Privacy Policy
Last updated: 26 August 2026
This Privacy Policy describes how MR facility services, s.r.o. processes personal data in connection with the operation of SmartRent — software for managing long-term residential rentals, available at smartrent.sk and smartrent-sigma.vercel.app (the “Application” or “SmartRent”).
Processing of personal data is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and Slovak Act No. 18/2018 Coll. on the protection of personal data, as amended.
1. Controller
MR facility services, s.r.o., registered office Zámocká 236/49, 019 01 Ilava, Slovakia, Company ID (IČO): 54679001, registered in the Commercial Register of the District Court Trenčín, Section Sro, [insert no. •] (“we” or the “Provider”).
- E-mail: martin.stacho@gmail.com
- Phone: [+421 •]
2. SmartRent's two roles in data processing
When operating the Application, we act in two distinct roles under the GDPR:
- Controller (Art. 4(7) GDPR) — with respect to the data of the Application's customers (landlords): account registration and management, billing and payments, communication and support, marketing and web analytics (Google Analytics 4).
- Processor (Art. 4(8) and Art. 28 GDPR) — with respect to the data of tenants and other persons entered into the Application by our customers (landlords). The controller of such data is the respective customer; we process it solely on the customer's documented instructions under a data processing agreement (Annex 1 of the Terms of Service at /terms).
3. Data we process as controller
| Purpose | Data categories | Legal basis | Retention |
|---|---|---|---|
| Registration and management of the customer account | Name, e-mail, login credentials, organisation name and billing details | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the account, then until statutory periods expire |
| Invoicing and accounting | Billing details, payment history, invoices | Legal obligation (Art. 6(1)(c) GDPR; Accounting Act) | 10 years |
| Customer support and communication | E-mail, content of communication | Performance of a contract, legitimate interest (Art. 6(1)(b) and (f) GDPR) | For the duration of the account |
| Web analytics (Google Analytics 4) | Pseudonymised identifiers, website usage data | Consent (Art. 6(1)(a) GDPR) | Max. 2 years (cookies), 14 months (GA4 data) |
| Tenant account in the tenant portal (sign-in, sessions, portal notifications, support) | E-mail, sign-in records, technical cookies, notification content | Performance of a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR) | For the duration of the tenancy / account |
| Transactional e-mails (Application notifications) | E-mail, notification content | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the account |
4. Tenant data — processing in the role of processor
For the operation of the tenant's access to the tenant portal itself (sign-in, session management, technical security and portal notifications) we determine the purposes and means of processing ourselves — in this layer we act as controller (see the 'Tenant account in the tenant portal' row in section 3). For the content of the tenancy relationship (data entered by the landlord) we remain the landlord's processor.
Customers (landlords) may enter their tenants' personal data into the Application, in particular: name and surname, address, contact details, Slovak personal identification number (rodné číslo), ID card number, rent and utility payment data, and photographs related to the property or handover protocols.
The personal identification number and the ID card number are encrypted in the database using AES-256-GCM and are not accessible to other customers or third parties.
Processing of the personal identification number: the personal identification number is a general-purpose identifier under Section 78(4) of Act No. 18/2018 Coll. and Art. 87 GDPR. Its processing in the Application is necessary for the unambiguous identification of a contracting party to a lease agreement for legal purposes (conclusion, performance and possible enforcement of claims under the lease) — without unambiguous identification of the tenant, these purposes cannot be achieved with the same reliability. The respective landlord, as controller, is responsible for the lawfulness of using the personal identification number vis-à-vis the tenant; SmartRent provides appropriate technical safeguards (encryption, access control, audit log).
If you are a tenant and wish to exercise your data-subject rights, please contact your landlord (the controller of your data) in the first instance. We will provide the landlord with all necessary assistance.
5. Sub-processors
We use the following sub-processors to operate the Application. For transfers to third countries (USA), we rely on the adequacy decision for the EU-U.S. Data Privacy Framework (DPF) or on standard contractual clauses.
| Sub-processor | Role / service | Location and transfer mechanism |
|---|---|---|
| Vercel Inc. | Hosting and operation of the Application | EU/USA — EU-U.S. DPF |
| Neon, Inc. | PostgreSQL database | EU |
| Cloudinary Ltd. | Storage and processing of photographs | EU/USA — EU-U.S. DPF |
| Resend, Inc. | Transactional e-mails | EU region (US parent company — EU-U.S. DPF / standard contractual clauses) |
| Google Ireland Ltd. | Google Analytics 4 (only after consent), Google Maps, Google OAuth sign-in | EU/USA — EU-U.S. DPF |
6. Retention periods
- 30 days after the end of a tenancy recorded in the Application, the tenant's personal identification number, ID card number and permanent address are automatically deleted (automated GDPR cleanup).
- Other tenancy data (lease agreement, handover protocol, contact details, relationship history) is kept by the landlord in the Application as a rule for 4 years after the end of the tenancy — for the period needed to prove and enforce claims under the lease (3-year limitation period plus a reserve).
- Accounting and tax records, including payment history, are retained for 10 years in accordance with the Slovak Accounting Act.
- The audit log of significant operations is retained for 24 months for the purpose of network and information system security (legitimate interest, Art. 6(1)(f) GDPR).
- Customer account data is retained until the account is cancelled; after cancellation it is deleted, except for data we are legally obliged to retain.
7. Your rights under Art. 15 – 22 GDPR
- the right of access to personal data (Art. 15),
- the right to rectification of inaccurate or incomplete data (Art. 16),
- the right to erasure (“right to be forgotten”) (Art. 17),
- the right to restriction of processing (Art. 18),
- the right to data portability (Art. 20),
- the right to object to processing (Art. 21),
- the right not to be subject to solely automated decision-making, including profiling (Art. 22),
- the right to withdraw consent at any time where processing is based on consent — without affecting the lawfulness of processing carried out before withdrawal.
You may exercise your rights by e-mail at martin.stacho@gmail.com. We will respond without undue delay and at the latest within one month.
If you believe the processing of your data violates applicable law, you have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk.
8. Data security
- encryption of sensitive fields (personal identification number, ID card number) using AES-256-GCM,
- encryption of data in transit via TLS,
- role- and organisation-based access control (data isolation between customers),
- audit logging of significant operations,
- regular database backups.
9. Cookies
Information on cookies and similar technologies can be found in the separate Cookie Policy at /cookies. Analytics cookies (Google Analytics 4) are used only after you have given your consent.
10. Changes to this policy
We may update this policy from time to time. We will inform customers of material changes by e-mail or by a notice in the Application. The current version is always available on this page.