Privacy Policy

SpotShelf B.V. (KvK: 92907040, VAT: NL004986424B83), established in the Netherlands, is the data controller for the processing of personal data as described in this policy.

Contact: privacy@spotshelf.com

Upon registration: name, email address, role (tenant or store owner), encrypted password.

During use: store data, spot and booking data, Stripe account (payments are processed by Stripe — we do not store payment card data), messages, reviews.

For DAC7 reporting: name, address, and tax identification number (BSN/VAT number) of landlords, as well as the amount of rental income received per period. This is a statutory obligation under EU Directive 2021/514 (DAC7) — see Article 5 below.

Automatically: IP address, browser information (session logs), anonymised usage data for platform improvement.

• • Provision of the service: facilitating bookings, payments, and communication.
• • Identity verification and fraud prevention.
• • Customer service and dispute resolution.
• • Statutory obligations: tax returns, DAC7 reporting to the Dutch Tax Authority.
• • Platform improvement via anonymised statistics.
• • Marketing communications, only with your explicit consent (opt-in).

• Performance of a contract (Art. 6(1)(b) GDPR): for providing our platform service.
• Legal obligation (Art. 6(1)(c) GDPR): for financial administration, VAT returns, and DAC7 reporting.
• Legitimate interest (Art. 6(1)(f) GDPR): for security, fraud prevention, and platform improvement.
• Consent (Art. 6(1)(a) GDPR): for marketing communications by email. You can withdraw consent at any time.

The report includes: name, address, date of birth (or legal entity number), tax identification number, IBAN, and the total amount of rental income received per calendar year. The Dutch Tax Authority then automatically shares this information with tax authorities in other EU member states where the landlord is fiscally resident.

Source: Dutch Tax Authority — DAC7 for platforms

• Account data: for as long as the account is active; on deletion we anonymise your personal data immediately. Anonymised financial records are kept for 7 years (statutory retention).
• Payment and booking history: 7 years (statutory retention obligation, Art. 52 AWR).
• DAC7 reporting data: minimum 5 years after the reporting year (statutory obligation).
• Messages: 2 years after the end of the relevant booking.
• Session logs: maximum 90 days, thereafter anonymised.

• Stripe Payments Europe, Ltd.: for payment processing. Stripe has its own privacy policy and is PCI DSS Level 1 certified.
• Supabase, Inc.: for database hosting on EU servers (Frankfurt). Data processing agreement in place.
• Resend, Inc.: for transactional emails (booking confirmations, KvK invitations, invoices). No marketing emails. Data processing agreement in place.
• PostHog, Inc. (EU-hosted): for product analytics, on EU servers (Frankfurt). Only activated after explicit consent via the cookie banner. No advertising tracking.
• Other users: name and booking information are visible to the other party in a booking.
• Dutch Tax Authority & other EU tax authorities: annual DAC7 reporting for landlords (statutory obligation).
• Government bodies: if required by law or by court order.

We never sell personal data to third parties.

Under the GDPR, you have the following rights. Send your request to privacy@spotshelf.com. We respond within 30 days. privacy@spotshelf.com.

• Access (Art. 15): request to see which data we process about you.
• Rectification (Art. 16): have incorrect or incomplete data corrected.
• Erasure (Art. 17): have your account and data deleted, unless a statutory retention obligation applies.
• Restriction (Art. 18): have processing restricted in certain situations.
• Data portability (Art. 20): receive your data in a machine-readable format.
• Objection (Art. 21): object to processing based on legitimate interest.
• Withdrawal of consent: withdraw consent for marketing communications at any time.

You also have the right to lodge a complaint with the Dutch Data Protection Authority. Dutch Data Protection Authority.

• • Encrypted connections (HTTPS/TLS) for all data transmission.
• • Encrypted password storage via Supabase Auth (bcrypt).
• • Row-Level Security at database level: users only see their own data.
• • Restricted access to production data for staff (need-to-know).
• • Regular security reviews and penetration tests.
• • Data breaches are reported to the Dutch Data Protection Authority within 72 hours in accordance with Art. 33 GDPR.

We use only functional cookies that are necessary for the platform to function (session cookies for authentication, preferences). No tracking or marketing cookies are placed without your explicit consent.

For analytical purposes we use anonymised statistics that contain no identifiable personal data.

We may update this privacy policy from time to time. Registered users will receive an email notification for material changes. The most recent version is always available on this page.

For questions about privacy or exercising your rights: privacy@spotshelf.com. privacy@spotshelf.com.

Lodge a complaint with the supervisory authority: autoriteitpersoonsgegevens.nl autoriteitpersoonsgegevens.nl