Privacy notice
Privacy notice
Notice version: 2026.18 · 2026-10-13
Controller and scope
The company that grants your MyRentory access is the controller for property-management data. MyRentory processes information only to operate the service securely and to support rental, accounting, communication and compliance workflows. Controller contact details must be supplied by that company.
What we store and why
We store account and contact data for authentication and communication; landlord, tenant, property, tenancy and contract data for performing and proving rental relationships; invoices, costs, allocations, income, payments, tax data and statements for settlement, accounting and legal obligations; documents, meter identifiers and readings for property administration; messages and attachments for tenancy communication; and security, consent, access and audit records for accountability, fraud prevention and system protection.
Legal bases
Processing may be necessary to perform a contract or pre-contractual steps, comply with legal and accounting obligations, and pursue legitimate interests such as secure operation, record integrity and the establishment, exercise or defence of legal claims. Consent is used only for genuinely optional purposes and can be withdrawn separately.
Retention and erasure
We keep data only for stated purposes and applicable tax, accounting, contractual, cybersecurity, limitation or legal-claim periods. On an erasure request we remove direct identifiers, credentials, optional contacts and non-retained content. Records still required by law or for legal claims remain restricted and protected for the documented period; technical continuity alone is not a legal basis. Once no retention basis remains, data is erased or irreversibly anonymized so the person is no longer reasonably identifiable.
Erasure and anonymisation
Approved requests deactivate access and remove account identity, authentication factors, optional contacts, non-retained messages and attachments, meter-reading photos and avoidable metadata. Random internal links may remain solely to keep legally retained financial and contractual records consistent. If the controller could still identify the person from dates, property, tenancy or other information, those records remain personal data and are not described as anonymous.
Your rights and requests
You may request access, rectification, restriction, portability, objection or erasure. We verify identity, record the request, respond within the applicable deadline, and explain any partial fulfilment or refusal and its retention basis. You may complain to the competent supervisory authority. Contact the company that issued your account to exercise these rights.
Security and recipients
Access is role-, company-, property- and tenancy-scoped and is logged for sensitive operations. Protected documents are not publicly addressable. We apply session protection, encryption in transit in production, controlled uploads, backups and recovery controls. Data is disclosed only to authorized participants, contracted processors and authorities where legally required.
External services and data transfers
The application does not load fonts, scripts, images, analytics, advertising or invoice-processing services from third-party servers. Browser requests remain on the MyRentory deployment. Invoice parsing and previews run locally. Password-reset email is delivered only through the mail infrastructure configured by the operator; the controller must identify any external mail provider as a processor in its deployment-specific information. MyRentory does not use tracking or marketing cookies.
Residents, contacts and contractual notifications
The system processes resident names and contact details, informational address registrations, plates, vehicle user names and parking registration dates for tenancy administration. Emergency/death contact names and details serve contractual contact purposes only. A recorded unsuccessful contact attempt does not prove delivery. Email preferences and jobs support payment reminders and confirmations. Operational personal register records are deleted 30 days after post-tenancy contractual deregistration deadlines unless an active retention hold applies. Contract documents and justified financial evidence follow their separate retention schedules and do not automatically become anonymous. Deletion affects the application database; backups expire under their existing schedule. Individual rights requests can be submitted on the Privacy page or to the controller; disclosure of third-party data requires separate review.
Service brands and domains
This privacy notice applies to the same system operated under the following brands and domains. The displayed brand is selected from the domain used.
- MyRentory: myrentory.com, www.myrentory.com, manage.myrentory.com
- Albérlet360: alberlet360.hu, www.alberlet360.hu, manage.alberlet360.hu
Detailed data inventory
The exact fields present depend on your role and rental relationship. The table describes why each category may be required.
| Data | Purpose and necessity | Typical legal basis |
|---|---|---|
| Name, company name, role and account identifier | Identifies the contracting or authorized person, links the correct landlord or tenant to a tenancy, and prevents records from being assigned to another person. | Contract performance / pre-contractual steps |
| Home, billing and correspondence address | Required where the lease, invoicing, formal notices, handover records or statutory documentation must identify an address or be delivered to it. | Contract performance / pre-contractual steps |
| Email address and telephone number | Used for account authentication, security notifications, delivery of statements, tenancy communication, payment reminders and urgent property coordination. | Contract performance / pre-contractual steps |
| Bank account number, payment identifier and payment reference | Matches incoming payments to the correct tenant and tenancy, prevents misposting, supports refunds and proves settlement of obligations. | Legal obligation and legal claims |
| Lease terms, signatures, deposit, possession and return data | Defines, performs and proves the rental relationship, access period, rent, deposit, handover condition, rights and obligations, including later legal claims. | Legal obligation and legal claims |
| Invoices, costs, tax content, allocations, charges, income and payment history | Calculates tenant and owner balances, supports transparent cost allocation, accounting, taxation, payment reconciliation, statements and defence of financial claims. | Legal obligation and legal claims |
| Property address, identifiers, utility connection and meter identifiers/readings | Links invoices and consumption to the correct premises, calculates period-based charges, supports handover and prevents another property’s data being shown. | Contract performance / pre-contractual steps |
| Contracts, invoices, protocols, photographs, floor plans and uploaded attachments | Provides evidence for contractual performance, property condition, cost settlement, authorized use and disputes. Access is limited to the relevant relationship and period. | Legal obligation and legal claims |
| Messages, sender, date, subject and attachments | Enables documented communication about the tenancy, payments, maintenance and handover and preserves evidence where a dispute or service request arises. | Legitimate interest in secure and accountable operation |
| Login time, IP address, session, browser, authorization and audit events | Protects accounts and confidential documents, detects unauthorized access, investigates incidents, proves administrative actions and supports NIS2 security obligations. | Legitimate interest in secure and accountable operation |
| Privacy-notice version, acknowledgement time, IP address and browser | Proves which notice was provided and acknowledged and supports accountability. Optional consent, if introduced, is recorded separately from this acknowledgement. | Legitimate interest in secure and accountable operation |
| Invoice and filtered recognition result sent to recognition support | Diagnoses a user-reported recognition problem and improves future parsing. Sending is optional and requires separate consent each time; support copies are deleted within 90 days and are not used for model training. | Optional, withdrawable consent |
| Meter photo and filtered recognition result sent to recognition support | Diagnoses a user-reported meter-recognition problem and improves future recognition. Sending is optional and requires separate consent each time; support copies are deleted within 90 days and are not used for model training. | Optional, withdrawable consent |
| Privacy requests, identity checks, decisions, legal bases and execution history | Allows rights to be fulfilled securely, prevents disclosure to impostors, records deadlines and demonstrates why data was exported, corrected, restricted, retained or erased. | Legal obligation and legal claims |
Payment bank account
We process the landlord account number, bank name and optional BIC/SWIFT to communicate contractual payment instructions under the recorded contract reference. The relevant tenant sees the current account; the landlord and assigned manager also see its history. Assignments are erased 30 days after actual tenancy closure unless an active retention hold applies; unused accounts are also erased. Retained records remain personal data. Access, rectification, restriction and erasure may be requested through privacy requests. Backups expire under the existing schedule; disposal runs again after restoration.
Tax methods, land values, opening depreciation and correction history support requested tax planning (GDPR 6(1)(b)); Hungarian tax evidence is retained under sections 78 and 202 of the Hungarian Tax Procedure Act (6(1)(c)). Access: landlord and assigned manager. Basis needed for active ownership is retained; records are automatically erased six years after closure and the last relevant year, unless a retention hold applies. On erasure requests, planning-only records may be deleted; required tax evidence remains restricted personal data. Access, rectification, restriction and erasure are available through privacy requests. Backups expire on the existing schedule; disposal repeats after restoration.
Delete property permanently
Company administrators can permanently dispose of a property and its exclusively related records after a documented lawful-disposal review and verification of a recovery archive. Active retention holds and unexpired tax-record retention block disposal. Shared identities and registers, legally required audit and revision evidence remain restricted records, not anonymous data. Decision references, actor, scope and counts are audited; no file contents are copied into the disposal queue. Associated files are removed after the transaction with retries. Backups expire under the existing schedule; restored data must reapply disposal decisions before use. No external recipient is introduced.
Terms and Conditions
Terms acceptance records include the account identifier, company at acceptance, version, language, exact content digest, time and separate liability confirmation. Purpose: contractual evidence and legal claims; basis: GDPR Article 6(1)(f). No additional IP or browser data is collected. Records are included in the subject’s data copy and inaccessible to other companies. Post-termination retention requires an applicable claims period or legal hold; expired grounds require reviewed deletion. Relinkable evidence remains personal data.
Calendar subscriptions
Optional personal calendar export is provided at your request under GDPR Article 6(1)(b). It contains selected task deadlines, property names, status and, only if selected, outstanding amounts and currencies. Anyone possessing its secret URL can read it; your chosen external calendar provider may store copies and notification content. No bank account, attachment or full meter identifier is exported. We store your account/company scope, selected properties and task types, token hash, expiry, accepted notice and terms, and last successful download; event version metadata contains identifiers, dates and a keyed fingerprint, not descriptions. Revocation, account deactivation and credential changes stop new downloads. Expired/revoked subscription metadata is removed after 30 days unless an applicable hold requires restricted retention; erasure, objection and restriction requests follow controller review and immediately suppress downloads while pending. Existing audit and backup lifecycles apply. Downloaded copies must be removed through your chosen calendar provider; server revocation cannot erase them. Updates may be delayed.
Tester licenses
We store your account or company reference, service level, property and storage allowances, validity, revocation and assignment source to provide and administer testing access under the service relationship. No card or payment record is created. Expired or revoked license records are removed after 30 days unless a retention hold applies; existing audit and backup retention rules remain applicable. Your own license settings are included in account data exports and reviewed account erasure. A license does not change your role or property access.
Advanced mode
We save your basic or advanced view preference with your account to provide the requested interface (service relationship). It is included in your account export and reset when the account is erased. New accounts receive a registration-success email without passwords. The existing email queue, delivery logs, authorized access, rights restrictions and retention rules apply; the existing email provider handles delivery. There is no new external recipient. Temporary transaction pages are held only in browser memory until the page is closed.
Property loans and returns
Optional loan balances, rates, dates, expense classifications and repayments are stored for your requested financing and return analysis under GDPR Article 6(1)(b), basis version 2026.14. Access is limited to the authorized landlord and assigned managers; tenants receive none. No lender names, account numbers, external bank connection or credit documents are collected here. Calculations are transient. Records are removed 30 days after all management assignments for the property end, unless a retention hold applies; reviewed subject erasure removes the relevant landlord records. Your own records are included in rights exports. Audit and backups follow existing retention and restore reconciliation. These are service-planning records, not tax or accounting evidence.
Registration privacy information
Notice 2026.16. We collect name parts, email, optional company name, password hash, language, timezone and package preference to process your requested registration (GDPR Article 6(1)(b), steps before a service contract). Only appointed registration reviewers access pending applications. Names and application details are encrypted on the server; email remains searchable. Email verification expires after 24 hours; pending requests are erased after 30 days or upon reviewed deletion unless a documented hold applies. Approved requests are removed from intake and become ordinary service accounts. Minimal security evidence and encrypted backups follow the existing retention policy; expired or erased requests must be reconciled after restoration. Contact the controller shown in the full privacy notice for access, correction, restriction or deletion before account approval. No card information, external CAPTCHA provider or tenant self-registration is used. The timezone defaults to Europe/Amsterdam and can be changed after approval. The applicant type, company activity and acceptance time, language, document versions and hashes are encrypted with the application. Initial acceptance does not replace account-level acceptance. On approval, minimal initial acceptance evidence is retained in the protected admission audit; it follows the existing audit retention policy.
Private investment and equipment invoices
Invoices for property improvements and equipment may be archived for owner investment planning and warranty claims under the requested service (GDPR Article 6(1)(b), basis version 2026.17). Invoice purpose, amount, currency and activation date are recorded; files and selected text use the existing protected document storage. Only authorized owners and assigned management actors can access them; tenants receive no invoice, charge or notification from these categories. Recording a category does not establish tax deductibility. Records remain while any property management or ownership relationship is active or future, then service-only records and their files are erased after 30 days. Capital invoices supporting recorded annual depreciation follow the existing tax-evidence retention, including six years after closure and the last relevant use; active holds suspend disposal. Reviewed erasure removes solely attributable service-only archives; shared service records and required tax evidence remain restricted personal data under their applicable basis. Access, correction, restriction, objection and erasure requests are available through Privacy. Reviewed exports include scoped invoice metadata and financial planning data, excluding unrelated persons and invoice bodies. Backups expire under the existing schedule; disposal and later erasures are reconciled after restoration. No external processor or disclosure is added.
Grouped system comparison
To accelerate reports we retain private numerical/date snapshots with your actor, company and property references under the requested service, GDPR Article 6(1)(b), basis 2026.18. They contain no person/property names, invoice documents or notes. Unused snapshots are removed after 30 days unless a hold applies; source changes remove old ready snapshots immediately. Optional contribution is initially off and records only your property, company, requesting account and choice. Enabling permits coarse country/currency/area/unit comparisons, never individual amounts or identities. You can withdraw here; affected publications are withheld, and private membership maps expire with the monthly publication. Privacy supports access, correction, restriction, objection and reviewed erasure; own configuration/cache metadata are included in rights exports. Account erasure/deactivation removes its private snapshots and participation. Existing source, audit and encrypted-backup/restore retention rules continue to apply. No external recipient or processor is added.