legal personality that has registered with the Service and uses the services of the Service Provider.
• Account — a set of resources identifying the User, created in the Service as a result of registration and used to access the services.
• Organisation — a set of data (equipment, customers, bookings, members) created by the User in the Service; a User may be a member of one or more Organisations.
• Terms of Service — this document, together with the Privacy Policy available at /en/privacy.

§ 2. General provisions

1. The Terms of Service set out the rules for using the Service, including the rules for registration and for creating and using an Account and Organisations.
2. The Service is a software platform that helps Users manage equipment rental. The Service Provider is not a party to the lease/rental agreements concluded between Users and their customers and is not liable for the performance of those agreements.
3. The User uses the Service at their own risk and for their own purposes, in compliance with the laws in force in the Republic of Poland and in the countries in which the User conducts business.

§ 3. Registration and Account

1. In order to use the Service, the User registers by completing the registration form, providing their first and last name, email address and password.
2. Registration is free of charge. Registration is completed on condition of:
   • providing true, current and complete data (indecent names, names infringing the rights of third parties or the law are not permitted and may result in the Account being blocked);
   • confirming the email address (verification is required — the verification link expires after 24 hours);
   • giving the required consents — acceptance of these Terms of Service and the Privacy Policy. Consent is explicit and voluntary. The User may withdraw it at any time, which is equivalent to submitting a request to delete the Account.
3. The User is obliged to keep their password and login details confidential and bears full responsibility for all actions taken using their Account.
4. The Service Provider reserves the right to refuse registration or to block an Account in the event of a breach of the Terms of Service or the law, in particular where falsification of data or prohibited activity is suspected.

§ 4. Services provided in the Service

1. Within the Service, the Service Provider makes tools available to the User for:
   • creating and managing Organisations;
   • adding and categorising equipment;
   • managing a customer database;
   • creating and tracking bookings;
   • generating agreements (templates and documents ready for signature);
   • integrating communication with customers;
   • viewing the calendar and statistics;
   • inviting team members to an Organisation.
2. The scope of functionality may change. The Service Provider informs Users of material changes by email or by notices in the Service.
3. The Service Provider does not guarantee uninterrupted availability of the Service and may carry out technical breaks for maintenance, updates or for reasons beyond its control (force majeure).

§ 5. Obligations of the User

1. The User undertakes to use the Service in accordance with the law, the Terms of Service and good practice, and in particular:
   • not to submit unlawful or offensive content or content infringing the rights of third parties (including copyright, image rights and trade secrets);
   • not to take actions aimed at disrupting the operation of the Service, including attempts at unauthorised access, attacks or overloading the infrastructure;
   • not to make their Account available to third parties or transfer rights to the Account without the consent of the Service Provider;
   • to comply with the law, including the GDPR, when collecting and processing the data of their customers entered into the Service — the User is the controller of that data and the Service Provider merely its processor (see the Privacy Policy).
2. The User bears sole responsibility for the content entered into the Service (equipment descriptions, customer data, the content of agreements and of messages sent on the User's behalf).

§ 6. Payments

1. The Service Provider may provide services in a free version and a paid version (plan/subscription). The scope and prices of paid plans are stated in the Service interface before an order is placed.
2. An agreement for the provision of paid services is concluded upon payment for the selected plan. The User has the right to withdraw from the agreement within 14 days of its conclusion, in accordance with the Polish Consumer Rights Act, subject to the exceptions set out in that Act.
3. Failure to pay for a paid plan results in restricted or blocked access to paid features, while the User's data remains available during the grace period specified in the interface.

§ 7. Personal data and privacy

1. Matters relating to the processing of personal data, including the information required by Article 13 of the GDPR, are governed by the Privacy Policy, which forms an integral part of the Terms of Service.

§ 8. Copyright and intellectual property

1. Copyright in the interface, code, marks and graphic elements of the Service belongs to the Service Provider. The User is granted a free-of-charge, non-exclusive licence to use the Service for the duration of the Account, to the extent necessary to use the services.
2. Content entered by the User remains the User's property. The User grants the Service Provider a free-of-charge licence to process that content to the extent necessary to provide the services (storage, display, document generation, sending).

§ 9. Liability

1. The Service Provider will exercise due diligence in maintaining the Service, but is not liable for:
   • the consequences of failures, technical breaks or force majeure;
   • agreements concluded by the User with its customers and their performance;
   • losses resulting from incorrect data entry by the User;
   • the actions of third parties, including providers of external services (e.g. email providers, storage providers).
2. The liability of the Service Provider is limited to the amounts actually paid by the User in the 12 months preceding the event giving rise to the damage, subject to liability that cannot be excluded by law.

§ 10. Complaints

1. Complaints concerning the operation of the Service may be submitted in writing to: ul. Zebrzydowicka 12 lok. 5, 44-200 Rybnik, or electronically to the email address: [email protected].
2. The Service Provider considers a complaint within 14 days of its receipt. This period may be extended where additional information needs to be obtained.
3. In disputed matters, out-of-court dispute resolution methods may be used, including the ODR platform.

§ 11. Termination and deletion of the Account

1. The User may delete their Account and data at any time via the Service interface, by sending a request to [email protected] or in writing to: ul. Zebrzydowicka 12 lok. 5, 44-200 Rybnik.
2. The Service Provider reserves the right to terminate the agreement and block the Account in the event of a breach of the Terms of Service or the law, after prior notice to cease (except in cases of gross breach).
3. After termination of the agreement, the Service Provider deletes the User's data within 30 days, subject to provisions requiring longer retention (e.g. tax and anti-money-laundering regulations).

§ 12. Amendments to the Terms of Service

1. The Service Provider reserves the right to amend the Terms of Service, including due to changes in the law or in the functionality of the Service.
2. The Service Provider informs Users of material changes at least 14 days before they take effect, electronically or by a notice in the Service.
3. Using the Service after the changes take effect constitutes acceptance of them, unless the User deletes their Account before the date on which the changes take effect.

§ 13. Final provisions

1. The Terms of Service are governed by the law of the Republic of Poland.
2. In matters not regulated herein, the provisions of the Polish Civil Code, the Act on the Provision of Electronically Supplied Services, the Consumer Rights Act and the GDPR apply.
3. Any questions concerning the Terms of Service should be sent to [email protected] or in writing to: ul. Zebrzydowicka 12 lok. 5, 44-200 Rybnik.

§ 14. Data Processing Agreement (DPA)

This § 14 constitutes an agreement on the entrustment of personal data processing within the meaning of Article 28 of the GDPR, concluded between the User and the Service Provider in electronic form (Article 28(9) of the GDPR). It takes effect when the User begins using the Service and remains an integral part of the Terms of Service.

14.1. Roles of the parties

1. With regard to the personal data of customers and other persons that the User enters into the Service in connection with its business (hereinafter "Entrusted Data"), the User acts as the data controller (Article 4(7) of the GDPR) and the Service Provider as the processor (Article 4(8) of the GDPR).
2. The Service Provider does not determine the purposes and means of processing of the Entrusted Data and processes it solely on the documented instructions of the User, the scope of which is defined by this Agreement and by the features of the Service used by the User.

14.2. Scope, nature and purpose of processing

1. Categories of data subjects: the User's customers, members of its Organisation and other natural persons whose data the User enters into the Service.
2. Categories of data: identification and contact data (first and last name, email address, telephone number, address, identity document number), data concerning equipment, bookings, agreements and notes, and the content of communications conducted through the features of the Service.
3. Nature of processing: collection, recording, encryption, storage, organisation, retrieval, use, erasure and destruction — to the extent necessary to provide the services of the Service.
4. Purpose of processing: enabling the User to manage a rental business (equipment, customers, bookings, agreements and communications) within the services provided by the Service Provider.
5. Duration: for the term of the Terms of Service, i.e. until the User's Account is deleted or the agreement is terminated, subject to § 11(3) of the Terms of Service.

14.3. Obligations of the Service Provider as processor

The Service Provider undertakes to:

1. process the Entrusted Data solely on the documented instructions of the User, including with regard to transfers of data to a third country or an international organisation, unless required to do so by European Union or Member State law;
2. ensure that persons authorised to process the Entrusted Data have committed themselves to confidentiality;
3. take the technical and organisational measures described in § 14.6 ensuring the security of processing;
4. not engage another processor (sub-processor) to process the Entrusted Data without the prior general or specific written authorisation of the User; in the case of general authorisation, the Service Provider informs the User of any intended changes concerning sub-processors, giving the User the opportunity to object;
5. assist the User, insofar as possible, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests from data subjects (Articles 15–22 of the GDPR);
6. assist the User in ensuring the security of processing, notifying personal data breaches, carrying out data protection impact assessments (Article 35 of the GDPR) and prior consultations with the supervisory authority (Article 36 of the GDPR);
7. delete or return the Entrusted Data after the end of the provision of services, in accordance with § 14.8;
8. make available to the User all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the User or another auditor mandated by the User;
9. immediately inform the User if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

14.4. Obligations of the User as controller

The User represents and undertakes that:

1. it is entitled to process the Entrusted Data and has a valid legal basis for processing it (Article 6 of the GDPR);
2. it has fulfilled its information obligation towards the data subjects (Articles 13 and 14 of the GDPR);
3. it is responsible for the lawfulness of collecting the Entrusted Data and entering it into the Service;
4. it will give instructions to the Service Provider in a form that allows them to be documented.

14.5. Sub-processors

1. The User grants general authorisation for the Service Provider to entrust the processing of the Entrusted Data to the following categories of sub-processors:
   • providers of cloud infrastructure, hosting and data storage (including S3-compatible object storage for files and images);
   • providers of email services (sending verification, transactional and notification messages) — depending on the SMTP server configuration;
   • providers of analytics tools — solely with respect to aggregated and pseudonymised data.
2. The Service Provider will inform the User of planned changes concerning sub-processors (addition or replacement), giving the User the opportunity to object within 14 days of notification.
3. The Service Provider will impose on sub-processors, by contract, data protection obligations at least equivalent to those arising from this Agreement and, where data is transferred outside the EEA, will ensure appropriate safeguards (Articles 44–49 of the GDPR).

14.6. Technical and organisational measures

The Service Provider ensures in particular:

• encryption of selected sensitive fields in the database using the AES-256-GCM algorithm (deterministic encryption for searchable fields, randomised for the others);
• encryption of data in transit (TLS);
• storage of passwords in one-way hashed form (bcrypt);
• access control and restriction of access to data to authorised persons;
• regular backups and restore procedures;
• maintenance of a record of processing activities in accordance with Article 30(2) of the GDPR.

14.7. Notification of personal data breaches

1. The Service Provider notifies the User of a personal data breach concerning the Entrusted Data without undue delay, and no later than 48 hours after becoming aware of it.
2. The notification contains at least: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences of the breach and a description of the measures taken or proposed to address it.

14.8. Deletion and return of data after termination

1. After the end of the provision of services, the Service Provider, at the User's choice, deletes or returns all Entrusted Data and deletes existing copies, unless European Union or Member State law requires storage of the data.
2. Deletion takes place within 30 days of termination of the agreement, subject to provisions requiring longer retention (e.g. tax and accounting regulations).

14.9. Audit

1. The User has the right, no more than once every 12 months and in the event of a justified suspicion of a breach, to audit the processing of the Entrusted Data at the Service Provider.
2. The audit is carried out on a date agreed in advance, during the Service Provider's working hours, in a manner that does not disrupt its business.
3. The costs of the audit are borne by the User, unless the audit reveals a breach of obligations by the Service Provider.

14.10. Liability

1. The parties are liable for damage caused by the processing of data in accordance with Article 82 of the GDPR, on the terms set out therein.
2. The Service Provider is not liable for damage resulting from the unlawful or unauthorised entry of Entrusted Data into the Service by the User.