Qualification questionnaires may run for named pilot agencies, with a cap of 100 applications. Documents stay off. ROPA v1, the document-workflow DPIA, and Art. 28 processor terms were owner-approved on 14 August 2026. The qualification-only phase was owner-instructed on 20 September 2026. Full controller identity, DPO appointment, and any CNPD consultation remain open. This notice is not a GDPR certificate.
Controller status
For this Luxembourg pilot, the operator contact for privacy requests is privacy@renttrust.online. Full controller identity, registered address, and DPO appointment will be confirmed upon SARL-S incorporation.
What we process and why
- Agency accounts: identity, contact, office, and billing details to perform the agency contract.
- Tenant triage: move-in date, household size, income band, employment category, guarantor, pets, smoking, and one listing question—with explicit consent.
- Tenant contact: email under a separate explicit consent.
- Documents: not collected in this qualification-only phase.
- Aggregate analytics: coarse location and product events under legitimate interests, authorized by a signed first-party cookie after you opt in; optional analytics remains off by default.
- Cookie preferences and optional analytics consent events, stored without IP addresses.
Processing mapped to product stores
The table below is the public extract of ROPA v1, owner-approved 14 August 2026, plus website enquiries added on 23 September 2026. Tenant rows stay inactive while intake is paused.
| Activity | Product store | Purpose | Lawful basis | Product gate |
|---|---|---|---|---|
| Agency account | agencies, agency_members, agency_invites | Operate the paying office workspace, members, team invites, and plan caps. | Contract · Art. 6(1)(b) | Agency authentication |
| Listings and Connect Links | properties | Publish per-property Connect Links and listing metadata. | Contract · Art. 6(1)(b) | Agency authentication |
| Tenant triage | applications, email_otps | Collect a minimized qualification file for one listing, only for named pilot agencies under the application cap. | Explicit consent · Art. 6(1)(a) | Fail-closed tenant intake flag |
| Rental Passport | tenants, passports, tenant_access_tokens, tenant_totp_factors, tenant_totp_recovery_codes | Let the tenant reuse a minimized profile, open it with email plus authenticator, and exercise rights. | Explicit consent · Art. 6(1)(a) | Passport / one-time code |
| Shortlist documents | doc_requests, documents, document_shares | View requested evidence after shortlisting, with watermark and audit. | Explicit consent · Art. 6(1)(a) | Shortlist stage and document consent |
| Identity-safe chat | chat_messages | Message about one application without exchanging direct contact by default. | Explicit consent · Art. 6(1)(a) | Open application and contact consent |
| Agency billing | subscriptions, stripe_events | Charge the office subscription and record verified webhook events. | Contract · Art. 6(1)(b) | Stripe billing configuration |
| Cookie consent evidence | cookie_consent_events | Record banner and preference-centre choices without storing IP addresses. | Explicit consent · Art. 6(1)(a) | Cookie preference centre |
| First-party product analytics | click_events | Count consented product events with coarse geography only. | Legitimate interests · Art. 6(1)(f) | Optional analytics consent |
| Security and operational audit | audit_events, system_events | Investigate misuse and support a 72-hour CNPD notification path. | Legitimate interests · Art. 6(1)(f) | Operator role |
| Data-subject rights | rights_requests | Log access, export, erasure, restriction, objection, and ranking contests. | Legal obligation · Art. 6(1)(c) | Passport / one-time code |
| Claim invitations | claim_invites | Issue tokenized, expiring claim invitations when email is configured. | Contract · Art. 6(1)(b) | Agency authentication |
| Agency sign-in security | agency_totp_factors, agency_totp_recovery_codes, agency_mfa_sessions, auth_throttles | Store authenticator secrets, hashed recovery codes, and email-hash sign-in throttles without IP addresses. | Legitimate interests · Art. 6(1)(f) | Agency authentication |
| Personal calendar sync | cl_calendar_connections, cl_calendar_event_map, cl_calendar_sync_outbox | After explicit opt-in, copy confirmed viewing times to Google or Microsoft and read busy intervals. Tokens stay encrypted in the EU. This row stays inactive until vendor terms are completed. | Explicit consent · Art. 6(1)(a) | Opt-in calendar sync flag |
| Website enquiry | website_enquiries | Save a contact-form message so the office can reply when email delivery is unavailable. Name, email, and message are encrypted and deleted after 12 months. | Legitimate interests · Art. 6(1)(f) | Public contact form |
Assisted ranking and automated processing
RentTrust calculates an assisted score from income band (max 40), household fit (max 20), indoor smoking (max 15), employment category (max 15), and completeness (10). The score only orders the agency inbox. Agencies must open and decide each lead. Ranking model version 1.0. Tenants can ask for human intervention and contest ranking from the Rental Passport.
AI / automated assistance disclosure
Qualification scoring is rule-based assisted ranking, not a black-box model deciding housing access. Significant decisions remain with the agency.
What we deliberately do not collect
We do not ask for exact income during triage, request documents before shortlisting, persist IP addresses in analytics, or use advertising trackers. Document access does not expose a permanent public download URL.
Your choices and rights
Tenants can access, export, correct, erase, restrict, object, and withdraw consent through the Rental Passport. Withdrawing consent does not affect processing that was lawful before withdrawal. Agency account and sign-in access remains available while new intake is paused.
Requests must be handled within one month unless a lawful extension applies. Write to the address below. You may also complain to Luxembourg’s CNPD. privacy@renttrust.online.
You may lodge a complaint with Luxembourg’s CNPD.
Retention and recipients
Pending applications and email codes expire within minutes; active application, account, document, billing, and audit categories follow the public retention register. Expired data is deleted automatically where no legal hold applies. Infrastructure is configured for EU regions.
Processors and transfers
Infrastructure targets EU regions (Supabase in Frankfurt, Vercel fra1, Resend, Stripe). Art. 28 terms for those processors were owner-approved on 14 August 2026.
Audit readiness
Engineering evidence includes RLS, authenticator sign-in, hashed auth throttles, consent_grants, rights_requests, cookie_consent_events, retention jobs, and Art. 22 contest controls. This supports a CNPD certification pathway and a future SOC 2 examination; it is not a certificate and must not be marketed as approval.
ROPA v1, the document-workflow DPIA, and processor DPAs were owner-approved on 14 August 2026. This is not legal advice and not a claim of GDPR certification, CNPD approval, or SOC 2 attestation. Tenant intake stays off until a separate written approval of the remaining gates.