Privacy Policy
Effective from: 6 November 2026
This text is a translation provided for convenience. If it differs from the Latvian version, the Latvian version is binding. Read the Latvian version
Effective from: 6 November 2026 Previous version: 8 October 2026
1. Who we are
Opernt (opernt.com) is an online platform for managing the rental of flats and other properties. The service is provided by:
SIA "Qhosting" Registration No. 40103183497 Registered address: Mauriņu iela 29A-33, Mārupe, Mārupes nov., LV-2167, Latvia Data protection contact: privacy@opernt.com
In this policy, "Opernt", "we" and "our" mean SIA "Qhosting". The "Service" means the Opernt website, app and tenant portal.
2. Who this policy covers
This policy covers:
- landlords and property managers who create an Opernt account ("Users");
- tenants and other contacts whose data Users enter into the Service;
- tenants who use the tenant portal;
- visitors to opernt.com.
3. Our role: controller or processor
| Data | Who decides how the data is used (controller) | Opernt's role |
|---|---|---|
| User account, settings and subscription data | Opernt | Controller |
| The User's own bank account data, if the User connects a bank | Opernt | Controller |
| Tenant and contact data entered by the User (including payer details in bank transactions) | The User (landlord) | Processor |
| Tenant portal usage data | The User (landlord) | Processor; controller for sign-in security and security logs |
| Website visit data | Opernt | Controller |
If you are a tenant, your landlord is usually the main controller of your data. Please contact your landlord first with any questions about your data. If you write to us, we will forward your request to your landlord and help them fulfil it.
The relationship between Opernt and the User as processor and controller is governed by the Data Processing Terms, which are an annex to the Terms of Service.
4. What data we process
4.1. User data: name or company name, email address, phone number, invoicing details (address, registration number or personal code if you provide it, bank account), language, settings and sign-in data.
4.2. Portfolio data: properties and flats, leases, rent amounts, due dates, charges, invoices, payments, deposits, handover reports, uploaded documents and notes.
4.3. Bank data: if you connect a bank account. See section 5.
4.4. Tenant and contact data entered by the User:
- name, email and phone number;
- lease details, charges, payments, arrears and deposit;
- documents;
- personal code or date of birth, if the User enters it, for example in a lease.
The Service is not intended for special categories of data, such as health data. Please do not enter them.
4.5. Communication data:
- emails and support requests;
- notifications and reminders sent by the Service, and their delivery status.
4.6. Technical data:
- IP address, device and browser information;
- sign-in times;
- security and error logs;
- website visit statistics on public marketing pages (page views, referrer, browser, device type and country), collected without cookies through our analytics provider;
- cookies, as described in the Cookie Policy;
- Google Ads conversion cookies, including `_gcl_au`, `_gcl_aw`, `_gcl_gs`, `_gcl_gb`, `_gcl_ag` and `_gcl_dc`. They measure whether a visit from our ads leads to a conversion. Each lasts 90 days. The provider is Google. Data may be transferred to the United States. Google LLC is certified under the EU–US Data Privacy Framework.
4.7. Subscription billing data (once paid plans are introduced): plan, invoices and payment status. Payment card details are processed by the payment provider. We do not see or store them.
5. Connecting a bank account
Connecting a bank account is optional. It lets Opernt recognise incoming rent payments automatically.
Who provides access. Access to bank account information is provided by Enable Banking Oy (Finland). It is a licensed account information service provider supervised by the Finnish Financial Supervisory Authority. Opernt does not hold such a licence itself and uses Enable Banking's service.
Sign-in. You approve the connection in your bank's own environment. We never see or store your online banking credentials.
What we receive:
- the account holder's name, IBAN and currency;
- account transactions: date, amount, currency, payer or payee name and account, payment reference and bank reference.
Your bank consent may allow access to account balances, but Opernt does not fetch or store balances.
Why:
- to recognise rent payments and match them to charges;
- to show payment status;
- to prepare reports.
We do not use bank data for advertising, credit scoring or profiling, and we do not sell it.
Transactions unrelated to rent. We store incoming (credit) transactions from the connected account for payment recognition; outgoing (debit) transactions are not stored. Unmatched incoming transactions may still be stored. Only you can see them. We recommend using a separate bank account for rent payments.
How long consent lasts and how to withdraw it:
- Bank consent is valid for up to 180 days. After that, you need to approve the connection again.
- You can withdraw consent at any time in Opernt settings or in your online bank.
- After withdrawal, no new data is retrieved and the access session is closed.
- Transactions already received stay in your account until you disconnect the bank connection or delete your account.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) and the consent you give your bank.
Payer data. Transactions may contain the names and accounts of other people, such as tenants. We process this data on the landlord's behalf as a processor.
6. Purposes and legal bases
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Creating an account and providing the Service | Performance of a contract |
| Bank connection and payment recognition | Performance of a contract |
| Sending charges, invoices, reminders and notifications to tenants on the User's behalf | The User's instructions (Opernt as processor) |
| Customer support | Performance of a contract; legitimate interests |
| Security, preventing fraud and abuse, fixing errors | Legitimate interests |
| Invoicing and accounting for the Opernt subscription | Legal obligation |
| Improving the Service using aggregated statistics | Legitimate interests |
| Website visit statistics on public pages (without cookies) | Legitimate interests |
| Newsletters and marketing emails | Consent (you can withdraw it at any time) |
| Google Ads conversion cookies | Consent (you can withdraw it at any time) |
7. Automated processing
Opernt automatically compares bank transactions with charges and suggests or makes matches. This is a helper tool. It does not make decisions with legal or similarly significant effects on you or on tenants. The User can review and change any match at any time. We do not carry out profiling.
8. Service providers and where data is stored
Your data is stored in the European Union. The database and files are located in Ireland.
We use the following service providers (sub-processors) to provide the Service:
| Provider | Function | Data location | Safeguards |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | EU (Ireland) | Data processing agreement; Standard Contractual Clauses |
| Vercel, Inc. | App and website hosting | EU (Ireland) for processing; global content delivery network | Data processing agreement; Standard Contractual Clauses; EU–US Data Privacy Framework |
| Enable Banking Oy | Bank account connection | EU (Finland) | Licensed account information service provider |
| Resend, Inc. | Email delivery | United States | Data processing agreement; Standard Contractual Clauses; EU–US Data Privacy Framework |
| Sentry (Functional Software, Inc.) | Error monitoring | EU (Germany) | Data processing agreement; Standard Contractual Clauses |
| Umami Software, Inc. | Website visit statistics (no cookies) | EU | Data processing agreement; Standard Contractual Clauses |
| Google Ireland Limited and Google LLC | Google Ads conversion measurement | United States | EU–US Data Privacy Framework. Google LLC is certified under that framework |
Some providers are US companies and may access data from outside the EEA, for example for technical support. In such cases, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
We keep this list up to date. We notify Users in advance of new sub-processors, as set out in the Data Processing Terms.
9. Who else we may share data with
- Professional advisers, such as accountants and lawyers, under confidentiality.
- Public authorities, where required by law.
- A new owner, if the business is reorganised or sold, who takes on the same data protection obligations.
We do not sell personal data.
10. How long we keep data
| Data | Retention period |
|---|---|
| Account and portfolio data | While the account is active. After the account is deleted, data is deleted within 30 days. |
| Bank transactions | While the account is active, or until you disconnect the bank connection or delete your account. |
| Bank access session data | Until the consent expires or is withdrawn |
| Backups | Up to 7 days after deletion |
| Security and technical logs | Up to 90 days |
| Support correspondence | 2 years after the last contact |
| Problem reports and screenshots | 12 months |
| Opernt invoices and accounting records | For the period required by the Latvian Accounting Law |
| Marketing consent | Until consent is withdrawn |
Data may be kept longer where the law requires it or where it is needed to resolve a dispute.
11. Security
We use the following security measures:
- encrypted connections (TLS);
- encryption of data at rest (via our hosting providers);
- access controls so that each User sees only their own data (including database row-level security);
- separate, access-restricted storage of bank connection secrets;
- access to data only when needed for support or security.
In the event of a personal data breach, we follow the procedure set out in the GDPR and, where required, notify the Data State Inspectorate and the people affected.
12. Your rights
You have the right to:
- access your data and receive a copy of it;
- correct inaccurate data;
- ask for your data to be deleted;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time.
You can correct, export (ZIP archive of CSV files and uploaded documents) or delete most of your data yourself in your account settings. In other cases, write to privacy@opernt.com. We reply within one month. We may need to verify your identity.
If you are a tenant, see section 3.
You have the right to lodge a complaint with the Data State Inspectorate of Latvia (Elijas iela 17, Riga, LV-1050, www.dvi.gov.lv) or with the supervisory authority in your country.
13. Age limit
The Service is intended for people aged 18 and over.
14. Cookies
We use strictly necessary cookies to operate the Service, and Google Ads conversion cookies to measure our advertisements. Cookies such as `_gcl_au` last 90 days. Google (Google Ireland Limited and Google LLC) is the provider. Data from these cookies may be transferred to the United States. Google LLC is certified under the EU–US Data Privacy Framework. The full list, purposes and durations are in the Cookie Policy.
15. Changes to this policy
We may update this policy. We will inform Users of material changes by email or in the Service at least 30 days before they take effect. The current version is always available on opernt.com.