Privacy Policy of Rentier.io

Introduction and Data Controller Details

• Dear User,
  We care about your data privacy. This Privacy Policy explains how Rentier Analytics Sp. z o.o. (the operator of the Rentier.io platform) processes your personal data in connection with the use of our services.
• Data Controller:
• The controller of your personal data is Rentier Analytics Sp. z o.o., with its registered office in Warsaw (00-682), ul. Hoża 86/410, entered in the National Court Register under KRS no. 0000728075, NIP: 7010818154, REGON: 369986038 (hereinafter: “Controller” or “we”).
• Contact details of the Controller:
• For any matters related to personal data protection, you may contact us:
• • via e-mail: [email protected]
  • in writing at the above-mentioned registered address.

Scope of Collected Personal Data

• The scope of personal data processed by the Controller may include:

• Data provided by the User:

• Information voluntarily submitted when using the Service:
  • identification and contact data such as name, e-mail address, phone number, and property address (if provided for valuation),
  • property characteristics required for valuation, such as location (city, district, street), size, number of rooms, floor, technical condition, year of construction, and other parameters indicated in the valuation form,
  • data provided during account registration, such as e-mail address (login) and password (stored in encrypted form, inaccessible to us), and optionally the user’s name,
  • user preferences regarding communication (e.g., consent to receive offers, selected cities/properties for monitoring).

• Automatically collected data:

• During your visit to the Service, our systems may automatically collect technical data, such as:
  • your device’s IP address,
  • browser and operating system details,
  • activity on the Service (e.g., date and time of visit, pages viewed, interface element clicks).

These data generally do not allow us to identify the User without being combined with other information. They are used for administration, security, and traffic analysis purposes (see: Cookies section).

• Data received from partners:

• If you use our Service through a widget embedded on a partner’s website (e.g., another online service), we may receive information about the source of the visit (partner ID) and related technical integration data. Personal data entered via the widget (e.g., contact details and property data) are securely transmitted directly to us.

• Communication data:

• This includes correspondence content (e.g., e-mails, complaint submissions, attachments) and call recordings if you contact us by phone and the call is recorded (you will be informed at the beginning of the call).

Purposes and Legal Bases for Data Processing

• We process users’ personal data for the following purposes and on the following legal bases:
  1. Providing services via the Platform – including property valuation, account creation and management, service functionalities (monitoring prices, analytics), and handling user inquiries.

     Legal basis: contract performance (Art. 6(1)(b) GDPR). If a user provides data of a third party (e.g., co-owner), the legal basis is also our legitimate interest in service execution (Art. 6(1)(f) GDPR), with the user declaring they have obtained the third party’s consent.

  2. Delivering a valuation report – including sending it to the provided e-mail address and possibly following up to confirm receipt or clarify contents.

     Legal basis: contract performance (Art. 6(1)(b) GDPR).

  3. Marketing activities and commercial communications – if the user consents, we use their contact data (e-mail, phone number) to send offers, newsletters, and information about our or partners’ real estate services. This may also include phone calls from our staff or authorized partners (e.g., real estate agents) to present offers.

     Legal basis: user consent (Art. 6(1)(a) GDPR), and as per Polish law – Art. 10 of the Act on Electronic Services and Art. 172 of the Telecommunications Law.

  4. Personalization and service improvement – including processing usage and preference data to customize offers and improve the valuation algorithm and platform functionality.

     Legal basis: legitimate interest (Art. 6(1)(f) GDPR). If such activities constitute profiling for direct marketing, the basis remains our legitimate interest.

  Note: Profiling does not have legal or similarly significant effects on the user. It is used solely to tailor marketing communications. Users can object to profiling at any time (see: User Rights).

  5. Compliance with legal obligations – such as issuing and retaining invoices, keeping required records, or responding to official requests from authorities.

     Legal basis: legal obligation (Art. 6(1)(c) GDPR) under tax, accounting, or other applicable laws.

  6. Establishing, exercising, or defending legal claims – e.g., when a user violates our Terms or we need to protect our rights.

     Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

  7. Analytical and statistical purposes – to understand service usage patterns, monitor trends (e.g., average real estate prices), improve the platform, and publish aggregated reports. Where possible, anonymized or aggregated data is used.

     Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Data Recipients

• We may disclose or provide personal data to the following categories of recipients:
  • Authorized employees and collaborators – such as IT staff, customer support, and analysts preparing valuation reports.
  • Business partners – including:
    • real estate partners (e.g., agencies, advisors) – only with user consent, to offer help in selling, buying, or renting property;
    • providers of additional services (e.g., renovation or financial services) – only upon the user’s explicit request or consent.
  • Service providers and subcontractors (data processors) – acting on our behalf:
    • hosting and IT infrastructure providers,
    • e-mail/SMS platforms,
    • analytics tool providers (e.g., Google Analytics, using anonymized or pseudonymized data),
    • legal or advisory service providers (e.g., law firms, auditors).
• All processors are contractually obliged to ensure appropriate data protection measures.
  • Public authorities and legally authorized third parties – such as the police, courts, data protection authorities, etc., upon lawful request. We may also share data with entities asserting legal claims (e.g., law firms or debt collection agencies) to protect our rights under applicable laws.
• We do not share user data with third parties beyond those listed unless required by law or with the user’s explicit consent.

Transfers to Third Countries

• As a rule, we process and store personal data within the European Economic Area (EEA). If any transfer outside the EEA occurs (e.g., to the USA when using cloud or analytics services), we ensure it is made with adequate safeguards under Chapter V of the GDPR (e.g., EU Standard Contractual Clauses) and meets privacy protection standards comparable to EU levels.

Data Retention Period

• We retain personal data no longer than necessary for the stated purposes. Retention periods depend on the type of service and processing basis:
  • Account-related data – stored as long as the account is active. Upon deletion or contract termination, data is erased or anonymized within 30 days, unless retained for legal or financial reasons.
  • Marketing data based on consent – retained until consent is withdrawn or the purpose no longer applies, but no longer than 5 years from the last interaction (e.g., login, email open). After that, minimal data may be retained to prove consent history.
  • One-time valuation reports (no account) – stored up to 12 months after delivery for potential follow-up (if consented). Then deleted or anonymized, unless further interaction occurs (e.g., account creation).
  • Data required by law (e.g., invoices) – retained as mandated by applicable regulations (e.g., 5 tax years).
  • Data needed for legal claims – retained as long as necessary to establish or defend claims (typically up to 6 years, depending on the limitation period).
  • Anonymized data for analytics/statistics – may be retained indefinitely if it cannot identify any individual.
• After the above periods, data is either deleted or permanently anonymized.

User Rights

• You have the following rights regarding your personal data:
  • Right of access – to confirm if we process your data and to access it along with relevant information. You may request a copy (administrative fees may apply for additional copies).
  • Right to rectification – to correct inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”) – to request deletion where permitted by Art. 17 GDPR (e.g., no longer necessary, consent withdrawn, unlawful processing). Exceptions apply (e.g., legal obligations or pending claims).
  • Right to restrict processing – in cases such as contesting accuracy or pending objection resolution (Art. 18 GDPR).
  • Right to data portability – for data processed based on consent or contract, and in an automated manner, you may request transfer to another controller.
  • Right to object – to processing based on legitimate interest (Art. 6(1)(f) GDPR), for reasons related to your situation. We will stop processing unless we demonstrate compelling legitimate grounds.
  • Objection to direct marketing – you may object at any time, and we will immediately stop such processing.
  • Right to withdraw consent – you may withdraw consent at any time (without affecting prior lawful processing). You can withdraw via account settings (if available), the unsubscribe link in emails, or by contacting us.
  • Right to lodge a complaint – with the supervisory authority responsible for data protection. In Poland, this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
• To exercise your rights, contact us via the channels listed at the top of this Policy. We aim to respond promptly, within one month (extendable by two months if necessary – you will be informed accordingly).

Cookies and Similar Technologies

• Our Service uses cookies and similar technologies (e.g., local storage, tracking pixels) for proper functioning, analytics, and marketing purposes.
• Cookies are small text files stored on your device during browsing. They contain, e.g., the domain name, a unique ID, and expiration date.
• We use the following categories of cookies:
  • Necessary cookies – required for basic functions (e.g., login, session management). These do not require consent and are installed automatically.
  • Analytical cookies – help us understand how users interact with the site (e.g., popular pages, error tracking). Often linked to external tools (e.g., Google Analytics). Their privacy terms are available on the providers’ websites.
  • Marketing cookies – used for advertising and profiling. They allow us and trusted partners to display personalized ads (including remarketing). Installed only with your consent.
• At your first visit, we display a cookie banner requesting consent for non-essential cookies. You can manage preferences via our cookie management tool or your browser settings.
• You can change your cookie settings at any time in your browser (e.g., block some or all cookies). Note that disabling cookies may limit service functionality.
• More information about cookies (and how to disable them) is available at: https://wszystkoociasteczkach.pl/ or a similar site in your language.

Data Security

• We take appropriate technical and organizational measures to safeguard your personal data against unauthorized access, disclosure, or destruction. These include SSL/TLS encryption, IT infrastructure protection, access control systems, data protection policies, and staff training. Our databases are secure from unauthorized access.

Changes to the Privacy Policy

• We may periodically update this Policy to reflect changes in our services or legal obligations (e.g., new data types, new features, or privacy regulations).
• We will notify users of material changes via a notice on our website. Registered users may also receive an e-mail. The latest version of the Privacy Policy will always be available at: https://rentier.io/policy-privacy
• We recommend reviewing this Policy regularly to stay informed of changes.

Contact and Final Provisions

• If you have any questions, concerns, or wish to exercise your data rights, please contact us using the details provided at the beginning of this Policy.
• This Privacy Policy enters into force on May 18, 2025.
• In matters not regulated herein, the applicable provisions of law shall apply, including the GDPR and the Polish Act on the Provision of Electronic Services.