Privacy policy

Homelinck is a service of Brickx B.V., based in The Hague, registered with the Dutch Chamber of Commerce under number 69502846. You can reach us at brickx@brickx.nl.

For questions about how your personal data is processed, you can contact our data protection officer (DPO) at brickx@brickx.nl.

• Account and profile data: name, email address, phone number, address, date of birth and other data you enter in your profile or registration form.
• Registration and preference data: your housing preferences, ranking of homes, household composition and attachments such as income details.
• Documents and attachments: files you upload with a registration (for example income statements) and your digital signature on a form, if any.
• Login and session data: IP address, browser type, times of logging in and out (see also our cookie policy).
• Error reports: technical information about a malfunction (page, error type, browser). If you are logged in, the account ID may be included so that we can trace the problem. Without your consent for analytics we send no email address with it and create no user profile.
• Usage data (only with your consent for analytics): page visits, click behaviour, technical page performance and session recordings. In recordings, input fields, images and visible contact details are masked. If you are logged in, we link this usage to your account: email address, role and the project or organisation you belong to.
• Communication: emails you exchange with us and messages within the portal.
• Homelinck Network (only with your explicit opt-in): name, email address, phone number, postcode, town and the project you signed up for are added to a central Homelinck list. Homelinck uses it to send you messages about suitable housing projects, including projects of Homelinck partners. Your details stay with Homelinck and are not passed on to those partners. We record the moment, the IP address and the version of your consent so that we can prove you gave consent. You can withdraw this consent at any time via the unsubscribe link in every email, via your profile or via the Homelinck Network unsubscribe page (/homelinck-netwerk/afmelden), even if the project you signed up for no longer exists.

We process your data solely for:

• Performance of the contract: providing the registration portal, managing your account, allocating homes. Legal basis: Art. 6(1)(b) GDPR.
• Legal obligations: retaining certain data for, for example, tax or rental law purposes. Legal basis: Art. 6(1)(c) GDPR.
• Legitimate interest: fraud prevention, securing the portal and fixing malfunctions through error reports without a user profile. Legal basis: Art. 6(1)(f) GDPR.
• Consent: analysis of usage in the portal (page visits, click behaviour, session recordings and linking to your account) and, on the public website, visit measurement via Google Analytics and advertising measurement. When you create an account, we then also store which campaign, website or page brought you in. Also optional marketing communication such as the newsletter and participation in the Homelinck Network. You can withdraw your consent at any time via your profile or via the cookie preferences at the bottom of the page.

We keep your data no longer than necessary:

• Account and profile data: for as long as your account exists. After you delete your account we erase or anonymise this data, unless a statutory retention obligation requires us to keep it longer.
• Registration and form answers: for as long as needed for the allocation procedure and its handling. After that we erase or anonymise this data, unless longer retention is required by law.
• Audit logs (security events): after 30 days the IP address, browser data and email address are anonymised automatically; after 2 years the log entry is deleted completely.
• Homelinck Network: after you withdraw consent we no longer contact you; we keep the consent record as proof of the consent previously given.
• Financial documents: 7 years under the statutory tax retention obligation.
• Usage data and session recordings: at most 12 months after capture, or sooner as soon as you withdraw your consent for analytics.

We only share your data with third parties where necessary:

• With the housing association or property developer you register with, to the extent relevant to the allocation.
• With our processors, with whom we have a data processing agreement or who work under their own processor terms: Vercel (hosting and file storage), Neon (database), Resend (email delivery), PostHog (error reporting without a user profile and, only with your consent, usage analytics, session recordings and linking to your account; storage in the EU), Laposta (newsletters, the Netherlands) and OpenPostcode (address completion based on postcode and house number).
• With competent authorities where we are legally obliged to do so.

We never sell your data and do not use it for automated decision-making with legal effects without human intervention.

Under the GDPR you have the right to:

• access your data and receive a copy (data portability);
• have inaccurate data corrected;
• request erasure (right to be forgotten);
• object to processing based on our legitimate interest;
• withdraw consent you gave earlier;
• lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise a right, email brickx@brickx.nl. We respond within 30 days.

We protect your data through, among other things, encryption in transit (TLS), encryption of sensitive fields at rest, strict access control and extensive audit logs. We report incidents to the Dutch Data Protection Authority within 72 hours where legally required.

We may update this policy from time to time. The most recent version is always on this page; we announce substantial changes by email or in the portal.