RentFriends Privacy Policy

The controllers of personal data processed within the RentFriends mobile application and the website available at https://rentfriends.app (jointly referred to as the "Application") are Aleksandra Kaziniec and Marvin Ruciński, natural persons not conducting business activity, e-mail address kontakt@rentfriends.app, correspondence address as stated in the Application Terms of Service, hereinafter referred to as the Personal Data Controller.

Any enquiries, requests and complaints about the processing of personal data by the Personal Data Controller, hereinafter referred to as Requests, should be sent to the following e-mail address: kontakt@rentfriends.app or in writing to the correspondence address stated in the Application Terms of Service. The Request should clearly state:

1. the details of the person or persons the Request concerns,

2. the event that gave rise to the Request,

3. your demands and their legal basis,

4. how you expect the matter to be resolved.

In our Application we collect the following personal data:

1. basic account data and contact details (first name or nickname, e-mail address, phone number, date of birth or age) - information provided during registration, necessary to create a profile, verify that the user is an adult, log in and communicate with the user on an ongoing basis.

2. data from login through external providers (account identifier and e-mail address provided by Google or Apple) – if an Account is created or the user logs in with a Google Account or an Apple Account (Apple ID),

3. profile data and matching criteria (gender, city of residence, university, profile description, flatmate preferences, property descriptions, profile photo, interests) – data shared to personalise the account, filter listings effectively and run the algorithms that find suitable flatmates.

4. activity in the Application (likes, rejections/matches, reports concerning safety or breaches of the terms of service) – data processed to handle any reports, carry out necessary content moderation and keep the platform safe,

5. content of chat messages – data processed to enable communication between Users and to handle reports of breaches of the Terms of Service,

6. listing data (description and photos of the premises, price, location of the premises indicated by the User, contact phone number) – data published by the User in a listing is visible to other people using the Application, and the phone number is displayed after the option to reveal it is selected,

7. phone number for verification – a number provided for verification with a one-time SMS code (e.g. when adding a listing through the website),

8. data from the phased-out shared household features (chore schedule, shared expenses and their settlement, shopping lists) – applies only to Users who used these features in an earlier version of the Application; this data is visible to the other members of the given household in the Application and is processed to provide these features until they are switched off or the Account is deleted,

9. device identifiers and mobile Application installation data (e.g. the IDFA or GAID advertising identifier, device model, system version, Application installation source) – data processed for analytics and to measure the effectiveness of advertising campaigns; on iOS devices the advertising identifier is used only after consent is given in the system App Tracking Transparency prompt,

10. data for marketing purposes (e-mail address) - the e-mail address processed to send the Newsletter and promotional communications, only if the user gives separate and voluntary consent to such activities. If consent to marketing Cookies is given, the e-mail address provided when registering on the website may be passed to Google in hashed form (SHA-256 hash) to measure the effectiveness of advertising (so-called enhanced conversions).

11. the device IP address and any personal data contained in Cookies – information resulting from the general rules of Internet connections, such as the IP address (and other information contained in system logs), is used for technical and statistical purposes, in particular to collect general demographic information (e.g. about the region from which the connection is made). This type of data is also used for marketing and analytics purposes if consent is given,

12. order and payment data (the package bought, amount, payment date and status, payment method, transaction identifiers assigned by the payment provider) – when buying a listing package on the website; we do not receive payment card details or online banking credentials, which are processed only by the payment provider,

13. other data may be collected in the course of handling specific matters or may be provided by users of our Application by e-mail, contact form, traditional mail or by phone.

Every person using our Application can choose whether and to what extent they want to use our services and share information and data about themselves, within the scope set out in this Privacy Policy.

We process personal data for the purpose of:

1. enabling Account registration and use of the Application (Article 6(1)(b) GDPR) – for this purpose, personal data will no longer be processed once the user deletes the account,

2. fulfilling the legal obligations of the Personal Data Controller, in particular handling notices concerning content in accordance with the DSA and exercising the rights of data subjects (Article 6(1)(c) GDPR) – for this purpose, personal data will be deleted once the relevant legal obligations have been fulfilled,

3. processing optional data and marketing activities based on consent (Article 6(1)(a) GDPR) – to send marketing content (the Newsletter) to the e-mail address provided for this purpose – data for this purpose is processed until the user deletes the information, withdraws consent or effectively objects.

4. sending marketing content about the Controller and carrying out analytics in connection with the use of cookies (Article 6(1)(a) GDPR), including analytics of the mobile Application and measuring the effectiveness of advertising campaigns using device identifiers – for this purpose personal data is processed until the end of the session or until the user deletes cookies, withdraws consent or effectively objects to processing for this purpose,

5. operating the Application and the website (Article 6(1)(f) GDPR) – for this purpose, personal data will no longer be processed when the Cookie expires, when Cookies are deleted or, as applicable, when the session ends,

6. ongoing communication related to the operation of the Application (Article 6(1)(f) GDPR, i.e. the legitimate interest of the Personal Data Controller) – for this purpose, your personal data will no longer be processed once the question or questions have been answered,

7. establishing, pursuing or defending against claims (Article 6(1)(f) GDPR, i.e. the legitimate interest of the Personal Data Controller) – for this purpose, personal data will be deleted when the claims expire, as a rule after the 3-year limitation period for claims.

8. selling listing packages, handling payments, refunds and complaints (Article 6(1)(b) GDPR) and keeping the sales records required by tax law (Article 6(1)(c) GDPR) – for this purpose, personal data is kept for the period required by tax law, as a rule 5 years from the end of the calendar year of the purchase.

The source of the data processed by the Personal Data Controller is the data subjects themselves.

Where there is a button or function that links to an external website, application or social media, the Controller of this Application and the controller of the external site are joint controllers. Joint control is limited to the data necessary for the operations related to the functioning of the given button or function. The Controller is not responsible for the policies of other entities, organisations or social media providers regarding further processing of personal data. Our Joint Controllers within this Application are:

1. Google Ireland Ltd. (login with a Google Account), registered address: Google Building Gordon House, 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland,

2. Apple Distribution International Ltd., registered address: Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (for the Apple Account / Apple ID service)

3. possibly others.

Some of the providers whose services we use (including Google, Apple, Singular, Cloudflare, Resend and Stripe) are based or process data outside the European Economic Area, in particular in the United States. In such cases, personal data is transferred to a third country on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework, for entities certified under it) or standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR). A copy of the safeguards applied can be obtained by contacting the Personal Data Controller.

We do not share any personal data with third parties without the explicit consent of the data subject. Data may be shared without the consent of the data subject only with entities authorised to process personal data under applicable law (e.g. law enforcement authorities, the Social Insurance Institution (ZUS) or the Tax Office). Profile and listing data that the User publishes in the Application is visible to other people using the Application to the extent resulting from its functionality.

Personal data may be entrusted for processing to entities that process such data on our behalf as the Personal Data Controller. In such cases, as the Personal Data Controller, we conclude a data processing agreement with the processor. The processor processes the entrusted personal data only for the needs, to the extent and for the purposes specified in the data processing agreement referred to in the previous sentence. Without entrusting personal data for processing, we would not be able to operate the Application. As the Personal Data Controller, we entrust personal data for processing in particular to the following entities:

1. providers of hosting and server services,

2. providers of cloud infrastructure and file storage (Cloudflare, Inc.),

3. providers of e-mail and e-mail delivery services (Resend – system messages, Brevo – Newsletter, Apple iCloud+ – handling correspondence),

4. the provider of authentication services (Google Firebase),

5. providers of analytics and campaign measurement tools (Google Analytics, Singular Labs, Inc., counter.dev),

6. the provider of SMS delivery services (to verify phone numbers),

7. the payment provider (Stripe Payments Europe, Ltd., Ireland – processing payments for listing packages, including BLIK, Klarna, Apple Pay and payment cards).

Within the Application, personal data may be subject to profiling in order to match users optimally according to their preferences. However, the Controller does not make automated decisions about users that would produce legal effects concerning them or similarly significantly affect them (within the meaning of Article 22 GDPR).

Under the GDPR, every person whose personal data we process as the Personal Data Controller has the right to:

1. access their personal data, as referred to in Article 15 GDPR,

2. be informed about the processing of personal data, as referred to in Article 12 GDPR,

3. correct, complete, update and rectify personal data, as referred to in Article 16 GDPR,

4. withdraw consent at any time, as referred to in Article 7(3) GDPR,

5. erasure of data (the right to be forgotten), as referred to in Article 17 GDPR,

6. restriction of processing, as referred to in Article 18 GDPR,

7. data portability, as referred to in Article 20 GDPR,

8. object to the processing of personal data, as referred to in Article 21 GDPR,

9. where the legal basis is consent – withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal,

10. not be subject to profiling, as referred to in Article 22 in conjunction with Article 4(4) GDPR,

11. lodge a complaint with a supervisory authority (i.e. the President of the Personal Data Protection Office, PUODO), as referred to in Article 77 GDPR.

If you wish to exercise your rights referred to in the previous point, please send a message by e-mail to the e-mail address referred to in point 2 above, or in writing to the correspondence address stated in the Application Terms of Service.

Every identified security breach is documented and, in any of the situations specified in the GDPR or the Polish Act on the Protection of Personal Data, the data subjects and – where applicable – the President of the Personal Data Protection Office (PUODO) are informed of the personal data breach.

The Cookies Policy is a separate document available at https://rentfriends.app

In matters not regulated by this Privacy Policy, the relevant provisions of generally applicable law apply. In the event of any inconsistency between this Privacy Policy and those provisions, those provisions prevail.

This Privacy Policy is effective from 23 October 2026.