Privacy Notice for Business Partners
Last Updated 29 October 2026
Grover Group attaches great importance to protecting personal data and respecting individuals' privacy rights.
This Privacy Notice explains how we process personal data relating to existing and prospective business partners, including their employees, owners, representatives and other individuals acting on their behalf.
It also applies to individuals applying for or using Grover's business rental services, including freelancers, sole traders, business owners and representatives of business customers.
This Privacy Notice explains which personal data we process, the purposes and legal bases of processing, the recipients of personal data, applicable retention periods and the rights of affected individuals.
1. Controller
Grover Group GmbH, Potsdamer Straße 125, 10783 Berlin, Germany, email: [email protected] (hereinafter referred to as "Grover Group", "we", "our" or "us"), is responsible as a controller for processing personal data in connection with its general business activities.
For business rental services, the relevant Grover rental company acts as the contractual partner and data controller. Depending on the country and applicable contractual arrangements, this may be Grover Deutschland GmbH, Grover Österreich GmbH, Grover Nederland B.V. or Grover Tech Rental Consumer Electronics Spain S.L.
The relevant rental company and Grover Group GmbH are jointly responsible for processing personal data in connection with business rental services where they jointly determine the purposes and means of processing, in accordance with Article 26 GDPR.
Under the applicable joint-controller arrangements, Grover Group GmbH is primarily responsible for facilitating the exercise of data subject rights and providing information concerning the processing of personal data.
Regardless of the allocation of responsibilities under the joint-controller arrangements, individuals may exercise their data protection rights against either relevant joint controller in accordance with Article 26(3) GDPR.
The essential contents of the joint-controller arrangement between Grover Group GmbH and Grover Deutschland GmbH are available here.
2. Data Protection Officer
You and any other individual whose personal data is processed may contact our external Data Protection Officer to request additional information or clarification regarding the processing of personal data.
Email: [email protected]
Subject line: Attn: Data Protection Officer
Please note that messages sent to this email address may also be accessible to Grover's Data Protection Team. If you wish to communicate confidentially or directly with the Data Protection Officer, you may request direct contact through this address.
3. Legal bases and Purposes
We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other applicable data protection laws.
Contractual and pre-contractual obligations — Article 6(1)(b) GDPR
Where the individual concerned is a party to a contract, processing may be necessary to take steps at that individual's request before entering into a contract or to perform an existing contract.
This includes processing information relating to rental applications, orders, deliveries, payments, contractual documentation and inquiries concerning the contractual relationship.
Legal obligations — Article 6(1)(c) GDPR
We process personal data where necessary to comply with applicable legal obligations, including those arising under tax, commercial and accounting laws.
Legitimate interests — Article 6(1)(f) GDPR
We may process personal data where necessary to pursue our legitimate interests or those of third parties, provided these interests are not overridden by the interests, rights or freedoms of the individuals concerned.
These interests include:
Establishing and maintaining contractual and business relationships, including communication with representatives and employees of business partners.
Responding to inquiries outside existing contractual relationships.
Internal administrative and accounting activities.
Ensuring IT security and the operation of our systems.
Conducting compliance investigations and maintaining building and facility security.
Establishing, exercising or defending legal claims.
Assessing creditworthiness and contractual risks, preventing fraud and avoiding payment defaults.
Creditworthiness assessments and fraud prevention
When assessing applications for our business rental services, including applications from freelancers and sole traders, we process personal data to assess creditworthiness, determine contractual risk, verify identity and prevent fraud.
We may use information provided during the application process, information obtained from credit reference agencies and results generated by our internal risk assessment systems.
Where processing is necessary for entering into or performing a contract with the individual concerned, Article 6(1)(b) GDPR may apply.
Where processing is necessary for our legitimate interests in preventing fraud, assessing contractual risks and avoiding payment defaults, Article 6(1)(f) GDPR may apply, provided those interests are not overridden by the individual's rights and freedoms.
Where identity verification involves special categories of personal data, including biometric data processed for uniquely identifying an individual, an applicable condition under Article 9 GDPR is also required.
Consent — Article 6(1)(a) GDPR
Where an individual has consented to processing for specific purposes, the processing is based on that consent.
Consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing undertaken before withdrawal.
Provision of personal data
In connection with a business relationship, individuals must provide personal data necessary to establish, perform or terminate the relevant relationship or to comply with applicable legal obligations.
Without the necessary information, we may be unable to establish or continue the business relationship.
Where personal data is required, we will indicate this during the collection process.
4. Categories of Personal Data
Depending on the nature of the business relationship, we may process the following categories of personal data:
Contact information, including full name, business address, telephone number, mobile telephone number and business email address.
Payment data necessary for payment processing and fraud prevention.
Information relating to projects, orders, contractual relationships, inquiries and other business activities.
Personal data obtained from publicly available sources, integrity databases and credit reference agencies.
Information required for compliance purposes, including commercial register records, publicly available financial information and information about relevant legal proceedings.
Business rental applications
For applications for business rental services, we may additionally process:
Identification and application information.
Creditworthiness information obtained from credit reference agencies, including credit scores and relevant payment history.
Financial and payment information.
Fraud prevention indicators.
Internally generated risk scores.
Identity verification information and results.
Records of approvals, rejections, referrals for manual assessment and applicable credit or rental limits.
Personal data may be obtained directly from applicants or, where applicable, from credit reference agencies, identity verification providers, fraud prevention providers and publicly available registers.
Where personal data relating to employees or representatives of business partners is not obtained directly from those individuals, it may be provided by their employer or the relevant business partner.
5. Recipients of your personal data
Within Grover, access to personal data is limited to departments and personnel who require the information for their responsibilities.
Where necessary and supported by an appropriate legal basis, personal data may be disclosed to:
IT service providers, including software-as-a-service, hosting, storage and cloud computing providers.
Payment service providers and credit institutions.
Debt collection agencies involved in the enforcement of claims.
Credit reference agencies providing information on creditworthiness and payment reliability.
Identity verification providers, fraud prevention providers and technology service providers supporting underwriting and credit assessment processes.
External accountants, tax advisers, insurance companies and legal service providers.
Other Grover group companies, where necessary for the purposes described in this Privacy Notice and supported by an appropriate legal basis.
Personal data may also be disclosed where the individual concerned has consented to the disclosure or where disclosure is required by law.
Where service providers process personal data on our behalf, we implement appropriate contractual arrangements in accordance with Article 28 GDPR.
6. Data transfer to third countries
For certain processing activities, we use service providers located outside the European Union or European Economic Area (EEA).
Where personal data is transferred to third countries, we ensure compliance with Chapter V GDPR.
Transfers may take place where the European Commission has adopted an adequacy decision concerning the recipient country or where appropriate safeguards are in place.
These safeguards may include the European Commission's Standard Contractual Clauses and supplementary technical, contractual or organisational measures where necessary.
In exceptional circumstances, transfers may take place on the basis of an applicable derogation under Article 49 GDPR, provided its legal requirements are satisfied.
Individuals may request a copy of the applicable transfer safeguards or information about where they are available by contacting us using the details provided in this Privacy Notice.
7. Retention period
We retain personal data only for as long as necessary for the purposes for which it is processed, subject to applicable legal obligations and other lawful grounds for continued retention.
Personal data may be retained for the duration of a contractual relationship, including its initiation, performance and termination.
Retention may also be necessary in connection with legal claims. Under Sections 195 et seq. of the German Civil Code (BGB), the general statutory limitation period is three years, although longer periods may apply in specific circumstances.
We are subject to applicable statutory retention and documentation requirements, including commercial, tax and accounting laws in the relevant jurisdictions. In Germany, these include requirements under the German Commercial Code (HGB) and the German Fiscal Code (AO), with statutory retention periods of six, eight or ten years depending on the category of records and applicable legal requirements.
Creditworthiness assessments, fraud prevention and identity verification
For business rental applications processed under the same retention and deletion arrangements as our consumer rental services, the following periods apply:
Credit scoring data relating to applications rejected for creditworthiness reasons is deleted or anonymised after six months.
Other creditworthiness data is deleted or anonymised five years after the end of the last rental agreement or the last account login, whichever occurs later.
Data generated through our internal fraud prevention and risk analyses is deleted or anonymised five years after the end of the last rental agreement or the last account login, whichever occurs later.
Data collected for identity verification is deleted six months after completion of the verification process.
Where bank account verification is carried out, the related bank account information is deleted or anonymised six months after receipt.
Where statutory obligations or other applicable legal grounds require continued retention, personal data may be retained for the period necessary to satisfy those requirements.
8. Data subject rights
Individuals whose personal data is processed have the following rights, subject to the applicable legal requirements:
Right of access — Article 15 GDPR
Individuals may request confirmation of whether their personal data is being processed and obtain access to the data and the information required under Article 15 GDPR.
They may also request a copy of the personal data undergoing processing.
Right to rectification — Article 16 GDPR
Individuals may request that inaccurate personal data be corrected or incomplete data be completed.
Right to erasure — Article 17 GDPR
Individuals may request deletion of their personal data where the applicable legal conditions are satisfied.
Right to restriction of processing — Article 18 GDPR
Individuals may request restriction of processing in the circumstances provided by law.
Right to data portability — Article 20 GDPR
Where the applicable conditions are satisfied, individuals may receive personal data they have provided in a structured, commonly used and machine-readable format or request its transmission to another controller.
Your right to object under Article 21 GDPR
Where processing is based on Article 6(1)(f) GDPR, individuals may object on grounds relating to their particular situation.
Where an objection is justified, we will cease the relevant processing unless compelling legitimate grounds prevail or the processing is necessary for the establishment, exercise or defence of legal claims.
Individuals may object to processing for direct marketing purposes at any time.
Right to withdraw consent
Where processing is based on consent, individuals may withdraw their consent at any time with effect for the future.
Rights concerning automated decision-making
Where decisions are based solely on automated processing, including profiling, and produce legal or similarly significant effects, Article 22 GDPR applies.
Where Article 22(3) GDPR applies, individuals have the right to obtain human intervention, express their point of view and contest the decision.
Further information is provided in Section 10.
Right to lodge a complaint — Article 77 GDPR
Individuals may lodge a complaint with a competent data protection supervisory authority if they believe that the processing of their personal data violates applicable data protection law.
9. The data subject can exercise their data protection rights here:
Individuals may contact us free of charge if they have questions regarding the processing of their personal data or wish to exercise their data protection rights.
Email: [email protected]
Postal address:
Grover Group GmbH Potsdamer Straße 125 10783 Berlin Germany
Data protection requests may also be submitted through our Privacy Webform:
10. Automated decision-making
When assessing applications for our business rental services, including applications from freelancers and sole traders, we may use automated processes to assess creditworthiness and the risk of fraud or non-payment.
These assessments may involve profiling and use information provided during the application process, information obtained from credit reference agencies, payment-related information and internal risk scores.
Our automated assessment combines these factors to evaluate creditworthiness and the likelihood of fraud or payment default. The outcome may determine whether an application is approved, rejected or referred for manual assessment, or influence the applicable credit or rental limit.
Where decisions are based solely on automated processing and produce legal or similarly significant effects, they are subject to Article 22 GDPR.
Where such automated decisions are necessary for entering into a contract with the individual concerned and the applicable legal requirements are met, Article 22(2)(a) GDPR permits those decisions.
Where Article 22(3) GDPR applies, affected individuals may request human intervention, express their point of view and contest the decision.
Requests may be submitted using the contact channels described in Section 9.
An automated assessment may result in an application being rejected or a lower credit or rental limit being assigned based on the assessed creditworthiness or risk of fraud or non-payment.