Legal
Privacy policy
This policy explains what personal data OnlyRent processes, why, how long we keep it, and how you can see, correct, download or delete it. It is written to meet the General Data Protection Regulation (EU) 2016/679 (GDPR).
Last updated
1. Who the controller is
Personal data processed through the OnlyRent website and app is controlled by SIA “PIKE”, Reg. No. 40103631502, VAT No. LV40103631502, registered at Ventspils iela 53-2, Riga, LV-1002, Latvia.
Send questions about data processing, and requests to exercise your rights, to info@pike.lv. We answer within one month at the latest.
2. What this policy covers
This policy covers the onlyrent.lv website and the OnlyRent mobile app, including the contact form, account creation, lease and invoice management, payment handling and repair requests.
When a landlord uses OnlyRent to manage their tenants, the landlord is the controller of the tenant data in their portfolio and OnlyRent acts as a processor on their instructions. For accounts, security, our own billing and support correspondence, OnlyRent is the controller.
3. What data we process
| Category | Specific data |
|---|---|
| Account data | Name, email address, phone number, password in hashed form, account role (tenant, landlord, staff member). |
| Property and lease data | Address, floor area, number of rooms, rent, deposit, lease term, the parties to the lease and the time of signature. |
| Payment data | Invoices, payment status, payment date and amount, bank account number or payment reference. We never see or store full card details — those are handled by the payment provider. |
| Repair requests | Fault description, attached photographs, request status and the messages exchanged between the parties. |
| Correspondence | Contact form submissions, emails to support and their attachments. |
| Technical data | IP address, device and browser type, event logs, error reports and sign-in times. |
We do not process special categories of personal data, and we ask you not to include any in repair requests or correspondence.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating an account and providing the service: leases, invoices and requests. | Performance of a contract (Article 6(1)(b)). |
| Answering a question sent through the contact form or by email. | Legitimate interests — replying to someone who writes to us (Article 6(1)(f)). |
| Preparing and retaining accounting and tax records. | Legal obligation (Article 6(1)(c)). |
| Security, fraud prevention and diagnosing faults. | Legitimate interests — keeping the service safe and working. |
| Newsletters and product announcements, where you have signed up. | Consent (Article 6(1)(a)), withdrawable at any time. |
| Analytics on how the site and app are used. | Consent, where optional cookies are involved; otherwise aggregated data that does not identify anyone. |
6. Transfers outside the EEA
Data is stored primarily within the European Union. Where an individual provider processes data outside the European Economic Area, the transfer relies on a European Commission adequacy decision, or on standard contractual clauses together with additional safeguards.
7. How long we keep data
| Data | Retention period |
|---|---|
| Active account data | For as long as the account exists, plus 30 days after a deletion request. |
| Leases and their annexes | The term of the lease plus 10 years, in line with limitation periods. |
| Invoices and payment records | 5 years, as required by accounting legislation. |
| Repair requests and their photographs | 3 years after the request is closed. |
| Contact form correspondence | 24 months after the last message, where no contract came of it. |
| Technical logs | Up to 12 months, after which they are deleted or anonymised. |
8. Your rights
In relation to your personal data, the GDPR gives you the right to:
- access your data and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have data erased where it is no longer needed for the purpose it was collected for;
- restrict processing while a disputed point is being checked;
- receive your data in a machine-readable format and move it to another provider;
- object to processing based on legitimate interests;
- withdraw consent where processing relies on it, without affecting processing already carried out;
- lodge a complaint with a supervisory authority.
To exercise any of these, write to info@pike.lv. We may ask you to confirm your identity so that data does not reach the wrong person.
9. Deleting your account and getting a copy of your data
You can delete your account, and the personal data attached to it, at any time. You do not have to give a reason and there is no charge.
- In the app: Settings → Personal details → Delete account. The request goes to our support team, who action it by hand — that way nobody else can delete your account, and any live contracts are closed properly first.
- By email: write to info@pike.lv from the address the account is registered to, saying that you want the account deleted.
- You can request a copy of your data — profile, leases, invoices, payment history and repair requests — by writing to info@pike.lv. We provide it within one month.
We deactivate the account as soon as we have received and verified the request, and personal data is irreversibly erased within 30 days. That window exists so an account can be restored if it was deleted by mistake or without the owner's knowledge.
After deletion we retain only what the law requires us to keep or what is needed to defend legal claims: issued invoices and accounting records, and signed leases. These are kept separately, with restricted access, and deleted as soon as the period in section 7 expires.
If you are a tenant, the lease and payment records held by your landlord are deleted by the landlord as controller. We will pass your request on to them and help them act on it.
10. Security
- Connections to the site and app are encrypted with TLS, and data is encrypted at rest.
- Passwords are stored only as one-way hashes.
- Access to data is limited to staff who need it for their work, and every access is logged.
- Backups are taken regularly and stored encrypted.
- If a personal data breach is likely to create a risk to your rights, we notify the supervisory authority within 72 hours, and you as well where the risk is high.
12. Children
OnlyRent is not intended for anyone under 16 and we do not knowingly collect their data. If we learn that an account was created for a child without parental consent, it is deleted.
13. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects for you. Invoices are raised automatically, but they follow terms already agreed in the lease and involve no judgement about you.
14. Changes to this policy
We may update this policy when the service or the legal requirements change. Significant changes are announced by email or in the app at least 14 days before they take effect, and the date of the last change is always shown at the top of this page.
15. Complaints
If you believe your data is being handled incorrectly, write to us first at info@pike.lv — most questions are settled straight away. You also have the right to complain to the supervisory authority: Data State Inspectorate of Latvia, Elijas iela 17, Riga, LV-1050, pasts@dvi.gov.lv, https://www.dvi.gov.lv.
Questions about your data?
Write to info@pike.lv or use the contact form — we reply within one working day.