Tenant GDPR provisions and privacy notice

TENANT APPLICATION PRIVACY NOTICE Who is responsible? FRAGEST SARL, 59, rue Charles IV, L-1309 Luxembourg, manages this rental application platform. For questions or to exercise your data protection rights, contact contact@fragest.lu. Why we collect your information We use your identity, contact and address details, employment information, intended occupancy, move-in date and selected property to assess your rental application, communicate with you, create your private Odoo portal account and, if accepted, prepare and manage your lease. Your submission also creates a contact record in our management system. Application review and lease preparation are pre-contractual steps at your request (GDPR Article 6(1)(b)). Platform security, fraud prevention and the handling of disputes are based on our legitimate interests (Article 6(1)(f)). Applicable statutory record-keeping obligations may require certain tenancy records to be retained (Article 6(1)(c)). Documents and joint applicants This online application requires either a passport or an identity card, the three requested monthly payslips and an employment contract for each applicant. A resident card is optional. These are our application requirements, not a statement that every document is required by law. Without the mandatory information we cannot process this online application; contact us if your circumstances require an alternative. Please supply only relevant information and avoid unrelated sensitive information. If you add a second applicant, they must read this notice and authorise you to provide their information. The same document requirements apply separately to them. Each applicant uses their own email address and private portal account. Who can access it? Access to application files is restricted to authorised staff. Relevant information may be shared with the property owner or their authorised representative where necessary to assess the application or prepare the tenancy, and with service providers supporting hosting, email and system maintenance. Documents are not public. Applicants can upload corrected or updated versions through their account; previous versions remain available to authorised staff. There is no applicant delete button, but this does not remove your statutory rights. Security verification Cloudflare Turnstile checks technical browser and connection information to protect the form against automated abuse. Uploaded identity and financial documents are stored in our Odoo application; they are not sent to Turnstile as part of its verification request. Cloudflare may process technical information internationally. Details about its processing and international transfer safeguards are available at https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/cloudflare-customer-dpa/. Contact us for information about safeguards applicable to your data. Human review Staff make the decision on your application. No solely automated acceptance or rejection is performed. External AI document analysis is currently disabled. Retention and rejected applications If your application is rejected, portal access is disabled and a rejection email is issued. Uploaded documents, including previous versions, are retained for one calendar year from rejection and are then removed from the active application database by the scheduled retention process. This document-deletion process does not automatically erase the contact record, application details or review history. Those records are retained only while needed to administer the application, meet applicable obligations or establish, exercise or defend legal claims. For accepted applicants, retention depends on the duration of the tenancy and applicable obligations or claims. Deletion from the active database does not immediately remove copies in existing restricted backups; contact us for information about backup retention. You may request earlier erasure where the legal conditions are met. Your rights You may request access, correction, erasure, restriction or portability of your data where applicable, and object to processing based on legitimate interests. Contact contact@fragest.lu. You may also complain to Luxembourg's Commission nationale pour la protection des donnees (CNPD), https://cnpd.public.lu. We may need to verify your identity before responding. Acknowledgement Ticking the box records that you have read this notice. It is not consent to marketing, a waiver of your rights or acceptance of a lease. The notice version is recorded with your submission. An unfinished form is not saved as a draft.