Privacy Policy

This policy explains what personal data Easyroom processes, why, on what legal basis, with whom it is shared and what your rights are. It applies to easyroom.lu and the associated services.

Data controller

PHG Sàrl-S, 22 boulevard de Verdun, L-2670 Luxembourg (RCS B230996). For any question about your data: privacy@easyroom.lu.

Data we process

Account data: email address, password (encrypted), first name, last name, preferred language, account type (individual/agency), optional profile photo.

Phone number: optional and private; never displayed publicly unless you explicitly allow it.

Content you publish: listings, descriptions, photos, saved searches, favourites, messages exchanged via the internal messaging system.

Technical usage data: IP address, connection logs, device/browser type, and cookieless audience measurement (aggregated statistics).

Social login data: if you use Google, Facebook or Apple, we receive the email address and name provided by the provider.

Proof of consent: for marketing communications, we keep the registration date, the date and proof of consent, and the associated IP address, in accordance with the GDPR.

Payment data (paid services in phase 2): handled by our payment providers; Easyroom stores no bank card data.

Purposes and legal bases

Each processing operation relies on a legal basis under the GDPR:

Recipients and processors

Host (OVH, EU), transactional email service (OVH), mapping and geocoding (MapTiler, Geoapify — EU), social login providers (Google, Facebook, Apple) and payment providers (Stripe, Mollie) where applicable. These providers act only on our instructions and under confidentiality commitments.

We never sell your personal data.

Transfers outside the EU

Hosting and mapping are provided within the European Union. Some providers (social login, payment) may involve transfers outside the European Economic Area.

Where data is transferred outside the European Economic Area, Easyroom ensures that such transfers rely on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission.

Retention periods

Account and content: kept as long as the account is active. Upon account deletion, identity data is erased or anonymised; messages may be kept in anonymised form to preserve other members’ conversations, or where retention is necessary for the establishment or defence of legal claims.

Billing data: kept for the statutory period applicable in Luxembourg (10 years).

Logs and histories: for security, evidentiary purposes and to respond to any judicial request, Easyroom keeps, for a proportionate period, connection logs, the history of listings, the history of their changes and the history of reports.

Your rights

You have the rights of access, rectification, erasure, objection, restriction, portability, and the right to withdraw your consent at any time. A self-service export and account deletion are available in your account area.

To exercise these rights: privacy@easyroom.lu. You may also lodge a complaint with the National Commission for Data Protection (CNPD), the supervisory authority in Luxembourg (cnpd.lu).

Security

We implement reasonable technical and organisational measures: password encryption, secure connections (HTTPS), attempt limiting, and restricted access to data.

Minors

The service is reserved for adults (18 and over). We do not knowingly collect data from minors.

Changes

This policy may change. Any significant change will be indicated on the site.