Privacy Policy
Your privacy and security are the foundation of Verhurio. Here is how we safeguard your data under EU 2016/679 GDPR data protection law.
We are Verhurio VOF, operating under the trade name "Verhurio" ("Company", "we", "us", or "our"), registered in the Netherlands. We operate the website verhurio.nl and the Verhurio mobile application (collectively, the "Services").
Verhurio provides a platform connecting landlords and tenants, enabling efficient communication, rent payments, document management, property listings, and tenancy administration.
We are the Data Controller of your personal data under the General Data Protection Regulation (GDPR) (EU) 2016/679. The legal entity responsible for processing your data is Verhurio VOF. Questions or concerns? Contact us at operations@verhurio.nl.
Summary of Key Points
This summary provides key points from our full privacy notice.
What personal data do we process?
Account details, rental & tenancy data, payment metadata, in-app messages, device identifiers, and technical logs.
Do we collect data automatically?
Yes, including IP addresses, device data, browser type, usage logs, and location (coarse, from IP) collected automatically.
Do we share data with third parties?
Only with trusted service providers under strict data processing agreements, such as Stripe for secure payment processing.
How do we protect your data?
Through industry-standard TLS encryption in transit, AES-256 encryption at rest, secure OTP codes, and server-validated authentication.
What are your rights?
Access, rectification, erasure, restriction, portability, objection, and the right to complain to the Autoriteit Persoonsgegevens.
How do you exercise your rights?
Email operations@verhurio.nl. We will respond within 30 days in accordance with GDPR.
Table of Contents
- What Information Do We Collect?
- How Do We Process Your Information?
- What Legal Bases Do We Rely On?
- When and With Whom Do We Share Your Data?
- Do We Use Cookies and Tracking Technologies?
- How Long Do We Keep Your Information?
- How Do We Keep Your Information Safe?
- Do We Collect Information From Minors?
- What Are Your Privacy Rights?
- Controls for Do-Not-Track Features
- Do We Make Updates to This Notice?
- How Can You Contact Us?
1. What Information Do We Collect?
In short: We collect information you provide and some information automatically.
A. Personal Information You Provide
- Account & Profile: Full name, email address, profile photo, account role (Landlord or Tenant), and authentication identifiers (including Google ID when signing in via Google OAuth).
- Rental & Tenancy Data: Property addresses, unit details, rent amounts, deposit requirements, WOZ valuation data, lease start/end dates, and lease status.
- Payment Information: Transaction metadata and payment statuses. All card and bank details are handled exclusively by Stripe. We never store raw payment credentials.
- Communications: In-app messages between landlords and tenants, document uploads, and support enquiries.
B. Information Collected Automatically
When you use our Services, we automatically collect certain technical data that does not directly identify you:
- Log & Usage Data: IP address, browser type, operating system, pages visited, feature interactions, and timestamps.
- Device Data: Device model, mobile OS version, app version, and crash/error reports.
- Push Notification Tokens: Firebase Cloud Messaging (FCM) device tokens, used solely to deliver in-app alerts (messages, payments, tenancy updates).
2. How Do We Process Your Information?
In short: We process your data to provide, improve, and secure our Services.
- To create and manage user accounts and authenticate access via email OTP or Google Sign-In.
- To facilitate tenancy agreements, rent payment records, and landlord–tenant communications.
- To send transactional notifications (payment confirmations, message alerts, lease reminders) via email and push notification.
- To protect the platform through fraud detection, OTP rate-limiting, and security monitoring.
- To improve our Services through internal analytics, crash reporting, and feature usage analysis.
- To request feedback and respond to support requests.
- To comply with applicable legal obligations (e.g., Dutch tax and accounting law).
3. What Legal Bases Do We Rely On?
In short: We only process your data when we have a valid legal reason under GDPR Art. 6.
A. Performance of Contract (Art. 6(1)(b))
To operate accounts, verify emails via OTP, process tenancy records, and manage payments between landlords and tenants.
B. Legitimate Interests (Art. 6(1)(f))
To secure the platform (rate-limiting, brute force prevention), monitor crashes, detect fraud, and improve the app, where these interests are not overridden by your rights.
C. Consent (Art. 6(1)(a))
For push notifications regarding messages, payments, and tenancy updates. You can revoke consent at any time through your device notification settings.
D. Legal Obligation (Art. 6(1)(c))
To comply with Dutch financial record-keeping requirements, tax regulations, and lawful requests from Dutch or EU regulatory authorities.
E. Vital Interests (Art. 6(1)(d))
In rare cases, to protect the vital interests of a user or third party from physical harm or safety risks.
4. When and With Whom Do We Share Your Data?
In short: We only share data with trusted service providers under strict contractual obligations.
- Cloud Hosting & Infrastructure: Safe database and storage servers located within the European Union (EU) under data processing agreements.
- Payment Processing: Stripe Payments Europe, Ltd., managing SCA, card tokenisation, and transaction flows. Stripe Privacy Policy.
- Communication & Messaging: Dedicated notification and messaging service providers used to deliver verification codes, system emails, and real-time push alerts.
Business Transfers: If Verhurio is involved in a merger, acquisition, or sale of assets, your personal data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
5. Do We Use Cookies and Tracking Technologies?
In short: Yes, we use cookies. Essential cookies are active by default; non-essential cookies are disabled by default and require your explicit consent.
Our website uses cookies and similar tracking technologies (web beacons, pixels) to operate. These are categorized as follows:
- Strictly Necessary Cookies: Required for platform security, user authentication, and basic operations. These are active by default and cannot be disabled.
- Preference Cookies: Used to remember your interface theme (light/dark mode) and language settings. These are disabled by default and only activated if you enable them.
- Analytics & Marketing Cookies: Used via Google Analytics to track anonymous page visits, load speeds, and user journeys. These cookies are completely blocked by default and will not be loaded unless you click "Accept All" or explicitly enable them via our Cookie Preferences customisation banner.
You can modify or withdraw your cookie consent at any time via the Cookie Settings options on our website or by configuring your browser to refuse all cookies. Refusing non-essential cookies will not affect your access to Verhurio Services.
Our mobile application does not use browser-based cookies. Device identifiers (FCM tokens) are used solely for push notification delivery, as described in the data collection section above.
6. How Long Do We Keep Your Information?
In short: Only as long as necessary to fulfil the stated purposes or comply with law.
We retain personal data for as long as your account is active and no longer than needed for the purposes described in this policy. Specific retention periods:
- Account & Profile Data: Retained for the duration of your account. Deleted within 30 days of a verified deletion request.
- Financial & Tax Records: Retained for up to 7 years in accordance with Dutch accounting law (Boek 2 BW / Belastingdienst requirements).
- Communication Logs & Messages: Retained for the duration of the tenancy plus 2 years, then anonymised.
- Technical Logs: Retained for up to 90 days for security monitoring, then automatically purged.
When we have no ongoing legitimate purpose to process your data, we will delete or anonymise it. If immediate deletion is not possible (e.g., backup archives), the data is isolated until deletion is possible.
7. How Do We Keep Your Information Safe?
In short: We use strong technical and organisational controls, but no system is 100% secure.
We have implemented appropriate technical and organisational security measures to protect your personal data:
- All connections secured with TLS 1.3 encryption in transit.
- Cloud storage files are encrypted at rest using AES-256.
- OTP codes are rate-limited and hashed before storage.
- Google Sign-In validates RS256-signed JWT tokens cryptographically on our servers, so raw identity claims from the client are never trusted.
- Access to production databases and infrastructure is restricted to authorised personnel only.
However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. While we do our best to protect your information, transmission of personal data to and from our Services is at your own risk. Please only access the Services within a secure environment.
8. Do We Collect Information From Minors?
In short: Only where permitted by law and with appropriate authorization.
The Verhurio platform is designed for and primarily intended for adults aged 18 and over. We do not actively market to or target minors. We do not knowingly collect personal data from individuals under 18 for general platform use.
However, Verhurio recognises that in some cases a user under the age of 18 may hold a valid, lawfully executed tenancy agreement - for example, a student tenant whose lease is co-signed or guaranteed by a parent or legal guardian. In such circumstances, access to the platform is permitted strictly for the purpose of managing that specific tenancy relationship. Any personal data collected from such a user is processed solely on the legal basis of the contractual necessity of administering the tenancy, in accordance with GDPR Art. 6(1)(b).
If we become aware that a user under the age of 18 is accessing the platform outside of a valid, lawfully executed tenancy relationship, Verhurio VOF reserves the right to immediately terminate that account without prior notice and permanently delete all associated personal data. This is consistent with Section 11.4 (Termination by Verhurio VOF) of our Terms of Service. Landlords who accept payments through Stripe must independently comply with Stripe's identity and age verification requirements.
9. What Are Your Privacy Rights?
In short: You have significant control over your personal data under the GDPR.
Request copies of your personal data in a structured, machine-readable format.
Request correction of inaccurate or incomplete data in your account.
Request deletion of your account and personal data, subject to legal retention obligations.
Request that we temporarily restrict processing of your data in certain circumstances.
Object to processing based on legitimate interests, including any direct marketing.
Withdraw consent at any time (e.g., for push notifications) without affecting prior lawful processing.
To exercise any of the above rights, submit a Data Subject Access Request (DSAR) or simply email operations@verhurio.nl. We will respond as soon as possible, typically within two calendar days.
If you believe we are unlawfully processing your data, you have the right to lodge a complaint with the Dutch data protection authority:Autoriteit Persoonsgegevens (AP).
10. Controls for Do-Not-Track Features
Most web browsers include a Do-Not-Track ("DNT") feature that signals to websites that you do not want your online browsing activity tracked. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals. If a recognised standard is adopted in the future, we will update this policy accordingly.
11. Do We Make Updates to This Notice?
In short: Yes, we will update this notice to stay compliant with relevant law.
We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last Updated" date at the top of this page. If we make material changes, we will notify you either by prominently posting a notice in the app or by emailing you directly. We encourage you to review this policy periodically.
12. How Can You Contact Us?
If you have questions or comments about this notice, or wish to exercise your data rights, please contact us:
To submit a formal Data Subject Access Request (DSAR), email the above address with the subject line "DSAR: [Your Name]" and a description of your request. We will acknowledge receipt as soon as possible and provide a full response typically within two calendar days.