Privacy Notice

1. Who controls your data?

For the Rentkey Passport (identity, income, rental history, score) Rentkey (WebWave Media Kft., Táborföld út 6., 2096 Üröm, Hungary) is an independent controller.

For data recorded in landlords' workspaces (properties, handling applications, leases, payments, utilities, deposits, maintenance) the landlord is the controller and Rentkey acts as processor (GDPR Art. 28).

Privacy contact: hello@rentkey.hu. [Appointment of a DPO: to be agreed with counsel.]

2. What data do we process?

Account data (e-mail, name, phone, language); Passport data and proofs (ID document, income proof, previous tenancies, references); applications, messages, viewings; contract data (birth data, ID number, address – only what you enter for a contract yourself); payments, deposit, utilities, maintenance; technical data (sign-ins, IP address in the security log).

3. Legal bases

Performance of a contract (GDPR Art. 6(1)(b)): running the account and the service.

Consent (Art. 6(1)(a)): sharing your Passport with a landlord – revocable at any time on the Shares page.

Legal obligation (Art. 6(1)(c)): keeping accounting records.

Legitimate interest (Art. 6(1)(f)): security of the service, preventing abuse, logging.

4. The score and automated decisions

The Passport score is calculated by fixed rules from your verified data. The score does not decide for you or the landlord: the landlord decides.

Under GDPR Art. 22 you have the right to express your point of view about the score, to contest it and to obtain human review. Ask at hello@rentkey.hu; a Rentkey staff member reviews it within [30] days.

5. How long do we keep data?

Account data while the account exists. Original Passport proof files are kept for 90 days after the check; after that only the result and the file fingerprint (SHA-256) remain.

Signed contracts, protocols, payments and deposit settlements: 5 years from the end of the lease (Civil Code 6:22, limitation period); accounting records: 8 years (Accounting Act 169 §).

Security logs: [12 months].

6. Who receives data?

Your Passport only goes to landlords you share it with. Our processors: Supabase (database and storage, EU – Frankfurt), Didit Identity Spain S.L. (identity check, EU – only if you start one; biometric data, with separate consent, images kept for at most 30 days), [hosting provider], [e-mail provider], OpenAI (Legal Assistant answers – see section 9). Otherwise no transfer to third countries [to be checked for the chosen providers].

7. Your rights

Access and portability: download all your data in Settings (JSON and PDF). Rectification: in your profile and Passport. Erasure: request deletion of your account in Settings – except documents that must be kept; in that case the account is anonymised. Restriction and objection: hello@rentkey.hu. Your consent (shares) can be withdrawn at any time.

You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9–11, www.naih.hu) or go to court.

8. Security

Data travels over encrypted connections; row-level access control protects it in the database; staff sign in with two-factor authentication and every access is logged; staff can open Passport documents only with a reason, which you can see.

9. Legal Assistant and model training

What we process: your questions to the Legal Assistant, the answers, the time and title of the conversation and, for tenants, the basic data of your lease recorded in Rentkey (rent, deposit, term, notice period), used for the answer. The assistant never receives ID documents, evidence or other users' data.

Producing the answer (GDPR Art. 6(1)(b)): we send the question and the necessary data to the AI provider (currently OpenAI, as processor) [contracting OpenAI entity and transfer location: to be confirmed with a lawyer]. Under its contract the provider does not use this data to train its own models. Safeguard for the transfer to a third country: [EU–US Data Privacy Framework or standard contractual clauses – to be confirmed with a lawyer]. We record the number of questions and the tokens used to apply the daily and monthly limits and track costs (legitimate interest, Art. 6(1)(f)).

Model training: it is a condition of using the Legal Assistant that Rentkey keeps your questions and the answers and uses them to develop, train and quality-check its own legal assistant and AI model. You expressly consent to this when you first use the assistant. If you don't accept it, you cannot use the Legal Assistant; you can still use Rentkey's other services. Legal basis: [consent (GDPR Art. 6(1)(a)) or legitimate interest (Art. 6(1)(f)) – to be confirmed with a lawyer].

Pseudonymisation: before a conversation enters the training data we remove or replace directly identifying data (names, home and property addresses, e-mail addresses, phone numbers, ID, tax and bank account numbers) and generalise amounts and dates. Only authorised Rentkey staff and processors handle training data; we never sell or publish it.

Retention: we keep conversations even if you remove them from your list in the app, for at most [3 years] from the last message; after that our staff delete them. Deleting your account deletes your conversations too. Individual conversations cannot be removed afterwards from training data already prepared (pseudonymised) or from a model already trained.

Your rights: you can exercise your rights of access, rectification, erasure, restriction and objection at hello@rentkey.hu (section 7). If you withdraw your consent, you can no longer use the Legal Assistant; withdrawal does not affect the lawfulness of earlier processing.

10. Website assistant (chat)

The website chat answers questions about Rentkey with AI, based on the website's own text. The question and the answer are sent to the AI provider (OpenAI or Anthropic); we keep the conversation for 30 days to check answer quality, then delete it. It is not linked to an account and we do not store the IP address with it (abuse limits use only a non-reversible key). Please do not write personal data in the chat. [Legal basis: legitimate interest – to be confirmed with a lawyer.]