LEGAL
Privacy policy
What we collect, why we collect it, and how long we keep it. Tenants share sensitive documents with us — this page explains exactly what happens to them.
Last updated: 11 September 2026
In short
We collect what a direct rental needs — nothing for advertising.
A landlord sees a tenant dossier only when that tenant sends them a request.
By sending a request, you agree that we pass your full dossier to that landlord.
Documents are kept on file — we remove them when the tenant or landlord asks us to.
We never sell your data, and we never share it with ad networks.
1. Who is responsible for your data
The data controller is the entity operating LuxFlat-direct.com, identified in full in our legal notice. For any question about this policy or to exercise your rights, contact privacy@luxflat.lu.
2. What we collect and why
We only collect what a direct rental actually requires. Each category below is tied to a purpose and a legal basis under Article 6 GDPR.
3. Tenant dossiers and what landlords see
To send a request, a tenant uploads identity, income and employment documents, together with any document needed to prove solvency — payslips, bank statements, a guarantee or an employer letter. We verify them and mark the profile as pre-approved. A landlord only receives a dossier when the tenant chooses to send a request to that specific listing — never before, and never as part of a searchable database.
Landlords receive the dossier for the sole purpose of deciding on that request and, if accepted, concluding the rental agreement. They may not reuse it for any other purpose, and they act as independent controllers for the data they retain after acceptance.
4. Your consent to share your dossier
IMPORTANT
By sending a request on a property, you expressly accept that we share your complete tenant dossier — identity, income, employment and solvency documents — with the landlord of that property, and with the landlords of any other property you request. This sharing is the core of the service: without it a landlord cannot decide on your request. You give this consent each time you send a request, and you can withdraw it for future requests at any time by writing to privacy@luxflat.lu or by closing your account.
5. Who we share data with
Landlords and tenants — the counterparty to a request receives the information needed to decide on it and conclude the rental agreement.
Processors acting on our instructions — hosting, document verification, payment processing, email delivery and customer support tooling, all bound by data processing agreements.
Professional advisers and authorities — where we are legally required to disclose, or to establish, exercise or defend legal claims.
A successor entity — in the event of a merger or acquisition, subject to the same protections as this policy.
We never sell your personal data, and we do not share it with advertising networks.
6. Where your data is stored
Data is hosted within the European Union. Where a processor operates outside the EU or EEA, the transfer is covered by an adequacy decision of the European Commission or by the Commission's Standard Contractual Clauses, together with any additional safeguards required. A list of current processors and their locations is available on request.
7. How long we keep it
We do not delete tenant documents automatically. They stay on file so you can reuse your dossier for future requests — we remove them when you or the landlord asks us to, unless the law requires us to keep a record.
8. Your rights
You can exercise any of the following at any time by writing to privacy@luxflat.lu. We respond within one month.
Access
Get a copy of the personal data we hold about you.
Rectification
Correct anything inaccurate or incomplete.
Erasure
Ask us to remove your documents or account — we do so unless the law requires us to keep them.
Restriction
Ask us to pause processing while a question is resolved.
Portability
Receive your data in a structured, machine-readable format.
Objection & withdrawal
Object to processing based on legitimate interest, or withdraw consent at any time.
You also have the right to lodge a complaint with the Commission nationale pour la protection des données (CNPD), the Luxembourg supervisory authority.
9. Cookies
Strictly necessary cookies keep you logged in and protect the platform against fraud; they cannot be disabled. Measurement cookies, which help us understand how listings and requests are used, are set only with your consent. We use no advertising or cross-site tracking cookies.
10. Security
Data is encrypted in transit and at rest. Access to tenant documents is restricted to the staff who need it for verification and is logged. In the event of a personal data breach likely to result in a risk to your rights, we notify the CNPD within 72 hours and inform affected users without undue delay.
11. Changes to this policy
We update this policy when our processing changes. Material changes are announced by email and on the platform at least 30 days before they take effect. The date at the top of this page always reflects the current version.
Want a copy of your data?
Ask us and we'll send your full file within one month.