Translation of the French version. The French version is authoritative; in case of doubt, the interpretation most favourable to the consumer prevails.
Privacy Policy
Version in force as of 2 November 2026 (Garentiz 3.14.23).
This policy explains how Nayaro SRL processes personal data in connection with Garentiz (website www.garentiz.com and mobile applications for iOS and Android), in accordance with the General Data Protection Regulation (GDPR) and Belgian legislation.
1. Who is responsible?
Garentiz processes two kinds of data, with two different roles:
Data of Garentiz users (landlords, partner co-owners, delegates, tradespeople, tenants who have their own area, referral partners, people who write to support): Nayaro SRL is the controller.
Data that landlords enter or receive in Garentiz about their tenants, occupants, applicants, guarantors, tradespeople and other people: each landlord is the controller. Nayaro SRL acts as processor on their behalf, under the Data Processing Agreement they accept when signing up. To exercise your rights over this data, contact the landlord concerned first; we will help them reply to you.
Contact for any question about your data: support@garentiz.com, or by post to Nayaro SRL, Chemin de la Cure d'Air 16, 7000 Mons, Belgium.
2. What data, why, on what basis?
Purpose
Data
Legal basis
Creating and securing your account
name, e-mail, language, password (hashed), two-factor authentication, login history (date, IP address, result), sessions (IP address, browser)
performance of the contract; legitimate interest (security)
Logging in with Google or Apple
e-mail (possibly Apple's relay address), name, identifier specific to the service; for Apple, an encrypted token used to revoke the authorisation when the account is deleted
performance of the contract, at your request
Mobile application and phone notifications
installation identifier, platform, device name, application version, device token (hashed), notification token; title and text of notifications
performance of the contract; your notification preferences
Providing the rental management service
data on your properties, leases, rent, payments, documents, requests, inventory reports, jobs, listings and applications, expenses, loans, budget and bank file, time-stamped register
performance of the contract
Reading your mailbox, if you connect it
your mailbox credentials (encrypted password); messages from known senders of your portfolio and their attachments
performance of the contract, at your request
Invoicing licences
name or company name, address, VAT number, billing e-mail, orders, subscriptions and invoices
performance of the contract; legal obligation (accounting)
Exercising your right of withdrawal
name, order, acknowledgement e-mail, date and time of the declaration, amount refunded
legal obligation (Code of Economic Law)
Keeping you informed (reminders, notifications, weekly summary)
e-mail, phone number for text messages if you have provided it
performance of the contract; your notification preferences
Assisting you and answering support requests
your messages, technical context
performance of the contract; legitimate interest
Running the partner programme
for a referral partner: identity, address, VAT number, IBAN, IP address at acceptance, commissions; for a customer: the partner code with which the account was opened
performance of the contract; legal obligation (accounting)
Knowing where sign-ups come from
the campaign or link through which you arrived (source, medium, campaign name, personal invitation link), the landing page, the date of the first visit, your answer to “How did you hear about us?”, then the main steps of your account (account created, first home entered, payment)
legitimate interest (measuring our acquisition channels and paying our partners)
Proving the actions carried out
time-stamped register of actions on accounts and audit log of the admin area
legitimate interest (evidence); legal obligation where applicable
Monitoring and improving the service
aggregated usage statistics, computed on our own servers
legitimate interest
A referral partner never receives personal data of the customers they have recommended: only dates, plans and amounts.
We do not sell your data, we do not use it for advertising purposes, and we use neither advertising cookies nor any audience measurement tool.
3. How long?
Account: as long as it is active. A deletion request takes effect 30 days later; during this period, you can cancel it.
When the account is deleted: your identity is anonymised (name, e-mail, phone, password, two-factor authentication); your sessions, notifications, preferences, recovery codes and exports are erased; your login history is anonymised; your Google and Apple identities are erased (coming back with the same Google or Apple account creates a new account); your mobile devices are disconnected and cleared (name, installation ID, version, notification token); the “Sign in with Apple” authorisation is revoked; your tenant passports are revoked and erased, and the recommendations received are erased; your acceptances of the terms are kept without the IP address.
Portfolio data when the account is deleted, where you are its last manager (the last manager cannot delete their account while partner co-owners still work in it): all the organisation's files are erased (documents, photos, attachments, end-of-lease files, statements); the identifying data of tenants, tradespeople, co-owners and co-borrowers is anonymised; applications, contacts, bank files, imports, mailbox credentials and assistant proposals are deleted; the content of requests, jobs, linked e-mails and claims, and the counterparty and reference of bank transactions are erased; delegations, link shares and QR codes are revoked. The portfolio itself (properties, leases, tenants, due dates and payments, documents, requests, inventories, expenses) is then erased 90 days after closure, or at closure if you ask for it (after exporting your data). What remains: the time-stamped register, Nayaro SRL's invoicing (orders, licences, invoices) and support tickets.
Time-stamped register and audit log: they are chained and append-only; no entry can be modified or deleted without breaking their verification. Since version 3.14.18, e-mail addresses are replaced there by a salted fingerprint, IBANs are masked (BE68 ** 7034), and dates of birth, addresses and phone numbers no longer enter it. Earlier entries remain as written, as proof of past actions.
Unsuccessful applications: erased on the date stated to the applicant, i.e. the period chosen by the landlord (30 days by default, from 1 to 180 days) after the listing closes or the application is declined; any unsuccessful application is in any case erased 180 days after it was sent, and a listing published for more than 6 months is closed automatically. The successful application is erased with the former tenant's data, after the lease.
Tenant passport: the certified payment history a tenant chooses to share through a link (with an application or directly); Nayaro SRL is the controller; it is only visible to the people given the link and while the link is active; the tenant can revoke it at any time from their area; it is erased when their account is deleted.
Recommendations: the reference a former landlord writes at the tenant's request, kept in the tenant's area and shown in their passport if they so decide; erased when the tenant's account is deleted or at their request.
Comments left on a link share: the name and e-mail of their author are erased 30 days after the share ends.
Login history: 12 months.
Sessions: until they expire, after 12 hours of inactivity, or after 30 days if you stay logged in.
Login links and other single-use links: deleted 7 days after they expire.
Connected mobile devices: until they are disconnected, from the application or from “Settings”, or until the account is deleted.
E-mails: removed from our sending queue 90 days after creation, sent or not.
Notifications: 6 months, read or not.
Exports of your data: 7 days.
Backups: the database every night (14 most recent) and the files every night (7 most recent); an encrypted copy is pulled by the publisher and kept for 60 days.
Origin of the sign-up: as long as the account exists; the personal invitation link and the landing page are erased when it is deleted.
Demonstration: a demonstration portfolio and its files are erased 24 hours after creation.
Offline inventory: changes and photos entered without a network stay on your device until they are sent, 7 days at most, and are erased at sign-out.
Stripe payment notifications: their content (customer name, e-mail, address) is erased 90 days after processing.
Acceptances of the terms: 10 years after the contract ends.
Support tickets: 3 years after they are closed.
Assistant proposals: 1 year.
Payment disputes and imported bank statements: 10 years.
Invoices and accounting records: statutory accounting retention period (10 years).
Unless stated otherwise above, data is kept for as long as the account exists.
4. With whom?
Your data is only disclosed to the providers needed for the service, each for its own role:
OVH SAS (France, European Union): hosting of the website, database, files and backups, and sending of e-mails.
Stripe: payment of licences, subscriptions and invoices (name, e-mail, billing address and VAT number, payment data). We never see your card number.
Peppol access point (accredited provider, European Union; only for invoices to a Belgian VAT-registered company): company name, address, enterprise and VAT numbers, billing e-mail and invoice content, to deliver the e-invoice mandatory between businesses.
Google: Google login, if you choose it; sending notifications to Android phones (Firebase Cloud Messaging: notification token, title and text of the notification).
Apple: Apple login, if you choose it; sending notifications to iPhones (Apple Push Notification service: notification token, title and text of the notification).
Brevo (Sendinblue SAS, Paris, France; only if text messaging is enabled and included in the licence): recipient's phone number and text of the message, for confirmation codes, reminders and urgent requests.
Anthropic (only if the assistant is enabled and included in the licence): the texts needed for the request, in which e-mail addresses, account numbers and phone numbers are masked, and the documents you submit to it (for example an invoice to read), sent as they are: their content is not masked. Nothing is saved without your approval. No identity document is sent to it. Under this provider's commercial terms, data received through its API is not used to train its models. Anthropic Ireland, Limited deletes the data it receives within 30 days (up to 2 years if misuse is reported); the transfer to the United States is covered by the standard contractual clauses. The assistant is never called from the demonstration or the test environment.
OpenStreetMap Foundation (United Kingdom): to place your properties on the portfolio map, the property's address is sent to its geocoding service (Nominatim); map backgrounds are loaded by your browser from its servers, which therefore receive your IP address.
If you connect your mailbox, Garentiz connects to it with the credentials you provide, about every 15 minutes; only messages from known senders of your portfolio (tenants, tradespeople, addresses already linked) are kept. Health indices are retrieved from Statbel through a request that contains no personal data. Route links to Google Maps only open that service if you click on them.
Several of these providers (Stripe, Google, Apple, Anthropic) belong to groups established in the United States, to which data may be transferred. These transfers are governed, as the case may be, by the European Commission's adequacy decision on the EU-US Data Privacy Framework, for companies that participate in it, or by standard contractual clauses of the European Commission. The United Kingdom benefits from an adequacy decision.
Data may also be disclosed to the authorities where required by law.
5. Security
Hashed passwords, two-factor authentication with backup codes, encryption of identity documents and secrets (mailbox credentials, tokens), encrypted connections, daily backups, strict separation between accounts, chained time-stamped register checked every night, chained audit log of administrative actions. The admin area can only be accessed from authorised network addresses, with a password; administrative access to an account (assisted login) is limited to 30 minutes and logged. Our test environment may receive a complete copy of the data and documents to check a new version on real data (sessions and sign-in material are never copied there): it is only reachable from the admin area's authorised network addresses, is hosted by the same provider, keeps the same protections (encryption, limits on sign-in attempts) and sends no messages. On your phone, any biometric unlocking is handled by the phone itself: Garentiz receives no biometric data.
In the event of a data breach presenting a risk, we notify the Data Protection Authority and, where appropriate, the data subjects, within the time limits laid down by the GDPR.
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. You can:
export your data (ZIP archive) and delete your account yourself from “My data”;
set your notifications (e-mail, text message, phone) in your preferences;
disconnect a mobile device from “Settings”;
write to us at support@garentiz.com for any other request; we reply within one month.
You can lodge a complaint with the Data Protection Authority (Autorité de protection des données), Rue de la Presse 35, 1000 Brussels (www.dataprotectionauthority.be).
7. Minors
Garentiz is intended for adults. An account must not be created by a person under 18.
8. Changes
We may update this policy. The version in force is always accessible from the website and the applications; when a significant change requires your agreement, it is presented to you at your next login.