Privacy Policy
Last updated: 27 October 2026
This policy describes how RentDesk24 actually works today. Fill in the operator details marked in brackets and have it reviewed by a lawyer before publishing.
1. Who is responsible
[Operator legal name], [Street, city, Kosovo], [Business registration no.] (“we”, “us”) operates RentDesk24 and is the controller for the personal data described in this policy, except where section 6 says that we act on behalf of a landlord.
Privacy questions and requests: [email protected].
We process personal data in line with the Law No. 06/L-082 on Protection of Personal Data of the Republic of Kosovo and, where it applies, the EU General Data Protection Regulation (GDPR).
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, username, email, language, role, the manager you belong to, password (stored only as an Argon2id hash) | You, or the manager / administrator who created your account |
| Security and usage data | IP address, browser type, login times, failed login attempts, remembered computers, audit log of actions | Your use of the application |
| Property data | Address, area, description, photos (location data is removed on upload), bank details for rent payments | Landlords |
| Tenant and lease data | Tenant name, phone, emergency phone, email, language, private notes, lease dates, rent, payment status | Landlords |
| Documents | Signed contracts, IDs, invoices, receipts | Landlords and tenants |
| Investment costs | Date, category, description and amount of costs per property | Landlords |
| Email records | Which reminder was sent to which address and whether it was delivered to our mail server | Generated by the application |
We don’t collect payment-card data, and we don’t buy data about you from third parties.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account, show your data, send reminders and tenant-page emails you set up | Performance of our contract with you |
| Protect accounts and the Service: login limits, detecting copied login cookies, audit log, preventing abuse | Our legitimate interest in a secure service |
| Service messages (security alerts, changes to terms or price) | Contract and legitimate interest |
| Answer questions and requests | Legitimate interest, or your request |
| Comply with legal obligations and requests from authorities | Legal obligation |
We don’t use your data for advertising, we don’t sell it, and we don’t make automated decisions about you that have legal or similarly significant effects.
4. Cookies
The website (rentdesk24.com) sets no cookies and loads no analytics, advertising or social-media scripts. Fonts and images are served from our own server.
The application (app.rentdesk24.com) uses only cookies that are strictly necessary:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you logged in and protects forms against forgery | Until you close the browser, at most 8 hours |
| “Keep me logged in” cookie | Only if you tick the box: logs you in again on that browser | 30 days, or until you log out, change your password or forget the computer |
Because these cookies are needed for the service you ask for, no consent banner is required. Your language choice is stored in your session and account.
5. Who can see your data
- You, and people you give access to.
- Your manager (if your account belongs to one) can see your properties, leases, tenants and documents read-only. Managers and administrators cannot see investment costs.
- Administrators of the platform can manage accounts and read the audit log.
- Tenants see, on their private page, the property, lease dates, amount, bank details, their own contact details and the lease documents.
- Service providers who process data for us under contract: hosting provider [Hosting provider name] (servers in [country]) and email delivery provider [Email delivery provider, e.g. your hosting provider or Brevo]. They may use the data only to provide their service to us.
- Authorities, only where the law requires it.
If data is transferred outside Kosovo or the EU/EEA, we make sure it is protected by an adequacy decision or standard contractual clauses.
6. Data landlords enter about tenants
When a landlord or manager enters information about tenants (names, contact details, notes, documents), the landlord is the controller of that data and RentDesk24 processes it on the landlord’s behalf and instructions, only to provide the Service. In this role we:
- process the data only to provide the Service and according to the landlord’s use of it;
- keep it confidential and protected with the measures in section 8;
- use only the service providers listed in section 5;
- help the landlord answer requests from tenants and delete the data when the landlord deletes it or closes the account.
Tenants: for questions about your data, contact your landlord first. You can also write to us and we will forward your request and help.
7. How long we keep data
| Data | Kept |
|---|---|
| Account, properties, tenants, leases, documents, costs | Until you delete them or close your account; then deleted within 30 days |
| Audit log | 24 months |
| Login attempts | 90 days |
| Password-reset and email-confirmation links | 30 days |
| Remembered computers | Until they expire (30 days) or you forget them |
| Backups | Overwritten within 30 days |
8. How we protect it
- HTTPS for all traffic; strict security headers on every page.
- Passwords hashed with Argon2id; temporary account lock after repeated failed logins; one-time, expiring links for password resets.
- Photos and documents stored outside the public web folder and checked against your login or the tenant link on every request; image files are re-encoded, which also removes hidden location data.
- Role-based access, an audit log of actions, and the option to end every session of your account.
- Database access restricted to the application, with regular backups.
If a personal-data breach is likely to put your rights at risk, we will inform you and the supervisory authority as the law requires.
9. Your rights
You have the right to access your data, have it corrected, deleted or restricted, receive it in a portable format, and object to processing based on legitimate interest. To use these rights, write to [email protected] from the email address of your account; we answer within 30 days.
You can also complain to the Information and Privacy Agency of the Republic of Kosovo, or to the data-protection authority of the EU country where you live.
10. Children
RentDesk24 is not intended for people under 18, and we don’t knowingly collect their data.
11. Changes to this policy
We will update this page when our processing changes, and tell account holders by email about important changes.
12. Contact
[Operator legal name], [Street, city, Kosovo]
Privacy: [email protected]
Security: [email protected]