Privacy statement

This English translation is provided for convenience. In case of any discrepancy, the Dutch version prevails.

1. Who is responsible for your data

Huurtreffer is the controller for the personal data processed through huurtreffer.nl.

• Huurtreffer is a trade name registered in the commercial register of the Dutch Chamber of Commerce (Kamer van Koophandel) under number 42126798. That number also shows the business that uses this trade name and that is the controller.
• Address: Emmastraat 4, 5503 JK Veldhoven. VAT identification number: NL869845780B01. We do not receive visitors at that address; please contact us at info@huurtreffer.nl.
• Email: info@huurtreffer.nl

We have not appointed a data protection officer; that is not compulsory for an organisation of our size. Send privacy questions to the email address above. Put "privacy" in the subject line and we will pick it up as a priority.

2. What we do, in short

We collect and show rental listings from third parties, send you alerts about homes that match your search preferences and offer tools to help you respond. For that we need a limited amount of data from you. We do not sell your data, we do not rent it out and we do not use it for third party advertising.

3. Which data we process

3.1 Data you give us yourself

• Phone number: required, because you log in with a code sent by WhatsApp or text message.
• Email address: required at checkout, because the law obliges us to send you a confirmation that you can save and print. We use it for that confirmation, for your invoice and, if you set that up, for alerts by email.
• Search profile: city or area, rent, number of rooms, floor area, property type, preferred start date and the channels on which you want to receive alerts.
• Tenant file, only if you fill it in yourself: name, year of birth, income, work or study, household situation, motivation text and any documents you upload.
• Tenancy agreements you upload for the contract check. A tenancy agreement often also contains data about the landlord. Black out what is not needed before you upload, such as bank account numbers and a citizen service number (burgerservicenummer).
• Messages you send us, by email, through the chat on the site or through the form in your account with which you make a request about your data. We store the text of such a request in encrypted form.
• Whether you are buying in the course of a business, and in that case your company name and Chamber of Commerce number.

3.2 Data that arises automatically

• Payment data: amount, time, status and a payment reference. The payment itself runs through Mollie, for iDEAL, and through PayPal. We ourselves do not see or keep any account numbers, card numbers or login details for your bank.
• Account data: which pass you have, the start and end date, your language choice, your alert settings with the moment you chose them, and your last activity.
• IP address and technical details of your browser: needed in order to show you the site, to resolve faults and to detect misuse. We keep this data in security logs for 12 months at most and do not link it to your search behaviour. For limits on the number of login codes we keep only a hashed version of your IP address, for 7 days at most.
• Error messages and security logs: what went wrong and when, which device logged in and which setting you changed when. Your phone number is not in there; the log refers to your account with a hashed key.
• Click identifier of advertisements, known as the gclid, gbraid or wbraid: only if you arrive through an advertisement and only if you clicked "Accept" in the cookie banner. Without that choice we do not keep that identifier on your device and we do not read it. If you withdraw your consent, we delete it. We keep it for 90 days.
• Your cookie choice: what you chose in the cookie banner, with the date on which you chose it.

We never ask for a citizen service number, a copy of your identity document or your bank statements. Please do not upload those in your tenant file either.

4. What we use it for and on which legal basis

We process data only for a specific purpose, with a legal basis from the General Data Protection Regulation.

• Creating your account and letting you log in. Data: phone number, login code. Basis: performance of the contract, Article 6(1)(b).
• Delivering your pass and giving you access. Data: account data, payment status. Basis: performance of the contract.
• Sending you the confirmation required by law after your purchase. Data: email address, chosen pass, price, start and end date, your request to start immediately. Basis: legal obligation, Article 6(1)(c).
• Sending you alerts about homes that match your search profile. Data: search profile, phone number, email address. Basis: performance of the contract. If you do not have a pass and you switch alerts on, the basis is your consent, Article 6(1)(a). Alerts are off by default; you switch them on yourself in your account, and we record when you did that and which text was on screen at the time.
• Delivering the tools, such as the reply text, the tenant file as a PDF, the chance score, the scam signals, the rent check, the negotiation report, the deposit recovery letter, the moving bundle and the rent watch. Data: search profile, tenant file. Basis: performance of the contract.
• Carrying out the contract check. Data: the tenancy agreement you upload and the text in it. Basis: performance of the contract. What happens to that text is set out in Article 9.
• Answering your questions and handling complaints. Data: your message and your account data. Basis: performance of the contract and our legitimate interest in good service, Article 6(1)(f).
• Drawing up invoices and keeping our accounts. Data: name or email address, amount, date. Basis: legal obligation, Article 6(1)(c).
• Securing the site, preventing misuse and fraud and enforcing limits. Data: IP address, technical data, login attempts. Basis: legitimate interest in a secure service.
• Preventing repeated misuse. Data: a hashed version of your phone number. Basis: legitimate interest in a secure service. We use this only after misuse has been established and only in order to recognise that a number has been blocked before.
• Making backups, so that we can restore your account and your data after a fault or an error. Data: a copy of our database. Basis: legitimate interest in a reliable service and our duty to secure data, Article 32.
• Assessing advertisements for signals of a scam and removing listings that give cause for that. Data: the advertisement and the contact details of the landlord or agent. Basis: legitimate interest in a safe service and a legal obligation as a hosting service.
• Improving the service with aggregated figures that cannot be traced back to a person. Basis: legitimate interest in a service that works and is understandable.
• Measuring which advertisements lead to a purchase. Data: click identifier, cookies, purchase data and, if you have consented to it, a hashed version of your email address or phone number. Basis: solely your consent through the cookie banner.
• Establishing, exercising or defending rights in a dispute. Basis: legitimate interest in legal protection.

Where the basis is consent, you can withdraw it at any time. That has no effect on what has already happened before.

5. Who we share data with

We engage service providers. With the parties that act as processors for us we have a data processing agreement; they may only use your data for the task we give them. A number of parties are themselves controllers for part of the processing and have their own privacy statement for that; this is stated per party below.

• Mollie: handling iDEAL payments. Processed in the European Union. Mollie is also a controller for the payment itself.
• PayPal: handling PayPal payments. PayPal is also a controller for the payment itself and has its own privacy statement.
• Meta, for WhatsApp Business: sending login codes and alerts by WhatsApp. Meta also processes for its own purposes and is a controller to that extent.
• Brevo (Sendinblue): sending login codes by text message. For that, Brevo receives your phone number and the text of the message. Processor, established in France, with processing in the European Union.
• Our email service provider: sending confirmations, invoices, alerts and service emails. Processor.
• Vercel: hosting of the website. Processor. Servers in the European Union, with support that may take place from the United States.
• MongoDB Atlas: our database, with storage in the European Union. Processor.
• Cloudflare: storage of the daily backups of our database and of the photos with the rental listings. The backups are in shielded storage with the European Union jurisdiction, which is never publicly reachable and is separate from the storage for photos. Processor.
• Google, for measuring advertisements. Only if you have consented to it do we send an encrypted, hashed version of your email address or phone number, so that Google can link a purchase to an advertisement click. Google is also a controller for that measurement itself and has its own privacy statement. Without your consent we send nothing.
• Google, for the fonts on the site. Our pages load fonts from Google. In doing so, Google receives your IP address, even if you choose "Essential only". No cookie is placed for this and no identifier of you is stored.
• Anthropic: language technology for producing reply texts, for the chat and for the contract check. We send only the text needed for that. Processor.

In addition, we may provide data to an accountant, a debt collection party or a lawyer where that is necessary, and to government bodies where the law obliges us to.

We do not share your data with landlords or agents. If you want to respond to a home, you send what you want to share yourself. What the landlord or agent does with it falls under their own privacy policy.

6. Transfer outside the European Economic Area

We keep the processing within the European Economic Area as far as possible. Our database is in the European Union, our backups are in storage with the European Union jurisdiction, our text message provider processes in the European Union and our hosting is set up for the European Union.

With a number of parties, processing may nevertheless take place outside the European Economic Area, in particular in the United States. Per party we use this safeguard:

• Vercel: the standard contractual clauses of the European Commission. Data is in the European Union; support may take place from the United States.
• Cloudflare: the standard contractual clauses of the European Commission, supplemented by the adequacy decision for the EU-US Data Privacy Framework. The backups themselves do not leave the storage in the European Union; support may take place from the United States.
• Meta: the standard contractual clauses of the European Commission.
• Google: the adequacy decision for the EU-US Data Privacy Framework, with the standard contractual clauses as a fallback.
• Anthropic: the standard contractual clauses of the European Commission, supplemented by encryption and by limiting what we send.

If an adequacy decision lapses, we fall back on the standard contractual clauses and reassess whether we can continue the transfer. You can request a copy of the safeguards used from us at info@huurtreffer.nl.

7. How long we keep data

• Account and search profile: up to 12 months after your last activity. After that we delete them automatically. If a feature continues after the end of your pass, such as the rent watch, we keep your account for as long as that feature runs.
• Tenant file and uploaded documents: up to 6 months after the end of your last pass, or sooner if you delete them yourself. After that we delete them automatically. We send you a message before we throw them away.
• Uploaded tenancy agreements for the contract check: 30 days, then automatically gone.
• Chat conversations: 30 days.
• Invoices and payment data: 7 years, because tax law requires it. After your account is deleted, only the payment reference, the amounts and the date remain, without your email address and phone number.
• Requests about your data and complaints: up to 2 years after they are settled, or longer where that is necessary for an ongoing dispute. If you delete your account, we remove the text of your request and keep only the reference, the date, how it was handled and a hash of the text, as evidence that we dealt with your request on time.
• Click identifier of advertisements: 90 days, and only if you have given consent.
• Cookie choice: 12 months at most, after that we ask again.
• IP address and security logs: 12 months at most; the log is cleaned up automatically after 12 months. If you delete your account, we make the log entries about you unreadable straight away: they then no longer refer to you and their content is gone.
• Backups: every day we make a copy of our database; we keep it for 30 days and after that it is deleted automatically. Data that you delete or that we delete may therefore still be in a backup for up to 30 days after that moment. We use a backup only to restore the service after a fault or an error, never to bring deleted data back into use; if we restore a backup, we carry out deletions from after that backup again.
• Block list after established misuse: a hashed version of your phone number, 3 years at most. It does not let us see who you are, only that a number has been blocked before. If no misuse has been established, we do not keep that version after your account is deleted.

If you delete your account, we delete your data straight away, with the exception of what we have to keep by law, such as invoices, of the evidence about your requests above, of the block list above where misuse has been established, and of the backups that disappear by themselves within 30 days. A running pass stops at that moment.

8. How we secure your data

We take appropriate technical and organisational measures. Among other things:

• encrypted traffic between your device and our site;
• logging in without a password, with a one-time code that is valid briefly and works only once;
• limits on the number of codes per number per day and per requester;
• encrypted storage of your email address, your tenant file and the text of your requests;
• access to data only for those who need it for their work;
• storage with service providers that meet a recognised security standard;
• daily backups in shielded storage, kept for 30 days;
• automatic deletion of data whose retention period has expired;
• logs to detect misuse.

No service is completely invulnerable. If you notice something that is not right, or think you have found a weak spot, report it at info@huurtreffer.nl. We respond, and we never use such a report against the person who made it. If there is nevertheless a data breach with a risk to you, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and inform you where the law requires it.

9. Automated processing, language technology and the indications

The chance score is an automated estimate. We compare your search profile and the details you filled in yourself with the features of the home, such as rent, income requirement, number of rooms, area and how long the home has already been online. That produces an indication, meant to help you choose which homes to respond to.

The chance score is not a decision about you, has no legal effect and is not shared with landlords or agents. There is therefore no automated decision making within the meaning of Article 22 of the General Data Protection Regulation. The same applies to the rent check, the scam signals, the contract check and the negotiation report: they are indications, not judgements and not advice.

For the reply text, the chat and the contract check we use language technology from Anthropic. For the contract check we send the text of the agreement you upload. No member of our staff reads along, unless you ask us to. Your input is not used to train third party models. We delete the file after 30 days. Do not put data in a reply text or in the chat that you would rather not share.

We also assess advertisements ourselves, for example for signals of a scam. Where that leads us to remove an advertisement or restrict a landlord or agent, it is not done solely automatically: a person always looks at it before it has consequences. We tell the landlord or agent what we have done and on what ground, and they can appeal to us against it.

10. Your rights

You have the following rights:

• Access: an overview of the data we hold about you. In your account you download it straight away as a file, including the log about your account.
• Rectification: having incorrect data corrected.
• Erasure: having your data deleted, in so far as we do not have to keep it by law.
• Restriction: having the processing paused temporarily, for example if you dispute the accuracy.
• Objection: objecting to processing based on a legitimate interest.
• Portability: receiving the data you gave us yourself in a common file format.
• Withdrawing consent: at any time, without effect on what has already happened before.

You arrange most of it yourself in your account: changing your search profile, editing your tenant file, deleting uploaded files, switching your alerts off and deleting your account. If you delete your account, that happens straight away once you have confirmed it with a code.

For other requests, use the form in your account or email info@huurtreffer.nl. We respond without undue delay and in any event within one month of receiving your request. If your request is complex or you have made several requests, we may extend that period by two months; we tell you that within the first month, with the reason. To prevent us giving data to the wrong person, we may ask you to make your request from the phone number or the email address that belongs to your account.

11. Making a complaint

If you are not happy with how we handle your data, please tell us first at info@huurtreffer.nl. We are glad to look into it.

You also always have the right to lodge a complaint with the supervisory authority. In the Netherlands that is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl. If you live in another country of the European Union, you can also turn to the supervisory authority in your country.

12. Cookies and comparable techniques

We place only essential cookies without asking your consent. Everything that is not essential we place only after you have made your choice in the cookie banner. That also applies to keeping the click identifier of an advertisement in your browser storage. Which cookies those are exactly and how long they stay is set out in our cookie policy. You can also change your choice there at any time.

13. Minors

Our service is intended for people aged 18 and over and we do not knowingly collect data from minors. If you think we do hold data about a minor, email info@huurtreffer.nl and we will delete it.

14. Third party websites

Our site contains links to websites of landlords, agents and other parties. Their own privacy statements apply on those websites. We have no say over them and are not responsible for them.

15. Changes to this statement

We update this statement when our service or the rules change. The current version is always on this page, with the version date at the top. If it is a far reaching change, we let you know through your account or by message.

Huurtreffer, Chamber of Commerce 42126798, VAT NL869845780B01, Emmastraat 4, 5503 JK Veldhoven. Version 17 September 2026.