Privacy Policy
We believe renting a home should feel simple and transparent. This Privacy Policy explains what personal data Settli collects, why we use it, how we protect it, and what rights you have.
1. About this Privacy Policy
This Privacy Policy explains how Settli processes personal data when you use the Settli mobile application, website or related services.
Settli is a Swedish rental-housing marketplace where tenants can browse rental listings, landlords can manage properties and both parties can communicate after matching. Where the parties agree, a rental contract may also be signed electronically through the app.
This policy applies to personal data processed in connection with these services and should be read together with our Terms and Conditions.
2. Who controls your personal data?
The controller responsible for your personal data is the Settli entity operating the Settli service:
Valhallavägen 65
114 28 Stockholm
Sweden
Company registration number: 559557-0945
Email: info@settli.se
For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), this entity acts as the data controller unless otherwise stated in this Privacy Policy.
3. What personal data do we collect?
We collect information that you provide directly, information generated when you use Settli, and certain information processed through service providers that help us operate the platform.
| Category | Examples | Why it is used |
|---|---|---|
| Account information | Email address, first name, last name, date of birth, active role. | Account creation, authentication, identification and operation of the service. |
| Business landlord information | Company name and organisationsnummer. | To identify business landlords and support landlord activities on the platform. |
| Tenant profile | Occupation, preferred move-in and move-out dates, desired amenities, pet information, biography and profile photographs. | To create and display tenant profiles and help landlords assess potential matches. |
| Landlord and listing information | Street address, latitude and longitude, home type, size, number of rooms, rent, amenities, house rules, availability dates and listing photographs. | To create, display and manage rental listings. |
| Address information | Address text entered into the address search field and the resulting verified address. | To provide address suggestions and verify real addresses. |
| Messages and shared images | Chat messages, photographs and other images shared between matched users. | To provide persistent communication between matched users. |
| Contract and signing information | Information required to execute and evidence a rental contract, including personnummer where required for identity verification through BankID. | To facilitate electronic signing and establish the identity of the signing party. |
| Notification information | Device push-notification token. | To deliver push notifications such as new matches and relevant account alerts. |
| Website and technical information | IP address, date and time of requests, and interactions with download links. | To operate and secure our website, prevent abuse, troubleshoot technical issues and understand use of our download links. |
| Safety and reports | Reports, block information and images or other material attached to reports. | To investigate misconduct, fraud, abuse and safety issues and protect users. |
4. How we use your personal data
We process personal data only where there is a lawful reason to do so. Depending on the circumstances, we use information to:
- Create and administer your Settli account.
- Authenticate your account using email verification codes.
- Operate tenant and landlord profiles, including the platform's dual-role functionality.
- Display rental listings and tenant information to relevant users.
- Enable users to discover potential rental matches.
- Enable communication between users who have matched.
- Facilitate electronic execution of rental contracts.
- Verify identity where required for contract signing.
- Send account-related emails and push notifications.
- Investigate reports, fraudulent activity, abuse and other safety concerns.
- Maintain, secure and improve the Settli service.
- Comply with legal obligations and respond to lawful requests from authorities where required.
5. Legal bases under GDPR
GDPR requires us to have a legal basis for processing personal data. The applicable legal basis depends on the particular processing activity.
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account, authenticating your login and providing the core Settli service. | Performance of a contract (GDPR Article 6(1)(b)) — processing is necessary to provide the services you request under our agreement with you. |
| Operating tenant and landlord profiles and displaying relevant profile and listing information. | Performance of a contract (Article 6(1)(b)) where the processing is necessary to provide the marketplace functionality. |
| Address lookup and verification using Google Places API. | Performance of a contract (Article 6(1)(b)) where address verification is necessary to provide listing functionality. |
| Chat and sharing of images after users match. | Performance of a contract (Article 6(1)(b)). |
| Facilitating rental-contract signing and processing the information required to establish the identity of the signing party. | Performance of a contract (Article 6(1)(b)) and, where applicable, compliance with a legal obligation (Article 6(1)(c)). |
| Sending essential service emails, such as login codes and account-related communications. | Performance of a contract (Article 6(1)(b)). |
| Security, fraud prevention, abuse prevention, user reports and investigation of misconduct. | Legitimate interests (Article 6(1)(f)), namely protecting users, the service and our business from fraud, abuse and security threats. |
| Maintaining technical security, reliability and functionality of the platform. | Legitimate interests (Article 6(1)(f)). |
| Processing required to comply with applicable laws, regulations or lawful authority requests. | Legal obligation (Article 6(1)(c)). |
| Optional processing that requires consent, where applicable. | Consent (Article 6(1)(a)). |
7. Where is your data stored?
Settli uses Google Firebase as its primary application backend. The Firebase services used by Settli are configured to store Settli data in the EU region europe-north1, located in Finland.
Google Firebase — europe-north1
Finland · European Union
We aim to keep personal data within the European Union. However, certain third-party providers may process data in other jurisdictions depending on the services they provide and their infrastructure. Where personal data is transferred outside the EEA, Settli will rely on a lawful transfer mechanism required by applicable data-protection law.
Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss and destruction.
These measures include access controls, authentication, infrastructure security and restrictions on access to personal data. No internet-based service can guarantee absolute security, and you should therefore also take reasonable steps to protect your account and login information.
8. How long do we keep your data?
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law or necessary to establish, exercise or defend legal claims.
Account deletion
When you delete your Settli account, it is initially marked for deletion. Your account remains in a 30-day grace period.
During this period, you may be able to sign back in and restore your account. Once the 30-day period has expired, the account is permanently deleted and personal account information is removed in accordance with our deletion processes.
This includes deletion of stored photographs and removal of the login account and personal profile fields such as name, email address, date of birth and profile photographs.
Incomplete registrations
Sign-ups that are never completed are automatically cleaned up after 30 days.
Exceptions
Certain information may need to be retained after account deletion where required by law or where reasonably necessary to establish, exercise or defend legal claims, prevent fraud or maintain evidence relating to a dispute or security incident. Where this occurs, the retained data will be restricted to what is necessary for that purpose.
9. Your rights
Depending on the circumstances and applicable law, you have several rights under GDPR concerning your personal data.
Access
You may request information about the personal data we hold about you and receive a copy of it.
Correction
You may ask us to correct inaccurate or incomplete personal data.
Deletion
In certain circumstances, you may request that your personal data be deleted.
Restriction
You may request that we restrict processing of your personal data in certain circumstances.
Objection
You may object to processing based on legitimate interests, subject to the requirements of GDPR.
Data portability
Where applicable, you may request your personal data in a structured, commonly used and machine-readable format.
Withdraw consent
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing carried out before withdrawal.
Complain
You have the right to lodge a complaint with the relevant supervisory authority if you believe your data has been processed unlawfully.
How to exercise your rights
To exercise your rights, contact us using the details in the Contact section below. We may need to verify your identity before fulfilling a request.
In Sweden, the relevant supervisory authority is the Integritetsskyddsmyndigheten (IMY).
You can find information about the Swedish data-protection authority at imy.se .
10. Children
Settli is a rental-housing marketplace intended for adults participating in the rental-housing market. We do not knowingly collect personal data from children in circumstances where such collection is prohibited by applicable law.
If you believe that a child has provided personal data to Settli inappropriately, please contact us so that we can investigate and, where appropriate, delete the information.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to Settli, our processing activities, technology, applicable law or regulatory guidance.
When we make material changes, we will take reasonable steps to notify users where required by law. The "Last updated" date at the top of this policy indicates when the policy was most recently revised.
12. Contact us
If you have questions about this Privacy Policy, want to exercise your GDPR rights, or have concerns about how your personal data is handled, please contact us:
You may also contact the Swedish data-protection authority, Integritetsskyddsmyndigheten (IMY), if you wish to lodge a complaint concerning the processing of your personal data.