Version 2.6 · effective date 3 October 2026
Who is responsible
HomeINN B.V., Rosestraat 1321, 3071 AL Rotterdam, Chamber of Commerce (KvK) 96713437, is the controller for the processing operations described in this privacy policy. Requests concerning your data: info@homeinn.nl or +31 6 33 32 22 57.
Which data we process and why
If you complete a form (introductory meeting, selling a property, following a project, investing or contact), we process the data you provide: name, e-mail address and/or telephone number, the subject of your enquiry and your message. If you offer us a property, we additionally ask for the address of the property, its type, the occupancy situation (vacant or tenanted), its structural condition, the reason for selling and the desired completion date — solely in order to make a substantiated proposal. Legal basis: the performance of (pre-contractual) measures at your request (Article 6(1)(b) GDPR (AVG)) and our legitimate interest in following up enquiries.
Data in letting, letting agency and management
If we act as letting agent or manage your property, we additionally process data of prospective tenants: identity data, income data, the outcome of a creditworthiness check and references from a previous landlord or employer. We do not keep copies of identity documents longer than necessary and do not disclose these data to third parties. If we carry out the management, we also process the data required for that purpose: the tenancy agreement, the tenant's contact details, rent payments and arrears, and correspondence about maintenance and reports. Legal basis: the performance of the (tenancy) agreement and our legitimate interest in careful selection and correct rent administration. Where we process these data on behalf of an owner, we act as processor and record this in a data processing agreement.
Data of lenders
If you request information about a development project, we process your name, contact details and what you indicate in the form (the project, the term, your interest, your confirmation that you participate as a professional market party, and your comments), solely to send you the project information and to contact you; we do not sell them and do not share them with third parties for their own purposes. If a loan is concluded, before you transfer the principal we verify your identity and, for a legal entity, that of its representatives and ultimate beneficial owners; we record the source of the funds and check whether you or they appear on a European or national sanctions list. We may repeat that check during the term and before any payment of interest or principal. We view your identity document, or that of the person signing on behalf of a legal entity: you show it to us in person or during a video call that we do not record. We note only the name, the date of birth, the type of document, the document number and the expiry date. Only where there is no other way do we ask for a copy. On that copy you mask the passport photo and the citizen service number (BSN), or any other personal identification number, before sending it, including in the line of characters at the bottom, for example by covering those parts before you make the copy or scan. We do not process citizen service numbers or other personal identification numbers: if we nevertheless receive a copy on which one of them is legible, we destroy it and, where necessary, ask for a masked copy. From a legal entity we ask for a recent extract from the trade register and an overview of its entry in the register of ultimate beneficial owners, or comparable documents from its country of establishment. We also process the data needed for the administration of your loan, the interest and the repayment, and the statements you make in the loan agreement. We use these data only for identification, establishing the source of the funds, the sanctions-list check, the administration of your loan and compliance with legal obligations. Legal basis: for identification, the source of the funds and the sanctions-list check, our legitimate interest (Article 6(1)(f) GDPR (AVG)) in knowing with whom we enter into a loan, in not accepting money of unlawful origin and in not receiving or making payments in breach of a sanctions measure; for the administration of your loan, the performance of the agreement (Article 6(1)(b) GDPR (AVG)); and where the law requires something of us, such as the tax retention obligation, that legal obligation (Article 6(1)(c) GDPR (AVG)). How long we keep these data is set out under Retention periods.
Forwarding and storing your enquiry
Form submissions are delivered to us by e-mail via FormSubmit (formsubmit.co), an external service that may be based outside the European Economic Area; your name, contact details and message pass through that service to us. In addition, we store your enquiry in our own secured database at Supabase (hosting region: Zurich, Switzerland, a country for which the European Commission has adopted an adequacy decision), so that we can follow it up in our management portal. From that database the e-mail service Resend (sending region: EU) sends a notification to our team and, if you provide an e-mail address, a confirmation to you. Supabase and Resend act as processors and process your data solely on our instructions. To prevent abuse of the form (for example thousands of fake submissions), our systems derive an encrypted hash from your IP address (for IPv6, from its network part) with each submission and use it to count submissions per network; we do not store the address itself in our database, and the derived value is deleted within a few days. Supabase and Vercel do keep the address briefly in their own server logs. Our legitimate interest is a working form and the protection of our systems. The website is hosted by Vercel Inc.; in doing so, Vercel briefly processes your IP address and browser data in server logs. We do not sell or share your data for third-party marketing purposes.
Google Maps
Maps on this site load only after you click on them. At that moment data (such as your IP address) are processed by Google; Google's privacy policy applies to that processing. If you do not click, no data are shared with Google. Fonts are loaded from our own server.
Scripts from jsDelivr
The public pages of this website, including the forms, load no third-party scripts. Only our client portal, including its login page, loads one script (the Supabase library) from the content delivery network jsDelivr (Prospect One / Fastly). In doing so, jsDelivr receives your IP address and browser data; jsDelivr itself sets no cookies and does not profile.
Retention periods
We retain enquiries for a maximum of 12 months after the contact has been concluded, unless an agreement is entered into — in which case the statutory (tax) retention period of 7 years for administration applies. For lenders, in addition: we keep data and documents for identification, the source of the funds and the sanctions-list check no longer than five years after the end of the loan agreement, unless the law requires a longer retention period; we keep the administration of your loan (the agreement and the payments of interest and principal) for 7 years, the statutory tax retention period.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection. To exercise these rights, e-mail info@homeinn.nl; we respond within four weeks. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).