Privacy Policy

This Privacy Policy explains how Boost Media Limited, a company established in Denmark ("Company", "we", "us", or "our"), collects, uses, shares, stores, transfers, and protects personal data when you access or use rentbilly.cl, Rentbilly, Billy, any mobile or web applications, and related online rental search, listing aggregation, notification, membership, payment, and communication services.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Danish Data Protection Act (Databeskyttelsesloven), and other applicable Danish data protection and e-privacy rules. Because Rentbilly sells into the United Kingdom, this Privacy Policy also includes UK-specific wording for cases where the UK GDPR, the UK Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) apply.

This Privacy Policy should be read together with our Terms and Conditions, Cookie Policy, Cookie Settings, checkout information, and any market-specific notices that apply to the relevant service or country. If you do not agree with this Privacy Policy, you should not use the services.

1. Definitions

In this Privacy Policy:

• "Billy" means our listing matching and notification feature, including related automated search, alert, recommendation, message, and matching functionality.
• "Listing" means a rental property advertisement, summary, image, price, availability indication, description, landlord or agent detail, source link, or related property information displayed, indexed, linked, cached, summarized, or otherwise made available through the services.
• "Membership" means a paid subscription plan that gives access to paid features of the services for the applicable billing cycle.
• "Profile" means the user account area where you may view or update account details, rental preferences, notification settings, and Membership status.
• "Source Site" means a third-party website, platform, portal, landlord site, agent site, feed, marketplace, or other source from which Listings or related information may be collected, indexed, linked, or displayed.
• "personal data" means information relating to an identified or identifiable individual.
• "User", "you", or "your" means the individual who accesses or uses the services.

2. Who We Are, Controller Details, and Scope

For the personal data described in this Privacy Policy, Boost Media Limited is normally the controller unless we say otherwise. This means that we decide why and how personal data is processed for the services.

Controller: Boost Media Limited, Business reg. no. 14229923, registered address 112c High Street, Hadleigh, Ipswich, IP7 5EL. Privacy contact: [email protected]. Website: rentbilly.cl.

Because we are established in Denmark, Datatilsynet will normally be our lead supervisory authority for cross-border processing within the EU/EEA, unless applicable law or the facts of a specific case require another authority.

This Privacy Policy applies to Users, visitors, members, people who contact us, people who receive communications from us, and, where applicable, landlords, agents, advertisers, or other individuals whose details appear in Listings or communications processed through the services.

Landlords, agents, advertisers, Source Sites, payment providers, communication providers, app stores, and other third-party services may also process personal data as independent controllers under their own privacy notices. We are not responsible for their privacy practices.

3. Personal Data We Collect

We may collect and process the following categories of personal data, depending on how you use the services, which market you use, which devices or channels you use, and which settings you choose:

• Account and Profile data: name, email address, phone number, Sign Up and Sign In details, password or authentication data, account ID, Profile settings, language, country, preferences, Membership status, and account history.
• Rental search and preference data: preferred location, budget, property type, move-in timing, household or search criteria you choose to provide, saved searches, viewed Listings, clicks, contact attempts, and Billy settings.
• Membership, billing, and payment data: plan, price, billing cycle, renewal date, cancellation status, refund status, payment method tokens, payment provider IDs, invoices, tax information, chargeback data, and payment events. Full card details are normally processed by payment providers rather than stored by us.
• Listing and Source Site data: Listing content and related landlord, agent, advertiser, or contact details collected from Source Sites, public sources, direct uploads, feeds, or communications, where that information contains personal data.
• Communication data: emails, WhatsApp messages, support messages, contact forms, platform messages, notification content, delivery status, replies, call or message metadata, and communication preferences.
• Device, usage, and technical data: IP address, device identifiers, browser type, operating system, app version, pages viewed, clicks, timestamps, session events, referring pages, cookies, pixels, local storage, SDK data, log data, diagnostics, and fraud or security signals.
• Marketing, analytics, and advertising data: newsletter preferences, campaign engagement, ad interaction data, cookie consent choices, audience or conversion data, attribution data, and market research responses.
• Support, compliance, and enforcement data: support requests, complaints, identity or authorization checks where needed, abuse reports, security events, legal correspondence, account restrictions, and records needed to enforce our Terms or comply with law.

We do not intentionally ask you to provide Danish CPR numbers, UK national insurance numbers, passport copies, health information, criminal offence data, financial documents, immigration documents, religious beliefs, political opinions, trade union membership, biometric data, or other sensitive data unless we clearly request it in a dedicated process and have a lawful basis to do so. You should not send sensitive documents or information through Rentbilly, Billy, WhatsApp, landlord contact forms, or support channels unless we specifically request them.

4. Sources of Personal Data

We may collect personal data from:

• You, when you Sign Up, Sign In, create a Profile, buy or manage a Membership, choose search preferences, contact us, contact landlords or agents through the platform, or use Billy.
• Your use of the services, including searches, clicks, Listing views, notifications, device data, cookies, and technical logs.
• Source Sites, landlords, agents, advertisers, feeds, marketplaces, public websites, and other public or third-party sources used to collect, index, cache, link, summarize, classify, or enrich Listings.
• Payment providers, app stores, communication providers, analytics providers, cookie providers, advertising partners, fraud prevention providers, and customer support tools.
• Group companies, service providers, professional advisers, regulators, courts, authorities, or other third parties where necessary for the purposes described in this Privacy Policy.

5. Purposes and Legal Bases

We process personal data only where we have a lawful basis. Under the GDPR and, where applicable, the UK GDPR, the legal bases may include performance of a contract with you, legitimate interests, consent, compliance with legal obligations, and, in rare cases, establishment, exercise, or defence of legal claims.

Where we rely on legitimate interests, those interests may include operating and improving the services, helping Users find rental opportunities, maintaining Listing coverage, securing the platform, preventing misuse, communicating with Users, managing subscriptions, measuring performance, and running our business. Where required by law, we balance those interests against your rights and freedoms.

6. Billy, AI, Profiling, and Automated Processing

Billy uses automated and AI-assisted processing to help match Users with Listings that may be relevant to their rental search. Billy may use Profile information, rental preferences, search activity, Listing data, Source Site data, location preferences, price ranges, communication settings, and platform activity to prioritize, summarize, recommend, or notify you about Listings.

Billy is designed to support rental discovery. It does not make decisions that produce legal effects or similarly significant effects about you. You remain responsible for deciding whether to contact a landlord, agent, advertiser, or Source Site, whether to apply for a property, and whether to enter into a tenancy, lease, or other agreement.

AI-assisted outputs may be inaccurate, incomplete, delayed, biased, or unavailable. We may test, monitor, retrain, limit, or change Billy and related matching logic to improve relevance, safety, accuracy, performance, and compliance. Where feasible, we use safeguards such as access controls, testing, monitoring, and minimizing personal data used for improvement or model-related processing.

If we introduce automated decision-making that produces legal or similarly significant effects, we will provide additional information and safeguards where required by the GDPR or UK GDPR.

7. Listing Data and Third-Party Source Data

The services collect, index, cache, link, display, summarize, classify, normalize, translate, or enrich Listings from Source Sites, direct uploads, feeds, public sources, and other third-party sources. Some Listing data may contain personal data, such as names, phone numbers, email addresses, photographs, professional contact details, or other information relating to landlords, agents, advertisers, or property contacts.

We process Listing and Source Site data to operate the rental listings aggregator, make Listings searchable, provide Source Site links, allow Users to contact relevant third parties, monitor Listing coverage, prevent misuse, and improve the services. We do not guarantee that Listing data is complete, accurate, current, lawful, or available, and Users must verify Listing information directly with the relevant third party before relying on it.

Where we obtain personal data from public or third-party sources rather than directly from the individual it relates to, we provide privacy information in the way and timing required by applicable law, subject to any lawful exemptions or limitations that may apply.

8. Cookies, Tracking, and Similar Technologies

We use cookies, pixels, local storage, SDKs, and similar technologies for purposes that may include operating the website, remembering settings, enabling Sign In and Membership functionality, measuring performance, improving the services, preventing fraud, personalizing content, and marketing where permitted.

Some technologies are necessary for the services to function and cannot be disabled through our cookie tool. Non-essential cookies and similar technologies are used only where permitted by law and, where required, after you have given consent. You can manage non-essential cookies through Cookie Settings and, where relevant, through your browser, device, or app settings.

For UK users, cookie and similar-technology use may also be subject to PECR. We will not set non-essential cookies or similar technologies that require consent under PECR unless the required consent has been obtained.

More information about the cookies and similar technologies we use, including their purpose and duration, is available in our Cookie Policy.

9. Communications, Marketing, WhatsApp, and Push Notifications

We may send service communications by email, WhatsApp, in-product messages, SMS where available, and future push notifications. Service communications may include account, security, billing, renewal, cancellation, customer support, policy, Listing, Billy, and notification messages.

Marketing communications will be sent only where permitted by law. You may unsubscribe from marketing emails using the unsubscribe link or update your communication preferences where available. Opting out of marketing does not stop essential service communications.

WhatsApp messages require a valid phone number and, where required, your opt-in or consent. Standard data, messaging, or carrier charges may apply. WhatsApp and other communication providers are third-party services and may process data under their own terms and policies.

Future push notifications will require browser, device, or app permission. You may disable push notifications through your device, browser, app, or Profile settings where available.

10. Sharing Personal Data

We may share personal data with the following categories of recipients where necessary for the purposes described in this Privacy Policy:

• Group companies and internal teams involved in operating, supporting, improving, securing, or administering the services.
• Processors and service providers that provide hosting, infrastructure, payments, subscription billing, analytics, advertising, communication, AI, development, customer support, fraud prevention, security, document, productivity, and similar services.
• Landlords, agents, advertisers, Source Sites, or other third parties where you ask us to send an inquiry, make contact, provide a Source Site link, or otherwise interact with a Listing.
• Payment providers, app stores, communication providers, advertising platforms, cookie providers, and other third parties that may also act as independent controllers for some processing activities.
• Professional advisers, insurers, auditors, accountants, banks, payment schemes, debt collection providers where lawful, and other business administration providers.
• Courts, regulators, public authorities, law enforcement, tax authorities, and other parties where required by law, where necessary to protect rights, or where necessary to enforce our Terms.
• Buyers, sellers, advisers, or group companies in connection with a merger, acquisition, financing, reorganization, group restructuring, sale of assets, or transfer of the services.

11. Processors and Subprocessors

We use processors and subprocessors to provide and support the services. The main processors and service providers currently identified for Rentbilly are listed in Annex 1. The exact role of a provider may vary by market, feature, configuration, and contract.

Before using processors, we aim to assess whether they provide appropriate technical, organizational, and contractual protections. Where required, we enter into data processing agreements under Article 28 GDPR or equivalent UK GDPR terms. Processors may only process personal data on our documented instructions unless they are required by law to do otherwise.

Some providers listed in Annex 1 may act as independent controllers for certain activities, including payments, app stores, advertising, communications, fraud prevention, analytics, or public platform services. Where a provider acts as an independent controller, its own privacy notice will apply to that processing.

12. International Transfers Outside the EU/EEA and UK

Because Rentbilly operates across markets and uses global service providers, personal data may be processed in Denmark, the EU/EEA, the United Kingdom, the United States, and other countries where we, our group companies, or our providers operate.

Where personal data is transferred from the EU/EEA to a country or international organization outside the EU/EEA, we will use a transfer mechanism recognized under Chapter V GDPR where required. This may include an EU adequacy decision, the EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework for certified recipients, binding corporate rules, approved codes of conduct or certifications, derogations where applicable, and supplementary technical, contractual, or organizational measures where needed.

The United Kingdom currently benefits from an EU adequacy decision for transfers from the EU/EEA to the UK. If this changes or does not cover a specific transfer, we will use another appropriate transfer mechanism where required.

Where UK data protection law applies and personal data is transferred from the UK to another country, we will use a UK-recognized transfer mechanism where required. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the UK Extension to the EU-U.S. Data Privacy Framework for eligible certified recipients, or another lawful transfer mechanism.

Where required, we assess transfer risks, including whether the law and practice of the destination country may affect the effectiveness of the transfer mechanism. We may use safeguards such as encryption in transit, access controls, data minimization, vendor due diligence, contractual audit rights, subprocessors controls, and internal policies.

13. Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Retention periods depend on the type of data, purpose, account status, legal requirements, dispute risk, technical backup cycles, and business needs.

When personal data is no longer needed, we will delete, anonymize, aggregate, or otherwise limit it in accordance with applicable law and our internal procedures. Backup copies may remain for a limited period before being overwritten or deleted.

14. Your Rights

Subject to the conditions and limitations in applicable law, you may have the following rights under the GDPR and, where applicable, the UK GDPR:

• Right of access: to receive confirmation and a copy of personal data we process about you.
• Right to rectification: to correct inaccurate or incomplete personal data.
• Right to erasure: to request deletion of personal data in certain circumstances.
• Right to restriction: to ask us to restrict processing in certain circumstances.
• Right to data portability: to receive certain personal data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.
• Right to object: to object to processing based on legitimate interests, including profiling based on legitimate interests, and to object to direct marketing at any time.
• Right to withdraw consent: to withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing carried out before withdrawal.
• Right not to be subject to certain automated decisions: to receive safeguards where automated decision-making produces legal or similarly significant effects.

You can exercise rights by contacting [email protected]. We may need to verify your identity or authority before responding. We may refuse or limit a request where permitted by law, including where a request is manifestly unfounded or excessive, would adversely affect the rights of others, or conflicts with legal obligations.

15. Complaints and Supervisory Authorities

We encourage you to contact us first at [email protected] so that we can try to resolve your concern.

If you are in Denmark or the EU/EEA, you may complain to Datatilsynet or to another competent supervisory authority in the EU/EEA country where you live, work, or where you believe an infringement occurred.

Datatilsynet contact details:

If you are in the United Kingdom and UK data protection law applies, you may complain to the UK Information Commissioner's Office (ICO). More information is available at www.ico.org.uk.

16. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction. These measures may include access controls, encryption in transit, logging, monitoring, backups, security testing, vendor controls, staff access restrictions, and incident response processes.

No online service can be guaranteed to be completely secure. You are responsible for keeping your Sign In credentials confidential, using strong passwords where applicable, keeping your devices secure, and notifying us promptly if you believe your account has been compromised.

17. Children

The services are intended for individuals who are at least 18 years old, or the age of legal majority in their jurisdiction. We do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, contact us at [email protected].

18. Third-Party Websites and Services

The services may link to Source Sites, landlord websites, agent websites, payment providers, app stores, WhatsApp, social media platforms, advertising platforms, and other third-party websites or services. Your use of those third-party services is governed by their own terms, privacy notices, cookie policies, and settings. We are not responsible for third-party privacy practices, content, communications, payments, applications, contracts, or conduct.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including where we change the services, Billy, Listing features, markets, communication channels, processors, cookies, legal requirements, or business operations. Where required by law, we will notify you of material changes or seek consent. The "Last updated" date at the top indicates when this Privacy Policy was last changed.

20. Contact

For privacy questions, requests, or complaints, contact:

• Boost Media Limited
• CVR no.: 14229923
• 112c High Street, Hadleigh, Ipswich, IP7 5EL
• Privacy email: [email protected]
• Legal/content questions: [email protected]
• Website: rentbilly.cl

21. Governing Language

This Privacy Policy has been originally drafted in English. Any translation is provided for convenience only and may be produced using translation services. To the fullest extent permitted by applicable law, if any inconsistency, ambiguity, omission, error, or dispute arises from or in connection with a translated version, the English version shall prevail and shall be used as the authoritative text for interpreting this Privacy Policy in good faith.

Annex 1. Data Processors

The following list reflects the processors and service providers identified for Rentbilly. The exact role of a provider may vary by market, feature, configuration, and contract. Some providers may act as independent controllers for certain processing activities, such as payments, app stores, advertising platforms, or public communications services.

Providers may process personal data in Denmark, the EU/EEA, the United Kingdom, the United States, or other countries depending on the provider, service, feature, and configuration. International transfers are handled as described in Section 12.

We may update this processor list from time to time if a processor is added, removed, renamed, or materially changes role.