Privacy Policy

myrent.mt(“MyRent”) is owned and operated by MyGroup Technologies, which is the data controller for the personal data described here. We are based in Malta and handle your data in line with the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Chapter 586). For any privacy enquiry or to exercise your rights, contact hello@myrent.mt.

We have not appointed a Data Protection Officer, as we do not meet the criteria for mandatory appointment under GDPR Article 37. The contact above is your point of contact for all privacy matters.

Account information

When you create an account, we collect:

• your name and email address;
• your password, which we store only as a secure hash (never in plain text);
• optionally, a phone number, profile photo, short bio, the languages you speak, and a public-facing email or phone you choose to display;
• for agents: your agency association and, where provided, your agent licence number used for our verification badges.

If you sign in with Google, we receive your name, email address and profile picture from Google to create or match your account.

Listing information

When you publish a property listing, we collect and process:

• property details (description, price, features, and locality);
• a map location (coordinates) if you place the property on the map;
• the photos you upload; and
• the contact details (name, phone number) you choose to display on the listing so people can reach you.

We may review and moderate listing content (including images) to enforce our platform rules and remove content that is inappropriate, unlawful, or harmful, under our legitimate interest in keeping the platform safe and compliant.

Technical information

When you sign in, we store the IP address and browser/user-agent associated with your session, to keep your account secure and to detect and prevent abuse. We also use cookieless analytics that records aggregated page views and performance data. See Cookies below.

We process personal data only for specific purposes and only where we have a lawful basis under GDPR Article 6. The map below sets out each activity and its basis.

No automated decision-making. We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

The contact details and listing information you choose to publish are visible to other people browsing the site; that’s the point of a listing. Beyond that, we share data only with the service providers that run parts of our platform. Each acts only on our instructions under a data-processing agreement (GDPR Article 28):

We may also disclose data to authorities where we are legally required to, or to protect users from harm or fraud.

We use essential cookies only: to keep you signed in, keep the site secure, and remember that you’ve dismissed a notice. We do not use tracking or advertising cookies. Our audience analytics (Vercel) is cookieless, and error monitoring (Sentry) does not set tracking cookies. Full details are in our Cookie Policy.

We keep personal data only as long as necessary for the purposes above or as required by law:

• Active account data: kept while your account is active. You can request deletion at any time.
• Deleted accounts: personal data is permanently deleted within 30 days of account deletion, unless a legal obligation requires us to keep it longer.
• Listings: kept while live; after removal, retained for a limited period (up to 24 months) for fraud-prevention and platform-integrity purposes, then deleted.
• Session data (IP, user agent): kept until the session expires.
• Error logs (Sentry): retained for a short period (around 90 days), then deleted.
• Newsletter subscription: kept until you unsubscribe.

Under the GDPR and Malta’s Data Protection Act, you have the right to:

• Access: get a copy of the personal data we hold about you;
• Rectification: correct inaccurate or incomplete data;
• Erasure: ask us to delete your data, subject to legal retention obligations;
• Restriction: ask us to limit processing in certain circumstances;
• Portability: receive your data in a structured, machine-readable format;
• Object: object to processing based on legitimate interests; and
• Withdraw consent: where processing is based on consent (e.g. the newsletter), at any time.

To exercise any of these, email hello@myrent.mt. We will respond within one month as required by GDPR Article 12 (extendable by two further months for complex requests, and we’ll tell you if so). Withdrawing consent doesn’t affect processing carried out before withdrawal. You can also complain to the IDPC at any time (see Who controls your data above) without contacting us first.

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), passwords stored as secure hashes, access controls limited on a need-to-know basis, and reputable, security-audited processors.

In the event of a personal data breach likely to risk your rights and freedoms, we will notify the IDPC within 72 hours (GDPR Article 33) and affected individuals without undue delay where required (Article 34). No system is perfectly secure, so we also rely on you to keep your login details private.

Some of our providers are based outside the European Economic Area (mainly in the US). Where personal data is transferred outside the EEA, we rely on appropriate safeguards:

• EU–US Data Privacy Framework: for certified US providers; and/or
• Standard Contractual Clauses (SCCs): as a supplementary safeguard with US-based providers.

You can request more detail on the safeguards for a specific provider by emailing hello@myrent.mt.

Publishing your listing, including contact details, photos and description, is the core service MyRent provides, carried out on the basis of contractual necessity (Article 6(1)(b)).

By posting a listing, you acknowledge that:

• you are responsible for managing communications from interested parties;
• we are not responsible for misuse of your contact information by third parties once it has been displayed publicly; and
• any third-party personal data you include (for example a joint landlord’s details) has been shared with their knowledge and agreement.

The platform is not intended for anyone under the age of 18, and we do not knowingly collect personal data from children. If you believe we have inadvertently done so, contact hello@myrent.mt and we will delete it promptly.

We may update this policy as the service evolves or the law changes. Where changes are material, we’ll flag them on the platform before they take effect. The “last updated” date above always reflects the current version.