Dean privacy policy and data rights

Dean Radar, a sole proprietorship (eenmanszaak) established in Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 83770089 and with VAT number NL003868118B20, is the controller for the processing described in this policy. For privacy questions and requests, contact help@heydean.nl.

We process personal data in accordance with the General Data Protection Regulation, Regulation (EU) 2016/679, and applicable Dutch law. The full GDPR text is available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

Dean is software for tracking and comparing rental listings with a search profile. Dean is not a landlord, letting agent, broker, representative of a provider or selection party. We do not decide availability, viewings, admission, tenancy terms or the allocation of a property.

To create and secure an account, we process your name, email address, account ID, authentication and session data, selected sign-in method, account status, consent preferences and necessary security and fraud-prevention signals. If you use Google sign-in, we process only the data needed to link that sign-in to your account, such as name, email address and a technical account ID.

We use this data to perform the agreement, provide access, administer accounts, prevent misuse and communicate with you about your account. The legal basis is performance of the agreement for the service itself and, for security and fraud prevention, our legitimate interest in a safe and reliable service.

For your search profile, we process the cities, neighbourhoods, locations, radius, budget, property type, rooms, surface area, availability preferences and alert settings you select. We use this data to compare listing data with your preferences and show or send suitable rental matches.

If you use the response letter, we process only information you choose to enter, such as job title, employer, gross monthly salary, contract type, household situation, combined income, desired move-in date and the text of the letter. This information is optional for the response letter and is stored encrypted so you can later edit or copy it.

The legal basis for these activities is performance of the agreement. You can amend or delete a search profile or response letter yourself. Entering information in a response letter does not mean that Dean gives it to a landlord, letting agent or platform; you decide whether and how to use or send it to an external party.

For email alerts, transactional messages and support, we process your email address, message content, sending and delivery status, error messages and limited audit data. For WhatsApp alerts, only when you enable that feature, we process your phone number, opt-in and opt-out status, the content needed to deliver the alert and delivery information.

If you add a Sleutelgenoot search companion, we process the name or label and email address you provide for that person in order to forward matches. You are responsible for informing that person in advance and for having a valid legal basis. The search companion receives an explanation and can opt out.

After an unpaid account has been created, recovery messages about completing onboarding or payment may be sent automatically. Where applicable rules permit it, we base such messages on the agreement, your request or a legitimate-interest assessment. Recipients can unsubscribe from messages that are direct marketing through the opt-out offered or by contacting help@heydean.nl. This policy does not state that every recovery message is permitted without consent in every circumstance.

Depending on the message, the legal basis is performance of the agreement, our legitimate interest in service, security and completing a process you started, or consent. For direct-marketing messages, we respect the applicable opt-in and opt-out rules.

For subscriptions and payments, we process invoice data, payment status, Stripe customer and subscription data, invoice numbers, recurring-payment data and limited payment-method data made available to us by Stripe. Full card or bank details are entered with and managed by Stripe or the payment method you choose; Dean does not receive or retain that full information.

We process this data to enter into and manage the subscription, collect or refund amounts, keep records, prevent fraud and comply with tax and accounting obligations. The legal basis is performance of the agreement, a legal obligation and, where necessary, our legitimate interest in preventing fraud and payment misuse.

Dean processes public or externally published rental-listing data, including title, address or location data, rent, characteristics, publication time, source, URL and limited technical fetch information. A public listing may incidentally contain personal data, for example where a source itself publishes a name, telephone number or other contact detail.

For such incidental personal data, we process information on the basis of our legitimate interest in indexing, structuring and matching public rental-market information and keeping the service operational. We balance that interest against the interests and fundamental rights of data subjects and limit processing to what is necessary for that purpose.

Public availability is not general consent, a licence or a waiver of rights. Processing does not give Dean ownership of listing data or an unrestricted right to reuse it. We may limit or remove a source, listing or component because of a legal obligation, a substantiated request, technical circumstances or our own balancing of interests.

If you are a data subject, rightsholder or representative and have a substantiated objection or removal request, send the source URL, a clear explanation and, where needed, evidence of authority to help@heydean.nl. We assess requests carefully and handle privacy rights under the GDPR. Dean does not act as the landlord, letting agent or selection party for the properties described in this data.

For operation, security and error resolution, we process IP address, device and browser data, log and security signals, referer, session data, error messages and usage events. This is based on our legitimate interest in availability, security, abuse prevention and quality control.

For non-essential statistics and marketing, we process data only after the required consent. Depending on your choice, this may involve Google Analytics 4, Google Ads, Meta Pixel, Meta Conversions API and PostHog EU Cloud. After statistics consent, PostHog may process pseudonymous product events and masked session recordings for onboarding. Our cookie policy provides further detail on categories, technologies, purposes and retention.

Cloudflare Turnstile helps protect forms from spam and bots. Cloudflare may process security signals such as IP address, user agent, TLS fingerprint, sitekey and page origin. Further information is available at https://www.cloudflare.com/turnstile-privacy-policy/

We engage suppliers for hosting, database, authentication, security, email, WhatsApp, payments, invoicing, analytics, marketing and operational scraper infrastructure. Where they process personal data on our behalf, we enter into appropriate processor or other required arrangements.

Depending on the feature you use, recipients may include Supabase for database and authentication, Cloudflare for hosting, security and Turnstile, Resend for email, Stripe for Checkout, invoicing and subscription management, Meta/WhatsApp for WhatsApp alerts and marketing measurement, Google for Google sign-in, Analytics and Ads, PostHog EU Cloud for consent-based onboarding analysis, and proxy or browser-rendering providers for technically processing public source data.

We do not sell account or search-profile data to landlords, letting agents, platforms or other advertising parties. When you open an external listing from Dean or contact a provider yourself, that external party processes data under its own terms and privacy policy.

Some suppliers or their subprocessors may process personal data outside the European Economic Area. Where that happens, we rely on an adequacy decision or put appropriate safeguards in place, such as standard contractual clauses supplemented with measures appropriate to the circumstances.

Countries, subprocessors and transfer mechanisms can vary by supplier and configuration. On request, we provide further information about the relevant transfer basis where reasonable and legally required.

We keep account data, search profiles, response letters and alert settings while your account is active, and afterwards only for as long as needed for closure, security, evidence, disputes or a legal obligation. Deleting an account does not automatically remove data we must still retain.

We generally keep invoices, payment administration and data required for tax administration for seven years. We generally retain limited email and WhatsApp audit data for up to twelve months, unless longer retention is necessary for support, security, evidence, dispute resolution or a legal obligation.

We retain public listing data for as long as it is reasonably needed for current presentation, matching, quality control or source management. We retain raw technical data for a shorter period under the operational configuration. After account deletion, where a trial is available, a minimal pseudonymous block may remain for up to 24 months to prevent repeated use of that trial.

We retain marketing data until you unsubscribe or withdraw consent, unless a limited suppression list is needed to respect your opt-out. Cookie and analytics periods are set out in the cookie policy.

To the extent the GDPR grants the right, you may request access, rectification, erasure, restriction, portability or object. You can withdraw consent at any time without affecting the lawfulness of earlier processing. You can also object to processing based on legitimate interests, including processing of public listing data.

Send your request from your account email address, or with enough information for us to verify your identity and request, to help@heydean.nl. We normally respond within one month of receipt. For complex or numerous requests, we may extend that period by up to two further months, with timely notice.

If you disagree with our handling, you may lodge a complaint with the Dutch Data Protection Authority. You also retain the remedies available under the GDPR and applicable law. Further information is available at https://autoriteitpersoonsgegevens.nl

Dean automatically compares listing data with your search profile. A match is a technical relevance assessment; it is not an automated decision with legal or similarly significant effects within the meaning of Article 22 GDPR. You can change your profile, turn off alerts or contact us for an explanation of how matching works.

We implement appropriate technical and organisational measures, including access controls, encryption where appropriate and logging. No system is entirely risk-free, so we cannot guarantee absolute security.

We may amend this policy when the service, suppliers or law changes. The date at the top shows the latest substantive update. We will communicate material changes in an appropriate way.