Privacy Policy

Last updated: 12 August 2026

This Privacy Policy explains how Kraken Solutions sp. z o.o., operating under the brand Findrent ("Findrent", "we", "us"), collects and uses personal data when you use findrent.nl and the services offered through it (the "Service"). Findrent is a rental-listing alert service: we monitor major housing platforms and notify you when a listing matches your search.

We take your privacy seriously and process personal data in line with the EU General Data Protection Regulation (GDPR), which applies throughout the European Union, together with the Polish national data-protection law that supplements it – Poland being the country in which we are established.

1. Who is responsible for your data

The data controller for the personal data described in this policy is Kraken Solutions sp. z o.o., ul. Floriańska 6/02, 03-707 Warszawa, Poland. Our full company details are in our Legal Notice.

For any privacy question or to exercise your rights, contact us at privacy@findrent.nl. Section 8 explains where you can complain if you are not satisfied with our answer.

2. What data we collect

Account data – the email address you register with and your login credentials.
Search data – the search criteria you set (city, budget, size, property type and similar preferences) and the alerts we send you.
Payment data – if you take a paid plan, the billing information needed to process your subscription. Payments are handled by Stripe, and card details are entered on Stripe's own hosted checkout pages, never on ours. We never see or store your card number, bank account details or any direct-debit mandate. What we store is Stripe's own reference numbers for you and your subscription, the plan's status, and the date your access runs until.
Usage data – aggregated statistics about how the Service is used, such as which pages are viewed and how long visits last. We collect this with analytics software we run on our own server, not a third-party analytics service, and it works without cookies: nothing is stored on or read from your device. Visits are grouped together using a value our own server works out from technical information your browser sends anyway (such as your IP address and browser type), combined with a secret that we change at the start of every month. We do not store your IP address itself. Because that secret changes each month, the value changes with it, so the same browser cannot be recognised from one month to the next. Within a single month, and on a connection that does not change, visits from the same browser are grouped under the same value, which is what lets us tell a returning visit from a new one. If you are signed in, we attach a pseudonymous account identifier – a random internal reference, never your email address – to your analytics sessions, so that we can see how registered users use the Service and where they get stuck; it is stored on our own server alongside the analytics data, and nothing is saved on or read from your device. We do not use any of this for advertising or profiling, and we do not use session recording or heat mapping.
Approximate sign-up location – when you create an account we derive an approximate location (city and country) from your IP address, for operational and anti-abuse monitoring. This lookup runs locally on our own server using an offline database: your IP address is not sent to any third party, and neither your IP address nor the derived location is stored. The approximate location appears once in an internal notification and is then discarded. Because it is derived from an IP address it is only ever approximate – it often reflects your internet provider's location rather than yours.
Communications – messages you send us and our replies.
Email preferences – whether you have chosen to receive optional product-update emails, and the date you made that choice (or withdrew it). We keep this so we can prove we only email people who asked us to, and that we stopped when asked.

3. Why we use your data and our legal basis

To provide the Service – create your account, run your searches and send you alerts (legal basis: performance of our contract with you).
To process payments and manage your subscription (legal basis: performance of our contract).
To keep the Service secure and prevent abuse (legal basis: our legitimate interest). This includes the approximate sign-up location described above, which we chose to derive on our own server and keep unstored precisely so that this interest does not come at the cost of your privacy.
To understand how the Service is used and improve it, using the cookieless, self-hosted analytics described above (legal basis: our legitimate interest in running and improving our own service). We chose a method that stores nothing on your device and, apart from the pseudonymous account identifier described above, does not identify visitors at all, precisely so that this interest does not come at the cost of your privacy.
To respond to your messages and provide support (legal basis: our legitimate interest / performance of our contract).
To send service-related emails – the alerts you asked for, and messages about your account or plan (legal basis: performance of our contract).
To send optional product-update emails about new features and improvements. These are sent only if you tick the box asking for them (legal basis: your consent). Ticking it is never required to use the Service, and you can withdraw your consent at any time – every such email carries a one-click unsubscribe link that needs no login, and you can also change the setting in your account. Withdrawing consent does not affect the alerts for your saved searches, which are separate.

4. Who we share data with

We do not sell your personal data. We share it only with service providers who help us run the Service, and only to the extent they need it to perform their role on our behalf:

Stripe – our payment provider. If you take a paid plan, Stripe processes your payment and holds your payment details; we do not. Stripe also acts as a controller in its own right for parts of that processing (fraud prevention and its own legal obligations), and its handling of your data is described in Stripe's own privacy policy.
Hosting and infrastructure providers – who run the servers the Service operates on.
Email-delivery providers – who deliver your alerts and account emails.

We may also disclose data where we are legally required to do so.

5. International transfers

Our servers are in the European Union, and most of the providers above process your data within the European Economic Area (EEA), where no transfer mechanism is required.

Stripe. Our contracting entity for payments is Stripe Payments Europe, Limited, established in Ireland, so that processing takes place inside the EEA and is not an international transfer. Where Stripe involves Stripe, Inc. in the United States, the transfer is covered by the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework and, in addition, by the European Commission's standard contractual clauses.

For any other provider that processes data outside the EEA, we take steps to ensure an adequate level of protection, such as relying on a European Commission adequacy decision or on standard contractual clauses.

6. How long we keep your data

We keep your personal data for as long as you have an account and as long as needed to provide the Service. When you close your account we delete or anonymise your data within a reasonable period, unless we are required to keep certain information longer (for example for tax or legal purposes).

Two specifics. Our analytics statistics are aggregated, and the only reference to you they can contain is the pseudonymous account identifier described in section 2, which is a random internal reference and nothing more. When you close your account, the record that identifier pointed to is deleted, so what is left in the statistics can no longer be traced back to you and there is nothing further in them to delete. Your email-preference record (whether you asked for product-update emails, and when you asked or withdrew) is kept while you have an account, because it is the evidence that we only emailed you with your permission.

7. How we protect your data

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. No online service can be completely secure, but we work to keep your information safe.

8. Your rights

Under the GDPR you have the right to access, correct, delete or restrict the processing of your personal data, to object to certain processing, to data portability, and to withdraw any consent you have given. To exercise any of these rights, contact privacy@findrent.nl.

You also have the right to lodge a complaint with a data-protection supervisory authority, and you may choose which one. Under Article 77 of the GDPR you can complain to the authority in the EU country where you live, where you work, or where the problem happened. If you live in the Netherlands, that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Because we are established in Poland, our lead supervisory authority is the Polish President of the Personal Data Protection Office – Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl). You are welcome to complain to them instead, but you do not have to: complaining to your own country's authority is always open to you, and they will deal with your complaint or pass it on.

9. Cookies

We use only strictly necessary cookies, to keep you logged in and to protect the Service. Our analytics is cookieless and stores nothing on your device, which is why we do not show a cookie banner. We describe all of this in our Cookie Policy.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "last updated" date above.

12. Contact

Questions about this policy or your data: privacy@findrent.nl.