Privacy Policy
Last updated
Version: 24 September 2026 | Controller: HuurwoningHub, Chamber of Commerce (KVK) 97713457 | Contact: info@huurwoninghub.nl
HuurwoningHub processes personal data in accordance with the General Data Protection Regulation (GDPR). This policy explains which data we process, why, on what legal basis, how long we keep it and what rights you have. The Dutch version prevails in case of any difference.
1. In short
- HuurwoningHub is free for tenants. We never ask you to pay and never ask for income details.
- For a rental alert we only need your email address and your search preferences. You first confirm your sign-up through a link in your email (double opt-in).
- If you respond to a property on our site, we forward your name, email address and message to the landlord. We do not keep the content of your message.
- An alert email may contain one offer from a partner. Partners never receive your data: we only show a link.
- We do not sell personal data and we do not take decisions about you based solely on automated processing.
2. What data we process and why
2.1 Rental alert
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, preferred city, maximum rent, property type, language, date and time of sign-up and confirmation, how you signed up (site or Facebook group), your choice regarding partner offers and which version of the notice you were shown | Sending you matching listings by email at most once a day, and being able to demonstrate that you consented | Consent (Art. 6(1)(a) GDPR). You can withdraw at any time via the unsubscribe link in every email or at /mijn-alert | Unconfirmed sign-ups: 30 days. Active alert: until you unsubscribe. After unsubscribing we delete your search preferences within 30 days; we keep your email address on a suppression list so we do not email you again |
| Which listings we sent you, and whether a link in an alert email was clicked | Never sending you the same listing twice and checking that alerts work | Legitimate interest (Art. 6(1)(f) GDPR) | While your alert is active, then up to 12 months |
Signing up through a Facebook group. When you ask to join one of our Facebook rental groups, you can voluntarily provide an email address for a rental alert in the membership questions. We use that address only to send you one invitation to confirm your sign-up. If you do not confirm, we delete the address after 30 days. We record what was asked and answered so that we can demonstrate your consent.
2.2 Partner offers in the alert email
An alert email may contain at most one offer from a partner in moving, energy, internet or insurance. New subscribers are told about this below the sign-up form. You can switch it off at any time at /mijn-alert; your alert keeps running.
Partners receive no personal data from us: no email address, no search preferences, no click data. The email only contains a link to the partner. If you click it, you go to the partner's website and the partner's privacy policy applies. Affiliate links on our website are labelled as such.
2.3 Responding to a property
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address and your message | Forwarding your message by email to the landlord, with your email address as the reply-to address so the landlord can answer you directly | Performance of the service you request (Art. 6(1)(b) GDPR) | We do not store your name, email address or message in our database. The email is sent through our email provider Resend, which keeps sent messages for a limited period |
| A log entry: which property, the time, your IP address and browser type. No message content, name or email address | Preventing abuse and spam | Legitimate interest (Art. 6(1)(f) GDPR) | 12 months |
You do not need an account and we do not ask for income details. We do not act as an agent and we do not select or screen tenants: what the landlord does with your message is the landlord's responsibility. The landlord is the controller for the data received from you.
For listings from our Facebook groups, the alert links to the original post. You contact the landlord there yourself; we do not see or receive that contact.
2.4 Landlords: account and listings
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address, password (stored encrypted), language, Google or Facebook login data if you log in that way | Creating and securing your account | Performance of a contract (Art. 6(1)(b) GDPR) | As long as your account exists. After deletion we erase your login data immediately and other account data within 30 days |
| Address, rent, features, photos and description of the property | Publishing the listing, showing it in alert emails and forwarding responses to you | Performance of a contract (Art. 6(1)(b) GDPR) | As long as the listing exists; within 30 days after removal |
| Draft listings not yet confirmed by the landlord | Giving the landlord the opportunity to confirm the listing | Legitimate interest (Art. 6(1)(f) GDPR) | 30 days, then deleted |
Contact details you put in the description (phone number, email address, links) are automatically hidden on the site. Responses go through the response form. If you choose to have AI suggest a description, we send the property details you entered to Google Gemini.
2.5 Listings from our Facebook groups
We run four Facebook rental groups ourselves. For property posts in those groups we process the text of the post and the link to it. Google Gemini helps us recognise the city, rent, property type and signs of fraud; a person approves the listing before any alert is sent about it. The text may contain personal data of the poster; we do not display that separately and do not use it for other purposes. Legal basis: legitimate interest (Art. 6(1)(f) GDPR), namely pointing people looking for a home to available listings and protecting them against fraud. Retention: as long as the listing is current, and no longer than 90 days after posting.
2.6 Website statistics
We measure use of the site with our own first-party statistics; no data goes to an analytics company. For each visit we record a random session code, the pages viewed, referring website, country, device type, browser and campaign parameters (UTM), and your account if you are logged in. We do not store your IP address for this. Legal basis: legitimate interest (Art. 6(1)(f) GDPR), namely improving the site. Individual page views are kept for 90 days, after which only totals remain. See also our cookie policy.
2.7 Security, reports and contact
- Security and error logs (event, time, IP address, browser type, and the account for logged-in users): to prevent abuse and fix problems. Legitimate interest. Retention: 12 months.
- Reports of suspicious listings (reason and explanation): to review listings. Legitimate interest and our obligation to handle notices (Digital Services Act). Retention: 12 months after handling.
- Email to info@huurwoninghub.nl: to answer your question. Legitimate interest. Retention: 12 months after handling.
2.8 Data from the previous model
Until the end of July 2026 tenants could pay to respond. For those who paid, we keep the payment records (amount, date, Stripe reference; no card details) for 7 years because Dutch tax law requires it (Art. 6(1)(c) GDPR). Tenants who created an account with a profile at the time (such as income or motivation) may still have that data in their account. We no longer use it. You can delete your account yourself via Account → Settings or ask us to erase the data.
3. Who we share data with
We use the following service providers. Processors are bound by a data processing agreement and may only use your data on our behalf.
| Party | Role | Purpose | Location |
|---|---|---|---|
| Supabase | Processor | Database, login and photo storage | EU (Ireland) |
| Vercel | Processor | Website hosting | Servers in the EU (Frankfurt); Vercel Inc. is based in the US |
| Resend | Processor | Sending email (alerts, confirmations, forwarded responses) | US |
| Processor | Gemini: recognising property posts and, at a landlord's request, suggesting a description. Search Console: search statistics without personal data. Google login if you choose it | US/EU | |
| Meta | Independent controller | Our Facebook groups and Facebook login if you choose it. Meta's privacy policy applies to what you do on Facebook | EU/US |
| Stripe | Independent controller | Only for the records of payments and subscriptions from before June 2026. There are no new payments | EU/US |
| The landlord | Recipient, independent controller | Receives your name, email address and message when you respond to their property | Netherlands |
Where data goes to a country outside the European Economic Area, this is based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Partners whose offers you see are not on this list: they receive no data from us.
4. Your rights
You have the right to access, rectify, erase, restrict the processing of and port your data, and you can object to processing based on legitimate interest. You can withdraw consent at any time; this does not affect processing that took place before.
- Change, pause, switch off partner offers or stop your alert: via the link in every alert email or at /mijn-alert.
- Delete your account: via Account → Settings.
- Any other request: email info@huurwoninghub.nl. We respond within one month. To prevent someone else from requesting your data, we may ask you to confirm that the email address is yours.
If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would appreciate it if you contacted us first.
5. Security
- All connections use HTTPS.
- Passwords are only stored in hashed form.
- Database access is restricted per table; admin keys are only used on the server.
- Sign-up and response forms are protected against bots and abuse.
- We collect no more data than necessary: no income details, no account needed to respond.
6. Changes
We update this policy when our service changes. The date of the current version is shown at the top. If a change matters to you, we will let you know in advance on the website or by email.