Legal

Privacy statement

Last updated: 1 October 2026 · version 1.7

This translation is for convenience; the Dutch version is legally binding.

This translation is based on version 1.5 of the Dutch document. The current Dutch version (1.7) may contain changes that aren't reflected in this translation yet. Read the Dutch version

This privacy statement explains which personal data HuurPulse processes, why we do so, how long we keep it and what rights you have. We write as clearly as we can. Is anything unclear? Then email privacy@huurpulse.nl.

Summary

We only process the data needed to make HuurPulse work.
We don't sell your data and we don't use advertising or tracking cookies.
We don't measure whether you open our emails or click on links.
Your data is stored on servers in the Netherlands. Our backups are also stored, encrypted, in the Netherlands.
We delete data automatically once the retention period has ended. A program checks this every night.
You can always download your data yourself in My HuurPulse, under Privacy.
You can also ask us there to delete your account. We'll do that within one month.

Who is responsible?

HuurPulse is a trade name of InviCorp B.V., located at Stationsweg 41, 3331 LR Zwijndrecht. We are registered in the Trade Register of the Netherlands Chamber of Commerce (KvK) under number 96868864. Our VAT number is NL867805286B01.

We are the controller for the personal data we process through HuurPulse. This means we decide why and how that happens. One exception: if you send a reply to a landlord or letting agent, that landlord or letting agent is responsible for what they then do with your data.

Questions about privacy can be sent to privacy@huurpulse.nl. Our postal address is shown above.

Who is this statement for?

This statement applies to everyone who uses HuurPulse:

visitors to huurpulse.nl;
home seekers with an account;
landlords, letting agents and other advertisers;
people who send us a message or report something;
people who signed up for the launch announcement.

What data do we process and why?

For each part you can read which data we use, what for and on which legal basis under the General Data Protection Regulation (GDPR). The legal basis is the legal reason why we're allowed to use the data.

Your account

Data: your first name, surname, email address, password (only as an unreadable, encrypted code), the type of account (home seeker or landlord) and the date on which you confirmed that you're 16 or older. If you fill them in yourself, also your phone number and housing preferences, such as towns, moving date and household size.
Purpose: to give you an account and let you log in.
Legal basis: performance of the contract with you (Article 6(1)(b) GDPR).

Accepting the terms

Data: which version of the terms you accepted, when, the type of browser and a pseudonymised code of your IP address. That code is a so-called salted hash: your IP address can't be read from it. We don't store your full IP address for this.
Purpose: to be able to show which terms apply to you.
Legal basis: our legitimate interest in being able to show this (Article 6(1)(f) GDPR).

If you delete your account, we only keep which version you accepted and when. We then delete the code of your IP address and the type of browser.

Logging in and security

Data: the time you log in, your IP address, the type of browser and device, whether you use two-step verification, and login attempts.
Purpose: to protect your account, prevent abuse and warn you. If you log in from a browser we haven't seen on your account in the last 30 days, we send you an email. That way you'll quickly notice if someone else is trying to log in.
Legal basis: our legitimate interest in a secure service (Article 6(1)(f) GDPR).

We record important actions, such as a new password, a different email setting or a deletion request, in a security log. This also includes the time and the IP address. The full IP address stays in the log for 6 months. After that we replace it with a pseudonymised code (a salted hash). The IP address can't be read from it; we can then only see whether different actions came from the same address. Nobody can change the log afterwards.

Logging in with Google

You can also create or use a HuurPulse account with your Google account ("Continue with Google"). This is a choice: logging in with an email address and password is always possible. If you create an account with Google, you also confirm by ticking a box that you're 16 or older. HuurPulse staff can't log in to the admin area with Google.

What data we receive from Google. We only ask Google for the basic details of your profile (the permissions "openid", "email" and "profile"). With these we receive:

your name (first name and surname as they appear in your Google account);
your email address, with confirmation that Google has verified this address;
your Google ID: a fixed number we use to recognise your Google account;
a link to your profile picture, if you have one at Google. We do not use or store that link.

We do not receive the password of your Google account and no access to your Gmail, contacts, calendar, Drive, photos or other data at Google. We don't ask for it either.

What we use this data for. Only to log you in, to create your HuurPulse account or link it to an existing account, and to secure your account (for example a notification when someone logs in from a new device). After that we use your name and email address as with any account (see above). The legal basis is performance of the contract with you (Article 6(1)(b) GDPR).

Where we store it. In the HuurPulse database on our own servers in the Netherlands (at TransIP). We store your Google ID, the email address at that time, the date of linking and the date you last logged in with Google. We don't store any access keys (tokens) from Google.

How long. For as long as the link exists:

If you remove the link in My HuurPulse, under Security, we delete the link and your Google ID straight away.
If you ask us to delete your account, we delete the link and your Google ID together with your account, within one month (as the GDPR requires).

No selling and no sharing. We never sell data we receive from Google. We don't share it with landlords, letting agents, advertisers or other parties, and we don't use it for advertising or profiling. We also don't use it to train artificial intelligence models.

Google API Services User Data Policy. HuurPulse's use and transfer of information received via Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. This means: we only use this data to provide the login feature you see, we don't transfer it to others (except where needed to provide the service, to comply with the law or in a merger or acquisition, with the same protection), and staff only read it when that's needed for security, to comply with the law or when you ask for it yourself (for example with a support question).

Removing the link and deleting data.

In My HuurPulse, under Security, choose "Disconnect". This takes effect straight away. If you only log in with Google, set a password first, so you can still log in afterwards.
You can also revoke access in your Google account, under "Third-party apps and services" (myaccount.google.com/connections).
Would you also like your HuurPulse account and all your data deleted? Request this in My HuurPulse, under Privacy, or email privacy@huurpulse.nl. We'll do this within one month.

Google processes your data itself in accordance with Google's privacy policy. Google is responsible for that itself.

Summary in English — Sign in with Google. Signing in with Google is optional. HuurPulse (InviCorp B.V., the Netherlands) only requests the basic profile scopes (openid, email, profile). We receive your name, your verified email address and your Google account ID; we also receive a link to your profile picture, which we do not use or store. We use this data solely to sign you in, to create or link your HuurPulse account and to keep your account secure. We store your Google account ID, the email address at the time of linking and the link and last-sign-in dates in our own database on servers in the Netherlands; we do not store Google access or refresh tokens. We keep this data only as long as the link exists: when you disconnect Google in My HuurPulse → Security, we delete it straight away; when you ask us to delete your account, we delete it together with your account within one month, as the GDPR requires. We never sell this data, never share it with landlords, advertisers or other third parties, and never use it for advertising, profiling or training AI models. HuurPulse's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can also revoke access at myaccount.google.com/connections, and request deletion of all your data in My HuurPulse → Privacy or via privacy@huurpulse.nl.

Saved searches, alerts, favourites and history

Data: the searches you save (with filters such as town, rent, floor area and, if you fill it in, your gross income to check income requirements), how often you want to receive alerts, your favourites with your own notes, the homes you viewed while logged in and the homes you replied to.
Purpose: to send you home alerts, show your favourites and history, and compare homes.
Legal basis: performance of the contract with you (Article 6(1)(b) GDPR).

You can always clear your history yourself in My HuurPulse, under History.

Your candidate profile

In My HuurPulse you can fill in a candidate profile. This is entirely voluntary.

Data: the composition and size of your household, an indication of your gross monthly income (you can also choose "I'd rather not say"), the type of work or situation you're in (for example permanent contract, self-employed or student), whether you have pets and a short introduction. We don't ask for your employer and we never ask for documents such as a payslip or passport.
Purpose: so you can show a landlord who you are in one go.
Legal basis: your consent (Article 6(1)(a) GDPR).

We only share your candidate profile if you tick the "Include candidate profile" box when replying to a home. That box is unticked by default. You can always change or delete your profile.

Replying to a home

Data: your name, email address, phone number (if you fill it in), your message and, if you choose to, your candidate profile.
Purpose: to deliver your reply to the landlord or letting agent. The landlord sees your reply in their area on HuurPulse and receives an email. If they reply, that reply goes to your email address.
Legal basis: performance of the contract with you (Article 6(1)(b) GDPR). With each reply you indicate that we may share your data with the landlord.

If you reply without an account, we delete your reply together with the whole conversation 12 months after the last message in that conversation.

If you reply to a home from a letting agent who has connected their system to HuurPulse, you can separately choose to have your details added to that letting agent's customer system. That box is unticked by default. Without that tick, we don't send anything to the letting agent's system. Legal basis: your consent (Article 6(1)(a) GDPR).

Once received, the landlord or letting agent is responsible for your data. If you want them to delete your data, please contact them.

Emails from HuurPulse

Service emails: such as confirmation of your email address, a new password, a security notification, a home alert or a message about your reply. Legal basis: performance of the contract (Article 6(1)(b) GDPR). You can always switch off home alerts, per saved search or with the unsubscribe link in every alert.
Newsletter: only if you choose to receive it. Legal basis: your consent (Article 6(1)(a) GDPR). How this works is explained below under "Newsletter".

For every email we send, we keep a sending record: the address, the subject, the type of message, whether sending succeeded and any delivery messages (for example that an address doesn't exist). We don't keep the content of the email in that record. We delete the sending record 90 days after sending. We don't use tracking pixels or tracking links.

Sending via Lettermint. We send our emails via Lettermint B.V., a Dutch company that sends emails for other companies. Lettermint is our processor. For this, Lettermint receives your email address, your name if it appears in the email and the content of the email, and keeps track of whether the email was delivered. Lettermint only processes this data within the European Union (in the Netherlands, with backups in Germany). Lettermint keeps it for 28 days and then deletes it automatically. Lettermint tells us whether an email was delivered, whether an address doesn't exist (any more) and whether someone has reported an email as spam. We don't measure whether you open an email or click a link at Lettermint either.

Block list. If an email address doesn't exist (any more), we stop sending emails to it. If someone reports an email from us as spam, we stop sending newsletters to that address. We do still send service emails, such as a new password or a security notification. For this we put the email address on a block list with the reason. Legal basis: our legitimate interest in not sending emails that don't arrive or aren't wanted (Article 6(1)(f) GDPR). The address stays on the list for as long as we send emails. If you delete your account, we also remove the address from the block list. Is your address working again, or do you want to be removed from the list for another reason? Then email privacy@huurpulse.nl.

We only send you a newsletter if you choose to receive it. You do this with the "Yes, send me the newsletter" box when creating your account, in My HuurPulse or in your landlord area. That box is unticked by default.

Double confirmation: after ticking the box, you'll get an email with a confirmation link. Only once you click that link will you receive the newsletter. The link works for 7 days. If you don't confirm, we delete your sign-up after 30 days.
Data: your email address, your first name (for the greeting), whether you're a home seeker or landlord, the towns from your saved searches and the towns you choose yourself (so you get news about homes in your town). As proof of your consent, we keep the text of the box, the time, where you signed up and an encrypted code of your IP address.
Purpose: to send you the newsletter, with new homes, tips and news about HuurPulse.
Legal basis: your consent (Article 6(1)(a) GDPR).
Unsubscribe with one click: every newsletter contains an unsubscribe link. Many email programs also show their own "Unsubscribe" button; that works with one click. If the newsletter also contains an unsubscribe link from our email service Lettermint, that works the same way. You can also untick the box in My HuurPulse. Unsubscribing takes effect straight away: you won't receive any more newsletters until you give consent again.
What we measure: per newsletter, only how many emails we sent, how many were delivered and how many people unsubscribed via that newsletter. We don't measure whether you open the newsletter or click links.
How long: for as long as you're signed up. If you unsubscribe, we keep your sign-up with the date you unsubscribed, so we can show that we're no longer allowed to send you a newsletter. If you delete your account, we also delete your sign-up.

Customer service, contact form and reports

Data: your name, email address, phone number (if you fill it in), your question, complaint or report, our messages and any attachments (PDF, JPG or PNG). For photos, we automatically remove hidden data such as the GPS location. For the contact form we also keep an encrypted code of your IP address (a "hash"), so we can recognise abuse without storing your IP address itself.
Purpose: to answer and handle your question, complaint or report, for example a report via the "Report an error" button.
Legal basis: performance of the contract if you're a customer (Article 6(1)(b) GDPR), and otherwise our legitimate interest in answering questions and keeping the platform safe (Article 6(1)(f) GDPR). For reports about illegal content we also have a legal obligation (Article 6(1)(c) GDPR).

Privacy requests

Data: what you ask us (for example access or deletion), your email address, the date and how we handled the request.
Purpose: to carry out your request and to be able to show that we did so properly and on time.
Legal basis: our legal obligation (Article 6(1)(c) GDPR).

We delete a privacy request 3 years after it has been handled.

Launch announcement

Before the launch, you can sign up to receive one email as soon as HuurPulse goes live.

Data: your email address, the time and text of your consent, whether you confirmed your sign-up and an encrypted code of your IP address.
Purpose: only to send you that one email. We don't use your address for anything else.
Legal basis: your consent (Article 6(1)(a) GDPR).

You confirm your sign-up via a link in an email. If you don't confirm, we delete your sign-up after 30 days. At launch we send one email to everyone who confirmed their sign-up. As soon as those emails are ready to be sent, we delete the whole list, including sign-ups that weren't confirmed. As with every email we send, your address then stays in our sending record for another 90 days. You can always unsubscribe via the link in the email; we then delete your sign-up straight away.

Landlords, letting agents and other advertisers

Data: your account and contact details, whether you advertise privately or as a business, for a company the company name, Chamber of Commerce (KvK) number, address and website, the status of checks (KvK number and phone number), your team members, your listings, the replies you receive and your answers, your standard replies and statistics per listing.
Purpose: to post and check your listings, deliver replies, prevent fraud and show your statistics. A member of staff checks the KvK number against the details in the Trade Register.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legitimate interest in preventing fraud (Article 6(1)(f) GDPR).

We count statistics per listing per day, without storing who viewed it. To avoid counting a visit twice, we use the visitor's IP address for 30 minutes in the server's working memory. We don't save it in our database.

Photos on social media. When you submit a listing, you can separately give permission to use the photos on HuurPulse's social media (see article 8 of the terms and conditions for advertisers). That box is unticked by default. We keep who gave permission, when, and the text of the box. Legal basis: your consent (Article 6(1)(a) GDPR). We never put your name, your contact details or the exact address of the home in a post. We publish posts on our own accounts on social networks, such as Instagram, Facebook and LinkedIn. The rules of that network also apply there, and that network is itself responsible for what it does with a post. You can always withdraw your permission; we then won't make any new posts with your photos.

Agent integration

Letting agents who work with Realworks can connect their listings to HuurPulse themselves. We then only collect the homes and fields the letting agent has released, such as photos, the description and the office's contact details. If the letting agent switches off the integration, we remove their listings from HuurPulse straight away. We store the letting agent's access codes encrypted.

Contact details in listings

Some listings come from partners, such as letting agents with an integration. These partners sometimes give us the name, email address, phone number or website of the landlord or office, so that home seekers can get in touch. We only show those details if the partner allows it. For own listings, we only show contact details to home seekers with an active subscription. Legal basis: our legitimate interest and that of the landlord in putting home seekers in touch with the landlord (Article 6(1)(f) GDPR). As a landlord, would you like us to stop showing your details? Email meldingen@huurpulse.nl.

For some of our listings we spot public listings on other websites (source "Signal"). From these we do not take any personal data: no names, phone numbers, email addresses, photos or descriptions. We only show basic details of the home and a link to the original listing.

Subscriptions and payments

If you take out a subscription, we process:

Data: your subscription, amounts, payment dates, the payment method (only masked, for example the last digits of your account number), invoices, any refunds or withdrawals, and your confirmation that you're 18 or older.
Purpose: to provide your subscription, process payments and create invoices. We also use whether you have an active subscription to decide whether you get to see all the details of a listing.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legal obligation to keep accounting records (Article 6(1)(c) GDPR).

Payments are handled by our payment service provider Mollie. You enter your card or bank details at Mollie; they don't reach our servers.

Visiting the website

Data: your IP address and the type of browser.
Purpose: to make the website work and protect it against abuse. We temporarily block too many requests in a short time (for example login attempts). For this we keep the IP address, or an encrypted code of it, for up to an hour in the server's working memory.
Legal basis: our legitimate interest in a secure and working website (Article 6(1)(f) GDPR).

We don't use analytics services such as Google Analytics, or advertising networks.

Map and addresses

The map on HuurPulse is the BRT background map from PDOK (Kadaster, the Dutch Land Registry). Your browser fetches the map via our own server, so you don't connect to PDOK. If you type a town or address in the search box, our server only sends that search text to PDOK to suggest places. We don't send your IP address or other data about you with it. We also look up the addresses of homes via PDOK to place them on the map. The map never shows the exact location of a home.

Outside the European Economic Area

Our servers and backups are in the Netherlands. Our processors process your data within the European Economic Area (EEA).

If you choose to log in with Google, Google may also process data outside the EEA, for example in the United States. Google LLC participates in the EU-US Data Privacy Framework. According to the European Commission, this ensures an adequate level of protection.

How long do we keep your data?

We don't keep your data longer than necessary. The main periods are:

We keep your account and everything that goes with it for as long as your account exists.
We keep the full IP address in the security log for 6 months. After that we replace it with a pseudonymised code.
We delete email sending records 90 days after sending.
At Lettermint, which sends our emails, emails are kept for 28 days. After that they're deleted automatically.
We keep an address on the block list (undeliverable or reported as spam) for as long as we send emails, or until you delete your account.
We delete replies to a home that you sent without an account, together with the whole conversation, 12 months after the last message.
We delete contact messages 12 months after receipt.
We delete closed support questions 24 months after closing, including messages and attachments.
We delete reports of fraud and errors 2 years after they have been handled.
We delete privacy requests 3 years after they have been handled.
We delete read notifications in your account after 6 months.
We keep invoices and payment details for 7 years, because tax law requires this.

A program on our server checks every night which periods have ended. Data therefore disappears no later than one day after the period has ended.

Backups. Deleted data may still be in our backups for up to 1 year afterwards (daily backups 15 days, monthly backups 1 year; see "How do we protect your data?"). We only use backups to restore HuurPulse after a fault or error.

All periods are listed in our data retention policy.

How do we protect your data?

We take appropriate technical and organisational measures. For example:

All connections to HuurPulse are encrypted (https).
We only store passwords as an unreadable code (using Argon2id). Nobody at HuurPulse can see your password.
You can turn on two-step verification for your account. For HuurPulse staff it's mandatory, and their sessions expire after 12 hours at most.
We store secret keys, such as those for two-step verification and letting agents' integration codes, encrypted.
The database can't be reached directly from the internet.
Staff only have access to the data they need for their work. Important actions in the admin area are recorded.
Every night we make a backup of the database and the photos. We encrypt it on our own server (AES-256) before any copy leaves the server. Only we have the key; Scaleway doesn't.
We keep a copy of every backup at Scaleway SAS (France), in a data centre in Amsterdam (the Netherlands). Scaleway only receives the encrypted files and can't read them. The copies are locked: nobody can delete or change them before their retention period has ended, not even us.
We keep daily backups for 15 days and monthly backups for 1 year. After that they're deleted automatically.

If something does go wrong with your data (a data breach), we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if the law requires this. If there's a high risk to you, we'll also inform you.

Automated decisions

We don't make decisions about you that are taken solely by a computer and that have legal effects or other significant effects on you. Home alerts work with the filters you set: the computer looks for homes that match them. Listings are assessed by people. Temporarily blocking too many requests (for example login attempts) happens automatically, but is only intended to prevent abuse.

Minors

You can create an account if you're 16 or older. You confirm this by ticking a required box, including when you sign up with Google. We store the date on which you confirmed this. You must be 18 or older for a paid subscription. Do you think we have data of someone under 16? Then email privacy@huurpulse.nl. We'll then delete that data.

Cookies

We only use cookies that are needed to make the site work, for example to keep you logged in. Read more in our cookie statement.

Your rights

You have these rights:

Access: you may know what data we hold about you.
Rectification: if your data is incorrect, you may ask us to correct it.
Erasure: you may ask us to delete your data.
Restriction: you may ask us to temporarily restrict the use of your data.
Data portability: you may receive your data in a file, to give it to someone else.
Objection: you may object if we use your data on the basis of our legitimate interest. You can always object to use for direct marketing.
Withdrawing consent: if you've given consent for something, you may always withdraw it. What we already did on that basis remains valid.

Deletion and our backups

If you ask us to delete your data, we erase it from HuurPulse itself within one month. We can't delete it individually from backups that have already been made, because those copies are locked. Your data disappears from them automatically once the retention period of that backup has ended: after 15 days at the latest from the daily backups and after 1 year at the latest from the monthly backups. Until then, we only use backups to restore HuurPulse after a fault or error. If we ever have to restore a backup, we delete your data again straight away.

How to exercise your rights

Download your data: in My HuurPulse, go to Privacy and choose "Download my data". You'll get a file (JSON) with your data straight away.
Change your data: you can change most data yourself in My HuurPulse, for example under My details and Notifications.
Delete your account: in My HuurPulse, go to Privacy and choose "Delete account". We'll carry out your request within one month. Until then, you can keep logging in as normal.
All other requests: email privacy@huurpulse.nl. Preferably do this from your account's email address. That way we know the request really comes from you. We never ask for a copy of your passport.

We respond within one month. If your request is complex or we receive a lot of requests, it may take two months longer. We'll let you know within one month if that's the case.

On deletion, we erase or anonymise your data. Some data we have to keep for longer, such as invoices (7 years, for tax law). We then only use that data for that purpose. Deleted data may still be in backups for up to 1 year (daily backups 15 days, monthly backups 1 year); after that it's gone from there too.

Complaints

Not happy with how we handle your data? Let us know via privacy@huurpulse.nl. We'd be glad to find a solution together. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), via autoriteitpersoonsgegevens.nl.

Changes

We update this privacy statement when HuurPulse changes. The date and version number are shown at the top. For important changes, we'll let you know, for example by email or with a notification in My HuurPulse.

Contact

Privacy and GDPR requests: privacy@huurpulse.nl
Post: InviCorp B.V., Stationsweg 41, 3331 LR Zwijndrecht