Privacy statement
Last updated: 11-07-2026. HuurSpoed handles your personal data carefully and keeps data collection to a minimum. This statement explains which data we process, why, on what legal basis, how long we keep it and which rights you have.
Data controller
The HuurSpoed service is provided by:
- Company
- MorphiToys
- Chamber of Commerce (KvK) number
- 97076686
- VAT number
- NL867901500B01
- Address
- Zuidlarenstraat 57, 2545 VP Den Haag
- info@morphitoys.com
- Phone
- +31 85 060 1337
For everything described in this statement, the company named above is the data controller within the meaning of the General Data Protection Regulation (GDPR). Any questions about your data? Please contact us using the details above.
Which data we process, why and on what basis
| Data | Form | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Email address | plain | creating your account and sending notifications | performance of the contract | until you delete your account |
| Password | irreversible hash (bcrypt) | letting you log in securely | performance of the contract | until your account is deleted |
| Search profile (e.g. city, price, rooms, optional income) | plain | filtering public listings and notifying you | performance of the contract | until you delete the profile or your account |
| Normalised email address | irreversible hash | keeping the free trial fair (one trial per person) | legitimate interest (fraud/abuse prevention) | retained after account deletion, not traceable to you |
| IP address | irreversible hash | preventing abuse and brute-force attacks | legitimate interest (security) | up to 30 days for login attempts |
| Audit / security logs | action + IP hash | security and incident investigation | legitimate interest (security) | up to 180 days |
We do not store raw IP addresses and we do not process payment details ourselves; those stay with our payment provider. We never sell your data and we use no third-party tracking or advertising cookies.
Purposes and legal basis
We use your data only for the purposes for which you provided it:
- Performance of the contract — managing your account, matching your search profile against public listings and sending you notifications. Without this data we cannot deliver the service.
- Legitimate interest — keeping the free trial fair, preventing abuse and fraud and securing our service. We limit this processing to what is strictly necessary and, wherever possible, use irreversible hashes instead of traceable data.
Cookies
We only place a functional session cookie to keep you logged in and to protect forms (CSRF protection). We use no analytics cookies and no third-party tracking or advertising cookies. That is why we do not need a cookie wall.
Processors and recipients
We engage carefully selected parties that process data on our behalf. We conclude a data processing agreement with every processor:
- TransIP — hosting the service and sending email notifications.
- Mollie — handling payments once paid subscriptions go live. Your payment details are processed directly by the payment provider; we do not receive them.
We do not share your data with any other third parties unless we are legally required to. We store your data within the European Economic Area (EEA).
Your rights (GDPR)
- Access & export — you can view and download your data from your dashboard under Settings.
- Rectification — you update your search profile and account details yourself under Settings.
- Erasure — you delete your account yourself under Settings. Your personal data is then erased; the irreversible email hash is kept for fraud prevention and is not traceable to you.
- Objection & restriction — you can object to processing based on legitimate interest and ask us to restrict processing.
You can exercise most rights directly yourself in your dashboard under Settings. Stuck? Email us using the contact details above.
Filing a complaint
If you disagree with how we handle your data, we would like to hear from you first. You also always have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens / Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
Security
We store passwords only as a hash, all connections run over HTTPS and we apply a strict security policy (including a Content Security Policy). We store IP addresses only as an irreversible hash. security.txt.
Changes
We may update this privacy statement from time to time, for example when we add features or when regulations change. The current version is always available on this page, with the date of the latest change shown at the top.