Privacy Policy

1. Data controller

Your House in the Sun, based in Rotterdam, the Netherlands, is the data controller for personal data processed via yourhouseinthesun.com.

2. What we collect and why

Account data (name, email, phone) to create and manage your account; listing and favourite data to provide the service; support messages to answer your enquiries; usage, device and IP data for security, fraud prevention and product improvement; and marketing preferences where you subscribe to our newsletter.

3. Lawful basis

We process data on the basis of contract performance (providing the service), legitimate interest (security, fraud prevention, improving the platform), consent (newsletter, analytics cookies) and legal obligation (accounting and tax records), as defined in Article 6 GDPR.

4. Who we share data with

We share personal data only with the following categories of recipients:

Merchant of Record and payment processing. Our order process is conducted by our online reseller Paddle.com, which acts as the Merchant of Record for all our orders. When you purchase a package, Paddle collects and processes your billing and payment data as an independent controller for payments, subscription management, invoicing, tax compliance and refunds, and handles related customer service. See Paddle's privacy notice. We never see or store your full card details.

Service providers (processors). Hosting and database infrastructure, email delivery, live chat support and analytics providers, acting on our instructions under data processing agreements.

Professional advisers (legal, accounting) and authorities, where required by law.

5. International transfers

Some providers process data outside the EEA. Where that happens we rely on adequacy decisions or EU Standard Contractual Clauses with appropriate supplementary safeguards.

6. Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest for stored data, row-level access controls in our database, role-based access limited to staff who need it, hashed credentials, and regular review of access rights and security configuration.

7. Your rights

You have the right to access, rectify, delete, restrict, export (portability) or object to processing of your data, to withdraw consent at any time, and to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch DPA). We respond within one month.

8. Cookies

We use strictly necessary cookies and, with your consent, analytics cookies to improve the platform. You can manage or withdraw cookie consent at any time in your browser settings.

9. Data retention

Account data is retained while your account is active and for up to 24 months after closure; transaction records are kept for as long as tax law requires. Data is deleted or anonymised once no longer needed.

10. Contact

Data protection contact: privacy@yourhouseinthesun.com.