Privacy Policy

The controller of your personal data within the meaning of Art. 4(7) GDPR is:

Full company details are in our Imprint. Because Flatswaps Limited is established in Ireland, the GDPR governs our processing of your data regardless of where you are located.

Art. 13 GDPR requires us to tell you the purpose and the legal basis for every kind of processing. The table below covers all of it.

Where we rely on legitimate interests under Art. 6(1)(f) GDPR, we have carried out a balancing test weighing our interest against your rights and freedoms. You can request a summary of that assessment at privacy@flatswaps.com.

The rental application pack lets you store the documents landlords normally ask for: proof of income, a Schufa or equivalent credit report, a rent-arrears certificate, a copy of your ID card or passport, a tenant self-declaration and a cover letter. These are sensitive financial and identity documents, so they are handled separately from the rest of your profile:

• Uploading is entirely voluntary. Nothing on Flatswaps requires you to provide these documents, and we do not read or analyse their contents.
• Documents are stored in a private bucket. Row-level security limits every file to the account that uploaded it.
• Nobody sees them unless you turn sharing on. Sharing generates a private link that you pass to a landlord yourself. Turning sharing off revokes the link immediately.
• A share link is an unlisted URL, not a password. Anyone you send it to can open it, and can forward it. Only share it with landlords you have chosen to deal with.
• You can delete any document at any time from your profile. Deletion removes it from storage and from any active share link.
• If your documents reveal data covered by Art. 9 GDPR — for example health information visible on a payslip — you are giving explicit consent under Art. 9(2)(a) GDPR by uploading them. You can withdraw it by deleting the file.

Flatswaps only works if members can evaluate each other, so parts of your profile are visible to others. Specifically:

• Visible to anyone, including people without an account: your listing, its photos, its approximate location, your first name, your profile photo and your verification badges.
• Visible to members you are in a conversation or swap with: your full name, the messages and attachments you send them, and the exact address once a swap is confirmed.
• Never visible to other members: your email address, your phone number, your payment details and your tenant portfolio documents, unless you deliberately share them.

Your listing shows an approximate location on the map rather than your exact address until a swap is confirmed. Anything you write in a message or listing description is your own choice to disclose, so avoid putting identity or financial details there.

We do not sell your personal data and we do not share it with advertisers. We do use service providers who process data on our instructions under a data processing agreement meeting Art. 28 GDPR:

Stripe and PayPal act as independent controllers for the payment itself and apply their own privacy notices to that part of the processing.

We may also disclose data to public authorities, courts or our legal advisers where we are legally required to, or where it is necessary to establish, exercise or defend legal claims.

Most of your data stays in the EU. Some of the providers listed above process data in the United States. For those transfers we rely on:

• the European Commission's adequacy decision for the EU–US Data Privacy Framework, where the provider is certified under it; or
• Standard Contractual Clauses adopted by the Commission under Art. 46(2)(c) GDPR, together with supplementary technical measures such as encryption in transit and at rest.

You can request a copy of the safeguards we rely on for any given transfer by writing to privacy@flatswaps.com.

Under the GDPR you have the following rights. All of them are free to exercise.

Access (Art. 15)

Download a complete copy of your data at any time from Settings → Your data. The file lists every category we hold, why we hold it and how long we keep it. You can also ask us by email instead.

Rectification (Art. 16)

Have inaccurate data corrected and incomplete data completed. Most profile and listing fields you can edit yourself in your account settings.

Erasure (Art. 17)

Ask us to delete your data. Closing your account triggers deletion automatically, except for records we must keep for tax, accounting or fraud-prevention reasons.

Restriction (Art. 18)

Ask us to pause processing while a dispute about accuracy or legitimate interest is being resolved.

Data portability (Art. 20)

The same download is machine-readable JSON, and the data you provided to us is flagged as portable so another provider can import just that part. Ask us if you would rather we transmit it directly.

Objection (Art. 21)

Object at any time to processing based on our legitimate interests, including profiling for match suggestions. We will stop unless we can show compelling legitimate grounds that override your interests.

Withdraw consent (Art. 7(3))

Withdraw any consent you have given — cookies, newsletter, the tenant portfolio, the Swapilot assistant — at any time. Withdrawal does not affect processing that already took place.

Automated decisions (Art. 22)

We do not make decisions producing legal or similarly significant effects about you by automated means alone. Match suggestions are ranked automatically, but they are only suggestions and never restrict your access to the service.

Access and portability are self-service: go to Settings → Your data and download the file. For anything else, email privacy@flatswaps.com. We will respond within one month as required by Art. 12(3) GDPR. If a request is complex we may extend that by two further months and will tell you why within the first month. We may ask you to confirm your identity before we act on a request.

If you believe we have handled your data unlawfully, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority. Our lead supervisory authority is:

You may also complain to the supervisory authority in the EU or EEA country where you live or work.

We apply the technical and organisational measures required by Art. 32 GDPR, including encryption in transit (TLS) and at rest, row-level security on every database table holding personal data, private storage buckets scoped to the owning account, hashed passwords, and access controls limiting staff access to what their role requires.

If a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by Art. 34 GDPR, and the Data Protection Commission within 72 hours under Art. 33 GDPR.