Section 1Who We Are

KeyHomez is a rental agency based in Den Haag, the Netherlands, offering apartment rental services and a third-party secure escrow payment solution to both tenants and landlords.

For the purposes of the GDPR, KeyHomez is the data controller for personal data collected through this website and through our rental and escrow services.

Section 2Personal Data We Collect

We collect only the personal data that is necessary to provide our services and operate our website. The categories of data we may collect include:

2.1 — Identity & Contact Data

2.2 — Rental & Escrow Data

2.3 — Website & Technical Data

We do not collect sensitive personal data (special categories under GDPR Article 9) such as health information, racial or ethnic origin, political opinions, or religious beliefs, unless explicitly required and consented to for a specific purpose.

Section 3How We Collect Your Data

We collect personal data through the following means:

• Directly from you — when you complete a contact form, request a property viewing, enquire about our escrow service, or communicate with us by email or phone.
• During the rental process — when you apply for a tenancy, submit identification documents, or sign a rental agreement through KeyHomez.
• Through our escrow service — when you initiate or receive an escrow payment, we collect the financial and identity data necessary to complete and verify the transaction.
• Automatically via your browser — when you visit keyhomez.com, certain technical data is collected automatically via cookies and server logs. See our Cookie Policy for full details.
• From third parties — in limited cases, we may receive data about you from landlords, reference providers, or credit check agencies as part of a tenancy application process, always with your knowledge and consent where required.

Section 4Why We Use Your Data

We use your personal data for the following purposes, each grounded in a lawful basis under GDPR Article 6:

• To process your rental enquiry or application — including verifying your identity, assessing suitability, and matching you with available properties. Basis: contract / legitimate interest.
• To operate our escrow service — including receiving, holding, and releasing funds between tenants and landlords in accordance with agreed conditions. Basis: contract / legal obligation.
• To communicate with you — responding to your messages, sending viewing confirmations, and keeping you updated on the status of your application or transaction. Basis: contract / legitimate interest.
• To comply with legal obligations — including anti-money laundering (AML) checks, identity verification, and financial record-keeping required under Dutch law. Basis: legal obligation.
• To improve our website and services — using anonymised analytics data to understand how visitors use our site and identify areas for improvement. Basis: consent / legitimate interest.
• To send you relevant updates — where you have opted in, we may send you information about new property listings or service updates. You may unsubscribe at any time. Basis: consent.
• To enforce our terms and resolve disputes — including maintaining records of transactions and agreements for legal and contractual purposes. Basis: legitimate interest / legal obligation.

We will never use your personal data for purposes that are incompatible with those listed above without informing you and, where required, obtaining your consent.

Section 5Sharing Your Personal Data

We do not sell, rent, or trade your personal data to third parties. We may share your data in the following limited circumstances:

5.1 — Landlords & Property Owners

As part of a tenancy application, we share relevant personal data (such as your name, contact details, and financial references) with the landlord of the property you are applying for. This is done only with your knowledge and as necessary to progress your application.

5.2 — Service Providers (Data Processors)

We share data with trusted third-party service providers who process it on our behalf. These processors are contractually bound to protect your data and may only use it for the specified purpose:

• Website hosting & IT infrastructure — including our hosting provider and content delivery services.
• Email & communication tools — used to send and receive correspondence with you.
• Analytics providers — Google Analytics (anonymised usage statistics).
• Payment & banking providers — for processing escrow transactions in accordance with Dutch financial regulations.
• Identity verification services — used for AML and tenant screening checks where legally required.

5.3 — Legal & Regulatory Authorities

We may disclose personal data to competent authorities (such as the Dutch Financial Intelligence Unit, tax authorities, or law enforcement) where we are legally required to do so, or where disclosure is necessary to protect our legal rights or the rights of others.

5.4 — Business Transfers

In the event that KeyHomez is acquired, merged, or undergoes a significant business change, personal data held by us may be transferred to the new entity. We will notify affected individuals in advance where possible and ensure equivalent data protection standards are maintained.

Section 6International Data Transfers

Where we use service providers located outside the European Economic Area (EEA) — such as Google LLC (USA) — your personal data may be transferred to and processed in countries that may not provide the same level of data protection as the Netherlands.

In such cases, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) — as approved by the European Commission under Article 46 GDPR.
• Adequacy decisions — transfers to countries recognised by the European Commission as providing adequate protection.
• Binding Corporate Rules — where applicable for multinational service providers.

You may request further information about the safeguards in place for specific transfers by contacting us at [email protected].

Section 7How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. The table below sets out our standard retention periods:

Once personal data is no longer required, it is securely deleted or anonymised in accordance with our internal data retention procedures.

Section 8Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights. You may exercise any of these rights at any time by contacting us using the details in Section 13.

Section 9Cookies

Our website uses cookies and similar tracking technologies to ensure it functions correctly and to improve your experience. For full details on the types of cookies we use, their purposes, durations, and how to manage your preferences, please refer to our dedicated Cookie Policy.

When you first visit keyhomez.com, a cookie consent banner will allow you to accept or decline non-essential cookies. You may change your preferences at any time by clearing your cookies and revisiting the site.

Section 10Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against accidental or unlawful loss, destruction, alteration, unauthorised disclosure, or access. These measures include:

• SSL/TLS encryption — all data transmitted between your browser and our website is encrypted using HTTPS.
• Access controls — personal data is accessible only to authorised KeyHomez staff who require it for their role.
• Secure data storage — data is stored on secure, password-protected systems with regular backups.
• Third-party security standards — we only work with service providers who maintain appropriate data security standards.
• Staff training — our team is trained on data protection best practices and obligations under the GDPR.

Despite these measures, no data transmission over the internet or electronic storage system is entirely secure. If you have reason to believe your interaction with us is no longer secure, please notify us immediately at [email protected].

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours as required by GDPR Article 33, and will notify affected individuals where required under Article 34.

Section 11Children’s Privacy

Our website and services are intended for adults aged 18 and over. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data without parental consent, please contact us at [email protected] and we will delete it promptly.

Section 12Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or via a notice on our website.

We encourage you to review this policy periodically. Your continued use of our website or services after any changes constitutes your acknowledgement of the updated policy.

Section 13Contact & How to Complain

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your personal data, please contact us:

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Dutch supervisory authority: