Privacy Policy

General

Swaphouse respects your personal data and strives for confidential treatment. By using Swaphouse, you provide us with personal information. In this Privacy Policy, we explain how we collect, use, and protect your personal data. The basis for this is the General Data Protection Regulation (GDPR).

Legal Basis for Processing Personal Data

The personal data is processed on the following grounds:

• Legal obligation;
• Execution of the agreement;
• Obtained consent from the data subject(s);
• Legitimate interest.

Address Verification is processed on the basis of performance of the agreement with the user and the user's explicit consent, as participation in Address Verification is optional.

Identity Verification is optional and is processed on the basis of the user's explicit consent. This includes biometric data (facial measurements used to compare a selfie with an identity document), which is processed on the basis of explicit consent under Article 9(2)(a) GDPR. Users can withdraw their consent at any time by removing or cancelling their Identity Verification. Withdrawing consent does not affect processing that took place before.

A record of Identity Verification attempts is kept on the basis of legitimate interest, to enforce the limit on attempts and prevent abuse. A record of the consent given is kept to comply with our legal obligation to be able to demonstrate consent.

After an account is deleted, Swaphouse keeps a minimal record on the basis of legitimate interest: to keep reviews reliable, and to recognize members who return with a new account to avoid their review history, a suspension or other measures. You can object to this. Because other members rely on reviews being complete, an objection will in principle not lead to reviews being unlinked while you use Swaphouse: you can use Swaphouse with your review history, or delete your account. We answer every objection in writing.

Recipients and Data Managers

The personal data is processed by: Swaphouse B.V., a company registered in the Netherlands under number 91817056, at Kornetstraat 22, 2023GN Haarlem

• Email: support@swaphouse.io
• Website: https://swaphouse.io

Third-party service providers

Swaphouse uses carefully selected third-party service providers to support its services, including hosting, analytics, communication tools, Address Verification and Identity Verification. These service providers process personal data solely on Swaphouse's instructions and under appropriate data processing agreements. Personal data is not sold to third parties.

Identity Verification is carried out by Didit Identity Spain, S.L. (CIF B22929327, Calle Nápoles 227, P. 1, 08013 Barcelona, Spain), which acts as a data processor on behalf of Swaphouse under a data processing agreement.

Data Protection Officer (DPO)

For further explanations or questions about the Privacy Policy, you can turn to the DPO, Tobias Sweijen, tobias@swaphouse.io.

Scope

The privacy statement applies to all users of the website and the services of Swaphouse. This privacy policy does not apply to third-party websites that are linked to the Swaphouse website. Swaphouse is not responsible or liable for the way these websites handle your data.

Processed Data

Swaphouse processes the following personal data for the purpose of providing services or data provided by the individual on their own initiative:

• First name and last name;
• LinkedIn member ID, used when you sign in with LinkedIn;
• Profile photo;
• Contact details: address (including verified address, if applicable), phone number, email address;
• IP address;
• Location of accommodation/housing;
• Amenities, what your place has to offer;
• Photos;
• Videos;
• Chat messages via the website;
• Reviews written by you and about you;
• Verified legal name, as entered by the user (if you complete Identity Verification);
• Identity Verification status, result, date and a reference to the check;
• Identity Verification attempt history (number of attempts, and the date and outcome of each);
• A record of the consent given for Identity Verification (date, time and version of the consent text).

Address Verification data

When a user chooses to participate in Address Verification, Swaphouse processes the submitted address for the purpose of sending a physical verification letter containing a unique code and confirming receipt of mail at that address.

Address Verification is carried out with the assistance of a third-party service provider that prints and sends the verification letter globally. This provider temporarily processes the address solely for the purpose of fulfilling the verification request and acts as a data processor on behalf of Swaphouse.

Verified addresses are stored securely by Swaphouse and are not publicly displayed on the Platform. Other users cannot see a verified address, unless the user chooses to share it. Users can share their verified address with the other user involved in a planned home swap through the Platform's interface.

Identity Verification data

When a user chooses to participate in Identity Verification, the user first enters their legal name on the Platform. Didit then processes the following on behalf of Swaphouse: the user's legal name and email address, an image of their identity document and the information shown on it, a selfie (which may include a short video to check that a live person is present), facial measurements (biometric data) to compare the selfie with the photo on the document, and device and connection information to detect possible fraud. Some checks may be reviewed by a person at Didit.

Swaphouse only stores the legal name the user entered, the status and result of the check (including whether the name matches the document), the date of the check and a reference to it. Swaphouse does not receive or store identity documents, selfies, biometric data or any other information from the document, and Swaphouse team members cannot view them. To handle a support request, they can see which checks passed or failed and the reason Didit gives.

Other users only see the user's public name and Identity Verified badge. The verified legal name is never shown publicly. To help prevent impersonation, Swaphouse may compare a verified user's public name with their verified legal name.

Didit does not use verification data from Swaphouse users to build, test or improve its AI models. Didit may process pseudonymised data as an independent controller to prevent fraud and keep its service secure, as described in Didit's Verification Privacy Notice.

Didit processes verification data within the European Economic Area. If data is transferred outside the EEA, appropriate safeguards are in place as required by law, such as the European Commission's Standard Contractual Clauses.

The result of the check is determined by Didit's automated systems. Users who disagree with a result can contact support@swaphouse.io. We will explain the reason for the result and, where possible, offer a new check.

Purpose of Processing

Swaphouse processes personal data for the following purposes:

• Browsing on the website;
• Communication with users and between users;
• For marketing, newsletters, social media;
• Service emails;
• Data security;
• Maintaining and improving the quality of services and security;
• Research and development;
• Statistics;
• Identity Verification: confirming a user's identity, showing the Identity Verified badge, and helping prevent fraud and impersonation;
• Keeping reviews reliable, and preventing members from avoiding their review history, a suspension or other measures by creating a new account;
• Compliance with legal and statutory obligations;
• In case of disputes.

Certain personal data, such as profile information and general home details, may be visible to other users of the Platform. Sensitive personal data, including full home addresses, is not publicly displayed and is only shared when a user explicitly chooses to do so in the context of a planned home swap.

Marketing communications, such as newsletters, are only sent to users who have explicitly opted in and may be withdrawn at any time.

Your data is not sold to third parties. Data is only shared with third-party service providers where necessary to operate the Platform, including analytics services such as Google Analytics.

Statistics and Cookies

Swaphouse collects usage data of the website for statistical purposes and to improve the service. The collected personal data is generally anonymous and is not sold or provided to third parties.

Swaphouse uses Google Analytics with IP anonymisation enabled to collect usage data for statistical purposes and to improve the service. Where required, cookie consent mechanisms are used in accordance with applicable data protection laws.

To enhance the usability of the website, Swaphouse uses cookies. A cookie is a text file that is placed on your computer, tablet, or smartphone during your visit to our website. You can refuse cookies at any time. However, this may limit the functionality or ease of use of the website.

Security

Swaphouse places great value on security and protection of your personal data and provides appropriate technical and organizational measures to ensure a security level commensurate with the risk.

Data Breaches

Swaphouse strives to prevent data breaches. If a data breach occurs, Swaphouse will notify users and the Dutch Data Protection Authority as soon as possible after becoming aware of the data breach.

Rights of Data Subjects

You can send a request to support@swaphouse.io for access, correction, restriction, objection, data portability, deletion of your personal data, or withdrawal of previously given consent to Swaphouse. Only requests concerning your own personal data will be processed. You will receive a response from us within four weeks of receiving your request.

At any time, you can delete your account via the platform. This deletes your profile, home listings and account information, except the limited data described under Storing and Deleting Data. You can also remove or cancel your Identity Verification at any time via your profile.

Storing and Deleting Data

Swaphouse does not store personal data longer than necessary for the purposes for which it is processed, unless a longer retention period is required by law.

Verified address data is deleted immediately when a user removes Address Verification or deletes their account, unless retention is required to comply with legal obligations or prevent fraud or abuse.

Didit deletes identity document images, selfies, videos and facial measurements one month after the check, and does not keep biometric templates after a check is deleted.

Swaphouse keeps the verified legal name, status, date and check reference for as long as the user keeps their Identity Verified badge. When a user removes or cancels their Identity Verification, or deletes their account, Swaphouse deletes these details and instructs Didit to permanently erase any verification data it still holds. If a check is not approved, Swaphouse keeps these details for one month to handle support requests, unless the user cancels the verification earlier.

Swaphouse keeps a record of verification attempts linked to the user's account (the number of attempts, and the date and outcome of each), also after a verification is cancelled. This record contains no identity document, selfie or legal name, and is deleted when an approved verification is removed or the account is deleted. The record of consent is kept for as long as the account exists.

From 2026-12-30, when a user deletes their account, or Swaphouse closes it, Swaphouse keeps a minimal record for five years: the user's name, the city of their listing, an encoded form of their LinkedIn member ID, and the link to reviews that other members wrote about them. This record is only used to keep reviews reliable and to recognize a returning member, and is not shown to other members. If the same member returns within this period, their earlier reviews, positive and negative, may be linked to their new account and the member is informed. After five years the record is deleted automatically.

Swaphouse keeps a log of the emails it sends to users (the date, type of email, email address and delivery status) for one year, to handle support questions. Records of important notices, such as changes to the Terms & Conditions or this Privacy Policy, are kept for five years, also after an account is deleted, so Swaphouse can show that a user was informed.

Deleted data may remain in our backups for up to 9 days until they are automatically overwritten. Backups are only used to restore the Platform after a failure.

Adjusting Privacy Statement

Swaphouse may change the privacy statement at any time to comply with laws and regulations and in case of changes in our practice. Of course, we will inform you of the adjustments.

Changelog

Last updated: 2026-10-31