Privacy policy

1. Data controller

The data controller is PeselCheck Sp. z o.o., with its registered office in Warsaw, Poland (see the imprint). For any data-protection matter you can contact us at privacy@peselcheck.pl.

2. What we collect

We collect (a) account data: e-mail, password hash, name, phone number, address, locale preference; (b) verification data: PESEL number and KYC outcome from Veriff; (c) tenant profile: income band, employment status, birth date; (d) landlord profile: company name and contact address; (e) operational data: access requests, consent logs, tenant ratings, invitations; (f) technical data: IP address, browser, timestamps for security.

3. Legal basis

Processing is based on: (a) performance of the contract (Art. 6(1)(b) GDPR) for accounts, rental-workflow features and billing; (b) your explicit consent (Art. 6(1)(a) GDPR) for sharing your rental history with a specific landlord; (c) legitimate interest (Art. 6(1)(f) GDPR) for fraud prevention and service security; (d) legal obligation (Art. 6(1)(c) GDPR) for tax and accounting records.

4. PESEL processing

Your PESEL number is stored encrypted at rest. We do not search or match on the plaintext PESEL: lookups go through a keyed hash (HMAC-SHA256 with a server-side pepper). The number itself is only decrypted to (i) show it back to you in your settings, (ii) export your data on request, (iii) pass it to Veriff during KYC, and (iv) admin support with audit logging.

5. Retention

Account data is retained while your account is active and for up to 6 months after deletion for legal-claim purposes. Tenant ratings are pseudonymised on account deletion and retained in the rating network; they no longer reference you personally but remain usable as reputation signals for the landlord who wrote them. Consent logs are retained for 5 years for audit purposes. KYC records follow Veriff retention rules; PeselCheck stores only the outcome and a reference.

6. Recipients

Personal data is shared only with: (a) landlords to whom you gave explicit consent via an access request; (b) Veriff OÜ (Estonia) as identity-verification processor; (c) hosting and mail providers under a data-processing agreement; (d) Polish authorities when required by law (UODO, prosecutor, court).

7. International transfers

Veriff processes data within the EEA. Hosting is located in the EU. We do not transfer personal data to countries outside the EEA without appropriate safeguards (standard contractual clauses or an adequacy decision).

8. Your rights

You have the right to access, rectification, erasure, restriction, data portability (Art. 15-21 GDPR) and the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You can exercise these rights in the Privacy Center of your account or by e-mail to privacy@peselcheck.pl. You can also lodge a complaint with the Polish Personal Data Protection Office (UODO, uodo.gov.pl).

9. Automated decision-making

PeselCheck does not take decisions about you that have legal effects based solely on automated processing. Ratings by previous landlords are visible to landlords you grant access to, but any decision (e.g. rejecting a tenancy) is taken by a human landlord.

10. Changes to this policy

We will notify you of material changes via e-mail or in the app. The effective date is shown at the bottom of this page.