Vastly Privacy Statement
1. Who we are
Vastly is property management software, offered by PDL Powerhouse B.V., established in Arnhem at Turfstraat 1-3, 6811 HL, Dutch Chamber of Commerce (KvK) no. 42063059 (“we”). Contact: [email protected].
2. Two roles: controller and processor
- For data of our own customers (landlords/property managers with a Vastly account: account details, billing, use of the app) we are the controller.
- For data our customers enter into Vastly about their tenants, contracts and properties we are the processor; the customer (landlord) is the controller. We conclude a data processing agreement with every customer.
3. What data we process
From customers (landlords/property managers): name, e-mail address, phone number, business details (Chamber of Commerce number, VAT number, IBAN), login credentials, linked service accounts (see section 7), usage and billing data.
On behalf of customers (tenant administration): tenants’ name and address details, e-mail and phone, date of birth (private tenants, for contracts), contract and invoice data, payment status, communication (invoices and reminders sent), documents in the contract file (rental agreements, handover documents, identification for electronic signing via our e-sign partner).
From public sources: building data via the BAG (Dutch Cadastre), energy labels via EP-Online (RVO), business data via the Dutch Business Register (KvK) and index figures from Statistics Netherlands (CBS). These are property, business and statistical data, in principle not personal data.
4. Why (purposes and legal bases)
Performance of the contract (providing the software, art. 6(1)(b) GDPR); legal obligations (statutory tax retention of invoices, art. 6(1)(c)); legitimate interest (security, abuse prevention, product improvement on aggregated data, art. 6(1)(f)).
We do not sell personal data and do not use customer or tenant data for advertising.
5. Sub-processors and recipients
We use a limited number of sub-processors, with whom data processing arrangements have been concluded:
- Google Cloud — hosting of the application and the database and storage of documents, all in region europe-west4 (Netherlands); processing within the EU.
- Google Workspace — sending of Vastly’s own system messages (such as invitations and service notifications) from our own e-mail address. Invoices and reminders to tenants are sent by the landlord from their own linked mailbox (see section 7), not via a central mail service of ours.
- Mollie — payment service provider for payment links to tenants; payments run directly through the landlord’s payment account.
- Yousign (EU) — electronic signing of contracts.
In addition, we consult the public sources listed in section 3 (BAG, EP-Online, Business Register, CBS index figures); no tenant data is shared in doing so.
For the website vastly.software the following also applies: demo requests are technically delivered via Web3Forms (form relay); we ourselves store no more than name, e-mail address and portfolio size. The website uses Cloudflare Web Analytics: cookieless and without tracking of individual visitors.
Optional AI feature (only after activation by the landlord): a landlord can enable the “read out notarial documents” feature themselves; it is off by default. Only then is the document uploaded by the landlord processed by AI provider Anthropic, under data processing arrangements; the data is not used to train AI models.
An up-to-date list of sub-processors is available via [email protected]. We do not transfer personal data outside the EEA, subject to the safeguards around the services referred to in section 7.
6. Retention periods
We retain invoice and administration data for 7 years (statutory tax retention obligation). We retain contract files for the duration of the rental relationship plus the statutory limitation periods.
Personal data that is no longer needed is deleted or anonymised. Where the tax retention obligation does not yet allow this, we detach directly identifying data (such as name and e-mail address) from the administration so that it can no longer be traced to a person; after the 7-year period, that administration data is also deleted or anonymised. Customers can have their account closed (including in the app); closure leads to the same detachment — earlier full deletion is not possible for data subject to the tax retention obligation.
7. Linked Google/Microsoft accounts (mail sending): Limited Use
A landlord can link their own mailbox (Google Gmail or Microsoft 365) to Vastly to send invoices and payment reminders from their own e-mail address.
- Vastly requests only the send e-mail permission (gmail.send) and the e-mail address of the linked account (identification). Vastly does not read e-mail and has no access to the inbox, contacts or other account data.
- Access tokens are stored encrypted and used exclusively to carry out sending actions initiated or configured by the user. The link can be disconnected in the app at any time; access can also be revoked via the Google/Microsoft account settings.
- The use of information received via Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements: data obtained via Google APIs is used only to provide the functionality described above, is not sold, is not used for advertising and is not read by humans, except for the exceptions listed in that policy (security, legal obligation, explicit consent).
8. Security
All connections with Vastly are encrypted (TLS). Signing in is done with a passkey (passwordless sign-in, for example with fingerprint or face recognition) or with a password plus two-step verification; we support passkeys and recommend them. Sessions expire automatically. Every user sees only the data of their own organisation, changes are recorded in an audit trail, and keys and link tokens are stored encrypted. All data is hosted within the EU and backups are made automatically.
9. Rights of data subjects
Data subjects (customers and tenants) have the right of access, rectification (correction), erasure, restriction, data portability and objection. A request can be made by e-mail to [email protected]; we respond within the statutory period of one month. Tenants can also contact their landlord directly (the controller); we support landlords with those requests. Complaints can be filed with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
For customers we make the right to data portability concrete with a complete export of contracts, invoices and core data (zip file): available for self-download at any time via My data in the app (per landlord entity, at most one export per day), or on request via [email protected]. During the read-only period after cancellation this export continues to work.
10. Changes
We may amend this statement; the current version is available at vastly.software. We will actively inform customers of material changes.