Privacy Policy

1. Introduction and Who We Are

Properly ("the Company", "we", "us", or "our") is the data controller responsible for your personal data. We are a property rental platform operating in Ireland.

Registered address: The Gate Lodge, Sandyford Road, Dundrum, Dublin 16, Ireland
Contact email: support@properly.ie
Website: https://properly.ie

We do not rely on your mere use of the Service as a form of consent to data processing. Where we rely on consent as our lawful basis, we will obtain this separately and explicitly.

2. Interpretation and Definitions

The words whose initial letters are capitalised have meanings defined below. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

• Account: A unique account created for you to access our Service.
• Affiliate: An entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• Cookies: Small files placed on your device by a website, containing details of your browsing activity on that website among other uses.
• Country: Ireland
• Data Controller: The entity that determines the purposes and means of processing personal data. Properly is the data controller for personal data processed through the Service.
• Data Processor: A natural or legal person who processes personal data on behalf of the data controller.
• Data Subject: An identified or identifiable natural person to whom personal data relates — this means you.
• Device: Any device that can access the Service, such as a computer, mobile phone, or digital tablet.
• Personal Data: Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier.
• Service: The Properly website and platform, accessible from https://properly.ie.
• Service Provider or Processor: A third-party company or individual engaged by Properly to process personal data on our behalf in connection with the Service.
• Special Category Data: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a natural person's sex life or sexual orientation, which requires additional protections under Article 9 GDPR.
• Usage Data: Data collected automatically, either generated by use of the Service or from the Service infrastructure (for example, page visit duration, IP address).

3. Lawful Bases for Processing

Under Article 6 GDPR, we rely on the following lawful bases for processing your personal data:

• Contract Performance (Article 6(1)(b)): Processing is necessary to enter into or perform our contract with you, including operating your account, processing tenancy applications, facilitating property listings, and managing document verification.
• Legal Obligation (Article 6(1)(c)): Processing is necessary to comply with our legal obligations, including identity verification requirements, financial record-keeping, and fraud prevention obligations.
• Legitimate Interests (Article 6(1)(f)): Processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests. Our legitimate interests include operating and improving the Service, preventing fraud, ensuring platform security, and facilitating communications between landlords and tenants. Where we rely on legitimate interests, you have the right to object (see Section 11).
• Consent (Article 6(1)(a)): For processing activities where consent is required — including certain cookies, optional document uploads beyond contractual necessity, and marketing communications — we will obtain your explicit, freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Where we process Special Category Data (for example, any health or disability information you voluntarily include in a personal description), we rely on your explicit consent under Article 9(2)(a) GDPR.

4. What Personal Data We Collect

4.1 Identity and Contact Information

• Full name
• Email address (used as your account username)
• Mobile phone number
• Date of birth
• Gender
• Profile picture
• Personal description or biography

Lawful basis: Contract performance; legitimate interests (account security and identification).

4.2 Location and Address Information

• Home or current address, including county, area, town, street name, house or apartment number, and Eircode (Irish postal code)
• Geographic coordinates (latitude and longitude) associated with property listings
• Preferred locations for property searches or roommate matching
• Work location or employer address

Lawful basis: Contract performance; legitimate interests (enabling location-based property searches).

4.3 Professional and Financial Information

• Occupation and job title
• Employer name and address
• Employment type (full-time, part-time, contract, self-employed, etc.)
• Salary range or income bracket
• Maximum monthly rental budget
• Number of occupants in your household

Lawful basis: Contract performance (required to assess rental applications); legitimate interests (facilitating accurate tenancy suitability assessments).

4.4 Document Uploads and Verification Data

We collect, store, and process the following documents and information extracted from them:

• Government-issued identity documents (e.g., passport, national ID card)
• Payslips and income verification documents
• Employer reference letters
• Previous landlord reference letters
• Signed lease agreements

During automated document verification we also extract and store:

• Names appearing on documents
• Document expiry dates
• Address verification results
• Income amounts extracted from payslips
• Credibility and verification scores (0–100 scale)
• Fraud indicator flags

Lawful basis: Contract performance (identity and suitability verification is required to process tenancy applications); legal obligation (identity verification under Irish tenancy and anti-fraud law); consent (your explicit document consent is recorded before upload).

4.5 Communication Data

• Content of messages sent between users through our in-platform chat
• Sender and recipient identifiers and names
• Message timestamps and delivery status
• Email correspondence with our support team
• Any custom requests or instructions submitted through the platform

Lawful basis: Contract performance; legitimate interests (facilitating communication between landlords and tenants, resolving disputes, ensuring platform safety).

4.6 Preferences and Behavioural Data

• Saved property searches and search filters
• Saved or shortlisted properties
• Roommate preferences (including lifestyle tags, preferred areas, and maximum budget)
• Liked, passed, and matched roommate profiles (where you use the roommate matching feature)
• Auto-apply preferences (locations, price ranges, bedroom requirements, property type, furnishing)
• Notification preferences

Lawful basis: Contract performance (to provide personalised features you request); legitimate interests (improving Service functionality).

4.7 Agency and Professional Account Information (Landlords and Agents)

• Agency or company name
• Company registration number
• Company VAT number
• Company address
• Agency logo
• Employee account associations
• Property listings and associated management data

Lawful basis: Contract performance; legal obligation (business identification and tax compliance).

4.8 Usage Data and Technical Information

• Device Internet Protocol (IP) address
• Browser type and version
• Pages of the Service visited and time spent on each page
• Time and date of visits
• Unique device identifiers and diagnostic data
• Mobile device type and operating system (where applicable)
• API request logs

Lawful basis: Legitimate interests (maintaining Service security, preventing fraud, improving platform performance).

4.9 Consent and Legal Records

• Record of acceptance of Terms and Conditions
• Record of document upload consent
• Email verification status
• Cookie consent preferences
• Password reset request timestamps

Lawful basis: Legal obligation; legitimate interests (demonstrating compliance with legal and contractual obligations).

5. How We Collect Personal Data

We collect personal data through the following means:

(a) Directly from you when you:

• Register for an account and complete your profile
• Submit a tenant application
• Create or edit a property listing
• Upload documents for verification
• Use our in-platform messaging system
• Save searches, properties, or roommate profiles
• Contact our support team by email or through the platform
• Set auto-apply or notification preferences

(b) Automatically when you use the Service:

• Through cookies and similar tracking technologies (see Section 6)
• Through server and API request logs
• Through analytics tools monitoring Service usage

(c) From third parties:

• Reference letters and information provided by your employer or previous landlord (on your instruction)
• Identity and document data extracted by our automated verification system (Stripe Identity and AWS Lambda processing)
• Location data via Google Maps API when you search for or create property listings

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service.

Strictly Necessary Cookies

Type: Session cookies  |  Administered by: Properly

Essential for the Service to function. These authenticate users and prevent fraudulent account access. These cookies cannot be disabled without impairing the Service.

Lawful basis: Legitimate interests (necessary for platform operation); no consent required for strictly necessary cookies.

Cookie Consent Cookies

Type: Persistent cookies  |  Administered by: Properly

Record whether you have accepted or declined non-essential cookies.

Lawful basis: Legitimate interests (maintaining a record of your consent decision).

Functionality Cookies

Type: Persistent cookies  |  Administered by: Properly

Remember your choices and preferences (e.g., login state, language preference) to provide a more personalised experience.

Lawful basis: Consent (where non-essential); contract performance (where required for core functionality you have requested).

Where we use non-essential cookies, we will obtain your consent before placing them. You may withdraw or change your cookie consent at any time using our cookie preferences tool on the website or through your browser settings. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

For more information, please see our Cookie Policy.

7. Automated Decision-Making and Profiling

In accordance with Article 22 GDPR, we inform you that the Service uses automated processing that may produce decisions which have a significant effect on you.

7.1 Document Credibility Scoring

When you upload identity or financial documents as part of a tenancy application, our automated verification system (operated via Stripe Identity and AWS Lambda processing) analyses the documents and generates:

• A credibility score (0–100) for each document
• An individual document score
• An overall application verification score
• A list of fraud indicator flags (if any)

These scores and flags are made available to landlords and letting agents who have received your application and may influence whether your application progresses.

7.2 AI-Assisted Analysis

We use AI-assisted tools to analyse applicant profiles and property listings for the purpose of improving matching outcomes and providing summary insights to landlords or letting agents.

7.3 Your Rights Regarding Automated Decisions

Where a decision based solely on automated processing produces legal or similarly significant effects on you, you have the right to:

• Request human review of the decision
• Express your point of view
• Obtain an explanation of the decision
• Contest the decision

To exercise these rights, please contact us at support@properly.ie.

8. Sharing Your Personal Data

We share personal data only where necessary and in accordance with this Privacy Policy. We do not sell your personal data to third parties.

8.1 Between Users on the Platform

• Tenant applicants: your name, contact details, application materials, and verification outcomes are shared with the landlord or letting agent for the property to which you applied.
• Landlords and agents: your name and contact phone number (if you choose to display it) are visible to prospective tenants viewing your listing.
• Roommate matching: if you enable your profile for roommate search, your name, profile picture, description, lifestyle preferences, and location preferences are visible to other users using the roommate matching feature.

8.2 Service Providers and Data Processors

We engage the following third-party processors to operate the Service. These processors act only on our documented instructions and are bound by contractual data protection obligations:

• Stripe, Inc. (USA): Payment processing and identity verification services. Data may be transferred to the USA under Standard Contractual Clauses. Stripe Privacy Policy
• Amazon Web Services (AWS) (USA): Cloud infrastructure, document and file storage (S3), serverless document processing (Lambda), and secrets management. Data may be transferred to the USA under Standard Contractual Clauses. AWS Privacy Policy
• Google LLC (USA): Google Maps Platform used for location search, address suggestions, and geographic coordinate services. Data may be transferred to the USA under Standard Contractual Clauses. Google Privacy Policy
• Zoho Corporation (India): Email delivery for account notifications, verification emails, and system alerts. Data may be transferred under Standard Contractual Clauses. Zoho Privacy Policy

8.3 Legal and Regulatory Disclosures

We may disclose your personal data where required or permitted by law:

• In response to a valid request from a court, regulator, or law enforcement authority
• To comply with a legal obligation under Irish or EU law
• To protect the rights, property, or safety of Properly, our users, or the public
• In connection with fraud prevention or investigation

8.4 Business Transfers

If Properly is involved in a merger, acquisition, restructuring, or asset sale, your personal data may be transferred to a successor entity. We will provide you with advance notice before your personal data becomes subject to a different privacy policy and, where required, seek your consent.

9. International Transfers of Personal Data

Some of our service providers are located outside the European Economic Area (EEA), including in the United States. Where we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place in accordance with Chapter V GDPR, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Supplementary technical and organisational measures where appropriate

You may request details of the specific safeguards in place for any international transfer by contacting us at support@properly.ie.

10. Retention of Your Personal Data

We retain your personal data only for as long as is necessary for the purposes described in this Privacy Policy, or as required by law. We apply the data minimisation principle and delete or anonymise data as soon as it is no longer needed.

The following maximum retention periods apply:

• Account and profile data: Retained for the duration of your account, plus up to 24 months after account closure to handle post-termination matters, resolve disputes, and comply with legal obligations. After this period, your account data is securely deleted or anonymised.
• Tenancy applications: Retained for up to 24 months from submission. Where a tenancy is entered into, application records may be retained for the duration of the tenancy plus 6 years to comply with landlord-tenant legal obligations.
• Uploaded documents (ID, payslips, references, leases): Retained for the duration of the related application or tenancy relationship plus up to 12 months, or longer where required by law (e.g., financial records for tax compliance under Irish law). Documents are stored in encrypted cloud storage (AWS S3).
• Automated verification data (extracted names, income figures, scores, fraud flags): Retained for the same period as the related application. This data is not used for any purpose other than the verification for which it was obtained.
• Chat messages: Retained for up to 24 months from the date of the message, unless required for dispute resolution, in which case relevant messages may be retained until the dispute is resolved.
• Usage data and server logs: Retained for up to 90 days from collection, unless required for ongoing security investigation or legal compliance.
• Cookie and consent records: Retained for up to 24 months from the date the consent decision was recorded.
• Support correspondence: Retained for up to 24 months from the date the matter was resolved.

We may retain personal data beyond the periods stated above where:

• We are required to do so by law (e.g., financial records under the Taxes Consolidation Act 1997)
• Retention is necessary to establish, exercise, or defend legal claims
• You have explicitly requested retention of specific information
• Data exists in encrypted backup systems pending scheduled deletion (backup copies are not actively processed and are deleted in accordance with our backup retention schedule)

Upon expiry of the applicable retention period, personal data is either securely deleted from our systems or irreversibly anonymised. Anonymised data is not personal data and may be retained indefinitely for research and analytics purposes.

11. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights. We will respond to requests within one month of receipt (or within three months for complex or multiple requests, with notice to you of the extension).

• Right of Access (Article 15): You have the right to obtain confirmation of whether we process your personal data, and to receive a copy of that data along with information about how it is used.
• Right to Rectification (Article 16): You have the right to have inaccurate personal data corrected and incomplete personal data completed without undue delay.
• Right to Erasure (Article 17): You have the right to request deletion of your personal data where: it is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other lawful basis; you object and there are no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required by EU or Irish law. This right does not apply where processing is necessary for legal obligations or legal claims.
• Right to Restriction of Processing (Article 18): You have the right to request that we restrict processing of your personal data in certain circumstances, including while the accuracy of data is contested, or where processing is unlawful and you prefer restriction over erasure.
• Right to Data Portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
• Right to Object (Article 21): You have the right to object at any time to processing of your personal data based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is necessary for legal claims. You have an unconditional right to object to processing for direct marketing purposes.
• Rights Related to Automated Decision-Making (Article 22): You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects, unless you have explicitly consented or it is necessary for a contract. Where automated decisions are made, you have the right to request human review and to contest the decision. See Section 7 for details.
• Right to Withdraw Consent (Article 7(3)): Where we rely on consent as our lawful basis, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, contact us at support@properly.ie with the subject line "Data Subject Request". We may need to verify your identity before processing your request.

Right to Lodge a Complaint (Article 77):

You have the right to lodge a complaint with the Data Protection Commission (DPC), the supervisory authority for Ireland:

12. Security of Your Personal Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include:

• Encryption of data in transit (TLS) and at rest
• Encrypted document storage in AWS S3
• Credential management through AWS Secrets Manager
• JWT-based authentication with 24-hour token expiry
• Role-based access controls limiting data access to authorised personnel
• API request logging and monitoring

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining appropriate safeguards and will notify you and the relevant supervisory authority of a personal data breach where required by Articles 33–34 GDPR.

13. Children's Privacy

Our Service is not directed at persons under the age of 18, and we do not knowingly collect personal data from minors. The minimum age to use our Service is 18 years.

If you become aware that a child under 18 has provided personal data to us without appropriate consent, please contact us at support@properly.ie and we will take steps to delete that data promptly.

14. Data Minimisation and Purpose Limitation

We collect only the personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this Privacy Policy (data minimisation — Article 5(1)(c) GDPR). We do not use your personal data for purposes incompatible with those for which it was originally collected (purpose limitation — Article 5(1)(b) GDPR). If we intend to process your personal data for a new purpose, we will provide you with prior notice and, where required, obtain your consent.

15. Links to Other Websites

Our Service may contain links to third-party websites not operated by us. If you click on a third-party link, you will be directed to that site. We strongly advise you to review the privacy policy of every site you visit. We have no control over and accept no responsibility for the content, privacy policies, or practices of any third-party sites or services.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on this page with a revised "Last updated" date
• Sending you an email notification to the address associated with your account
• Displaying a prominent notice on our Service prior to the change taking effect

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after notification of changes constitutes acknowledgement (but not consent, where consent is separately required) of the updated policy.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

By email: support@properly.ie
By post: Properly, The Gate Lodge, Sandyford Road, Dundrum, Dublin 16, Ireland
By visiting: https://properly.ie

For requests relating to your data subject rights under GDPR, please use the subject line "Data Subject Request" in any email to ensure your request is handled promptly.

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (see Section 11).