Vastly Privacy Statement
1. Who we are
Vastly is property management software, offered by PDL Powerhouse B.V., established in Arnhem at Turfstraat 1-3, 6811 HL, Dutch Chamber of Commerce (KvK) no. 42063059 (“we”). Contact: info@vastly.software.
2. Two roles: controller and processor
- For data of our own customers (landlords/property managers with a Vastly account: account details, billing, use of the app) we are the controller.
- For data our customers enter into Vastly about their tenants, contracts and properties we are the processor; the customer (landlord) is the controller. We conclude a data processing agreement with every customer.
3. What data we process
From customers (landlords/property managers): name, e-mail address, phone number, business details (Chamber of Commerce number, VAT number, IBAN), login credentials, linked service accounts (see section 7), usage and billing data.
On behalf of customers (tenant administration): tenants’ name and address details, e-mail and phone, date of birth (private tenants, for contracts), contract and invoice data, payment status, communication (invoices and reminders sent), documents in the contract file (rental agreements, handover documents, identification for electronic signing via our e-sign partner).
From public sources: building data via the BAG (Dutch Cadastre), energy labels via EP-Online (RVO), business data via the Dutch Business Register (KvK) and index figures from Statistics Netherlands (CBS). These are property, business and statistical data, in principle not personal data.
Free rent check on vastly.software. The rent check calculates, without an account, the points, rent segment and maximum rent of a home under the Dutch housing valuation system. What you enter (address, rooms, facilities, WOZ value) is neither stored nor logged: the calculation runs on our server and the result goes straight back to your browser. Based on the address we retrieve the dwelling type, year of construction, floor area and energy label from the public registers BAG (Kadaster) and EP-online (RVO); for that purpose the address is kept in server memory for at most 24 hours, hashed to a non-reversible key, and is not shared with third parties. To prevent abuse we count the number of calculations per day, using a daily-changing, non-reversible derivative of your IP address and a small file in your browser (cookie and local storage, 30 days) holding your remaining free checks. If you request the result as a PDF by e-mail, we store only your e-mail address, the text and version of your consent, the time, the derivative of your IP address and the result (points, segment, maximum rent); not the address and not your input. Legal basis: your consent. We use the e-mail address to send the PDF and, if you consented, to inform you once about Vastly for landlords. You can withdraw consent and request deletion via info@vastly.software; we keep these data for at most twelve months. The PDF is sent via Amazon SES (European region), our e-mail processor.
Credits for the rent check. If you want to run more calculations than the free checks, you buy credits. The credits are tied to your e-mail address, without a password. For that purpose we store your e-mail address, your balance in checks and your purchases (bundle, amount, VAT, invoice number and the Mollie payment reference; for business buyers optionally the Chamber of Commerce and VAT numbers), the text and time of your consent to the terms and to immediate delivery (whereby the right of withdrawal lapses for the part used), and the daily-changing, non-reversible derivative of your IP address. On your own device you stay logged in with a key in your browser that we store only in hashed form, for at most one year; on another device you log in with a one-time login link by e-mail that is valid for 30 minutes and that we likewise store only in hashed form. What you enter in the check and the results are not stored, with credits either. For each purchase we store the expiry date: credits are valid for two years from purchase; thirty days before that date you receive one reminder by e-mail, after which the unused part of that purchase lapses. Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legal obligation (invoice, Article 6(1)(c)). Payment (iDEAL) runs through Mollie, our payment service provider; confirmation, invoice and login link are sent via Amazon SES. We keep your account and balance until your deletion request via info@vastly.software; the invoice data of your purchases are kept for 7 years (statutory tax retention).
Professional for the rent check. If, as a professional user, you choose Professional (unlimited checks, twelve months per payment), we additionally store with your credit account the expiry date and the first payment date of Professional, whether you wish to receive reminders for a new year, and the office details you enter yourself for the header of the points PDF: office name, address and logo (the logo as a file in our document storage). These details only appear on the PDFs you have generated and you can change or remove them yourself at any time on your Professional page; if you remove the logo, we also delete the file. Thirty and seven days before the expiry date you receive one reminder by e-mail with a payment link; you switch those off yourself with “Do not renew”. Legal basis: performance of the contract (Article 6(1)(b) GDPR). Retention: as long as your account exists (until your deletion request via info@vastly.software); the invoice details for 7 years.
4. Why (purposes and legal bases)
Performance of the contract (providing the software, art. 6(1)(b) GDPR); legal obligations (statutory tax retention of invoices, art. 6(1)(c)); legitimate interest (security, abuse prevention, product improvement on aggregated data, art. 6(1)(f)).
We do not sell personal data and do not use customer or tenant data for advertising.
5. Sub-processors and recipients
We use a limited number of sub-processors, with whom data processing arrangements have been concluded (as at 24 September 2026):
- Google Cloud — hosting of the application and the database and storage of documents, all in region europe-west4 (Netherlands); processing within the EU.
- Amazon Web Services (Amazon SES) — sending of e-mail from Vastly, region eu-west-1 (Ireland): Vastly’s own system messages (such as invitations, login codes and service notifications), the PDF of the free rent check and, only where the landlord opts for it, messages to tenants on behalf of the landlord. Landlords with a linked mailbox of their own send invoices and reminders from that mailbox (see section 7).
- Google Workspace — solely our own mailbox info@vastly.software, for receiving and answering contact and demo requests; not a sending channel of the application.
- Online Payment Platform (OPP) — payment service provider for rent payments per invoice (iDEAL) to the landlord. OPP is a licensed payment institution and itself performs the statutory customer identification (KYC) of the landlord; for that OPP is an independent controller.
- Mollie — payment service provider for payment links to tenants through the landlord’s own payment account (payments run directly through that account) and, since 17 September 2026, for Vastly’s own sales (credits for the rent check, iDEAL).
- Expo (United States) — delivery of push notifications of the Vastly app and roll-out of app updates; processes the device’s push token, the title and short text of the notification and the app version, never the contents of the file. Transfer under the EU-US Data Privacy Framework and standard contractual clauses.
- Web3Forms — technical delivery of demo requests via the website (form relay); we ourselves store no more than name, e-mail address and portfolio size.
- Cloudflare — hosting of the website vastly.software (Cloudflare Pages). The website uses Cloudflare Web Analytics: cookieless and without tracking of individual visitors.
- Yousign (EU; contracting party Youtrust) — electronic signing of tenancy agreements (advanced electronic signature for tenants) and of other documents.
- Company.info — querying of the Dutch Commercial Register at registration and when checking signing authority: processes the company name or Chamber of Commerce number entered by the landlord and returns the public register data (registration, officers); no tenant data.
In addition, we consult the public sources listed in section 3 (BAG, EP-Online, Business Register, CBS index figures); no tenant data is shared in doing so.
AI feature reading out notarial documents: notarial deeds and statements that a landlord uploads to Vastly are read by AI provider Anthropic (Claude API) to propose amounts and dates; the landlord always checks and confirms those proposals themselves. The processing falls under the data processing agreement between the landlord and Vastly and under processing arrangements with Anthropic; the documents are not used to train AI models and are not retained by Anthropic after processing. A landlord can have this feature switched off via Vastly. Since September 2026 the same applies to floor plans a landlord uploads for a dwelling: the AI reads out rooms and floor areas as a proposal for the points assessment, the landlord ticks per room what is adopted and Vastly calculates the points itself, without AI.
An up-to-date list of sub-processors is available via info@vastly.software. We do not transfer personal data outside the EEA, except for push delivery via Expo (see above) and subject to the safeguards around the services referred to in section 7.
6. Retention periods
We retain invoice and administration data for 7 years (statutory tax retention obligation). We retain contract files for the duration of the rental relationship plus the statutory limitation periods.
Personal data that is no longer needed is deleted or anonymised. Where the tax retention obligation does not yet allow this, we detach directly identifying data (such as name and e-mail address) from the administration so that it can no longer be traced to a person; after the 7-year period, that administration data is also deleted or anonymised. Customers can have their account closed (including in the app); closure leads to the same detachment — earlier full deletion is not possible for data subject to the tax retention obligation.
7. Linked Google/Microsoft accounts (mail sending): Limited Use
A landlord can link their own mailbox (Google Gmail or Microsoft 365) to Vastly to send invoices and payment reminders from their own e-mail address.
- Vastly requests only the send e-mail permission (gmail.send) and the e-mail address of the linked account (identification). Vastly does not read e-mail and has no access to the inbox, contacts or other account data.
- Access tokens are stored encrypted and used exclusively to carry out sending actions initiated or configured by the user. The link can be disconnected in the app at any time; access can also be revoked via the Google/Microsoft account settings.
- The use of information received via Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements: data obtained via Google APIs is used only to provide the functionality described above, is not sold, is not used for advertising and is not read by humans, except for the exceptions listed in that policy (security, legal obligation, explicit consent).
8. Security
All connections with Vastly are encrypted (TLS). Signing in is done with a passkey (passwordless sign-in, for example with fingerprint or face recognition) or with a password plus two-step verification; we support passkeys and recommend them. Sessions expire automatically. Every user sees only the data of their own organisation, changes are recorded in an audit trail, and keys and link tokens are stored encrypted. All data is hosted within the EU and backups are made automatically.
9. Rights of data subjects
Data subjects (customers and tenants) have the right of access, rectification (correction), erasure, restriction, data portability and objection. A request can be made by e-mail to info@vastly.software; we respond within the statutory period of one month. Tenants can also contact their landlord directly (the controller); we support landlords with those requests. Complaints can be filed with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
For customers we make the right to data portability concrete with a complete export of contracts, invoices and core data (zip file): available for self-download at any time via My data in the app (per landlord entity, at most one export per day), or on request via info@vastly.software. During the read-only period after cancellation this export continues to work.
10. Changes
We may amend this statement; the current version is available at vastly.software. We will actively inform customers of material changes.