Privacy Policy
1. Who We Are and How to Contact Us
1.1 Data Controller
Flatmaters OÜ, a company incorporated in Estonia under e-residency and trading under the commercial name Flatmaters, is the data controller for all personal data processed through the Flatmaters website, platform, and services.
As a company registered in Estonia, a Member State of the European Union, Flatmaters complies with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and all applicable data protection laws.
1.2 Lead Supervisory Authority
The lead supervisory authority for Flatmaters OÜ is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon):
- Website: www.aki.ee
- Address: Tatari 39, 10134 Tallinn, Estonia
- Email: info@aki.ee
Users resident in other EU/EEA Member States also have the right to lodge a complaint with the supervisory authority of their country of habitual residence.
1.3 Contact
For any questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data, please contact us at contact@flatmaters.com.
1.4 Independent Controllers
Flatmaters OÜ acts as an independent data controller in relation to all personal data processed through the Platform. Where Property Owners receive personal data of Students in connection with a confirmed Booking, they act as independent data controllers for that data and are solely responsible for ensuring their own compliance with applicable data protection laws.
1.5 Data Protection Officer
We do not currently have a designated Data Protection Officer (DPO), as our core activities do not consist of large-scale systematic monitoring of individuals, nor large-scale processing of special categories of data, as defined under Article 37 GDPR. If our processing activities change in a way that triggers the mandatory designation criteria, we will appoint a DPO and update this Policy accordingly.
2. Personal Data We Collect
2.1 Students
When you register as a Student or make a Booking, we collect and process the following categories of personal data:
| Category | Data | Purpose |
|---|---|---|
| Identity | Full name, nationality, identification number where strictly necessary for Booking processing or compliance with applicable legal obligations | Account creation, Rental Agreement generation, property access coordination |
| Contact | Email address, phone number | Account management, booking communications, platform notifications |
| Academic | Name of university or institution, enrollment or acceptance status | Eligibility verification, Booking confirmation |
| Booking | Desired stay dates, selected accommodation, Semester Period | Booking processing, Rental Agreement generation |
| Financial | Payment method, transaction references (no full card data stored by Flatmaters) | Payment processing via third-party providers |
| Contractual | Signed Rental Agreement, correspondence related to the booking | Contract management, dispute resolution |
| Technical | IP address, device type, browser, session data, registration origin (direct sign-up or booking attempt) | Platform security, account creation metadata, fraud prevention |
| Communications | Messages exchanged via WhatsApp, inbound email, or website contact forms (where these channels are activated) | Commercial follow-up, customer support, traceability of the user relationship |
2.2 Property Owners
When you register as a Property Owner or publish a Listing, we collect and process:
| Category | Data | Purpose |
|---|---|---|
| Identity | Full name, nationality, identification number where strictly necessary, equivalent authorization documents where required | Account creation, Listing Agreement, identity and fraud prevention verification, Rental Agreement generation |
| Contact | Email address, phone number, address | Account management, operational coordination, payment processing |
| Property | Property address, photographs, description, pricing, availability, house rules | Listing publication, Rental Agreement generation, platform promotion |
| Financial | Bank account details (for payment transfers via Wise or bank transfer) | Rental payment transfers |
| Contractual | Listing Agreement, generated Rental Agreements, correspondence | Contract management, commission calculation, dispute resolution |
| Technical | IP address, device type, browser, session data, registration origin | Platform security, account creation metadata, fraud prevention |
| Communications | Messages exchanged via WhatsApp, inbound email, or website contact forms (where these channels are activated) | Commercial follow-up, operational coordination, traceability of the user relationship |
2.3 Identification Documents
Flatmaters does not systematically store copies of identification documents. Identity verification is performed at registration; identification numbers are recorded only where strictly necessary for Booking processing or compliance with applicable legal obligations. Where local law or building regulations specifically require Flatmaters or the Property Owner to retain a copy of the identification document for a specific Booking, that requirement is documented in writing and the copy is retained only for the period strictly required by such law or regulation.
2.4 Website Visitors
When you visit the Flatmaters website without registering, we may collect: IP address, browser type and version, operating system, referring URL, pages visited, time and duration of visit, and cookie data. This data is collected automatically through standard web server logs and analytics tools (see Section 10).
2.5 Prospects and Commercial Leads
Where you contact us through the Platform's contact forms, public landing pages, the booking-attempt flow, or external messaging channels (such as WhatsApp inbound messages or website chat) without completing registration, we record the following data to follow up commercially with you:
- name, email address, phone number (in international E.164 format where applicable);
- country of origin (ISO code), preferred language;
- desired destination city and semester of interest, where provided;
- registration origin (form name, page URL, UTM parameters where applicable);
- timestamp of first contact and subsequent activity log;
- content of the messages or inquiries you submit.
We do not enrich this data through external sources or third-party data brokers.
3. How We Collect Personal Data
We collect personal data through the following means:
- Directly from you: when you create an account, complete a registration or booking form, sign a Listing Agreement or Rental Agreement, communicate with us by email or through the platform, or submit documentation for verification purposes.
- Automatically: when you access or use our website and platform, through cookies, web server logs, and analytics tools (see Section 10).
- From third parties: in limited cases, from payment processors, identity verification services, or other users who provide your data in connection with a booking (for example, when a Property Owner or Student references your contact details).
Users are responsible for ensuring that any personal data they provide is accurate, complete, and up to date. Where a user provides personal data about a third party (for example, a co-tenant), they warrant that they have the legal right to share such data and that the relevant individuals have been informed of this Privacy Policy and the purposes for which their data will be processed.
Flatmaters applies the principle of data minimisation in accordance with Article 5(1)(c) GDPR: we only collect and process personal data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. Where possible, we use anonymized or aggregated data rather than personal data.
4. Purposes and Legal Bases for Processing
We process personal data only when we have a valid legal basis to do so under Article 6 of the GDPR. The table below sets out our processing activities and their corresponding legal bases:
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Creating and managing user accounts | Art. 6(1)(b) – performance of a contract |
| Processing Bookings and generating Rental Agreements | Art. 6(1)(b) – performance of a contract |
| Processing payments and managing financial transactions | Art. 6(1)(b) – performance of a contract |
| Sharing Student identity and university data with Property Owners upon Booking confirmation | Art. 6(1)(b) – performance of a contract; necessary for access coordination and local registration requirements |
| Recording registration origin (direct sign-up vs. booking attempt) as account metadata | Art. 6(1)(b) – performance of a contract (account creation) |
| Processing prospect and lead data (commercial inquiries received without completing registration) | Art. 6(1)(b) – pre-contractual measures taken at the data subject's request, where the prospect initiates contact; supplemented by Art. 6(1)(f) – legitimate interests in maintaining a commercial pipeline and following up with prospects, subject to the right to object at any time |
| Operational communications via WhatsApp, email, and other messaging channels (commercial follow-up, customer support, booking coordination) | Art. 6(1)(b) – performance of a contract (for users with active or pending bookings); Art. 6(1)(f) – legitimate interests (for general operational communications), subject to the right to object |
| Identity verification and fraud prevention checks | Art. 6(1)(f) – legitimate interests in preventing fraud, ensuring platform security, and verifying identity; supplemented by Art. 6(1)(c) where a specific legal obligation applies |
| Retaining contractual and financial records | Art. 6(1)(c) – compliance with legal obligations (accounting, tax, civil law) |
| Fraud detection and platform security | Art. 6(1)(f) – legitimate interests of Flatmaters and its users in maintaining a secure and trustworthy platform |
| Platform analytics (Google Analytics) | Art. 6(1)(a) – your consent, obtained via the cookie consent banner on the Platform |
| Customer support and dispute resolution | Art. 6(1)(b) – performance of a contract; Art. 6(1)(f) – legitimate interests |
| Sending service-related communications (booking confirmations, operational updates) | Art. 6(1)(b) – performance of a contract |
| Complying with legal and regulatory obligations and responding to lawful requests from authorities | Art. 6(1)(c) – compliance with legal obligations |
4.1 Legitimate Interests Assessment
Where we rely on legitimate interests (Art. 6(1)(f)), Flatmaters has conducted a balancing assessment and determined that such processing is necessary and proportionate, and does not override the fundamental rights and freedoms of users. In particular: fraud prevention and platform security protect all users equally; platform analytics are conducted only on the basis of user consent, with IP anonymization enabled, and do not result in individual profiling or automated decision-making; and dispute resolution is necessary to enforce rights that both parties have under their contracts. Users retain the right to object to processing based on legitimate interests at any time (see Section 8). These assessments are documented internally and may be provided to supervisory authorities upon request.
4.2 Withdrawal of Consent
Where processing is based on your consent (in particular, non-essential cookies and any future marketing communications), you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. To withdraw consent, contact us at contact@flatmaters.com or use the opt-out mechanism in any future marketing communication.
4.3 Acceptance Through the Booking Flow
By creating an account, publishing a Listing, or proceeding through the Booking flow (including the Before You Book confirmation step), you acknowledge that you have read and accepted this Privacy Policy. Continued use of the Platform constitutes ongoing acceptance.
5. Who We Share Your Data With
5.1 Sharing with Other Users
Upon confirmation of a Booking, Flatmaters shares the following Student data with the relevant Property Owner, to the extent necessary for the rental relationship:
- full name;
- nationality;
- university or institution name;
- contact details necessary for arrival coordination;
- identification number where strictly required by applicable local law or building regulations.
Where local law or building regulations specifically require a copy of the identification document for a specific Booking, the document is shared directly between Student and Property Owner upon arrival rather than systematically stored by Flatmaters.
This sharing is necessary for the performance of the Rental Agreement (access coordination, building registration requirements in the country of the property) and is limited to what is strictly necessary. Property Owners who receive Student personal data act as independent data controllers for that data and are solely responsible for ensuring their own compliance with applicable data protection laws. Property Owners may only process such data strictly for legal and administrative requirements related to the rental relationship and for no other purpose. Flatmaters requires Property Owners to maintain appropriate confidentiality and security measures for any Student data received.
Students are similarly informed that their Property Owner's name and contact details will be shared with them as part of the Rental Agreement and booking process.
Where you communicate with Flatmaters through WhatsApp or other Meta-operated messaging channels, Meta acts as the data controller for the messaging infrastructure itself (storage, transmission, and basic metadata of the channel). Flatmaters acts as the data controller for the content of communications received and sent in the context of the Flatmaters service. The use of these channels is voluntary; you may always choose to communicate with us through the Flatmaters platform or by email instead. We recommend reviewing WhatsApp's Privacy Policy regarding the channel-level processing performed by Meta.
5.2 Service Providers (Data Processors)
Flatmaters uses the following categories of third-party service providers who process personal data on our behalf under data processing agreements:
| Provider / Category | Purpose | Location |
|---|---|---|
| Hostinger | Website and platform hosting | EU / international |
| Amazon Web Services (SES + S3) | Transactional emails (verification, password reset, notifications); document storage (signed Rental Agreements, inventories, identification documents where strictly required) | USA (EU-U.S. Data Privacy Framework where applicable, and/or Standard Contractual Clauses) |
| Google (Sign in, Maps, Places, Analytics) | OAuth authentication, address geocoding and autocomplete, website analytics | USA (EU-U.S. Data Privacy Framework where applicable, and/or Standard Contractual Clauses) |
| Wise | International payment processing and transfers | UK / EU / international |
| Discord (private webhook channel) | Internal team notifications (new account creation, booking requests, critical alerts) — limited operational metadata | USA (Standard Contractual Clauses) |
| WhatsApp Business / Meta | Inbound and outbound communications with users for commercial follow-up, customer support, and operational coordination of bookings | USA / international (Meta is the controller of the messaging channel; Flatmaters processes the content of communications received and sent) |
| Email service providers (current and future) | Transactional and operational communications | Varies |
| Legal and compliance advisors | Legal advice, contract review, regulatory compliance | Varies |
Flatmaters does not sell, rent, or trade personal data to any third party for commercial purposes.
5.3 Legal Disclosures
We may disclose personal data to competent authorities, courts, or regulators where required by law, in response to a valid legal request, or where necessary to protect the rights, safety, or property of Flatmaters, its users, or third parties. This includes disclosures required under applicable anti-money laundering and counter-terrorism financing legislation.
5.4 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of Flatmaters or its assets, personal data may be transferred as part of that transaction. Users will be notified of any such transfer and of any changes to this Privacy Policy that result from it.
6. International Data Transfers
Flatmaters is incorporated in Estonia (EU) and its operations involve the transfer of personal data to countries outside the European Economic Area (EEA). We ensure that appropriate safeguards are in place for all such transfers as follows:
6.1 Transfers to Chile
Chile does not currently have an EU adequacy decision under the GDPR. Where personal data is transferred to Chile (for example, when Student data is shared with a Property Owner located in Chile, or when data is processed by service providers based there), Flatmaters relies on Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914/EU) as the transfer mechanism. Property Owners located in Chile who receive Student personal data are required to process it in accordance with the terms set out in the Listing Agreement and Rental Agreement.
6.2 Transfers to Argentina
Argentina has been recognized as providing an adequate level of data protection pursuant to European Commission Decision 2003/490/EC. Where personal data is transferred to Argentina (for example, when Argentinian Students or Property Owners interact with the Platform, or when operations are based in Argentina), such transfers are permitted under GDPR Article 45 on the basis of this adequacy decision.
6.3 Transfers to Other Third Countries
For transfers to other third countries (including the USA, where service providers such as Amazon Web Services, Google, Discord, and Meta/WhatsApp are based), Flatmaters relies on: (a) the EU-U.S. Data Privacy Framework (DPF), adopted by the European Commission on 10 July 2023, where the relevant provider is certified under the DPF; and/or (b) Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914/EU), supplemented by appropriate technical and organizational measures where required, in accordance with the requirements established by the Court of Justice of the European Union in Case C-311/18 (Schrems II).
6.4 How to Obtain Transfer Documentation
You may request a copy of the Standard Contractual Clauses or other transfer safeguards applicable to your personal data by contacting us at contact@flatmaters.com.
7. How Long We Keep Your Data
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with applicable legal obligations. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data (name, email, contact details, registration origin) | Duration of the account + 3 years after last activity or account closure | Legitimate interests; limitation periods for contractual claims |
| Booking and Rental Agreement data (including identification numbers shared at booking) | Duration of the rental relationship + 5 years where required for legal compliance or dispute resolution purposes | Legal obligation (civil law limitation periods); legitimate interests (dispute resolution) |
| Financial and payment records | 7 years from the date of the transaction | Legal obligation (accounting and tax law in Estonia; applicable local tax law) |
| Identity verification and fraud prevention data | 5 years from the end of the business relationship where required for fraud prevention, dispute resolution, or applicable legal obligations | Art. 6(1)(f) – legitimate interests; Art. 6(1)(c) where a specific legal obligation applies |
| Marketing consent records (where applicable in the future) | Until consent is withdrawn + 3 years (proof of consent) | Legal obligation (accountability under GDPR Art. 7(1)) |
| Technical logs (IP addresses, session data) | 12 months from collection | Legitimate interests (security, fraud prevention) |
| Google Analytics data | 14 months (default Google Analytics retention setting) | Consent |
| Communications and support tickets (email, contact forms, internal platform messages) | 3 years from last communication | Legitimate interests (dispute resolution) |
| WhatsApp messages and external messaging channel communications | 3 years from last communication; subject to the retention policies of the underlying channel provider (Meta) for storage on their infrastructure | Legitimate interests (operational continuity, dispute resolution); performance of contract where related to active bookings |
| Prospect and lead data (inquiries without completed registration) | 3 years from last activity, after which the lead is permanently deleted or anonymized | Pre-contractual measures and legitimate interests (commercial pipeline) |
At the end of the applicable retention period, personal data is securely deleted or anonymized. Where data is anonymized, it may be retained for statistical or analytical purposes without time limit, as it can no longer identify any individual.
8. Your Rights
Under the GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at contact@flatmaters.com. We will respond within 30 calendar days of receiving your request. In complex or multiple cases, we may extend this period by a further 60 days, in which case we will inform you within the initial 30-day period.
| Right | What it means |
|---|---|
| Access (Art. 15) | You may request a copy of the personal data we hold about you and information about how we process it. |
| Rectification (Art. 16) | You may request that inaccurate or incomplete personal data be corrected or completed. |
| Erasure (Art. 17) | You may request that we delete your personal data where it is no longer necessary, where you withdraw consent, or where processing is unlawful. This right is subject to legal retention obligations. |
| Restriction (Art. 18) | You may request that we temporarily restrict processing of your data in certain circumstances (e.g., while a correction is being verified). |
| Portability (Art. 20) | Where processing is based on consent or contract and carried out by automated means, you may receive your personal data in a structured, commonly used, machine-readable format, and transfer it to another controller. |
| Objection (Art. 21) | You may object to processing based on legitimate interests or carried out for direct marketing purposes. Where you object to direct marketing, we will stop processing immediately. |
| Withdrawal of consent (Art. 7(3)) | Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing. |
| Lodge a complaint (Art. 77) | You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority in your country of habitual residence. |
Exercising certain rights (such as erasure or restriction) while a Booking is active or while a Security Deposit is unresolved may not be possible where the data is necessary for the performance of the contract or compliance with a legal obligation.
9. Automated Decision-Making and Profiling
9.1 No Fully Automated Decisions
Flatmaters does not carry out fully automated decision-making that produces legal effects concerning users or similarly significantly affects them, within the meaning of Article 22 of the GDPR.
While certain Platform processes are partially automated — in particular, the automatic rejection of a Booking Request where a Property Owner does not accept it within the 24-hour window, and the corresponding automatic refund of the Booking Fee — these processes always involve the active participation of the relevant parties. The Property Owner retains the right to actively accept any Booking Request within the applicable window. The default outcome (rejection on non-response) is favorable to the Student, who receives a full refund. Accordingly, these processes do not constitute automated decision-making with legal or similarly significant effects under Article 22 GDPR.
9.2 Fraud and Security Checks
Flatmaters may use automated tools to flag potentially suspicious activity or identity verification concerns for the purposes of fraud prevention and platform security. Any such flags result in a manual review by Flatmaters staff before any action is taken. No account suspension, transaction block, or other significant measure is applied based solely on automated processing without human assessment.
If you believe that an automated process has produced an incorrect outcome affecting you, you may contact us at contact@flatmaters.com to request a manual review.
10. Cookies and Analytics
10.1 Cookies We Use
The Flatmaters website uses cookies in accordance with the EU ePrivacy Directive (2002/58/EC as amended) and applicable national implementing laws. Cookies are small text files stored on your device that help us operate the platform, remember your preferences, and analyze usage. We currently use:
- Strictly necessary cookies: session cookies (authentication token, role, temporary OAuth flow cookies, CSRF protection) required for the platform to function. These do not require your consent.
- Preference cookie (NEXT_LOCALE): a single cookie memorizing your chosen language to deliver content in the correct localization. This does not require your consent under the ePrivacy Directive as it is strictly necessary to provide the user-requested service.
- Analytics cookies (Google Analytics): used to collect information about how visitors use our website (pages visited, time spent, referring sources). These cookies are only activated with your consent through our cookie consent banner.
We do not currently use marketing cookies. If introduced in the future, they will require your prior consent.
You can manage your cookie preferences at any time through the cookie consent banner on our website, or by adjusting your browser settings. Withdrawing consent for analytics cookies does not affect strictly necessary or preference cookies.
10.2 Google Analytics
We use Google Analytics, a web analytics service provided by Google LLC (USA). Google Analytics collects data such as your IP address (anonymized by default), browser type, pages visited, and session duration. This data is processed by Google on our behalf under a Data Processing Agreement and is used solely to analyze platform usage and improve our services. IP anonymization is enabled, meaning your full IP address is not stored by Google.
For more information about how Google processes this data, see Google's Privacy Policy. You may opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on. Where applicable, Google acts as an independent data controller for certain processing activities carried out in connection with Google Analytics.
10.3 IP Addresses
We collect and log IP addresses automatically when you access the Flatmaters platform or website. IP addresses are used for: platform security and fraud detection; diagnosing technical issues; and, in anonymized form, for analytics purposes. IP addresses are retained for 12 months from the date of collection and are not used to identify you individually beyond security and fraud prevention purposes.
11. Security
Flatmaters implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures include:
- encrypted data transmission (HTTPS/TLS) for all data in transit;
- encryption at rest and pseudonymisation where applicable for stored personal data;
- restricted access controls and role-based permissions for internal systems;
- multi-factor authentication requirements for platform administration;
- secure storage with reputable infrastructure providers subject to confidentiality obligations;
- internal data handling procedures and staff awareness measures;
- regular testing, assessment and evaluation of the effectiveness of technical and organizational measures for ensuring the security of the processing, in accordance with Article 32 GDPR.
No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Flatmaters will notify the Estonian Data Protection Inspectorate without undue delay and, where required, will notify affected individuals directly. We maintain an internal register of data breaches in accordance with our GDPR accountability obligations.
12. Minors
The Flatmaters platform is intended exclusively for individuals aged 18 years or older. We do not knowingly collect or process personal data of individuals under 18. If we become aware that personal data of a minor has been collected without the required consent, we will take immediate steps to delete it. If you believe that we may have inadvertently collected data from a minor, please contact us at contact@flatmaters.com.
13. Future Processing Activities
Flatmaters may, in the future, introduce additional processing activities to improve the Platform, enhance user experience, or strengthen platform security. The categories below describe processing activities that are not currently active but that we anticipate may be introduced. They are listed here for transparency. Each will only be activated subject to the legal basis specified, and where consent is required, only after explicit consent is obtained through appropriate mechanisms.
13.1 Marketing and Promotional Communications May be activated
We may, in the future, send marketing communications such as newsletters, special offers, or service updates of a promotional nature. Any such communications will be based on Art. 6(1)(a) GDPR consent, obtained through an explicit opt-in. You will be able to withdraw consent at any time through an unsubscribe link in any communication or by contacting us. Marketing communications will not be sent on the basis of legitimate interests without prior consent.
13.2 Enhanced Fraud Prevention May be activated
We may, in the future, integrate additional fraud prevention tools (such as risk scoring services, IP reputation checks, or device-based verification) to strengthen platform security. Any such processing will be based on Art. 6(1)(f) GDPR legitimate interests, supported by a documented Legitimate Interests Assessment. No automated decision-making producing legal or similarly significant effects under Art. 22 GDPR will be carried out without human review. Users will retain the right to object to processing based on legitimate interests at any time.
13.3 Advanced Analytics May be activated
We may, in the future, introduce additional analytics tools beyond Google Analytics (such as session replay tools, heatmaps, or A/B testing platforms) to improve user experience and conversion. Any such tools will be activated only with prior consent through the cookie consent banner, with anonymization or pseudonymization enabled by default where technically feasible. These tools will not be used for individual profiling.
13.4 Card Payment Processing May be activated
We currently process all payments through Wise. We may, in the future, integrate an additional card payment processor (such as Stripe or an equivalent provider) to expand payment options and improve user experience. Any such integration will be subject to a Data Processing Agreement with the provider, with appropriate transfer safeguards (DPF and/or SCCs) where the provider is based outside the EEA. The processing will be based on Art. 6(1)(b) GDPR (performance of the contract for payment of Booking Fees and rent).
13.5 Notification of Activation
When any of the future processing activities described above is activated, we will: (i) update this Privacy Policy with effective date and clear identification of the change; (ii) notify registered users by email or platform notification; and (iii) where consent is required, request such consent through appropriate mechanisms before the activity begins.
14. Third-Party Links
The Flatmaters platform may contain links to third-party websites or services (for example, university websites, mapping services, or payment providers). Flatmaters is not responsible for the privacy practices, content, or data protection policies of any third-party websites. We encourage you to review the privacy policies of any third-party service before providing your personal data.
15. Changes to This Privacy Policy
Flatmaters reserves the right to update this Privacy Policy at any time to reflect legal, technical, or operational changes. Updated versions will be published on the website with the revised effective date. Where changes are material, we will notify registered users by email or through a platform notification. We encourage you to review this Privacy Policy periodically. Continued use of the platform following the publication of an updated version constitutes acceptance of the changes.
16. Contact
For any questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data:
- Email: contact@flatmaters.com
- Website: www.flatmaters.com
To exercise your rights under Section 8, please submit your request in writing to contact@flatmaters.com, identifying yourself and specifying the right you wish to exercise. We will respond within 30 calendar days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee) or with the supervisory authority in your country of habitual residence.