Privacy policy.
IKRI (hereinafter referred to as, "We", "Us", "Our") is committed to the protection of personal information and has established a set of controls for ensuring that your information remains safe and according to the provisions of the law.
Policy Statement
IKRI (hereinafter referred to as, "We", "Us", "Our") is committed to the protection of personal information and has established a set of controls for ensuring that your information remains safe and according to the provisions of the law.
Contact Details
| Type | Name | Contact Details |
|---|---|---|
| Controller | IKRI | dpo@ikri.net |
| Processor | IKRI | dpo@ikri.net |
| Data Protection Officer | N/A | dpo@ikri.net |
What Information is being processed, for which purpose and for how long?
We collect the following information types:
3. Information you provide to us: we collect and store any information you enter for the purpose of the services provided. Those include, but not limited to:
A. Email Address / Account Creation Date - Up to 5 years
B. Review Answers / Property Reviews - Indefinitely (non Personally Identifiable Information)
Passport Viewer Tracking
When you create a Tenant Passport on our platform, we record viewing activity so we can show you an aggregate count of how many people have viewed your passport. This feature is designed to give you visibility into interest in your rental profile without revealing individual viewer identities.
Information We Collect
When someone views your passport, we record:
- A record that a view occurred (linked to the viewer's account when they are signed in)
- The date and time of the view
How We Display This Information
Passport viewing activity is displayed in your dashboard as an aggregate count (for example, how many unique people viewed your passport in the last 30 days). Individual viewer names, photos, and agency details are not shown to you and are not returned in dashboard API responses. This aggregate information is visible only to you as the passport owner and is not shared with other users or third parties.
Real-Time Presence Indicators
When agents are actively viewing your passport, we may display a real-time presence indicator (e.g., "2 agents currently viewing"). This feature uses temporary session data that is automatically deleted after 1 hour of inactivity. Real-time presence data does not include individual agent identities and is used solely for aggregate counts.
Agent Privacy
Agents are entitled to privacy protections regarding their viewing behavior. We do not show passport owners who viewed their profile, detailed browsing patterns, time spent on page, or other granular behavioral data. Dashboard insights are limited to aggregate view counts.
Data Retention
Passport viewing records are retained for 90 days, after which they are automatically deleted from our systems. Real-time presence data is retained for a maximum of 1 hour. This limited retention ensures we comply with data minimization principles while still providing useful insights into engagement.
Your Control
You can control the visibility of your passport through privacy settings. If you set your passport to "Private" mode, only agents you specifically whitelist can view it. In this case, viewing activity is still tracked for aggregate counts, but the pool of potential viewers is limited to those you've explicitly granted access to.
Access to Email Data
To provide our tenancy verification services, we request permission to access emails in your connected email account. Connecting your email account for verification purposes is entirely optional. You will only be asked to grant email access if you choose to use the email-based verification method, and you must explicitly authorise this connection at each step of the process. If you prefer not to connect your email account, we offer an alternative Live Call verification method that does not require access to your emails. You may use this method instead at any point in the verification process.
This access is strictly limited to identifying and reading emails originating from the Malta Rent Registration Board. We identify relevant emails by their subject line and verify their authenticity by inspecting email metadata to confirm they were sent from the Rent Registration Board's official servers. We do not read, access, scan, or store any other emails in your account.
How We Use Email Data
Information extracted from Rent Registration Board emails is used solely to verify tenancy-related claims on our platform, specifically:
- to confirm that a tenant has resided at a declared property;
- to confirm that a landlord owns or has owned a declared property;
- to verify a landlord's claim that a tenant has resided at their property.
We do not use email data for advertising, profiling, or any purpose unrelated to tenancy verification.
Data Minimisation and Security
We extract only the rental agreement information necessary for verification purposes. Any sensitive personal information derived from these emails is immediately processed using a proprietary hashing algorithm and is never stored in a readable or reversible form. The raw content of your emails is never stored on our systems at any point.
Google user data is processed exclusively by automated systems and is never accessible to any human, including administrators and engineers. Administrators are limited to querying whether a verified match exists for a specific rental agreement, as described under Administrative Access above.
All data transmitted between your email provider and our platform is encrypted in transit using TLS. We have appropriate technical and organisational security measures in place to protect any Google user data we access against unauthorised access, disclosure, alteration, or destruction.
Administrative Access
Access to verification data is strictly controlled. Even platform administrators are not permitted unrestricted access to this information. Administrators may only query whether a verified match exists for a specific rental agreement - either on the tenant or the landlord side - and cannot retrieve or view the underlying personal data.
Third-Party Email Providers
Where you connect a third-party email account (such as Gmail) to our platform, we access your emails solely through the provider's official authorisation mechanisms (such as OAuth 2.0). We only request the minimum permissions necessary to locate and read relevant Rent Registration Board emails. We do not store your email credentials.
Automated Decision Making
We have not established mechanisms for automated decision making through the processing of your data, and all reviews submitted are manually vetted. However, should we introduce such functionality, we will inform the user on how the data collected will be processed.
Disclosure to 3rd parties
We may disclose information to third parties (partners). Those are the following:
- Aggregated information, which does not include any personal identifiable information
- Any lawful order we may receive from the respective authorities or Court of Laws.
We make use of a third-party software vendor to verify the identity of our users when submitting a review and/or creating an account, and as such, the user is bound by the terms and conditions of the software vendor, and the user acknowledges that the software vendor may collect and store personally identifiable information. It is to be noted that We do not have access to such data, and such data can not be retrieved by us.
Data Transfers
The Data that you provide us with is hosted and stored within the European Union, with our service provider being located in Germany, and the data being stored as per GDPR requirements
You can request a copy of this data anytime – please refer to the requests section.
Security Controls
Only We will have access to the information and data you provide us with. We will not share any personally identifiable information to third-parties, without your written consent. We may however be compelled to share information and/or data if We are presented with a lawful request.
Rights and Requests
You have the right request controlling your personal data in multiple ways, subject to other laws of the jurisdiction. Those include:
A. Obtaining a copy of your personal data
B. Having inaccuracies corrected
C. Being forgotten through erasing your data
D. Objecting to direct marketing
E. Restricting processing
F. Being portable
G. Withdrawing your consent
H. Objecting
I. Lodging a complaint with the Data Supervisory Authority
For exercising your rights please use the contact details at the beginning of this policy for submitting a request and we will make sure that we reply in due time.
Further processing
In case we conduct further processing to your personal data, we will make sure that we will inform you prior to that processing and provide all the necessary details and reasons.
Links to Other Sites
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that We do not have any control over that other website. Therefore, We cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.