Privacy Policy

1. Who this covers

The platform serves four groups of people, each with different data:

• Visitors who submit an enquiry, a support request or a registration form.
• Estate agents and agencies, who hold an account and enter cases and properties.
• Prospective tenants, co-tenants and guarantors, who are referenced as part of a case.
• Previous landlords, who are asked for a reference about a past tenancy.

2. What we collect

Depending on your relationship with the platform:

• Identity and contact details: name, email, phone, preferred contact channel, language.
• Property and tenancy details: address, type, size, rent, duration and start date.
• Referencing data: income and employment, rental history, guarantor details, and the documents you upload (ID or passport, proof of income, tax return, previous lease).
• Your Greek tax number (ΑΦΜ), stored only as an irreversible cryptographic hash together with its last four digits. The number itself is never stored.
• Identity verification data: full name, date of birth, nationality, the type and number of your identity document, the photos of the document you upload and a short video of your face recorded on the platform, so that our team can verify your identity.
• Consent evidence: which text you accepted, in which version, when, from which IP address and with which browser.
• Payment data in the sense of a transaction reference and an amount. Card details never pass through the platform — they are entered directly on the payment provider's page.
• Application logs, to the extent needed for security and fault diagnosis.

3. Where it comes from

Most of it you give us. Three exceptions are worth stating plainly: (a) when an agent opens a case they enter the prospective tenant's name and contact details before we contact them; (b) when you declare a previous tenancy we ask the landlord you named for a reference; (c) property listing details are drawn from publicly published portal listings (Spitogatos, XE) through our partner Apify.

4. Purposes and legal bases

• Performance of a contract (art. 6(1)(b)): opening and running an account, carrying out a referencing case, issuing a report, collecting the fee.
• Consent (art. 6(1)(a)): referencing a prospective tenant, co-tenant or guarantor, which begins only once that person has consented in the evaluation portal. Consent can be withdrawn at any time.
• Legitimate interests (art. 6(1)(f)): platform security, abuse prevention, answering support requests, following up an agent's expression of interest.
• Legal obligation (art. 6(1)(c)): tax and accounting records.

5. Automated processing and profiling

The platform computes referencing indicators automatically (rent-to-income ratio, completeness of documents, the outcome of a previous-landlord reference) and proposes a risk level. No report is issued automatically: every case passes through a human review stage in which an administrator confirms or corrects the outcome before it is released.

The decision to grant a tenancy is taken by the landlord or agent, not by the platform. You may ask for an explanation of the outcome and contest it.

6. Recipients and processors

We do not sell personal data. It is shared only with those who process it on our behalf under an art. 28 agreement:

• The agent or agency handling your case, and the landlord on whose behalf the check was requested — as to the outcome.
• Amazon Web Services (file storage, eu-central-1, Frankfurt).
• Revolut (card payment processing).
• Infobip (email and SMS delivery).
• Apify (collection of public property listings).
• Google Maps (map display and address geocoding).
• Public authorities, where the law requires it.

7. Transfers outside the EEA

Data is stored within the European Union. Some of the providers above may process data outside the EEA; where they do, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses.

8. Retention

These periods state our policy; automatic deletion at the end of a period is not yet implemented technically and is carried out on request.

• Agent account data: for the life of the account and five years after its deletion, for evidential purposes.
• Referencing data and documents: up to twelve months from the issue of the report, unless a dispute is pending.
• Consent evidence: five years from the moment it was given.
• Payment records: as required by tax law.
• Support requests: two years from closure.

9. Cookies

The platform sets no advertising, tracking or statistics cookies and embeds no analytics tooling. Only strictly necessary session cookies (ra_access, ra_refresh) and a language preference cookie (NEXT_LOCALE) are used. These require no consent under art. 4(5) of Greek law 3471/2006.

10. Security

Access is over an encrypted connection, passwords are stored hashed, uploaded files are not publicly reachable, and links sent by email or SMS expire. Tax numbers are held only as a hash. An agent's access is limited to their own cases.

11. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability (arts. 15-21 GDPR), and the right to withdraw consent without affecting the lawfulness of processing carried out beforehand.

Write to support@rentassured.gr. We answer within one month. If you are not satisfied you may complain to the Hellenic Data Protection Authority (1-3 Kifissias Ave., 115 23 Athens, www.dpa.gr).

12. Changes

Any material change to this policy is published on this page with a new date and version. Consent records store the version that was in force when you submitted.