Privacy statement

How Monk Industries handles personal data in the Rent A Monk replica rental service. This statement describes what the system actually does, not what it is permitted to do.

Last updated: 4 September 2026

Who is responsible

Monk Industries, established in the Netherlands, is the controller for the personal data described here. A partner venue where you collect a replica acts as a processor on our documented instructions, under a data processing agreement. A venue cannot export, retain or separately use your data, and its staff see only the bookings at their own venue.

Questions, or any request described under your rights, go to privacy@rent-a-monk.com. We answer within one month.

What we collect, and why

You can book as a guest. An account exists only once you have proved control of your email address by following a sign-in link. A booking made with the same address as an existing account is not attached to that account until that proof exists.

What we deliberately do not collect

When you collect a replica, a member of venue staff records that they verified your identity and age and completed the venue's compliance checklist. The record is the attestation and who made it. We do not collect or store:

• your date of birth, or any evidence of your age
• your identity document, its type, its number, or an image of it
• your airsoft association (NABV) membership number
• your signature

This is a deliberate minimisation, decided during our legal review. Operational compliance with Dutch weapons legislation is the venue's responsibility; our system holds the record that the check was made and by whom, and nothing further. Adding any of the fields above would require a fresh legal review, not merely a software change.

Photographs of the replica

Staff photograph the replica when it is handed over and again when it is returned. These are a record of the equipment's condition, and supporting material for an insurance claim or a dispute. Capture guidance instructs staff to photograph the replica and not people, and location and camera metadata are stripped when the image is uploaded.

Nothing in our system charges you for damage on the basis of these photographs. Post-hoc damage billing is not part of this service.

Payments

Payments are handled by Stripe on a page hosted by Stripe. Your card or bank details are entered there and never reach our systems. We receive confirmation that a payment succeeded, the amount, and the identifiers we need to issue a refund. Stripe is also an independent controller for its own fraud prevention and regulatory obligations.

Email

We send transactional email only: confirmations, payment notices, reminders, cancellations, refunds and reassignment notices. There is no marketing mail and no newsletter.

We do not track whether you open our email. There is no tracking pixel in any message we send. We record only that a message bounced or was reported as spam, so that we stop mailing an address that is not working or does not want to hear from us.

Cookies

The site sets no analytics, advertising or profiling cookies, and loads no third-party scripts. There is therefore no consent banner, because there is nothing to consent to.

The cookies we do set are strictly necessary for the service to function:

• ram_booking and ram_booking_switch - keep you signed in to a booking you reached from a link in your email, so the link itself does not have to stay in your browser history
• ram_auth_pending - carries a sign-in attempt across the moment you follow the link in your email
• ram_venue_device and ram_venue_staff - used only by venue staff on venue equipment, never on a customer's device
• a session cookie from Supabase, our database and authentication provider, once you sign in

The five cookies we set ourselves are restricted so that scripts running in your browser cannot read them. The Supabase session cookie is set by that provider's library with its own defaults.

How long we keep things

Anonymising a booking is not the same as deleting it. The booking survives so that the seven-year financial record stays complete and reconcilable, but the link to you is removed. Your name and phone number are deleted and your email address is irreversibly overwritten with a generated placeholder, so what remains cannot be traced back to you. Each booking ages out on its own schedule, not on the schedule of your most recent visit.

Who else processes your data

Each has a data processing agreement with us. Where a transfer outside the European Economic Area is involved, it is covered by the European Commission's standard contractual clauses.

Automated decisions

We do not profile you and we make no decisions about you by automated means that have a legal or similarly significant effect.

Your rights

• Access. A copy of your booking history, contact details, handover records and complaints. We prove your identity with the same sign-in link that protects your dashboard, so a request from an unverified address gets a general answer and no data.
• Correction. Your contact details are editable in your dashboard. A serial number that has already been recorded against physical equipment is not rewritten; a discrepancy is recorded as a separate note rather than by altering history.
• Erasure. Applied as anonymisation. We must keep the financial record for seven years under Dutch tax law, which Article 17(3)(b) GDPR permits, and we will tell you that is what happened.
• Objection and restriction. Handled case by case.
• Portability. Your data in a structured, machine-readable file.
• Complaint. You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. We would rather you told us first, but it is your right either way.

Security, and what happens if it fails

Access to your data is restricted by the database itself rather than only by the application, so a mistake in the software does not open a door. Venue staff reach only their own venue's bookings. Payment card details never enter our systems at all.

If a breach occurs and it is likely to put your rights at risk, we notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, and we tell you directly if the risk to you is high.

Changes to this statement

If we change how we handle personal data we will update this page and the date at the top. A change that affects an existing booking is communicated to the people it affects, not left for them to discover here.