Working version, drafted from a review of Romanian and EU law. The text must be reviewed by a lawyer before it is relied on; details marked “[to be completed]” are for the platform's operator to fill in.
Privacy notice
In force from 01/07/2026
This notice explains which personal data the platform processes, why, who processes it and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Romanian Law No 190/2018.
1. Who is responsible for the data
- The hub (the company letting the unit, or its manager) is the CONTROLLER of the data of its tenants, guests, offer requesters, owners and staff: it decides what is collected and why. To exercise your rights about a stay, a lease or an offer, turn first to the hub (its contact details are in the emails and pages you received).
- The platform's operator ([to be completed]) is the hub's PROCESSOR for that data (GDPR art. 28): it processes it only to provide the platform, on the hub's instructions.
- The platform's operator is the CONTROLLER of user-account data (email, name, role), the sign-in log and the technical logs needed for security.
The platform operator's details:
- Name: [to be completed]
- Company ID (CUI): [to be completed]
- Trade Register number: [to be completed]
- Registered office: [to be completed]
- Email: [to be completed]
For data protection: [to be completed].
2. What data we process
| People | Data |
|---|---|
| Users (hub staff, admins) | email, name, phone (optional), role, hubs, sign-in history, actions taken in the app (who created or changed a record) |
| Owners | name, email, phone, units owned, purchase price and remarks (if the hub enters them), their own stays |
| Tenants and guests | name, email, phone, stay dates, unit, rent and payments, deposit, meter readings (with photos if sent), door codes and door history, messages received; for a contract: date of birth, address, national ID number (CNP) or company ID, ID card series and number, the drawn signature, the IP address at signing |
| People requesting an offer | name, email, phone, unit type and dates wanted, budget, message, language; for a company — its name and ID |
| Cleaners and the field team | name, phone, door code, cleanings done, photos uploaded, door-opening history on the day of a cleaning |
We do not process card data (only Stripe receives it) and do not use the data for advertising or profiling.
3. Why and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Running offers, bookings and leases, payments, invoices, access to the unit, communication with tenants | performance of a contract or steps before entering into it — (b) |
| Invoicing, accounting records, registering leases with ANAF | legal obligation — (c) |
| Platform security, the sign-in and door logs, fraud prevention, defending legal claims | legitimate interest — (f) |
| User accounts and running the platform | performance of the contract with the client — (b) / legitimate interest — (f) |
The national ID number (CNP) is collected only for the lease contract, with the safeguards required by art. 4 of Law No 190/2018: it is visible only in the contract and to the people managing the contract, never in reports or exports, and kept only as long as the contract and legal obligations require.
Some actions are automatic (for example, once the first month and the deposit are paid, the door code is created and the welcome message is sent), but no decision based solely on automated processing producing legal effects on you within GDPR art. 22 is taken.
4. Who receives the data
- The hub's staff, each according to their role (for example, the field team does not see rents, and reporting users see masked names).
- The providers that help us run the platform (sub-processors) — the full list, with the country, where this deployment hosts and stores the data (the server, the database, the files, the backup, the email) and the safeguards for each, is on the Processors page.
- Authorities, when the law requires it.
5. Transfers outside the European Economic Area
Some providers are outside the EEA (for example in the US or China). Transfers take place only with the safeguards of GDPR Chapter V: the adequacy decision for the EU–US Data Privacy Framework (for certified providers) or the European Commission's standard contractual clauses, together with a transfer impact assessment. For locks we use TTLock's European platform, whose API server is in Frankfurt (EU); TTLock is, however, a company in China, a country without an adequacy decision, which can access the data remotely: a hub using the locks must have standard contractual clauses in place and minimise the data (for example, a code's name may be just a first name or a reference).
6. How long we keep the data
| Data | Period |
|---|---|
| Stay, lease, payment and offer data | while the hub is a client of the platform, then deleted or anonymised, except what the law requires to keep |
| Accounting registers and supporting documents (invoices, receipts) | 5 years from 1 July of the year after the financial year (Law No 82/1991, art. 25, as amended by Law No 36/2023); annual financial statements — 10 years |
| Electronically signed contracts | for the contract's term and the limitation period (usually 3 years after it ends) |
| Offer requests that did not become leases | until the hub deletes them; we recommend at most 12 months |
| Sign-in and confirmation codes | expire in 15 minutes (codes) or 30 days (session) |
| Sign-in log and technical logs | as long as security requires, for the term of the contract |
7. Your rights
- access to the data and a copy of it (art. 15)
- rectification (art. 16) and erasure (art. 17)
- restriction of processing (art. 18) and portability (art. 20)
- objection to processing based on legitimate interest (art. 21)
- a complaint to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru 28–30, sector 1, Bucharest, www.dataprotection.ro
For data about a stay, a lease or an offer, write to the hub; we help it answer. For your user account, write to us at [to be completed]. We answer within one month (GDPR art. 12).
8. How we protect the data
- Encrypted connections (HTTPS) and role-based access: everyone sees only what their role allows, and names are masked for those who do not need them.
- Passwordless sign-in by an emailed link or one-time code; codes (sign-in and confirmation) are stored only as a cryptographic hash, with limited attempts.
- Stripe, SmartBill, FGO and TTLock keys are write-only and never shown again; files sit in private storage, served only to those entitled to see them.
- If a personal data breach happens, we tell the hub without undue delay, and ANSPDCP within 72 hours where we are the controller (GDPR art. 33).