Privacy Policy
Last Updated: December 1, 2025
Privacy at a Glance
Using encryption, access controls, and industry-standard security measures
Your personal information is never sold to third parties
Access, correct, delete, or export your data at any time
We comply with EU and Dutch data protection regulations
1. Data Controller
The data controller responsible for your personal data under this Privacy Policy is:
Buurito B.V.
Chamber of Commerce (KvK): [Registration Number]
Registered Office: Amsterdam, Netherlands
Data Protection Officer: privacy@buurito.nl
For any questions, concerns, or requests regarding your personal data or this Privacy Policy, please contact our Data Protection Officer at the email address above. We are committed to responding to your inquiries within 30 days as required by GDPR.
2. Personal Data We Collect
We collect various types of personal data to provide, improve, and secure our services. Below is a comprehensive overview of the data we collect:
2.1 Information You Provide Directly
Account & Identity Data
- Full name (first name, last name)
- Email address
- Phone number (for verification and communication)
- Password (stored in encrypted form)
- Profile photograph
- Date of birth (for age verification)
Identity Verification Documents (KYC)
- Government-issued ID (passport, driver's license, national ID card, residence permit)
- Front and back images of identification documents
- Verification status and timestamps
Note: ID documents are stored securely and used solely for identity verification purposes. They are deleted after 24 months following account closure.
Listing Data (for Hosts)
- Storage space title, description, and photographs
- Full address (street, house number, postal code, city)
- Geographic coordinates (latitude/longitude)
- Space dimensions (length, width, height, total area)
- Pricing information and availability dates
- Access instructions, doorbell name, and access limitations
- Space features and amenities
Booking Data (for Renters)
- Items to be stored (description, photos, type such as furniture, boxes, bikes, vehicles)
- Requested storage area and duration
- Booking dates (start and end)
- Special requests or messages to hosts
- Insurance preferences
Note: For certain item types like vehicles, we recommend users maintain their own comprehensive insurance coverage. The platform facilitates the connection but users are responsible for their own insurance needs.
Financial & Payment Data
- Bank account holder name
- IBAN (International Bank Account Number) for payouts
- Payment transaction references (processed by Mollie)
- Invoice and payout history
Note: We do not store full credit card numbers. All payment card processing is handled by our PCI-DSS compliant payment processor, Mollie.
Communication Data
- Messages exchanged between Hosts and Renters via our platform
- Customer support inquiries and correspondence
- Reviews, ratings, and feedback
- Dispute-related communications and evidence
2.2 Information Collected Automatically
Technical & Device Data
- IP address (may be anonymized for analytics)
- Device type, model, and operating system
- Browser type and version
- Screen resolution and device identifiers
- Time zone and language settings
Usage Data
- Pages visited and features used
- Time spent on pages and interaction patterns
- Referral sources (how you found us)
- Search queries within the platform
- Click-through rates and navigation paths
Location Data
- General location inferred from IP address
- Precise location (only with your explicit consent, for finding nearby storage)
- City/region preferences you set in your profile
Cookies & Similar Technologies
We use cookies and similar tracking technologies to enhance your experience. For detailed information, please see our Cookie Policy.
2.3 Information from Third Parties
- Payment Processors (Mollie): Transaction status, payment method used, fraud risk indicators
- Identity Verification Services: Verification results and fraud screening outcomes
- Analytics Providers (Google Analytics): Aggregated usage statistics and performance metrics
- Advertising Partners (if you consent): Advertising identifiers and campaign effectiveness data
3. How We Use Your Personal Data
We process your personal data only when we have a valid legal basis under GDPR. Below is a comprehensive table explaining each purpose, the activities involved, and our legal justification:
| Purpose | Activities | Legal Basis (GDPR) |
|---|---|---|
| Account Management | Creating and maintaining your account, authentication, password management | Contract performance (Art. 6(1)(b)) |
| Service Provision | Facilitating bookings, matching Hosts and Renters, enabling communication | Contract performance (Art. 6(1)(b)) |
| Payment Processing | Processing payments, escrow services, issuing refunds, Host payouts | Contract performance (Art. 6(1)(b)), Legal obligation (Art. 6(1)(c)) |
| Identity Verification (KYC) | Verifying identity documents, fraud prevention, age verification | Legal obligation (Art. 6(1)(c)), Legitimate interest (Art. 6(1)(f)) |
| Communication | Sending booking confirmations, payment receipts, service notifications | Contract performance (Art. 6(1)(b)) |
| Customer Support | Responding to inquiries, resolving issues, providing technical assistance | Contract performance (Art. 6(1)(b)), Legitimate interest (Art. 6(1)(f)) |
| Safety & Security | Fraud detection, abuse prevention, platform security, access logging | Legitimate interest (Art. 6(1)(f)) |
| Dispute Resolution | Mediating disputes, investigating complaints, processing claims | Legitimate interest (Art. 6(1)(f)), Legal obligation (Art. 6(1)(c)) |
| Analytics & Improvement | Understanding usage patterns, improving features, bug fixing | Legitimate interest (Art. 6(1)(f)), Consent (Art. 6(1)(a)) for cookies |
| Marketing | Newsletters, promotional offers, personalized recommendations | Consent (Art. 6(1)(a)) |
| Legal Compliance | Tax reporting, responding to legal requests, regulatory compliance | Legal obligation (Art. 6(1)(c)) |
4. How We Share Your Data
We share your personal data only when necessary to provide our services, comply with legal obligations, or with your consent. Here's who may receive your data:
Other Platform Users
When you make or accept a booking, certain information is shared between Hosts and Renters:
- First name and profile photo
- General location (neighborhood/city) before booking confirmation
- Full address and access details (only after payment is confirmed)
- Phone number (for coordination after booking confirmation)
- Messages exchanged through the platform
Payment Processors
We use Mollie B.V. (based in the Netherlands) to process all payments securely. They receive:
- Payment details necessary for transaction processing
- Billing information for invoicing
- Transaction amounts and references
Mollie acts as a separate data controller and processes data under their own Privacy Policy.
Service Providers & Infrastructure
We engage trusted third-party service providers who process data on our behalf:
- Cloud Infrastructure: Supabase, Base44 (data hosting and storage)
- Email Services: Resend (transactional emails)
- SMS Services: Twilio (phone verification)
- Analytics: Google Analytics (usage statistics)
- Mapping: Leaflet/OpenStreetMap (location services)
All service providers are bound by Data Processing Agreements (DPAs) ensuring GDPR compliance.
Legal & Regulatory Authorities
We may disclose your data when legally required:
- To comply with court orders, subpoenas, or legal processes
- To respond to lawful requests from government authorities
- To enforce our Terms of Service or protect our legal rights
- To prevent fraud, security threats, or illegal activities
- For tax reporting and financial compliance (Dutch Tax Authority)
Insurance Partners
In case of damage claims or disputes, relevant booking and user information may be shared with insurance providers to process claims and provide coverage.
Business Transfers
In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer and any choices you may have.
5. International Data Transfers
Your personal data may be transferred to, and processed in, countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place:
- Adequacy Decisions: We transfer data to countries that the European Commission has determined provide an adequate level of data protection.
- Standard Contractual Clauses (SCCs): For transfers to other countries, we use EU-approved Standard Contractual Clauses to ensure your data receives equivalent protection.
- EU-US Data Privacy Framework: For US-based providers participating in the framework, transfers are made under this certified mechanism.
Our primary payment processor, Mollie, is based in the Netherlands and processes payments within the EU. Our infrastructure providers maintain data centers in the EU where possible. You may contact us for more information about the specific safeguards we use for international transfers.
6. Data Security
We implement comprehensive technical and organizational security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction:
Technical Measures
- SSL/TLS encryption for all data in transit
- AES-256 encryption for sensitive data at rest
- Secure password hashing (bcrypt)
- Regular security vulnerability assessments
- Intrusion detection and monitoring systems
- Automated backups with encryption
Organizational Measures
- Role-based access control (need-to-know basis)
- Employee confidentiality agreements
- Regular staff training on data protection
- Incident response procedures
- Vendor security assessments
- Data minimization practices
7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Here are our retention periods:
| Data Type | Retention Period | Reason |
|---|---|---|
| Active account data | Duration of account + 24 months | Service provision, dispute resolution |
| Financial/tax records | 7 years after transaction | Dutch fiscal law (AWR) compliance |
| ID verification documents | 24 months after account closure | KYC/AML compliance, fraud prevention |
| Booking history | 7 years after booking completion | Legal claims, tax compliance |
| Messages | 3 years after last activity | Dispute resolution |
| Analytics data | 26 months (anonymized) | Service improvement |
| Cookie consent records | 3 years | Compliance documentation |
After the retention period expires, data is either securely deleted or anonymized so that it can no longer be linked to you.
8. Your Rights Under GDPR
As a data subject under GDPR, you have the following rights regarding your personal data:
Right to Access
Request a copy of the personal data we hold about you, free of charge.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to be Forgotten")
Request deletion of your personal data in certain circumstances (e.g., when no longer necessary, consent withdrawn).
Right to Restrict Processing
Request limitation of how we process your data (e.g., while we verify accuracy or assess an objection).
Right to Data Portability
Receive your data in a structured, commonly used, machine-readable format (e.g., JSON, CSV) and transmit it to another controller.
Right to Object
Object to processing based on legitimate interests or for direct marketing purposes at any time.
Right to Withdraw Consent
Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
Right to Lodge a Complaint
File a complaint with a supervisory authority if you believe your rights have been violated.
9. Cookies and Tracking Technologies
We use cookies and similar technologies to enhance your experience, analyze usage, and assist with marketing (with your consent). Types of cookies we use include:
- Strictly Necessary Cookies: Essential for the website to function (authentication, security, preferences). These cannot be disabled.
- Functional Cookies: Remember your preferences (language, region, display settings).
- Analytics Cookies: Help us understand how visitors use our site (Google Analytics with IP anonymization).
- Marketing Cookies: Enable targeted advertising (Meta Pixel, Google Ads) - only with your explicit consent.
You can manage your cookie preferences at any time through our cookie banner or the Cookie Settings page. For full details, please review our Cookie Policy.
10. Children's Privacy
Our services are intended for users aged 18 years or older. We do not knowingly collect personal data from individuals under 18 years of age. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at privacy@buurito.nl.
Upon verification, we will promptly delete any personal data collected from minors.
11. Third-Party Links and Services
Our platform may contain links to third-party websites, services, or applications (e.g., social media platforms, insurance partners, payment providers). These third parties have their own privacy policies, and we are not responsible for their practices.
We encourage you to review the privacy policies of any third-party services you access through our platform before providing them with your personal data.
12. Marketing and Communications
Transactional Communications
You will receive essential service-related emails regarding bookings, payments, account security, and important platform updates. These are necessary for service provision and cannot be opted out of while your account is active.
Marketing Communications
With your explicit consent, we may send you promotional emails about new features, special offers, and tips for using the platform. You can opt out at any time by clicking the "unsubscribe" link in any marketing email or updating your communication preferences in your account settings.
Legal & Safety Notices
We may send important legal, safety, or security notifications that you cannot opt out of (e.g., policy changes, data breach notifications, account security alerts).
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes:
- We will update the "Last Updated" date at the top of this policy
- For significant changes, we will notify you via email or prominent notice on our platform
- Where required by law, we will seek your consent before implementing material changes
We encourage you to periodically review this Privacy Policy to stay informed about how we protect your data.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Buurito B.V.
Data Protection Officer: privacy@buurito.nl
General Inquiries: hello@buurito.nl
Amsterdam, The Netherlands
Supervisory Authority
If you are not satisfied with how we handle your complaint, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
Related policies: Cookie Policy • Terms of Service