Table of contents

PRIVACY POLICY of the Rent2End Web Service

Document Purpose: This Privacy Policy is intended to inform you of the rules regarding the processing of personal data in connection with the use of the Rent2End platform, in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”).

1. Personal Data Controller

The Data Controller of your personal data is Robert Zdanowski, owner of the Rent2End brand, with its registered address at ul. Stanisława Drabika 38 lok. 24, 52-131 Wrocław, Poland, NIP (Tax ID): 8992843940, REGON: 380004584 (hereinafter: “Rent2End”, “Controller”). Contact regarding personal data protection is possible via email at: kontakt@rent2end.pl.

2. Scope and Sources of Obtained Data

To provide services, Rent2End processes the following categories of personal data: • Data necessary to establish and maintain an account: first name, last name, email address, phone number. We obtain these data directly from you during registration. • Data obtained in the case of registration or login via external services (Facebook, Google): email address, first and last name, public user ID, and optionally profile picture. The sources of these data, if such authentication method is selected, are external identity providers – respectively: Meta Platforms Ireland Limited or Google Ireland Limited. These data are transferred to us based on your explicit instruction upon account integration. • Data necessary to conclude and execute a lease agreement: o Identification data: first name, last name, PESEL number, series and number of identity card. Providing these data is required for the unambiguous identity verification of the parties to the lease agreement and to secure the legal interests of both transaction parties, which is necessary for the proper performance of the contract. o Contact data: residential address, correspondence address. o Financial data: bank account number (for processing rent payments), history of payments made through the platform. • Data processed to build a rental history (solely with your consent): o Objectified ratings concerning the course of the lease (e.g., payment punctuality). o History of concluded agreements and service requests within the platform. • Technical data (collected automatically): IP address, cookie identifiers, information about the terminal device and browser.

Your personal data are processed for the following purposes: a) Conclusion and execution of the agreement for the provision of electronic services (account management, user authentication via external provider login systems such as Facebook and Google, providing platform functionalities, generating agreements, payment processing) – the legal basis is the necessity for the performance of a contract (Article 6(1)(b) of the GDPR). b) Fulfillment of legal obligations incumbent on the Controller (e.g., maintaining accounting and tax records) – the legal basis is a legal obligation (Article 6(1)(c) of the GDPR). c) Creating and making available a rental history (tenant profile) to increase transparency and security for parties to future agreements – the legal basis is your voluntary consent (Article 6(1)(a) of the GDPR). d) Direct marketing of Rent2End’s own services addressed to our clients – the legal basis is our legitimate interest (Article 6(1)(f) of the GDPR). e) Sending commercial information (newsletter) and using marketing cookies – the legal basis is your voluntary consent (Article 6(1)(a) of the GDPR). f) Establishment, exercise, or defense of legal claims – the legal basis is our legitimate interest (Article 6(1)(f) of the GDPR). g) Conducting analytics and statistics to improve our services (based on anonymized or pseudonymized data) – the legal basis is our legitimate interest (Article 6(1)(f) of the GDPR).

4. Profiling and Rental History

Rent2End enables the creation of a tenant profile, which is informative for property owners and aims to increase mutual trust between parties. Creation and sharing of the profile take place exclusively based on your explicit consent. • The profile is based on objective data, such as payment punctuality history within the platform and the history of concluded lease agreements. • You have the right to withdraw consent for the creation and sharing of your profile at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal. • Profiling does not lead to automated decision-making producing legal effects concerning you. The final decision to enter into a lease agreement always rests with the property owner.

5. Recipients of Data

Your personal data may be transferred to the following categories of recipients: • Other platform users (property owners or tenants) – solely to the extent necessary to enter into and execute a lease agreement. • External partners providing services upon your direct request – in particular Audyteco Sp. z o.o., to the extent necessary to place and fulfill an order for an energy performance certificate for real estate (including identification data, contact data, and property data). Depending on the operational model adopted, Audyteco Sp. z o.o. processes data as an independent data controller or as a processor. • External authentication service providers (Single Sign-On): If you choose to log in via Facebook or Google, external service providers (Meta Platforms Ireland Limited, Google Ireland Limited) may collect and process data regarding your activity during authentication as separate controllers, in accordance with their own privacy policies. • Processors acting on our behalf, with whom we have concluded appropriate data processing agreements (Article 28 of the GDPR), such as: o Hosting service providers (Amazon Web Services, located in the EU). o Online payment gateway providers. o Entities providing IT, technical support, legal, or accounting services to us. • Public authorities, if required by applicable laws.

6. Transfer of Data Outside the European Economic Area (EEA)

As a rule, your personal data are processed on servers located within the EEA. We do not transfer your data outside this area. Should a need to transfer data arise in the future, it will take place exclusively while ensuring an adequate level of protection, e.g., based on Standard Contractual Clauses.

7. Data Retention Period

We store your personal data for the period necessary to achieve the purposes for which they were collected: • Contract-related data – for the duration of the contract and until the statute of limitations for potential claims expires (as a rule, up to 6 years after its termination). • Data processed based on a legal obligation (e.g., accounting records) – for the period required by law (e.g., 5 years from the end of the calendar year). • Data processed based on consent (e.g., profile data, marketing data) – until your consent is withdrawn. • Data processed based on legitimate interest – until an effective objection is lodged.

8. Rights of Data Subjects

In connection with the processing of your personal data, you have the following rights: • Right of access to your data (Article 15 GDPR). • Right to rectification of inaccurate data (Article 16 GDPR). • Right to erasure (“right to be forgotten”) in cases specified in Article 17 GDPR. This includes the right to permanently delete the account and any data obtained through external login mechanisms (Facebook, Google). To exercise this right and request data deletion, you may delete your account directly in the Rent2End application settings at any time or send a request to: kontakt@rent2end.pl. • Right to restriction of processing (Article 18 GDPR). • Right to data portability (Article 20 GDPR). • Right to object to processing based on our legitimate interest (Article 21 GDPR). • Right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. • Right to lodge a complaint with a supervisory authority – the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland).

9. Voluntary Provision of Data

Providing the data necessary for registration and contract conclusion is voluntary but required to use Rent2End services. Failure to provide these data will prevent account creation and the conclusion of a lease agreement through the platform.

10. Cookies and Tracking Technologies

The Rent2End platform uses cookies for: • Essential purposes – for the proper functioning of the service. • Analytical purposes – for traffic analysis and statistics (e.g., Google Analytics). • Marketing purposes – for ad personalization (e.g., Meta Pixel). During your first visit to the website, an information banner is displayed allowing you to manage your consent for specific types of cookies. Granting consent is voluntary.

11. Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of violating the rights or freedoms of natural persons. We utilize, among other things, SSL encryption, access controls, regular backups, and data minimization procedures.

12. Changes to the Privacy Policy

We reserve the right to make changes to this Privacy Policy. We will inform you of any material changes reasonably in advance via email or through a notice on the platform.