Privacy Policy
Data controller
Rumicasa is the data controller for the personal data processed through this site and the service. For questions about this Privacy Policy or your personal data, please contact privacy@rumicasa.com.
What personal data we process
We process the data you provide through our forms, emails or your use of the service. This includes your name, email address, phone number, address or postcode of your homeowners association, your position within the HOA, and the content of your correspondence with us. When you use the service we also process technical data such as your IP address, browser and device information, and log files.
Purposes and legal basis
We process your personal data (a) to perform our contract with you or the HOA of which you are a part (Art. 6(1)(b) GDPR), (b) to comply with legal obligations such as tax retention requirements (Art. 6(1)(c) GDPR), (c) on the basis of your consent for marketing and to send you your free health check (Art. 6(1)(a) GDPR), and (d) for our legitimate interests such as product improvement, fraud prevention and security (Art. 6(1)(f) GDPR). You may withdraw consent at any time; withdrawal does not affect processing carried out before withdrawal.
Recipients and processors
We share your data only with processors that support us in delivering the service, including Supabase (database and authentication, EU-hosted), Vercel (hosting), Twilio (verification over WhatsApp and SMS), Sentry (error monitoring) and Meta (WhatsApp Business API). We have entered into a data processing agreement with each processor. We do not sell your data to third parties.
Transfers outside the EEA
Where a processor is established outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and, where necessary, supplementary technical and organisational measures such as encryption.
Retention
We do not retain your data longer than necessary. Marketing contacts are kept for up to 24 months after your last interaction. Account data is kept for the duration of your account. Fiscal and administrative records are kept for 7 years in line with Article 52 of the Dutch General Tax Act (Algemene wet inzake rijksbelastingen). You may request earlier deletion where no legal retention requirement applies.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and you have the right to withdraw any consent you have given. To exercise these rights, contact privacy@rumicasa.com. In principle, we respond within one month.
Cookies
Our site uses only functional cookies and privacy-friendly, anonymised analytics cookies. We do not use advertising or tracking cookies. You can refuse or delete cookies through your browser settings.
Security
We apply appropriate technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest, need-to-know access controls, logging and periodic reviews. In the event of a data breach, we notify the Dutch Data Protection Authority within 72 hours as required by the GDPR, and, where required, the data subjects concerned.
Complaints
If you are not satisfied with how we handle your data, please first contact us at privacy@rumicasa.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
Changes
We may update this Privacy Policy from time to time. The current version is always available on this page, with the date it was last updated. We announce material changes in advance by email or within the service.
Contact
For questions about this Privacy Policy or your personal data, please contact privacy@rumicasa.com.