Privacy statement

Who we are

Protiva B.V. is a Dutch property management platform, established at Goudstraat 2, 2718 RC Zoetermeer, the Netherlands, registered with the Dutch Chamber of Commerce under number 42132675. For the processing described in this statement, Protiva B.V. is the controller within the meaning of the General Data Protection Regulation (GDPR).

Privacy questions can be sent to [email protected].

What personal data we process

Depending on your relationship with us, we process among other things:

• Contact and account details: name, email address, phone number, job title and organisation.
• Invoicing and payment details of our customers.
• Usage and log data from the website and the platform (IP address and actions, for example), for security and improvement.
• Communication: emails, support messages and form submissions (such as a demo request).
• Connected social account data: the name, account ID and access token of the person who creates the connection (stored encrypted).

Purposes and legal bases

We process personal data only for clear purposes, and always on one of the legal bases set out in the GDPR:

• Performance of the contract — to deliver our service, manage accounts and invoice.
• Legitimate interest — for the security, improvement and support of the platform, and for limited, relevant communication with customers.
• Consent — for marketing messages and for non-essential cookies (see the cookie policy).
• Legal obligation — the statutory retention period for accounting records, for example.

Who we share data with

We never sell your data. We do engage carefully selected processors, such as our hosting provider (AWS, region eu-central-1 in Frankfurt) and services for email, SMS and analytics. We have a data processing agreement in place with all of them.

Our own storage and processing take place within the European Economic Area (EEA); the platform and the AI processing run in Frankfurt. For a small number of integrations that you activate yourself we work with parties outside the EEA — LinkedIn and Meta, for example, when we publish to our own company pages from the back office. The sign-in credentials and the name of the connecting account are exchanged in the process. Such transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

Retention periods

We keep personal data no longer than necessary for the purposes for which it was collected:

• Administrative and tax records: seven years, in line with the statutory retention obligation.
• Account and usage data: for the duration of the contract and a limited period thereafter.
• Identity data (such as ID scans processed through the platform): a maximum of around 30 days.

How we secure your data

We take appropriate technical and organisational measures: encryption of data in transit and at rest, strict access control, logging of sensitive actions and strict separation of customer environments (multi-tenant isolation). We review our security periodically.

Automated analysis and AI

Protiva uses AI for document recognition (reading and classifying uploaded documents), for the assistant that answers questions about your portfolio, for drafting contract and letter text, for triaging tenant reports, and for comparing an identity document against a face scan.

What is sent is only ever the data belonging to that action: the contents of the document, the question along with the related data from the active portfolio (such as properties, leases, tenant names and outstanding amounts), the description of a report, or the photo on the identity document together with the face scan.

The processing is carried out by Amazon Web Services (AWS) through the Amazon Bedrock service, in region eu-central-1 (Frankfurt), which runs Anthropic's Claude model. AWS acts as a processor on our instructions under a data processing agreement, and thereby provides the same level of protection as described in this privacy policy. The data stays within the European Economic Area, is not used to train AI models, and is not shared with other customers or with third parties.

For our customers (landlords and managers) this processing is an essential part of the service: the lawful basis is performance of the agreement, and there is no separate way to switch it on or off. The Owner app explains this on first use and asks you to confirm it before continuing. For tenants the position is different: they have no agreement with us, so the Tenant app does ask them for explicit permission in advance — in particular for comparing an identity document with a face scan, which involves biometric data. A tenant who does not give permission can have their identity established by their landlord in another way; that permission can be withdrawn at any time under Settings › Security.

This processing supports the user and does not make decisions with legal or similarly significant effects: an outcome from the model is advice that is confirmed by a member of staff. There is therefore no automated decision-making within the meaning of Article 22 GDPR.

Your rights

You have the right of access to, rectification of and erasure of your data, the right to restriction of and objection to processing, and the right to data portability. Where we process on the basis of consent, you can withdraw it at any time.

Would you like to exercise a right? Get in touch at [email protected]. Are you a tenant or supplier whose data sits in a landlord's or managing agent's platform? Then address your request to that organisation in the first instance; we will assist them.

Making a complaint

If you disagree with how we handle your data, we would like to hear it from you first. You also always have the right to lodge a complaint with the supervisory authority of the country where you live or work, or with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl), where Protiva B.V. is established.

Changes

We may amend this privacy statement from time to time. The current version is always on this page, with the date of the last change.