RoomPair Privacy Policy

1. Who We Are

RoomPair is operated by:

DRMD Holdco Limited Company Registration No. 799471 Swinford, Co. Mayo Ireland

Email: support@roompair.ie

For the purposes of applicable data-protection law, DRMD Holdco Limited is the data controller for personal data processed as described in this Privacy Policy.

2. Purpose of This Policy

This Privacy Policy explains how RoomPair collects, uses, shares, stores and protects personal information when you:

• visit RoomPair.ie;
• create an account;
• create a Host or Renter profile;
• list a Room;
• complete verification;
• search for accommodation;
• make or accept a Booking Request;
• make a RoomPair payment;
• send messages;
• submit a support request;
• otherwise use RoomPair.

3. Personal Information We Collect

Account information

We may collect:

• name;
• email;
• phone number;
• date of birth;
• authentication information;
• account role;
• account status.

We do not store passwords in readable form.

Renter profile information

This may include:

• profile photograph;
• occupation;
• employer;
• student status;
• college or university;
• course;
• desired location;
• budget;
• move-in date;
• intended stay;
• introduction;
• smoking status;
• pet information;
• work-from-home status;
• references.

Host information

This may include:

• name;
• contact information;
• profile photograph;
• Host type;
• whether the property is the Host's main residence;
• verification status;
• booking and hosting history.

Host referral information

If a Host chooses to record a referral, we process the referrer's name, an optional referral code, the referred Host's account identifier and registration date, relevant listing and booking eligibility information, administrative notes, reward status, completion confirmation and reward payment date. Referral details are optional and are not displayed publicly. Hosts must not provide another person's phone number, email address or bank details in referral fields.

We use this limited information to identify the referrer, administer the referral programme, verify eligibility, prevent fraud and abuse and process eligible reward payments. Programme administration and eligible payments rely on contract where applicable; eligibility checks, fraud prevention and proportionate record-keeping rely on legitimate interests; required financial records rely on legal obligation.

Only authorised administrators can access the full referral administration records. A Host can view their own submitted name and code, but not internal notes or another Host's referral record. After a reward becomes eligible, RoomPair contacts the referrer separately to obtain only the bank details reasonably required for a manual bank transfer. Bank details are not collected at signup or stored in referral fields or Admin referral notes. Necessary payment information may be shared with the bank processing the transfer.

Referral information is kept only while necessary to administer the programme, resolve questions or prevent abuse. Limited account-linked information is reviewed under the account-data periods in section 14; reward payment records follow the financial-record periods there. Bank details obtained separately are restricted to authorised payment administrators and retained only as necessary for payment and applicable legal obligations. Referrers can contact support@roompair.ie to exercise the rights described in section 19.

Property and Room information

This may include:

• property address;
• Eircode;
• room details;
• photographs;
• rent;
• deposit;
• bills information;
• availability;
• amenities;
• House Rules.

We do not publicly display exact property addresses before the appropriate Booking stage.

4. Verification Information

RoomPair may collect or process:

• identity documents;
• age verification;
• proof of address;
• identity-verification result;
• verification photographs;
• room-verification videos;
• unique RoomPair verification codes;
• device/location information where permission has been granted;
• student or employment evidence;
• references.

Verification information is stored privately.

Hosts normally see the Renter's verification status, not the Renter's identity document.

Renters normally see the Host's verification status, not the Host's identity document.

5. Booking Information

We may process:

• Room requested;
• requested dates;
• Booking status;
• Host and Renter;
• acceptance/decline information;
• Booking reference;
• cancellation information;
• stay extensions;
• Booking history.

6. Payments

RoomPair uses third-party payment providers such as Stripe.

RoomPair does not store full payment-card numbers or card security codes.

We may receive and retain information such as:

• payment identifier;
• Booking Fee amount;
• currency;
• payment status;
• refund status;
• card type;
• limited card details such as last digits;
• fraud/risk signals supplied by the payment provider.

7. Messages and Support

RoomPair may process:

• messages between Hosts and Renters;
• support tickets;
• complaints;
• reports;
• evidence relating to disputes;
• attachments.

Messages may be processed for:

• providing the messaging service;
• safety;
• preventing fraud;
• enforcing platform rules;
• resolving complaints.

8. Technical and Security Data

We may collect:

• IP address;
• device information;
• browser;
• session data;
• login timestamps;
• security logs;
• page/activity information;
• error and diagnostic information;
• cookie or consent information.

9. Why We Use Personal Information

We use information where necessary to:

• create and secure accounts;
• authenticate Users;
• provide Listings;
• operate search;
• match Hosts and Renters;
• process Bookings;
• process Booking Fees;
• verify Users and Rooms;
• prevent scams;
• communicate with Users;
• provide customer support;
• enforce platform rules;
• investigate complaints;
• protect RoomPair and its Users;
• comply with legal and accounting obligations;
• improve RoomPair.

10. Legal Bases

Depending on the activity, RoomPair relies on one or more lawful bases.

Contract

Where processing is necessary to provide services requested by you, including:

• account functionality;
• Booking services;
• messaging;
• payment processing.

Legal obligation

Where information must be retained or processed because of legal, accounting, tax or regulatory requirements.

Legitimate interests

RoomPair may rely on legitimate interests for purposes such as:

• fraud prevention;
• platform security;
• account protection;
• investigating misuse;
• maintaining business records;
• establishing or defending legal claims;
• improving service reliability.

Where we rely on legitimate interests, we consider the impact on Users' rights.

Consent

We may rely on consent for activities including:

• optional marketing;
• optional cookies/tracking;
• optional location access;
• other processing where consent is legally appropriate.

Consent can be withdrawn where consent is the lawful basis.

11. Identity and Biometric Verification

RoomPair may use specialist third-party verification providers.

If RoomPair introduces biometric facial/liveness technology involving biometric personal data, RoomPair will provide additional information and identify the appropriate lawful basis and GDPR condition before using it.

We will not publicly display identity-verification documents.

12. Who We Share Information With

RoomPair may share necessary personal information with:

Other Users

Following appropriate Booking stages, Hosts and Renters may receive information necessary to complete their accommodation arrangement.

We do not intentionally provide identity documents to other Users.

Payment Providers

Including Stripe.

Technology Providers

Including providers used for:

• application hosting;
• databases;
• authentication;
• secure storage;
• transactional email;
• monitoring;
• security.

Current core technology providers include Lovable and Supabase.

Verification Providers

Where external verification tools are used.

Professional Advisers

Including accountants, solicitors, auditors and insurers.

Authorities

Where disclosure is required by law or reasonably necessary to respond to suspected crime, fraud, legal claims or regulatory requirements.

13. International Transfers

Some service providers may process information outside Ireland or the European Economic Area.

Where required, RoomPair will rely on recognised legal safeguards such as:

• an EU adequacy decision;
• Standard Contractual Clauses;
• another transfer mechanism permitted by GDPR.

14. Data Retention

RoomPair aims to keep personal information only for as long as necessary.

Retention reviews and deletions may be carried out through manual or automated processes. Our intended retention framework is:

Active account/profile data

Kept while the account remains active.

Following account closure, limited account information may generally be retained for up to 24 months where necessary for fraud prevention, complaints or legal claims.

Booking and payment records

Generally retained for up to six years where required for tax, accounting or legal-record purposes.

Raw Host/Renter identity documents

Our intended approach is to delete raw identity documents as soon as they are no longer reasonably required for verification, generally within 90 days of completion of the verification decision, unless:

• re-verification is required;
• fraud is suspected;
• a complaint or dispute is ongoing;
• longer retention is legally required.

We may retain the fact and outcome of verification for longer.

Proof of address

Generally deleted on the same basis as raw identity material once its verification purpose has been completed.

Room-verification videos

Generally retained while the Listing remains active and for up to 90 days after the Listing is removed or verification is replaced, unless required for an ongoing safety, fraud or dispute matter.

Messages and support records

Generally retained while relevant to an active account/Booking and for up to 24 months afterwards, unless longer retention is reasonably required.

Security logs

Generally retained for up to 12 months, subject to legitimate security needs.

These periods may be extended where reasonably necessary for a legal obligation, dispute, fraud investigation or legal claim.

15. Account Deletion

Users may request account deletion.

Some information may be deleted, anonymised or de-linked from the User.

Deletion is not absolute where RoomPair must retain information for:

• legal obligations;
• accounting;
• tax records;
• prevention of fraud;
• legal claims;
• existing disputes.

Private verification material that no longer has a valid retention purpose will be deleted in accordance with RoomPair's retention policy.

16. Cookies and Tracking

RoomPair uses strictly necessary technologies to operate functions such as:

• login;
• session management;
• security;
• essential payment functions.

RoomPair may also use:

• analytics;
• preference technologies;
• marketing/advertising technologies.

Where consent is legally required, optional tracking will not be activated until consent has been given.

Users can reject non-essential tracking and change their preferences through Cookie Settings.

Further information is available in the RoomPair Cookie Policy.

17. Marketing

RoomPair may send marketing communications where:

• you have consented; or
• another lawful basis permits the communication.

Users may unsubscribe from marketing.

Messages necessary for:

• Bookings;
• security;
• verification;
• support;
• payments;
• account administration

are service communications rather than marketing.

18. Security

RoomPair uses technical and organisational measures intended to protect personal information, including:

• authentication;
• access controls;
• Row Level Security;
• private storage;
• role-based permissions;
• encrypted HTTPS connections;
• secure third-party payment processing;
• rate limiting;
• security logging;
• restricted Admin access;
• expiring/signed private-file access where appropriate.

No internet service can guarantee complete security.

Users should protect their passwords and report suspected unauthorised access promptly.

19. Your Rights

Subject to applicable law, you may have the right to:

• access your personal information;
• correct inaccurate information;
• request deletion;
• restrict processing;
• object to processing;
• receive certain information in portable form;
• withdraw consent;
• complain to a supervisory authority.

Requests may be sent to:

support@roompair.ie

RoomPair may request reasonable identity verification before responding.

20. Complaints

If you have concerns about how RoomPair processes your personal information, contact:

support@roompair.ie

You also have the right to complain to the Data Protection Commission of Ireland.

21. Under-18s

RoomPair is not intended to permit people under 18 to make accommodation Bookings.

Where we become aware that an under-18 User has created a Booking account in breach of our rules, we may restrict or remove the account.

22. Automated Systems

RoomPair may use automated tools to:

• detect spam;
• flag potentially suspicious accounts;
• identify possible fraud;
• identify prohibited content;
• prioritise security reviews.

RoomPair does not intend to make decisions producing significant legal effects solely through automated processing without appropriate safeguards.

23. Changes to This Privacy Policy

RoomPair may update this Privacy Policy as:

• our service changes;
• technology changes;
• processing activities change;
• legal obligations change.

The latest version will be published with its update date.

24. Contact

DRMD Holdco Limited Company Registration No. 799471 Swinford, Co. Mayo Ireland

support@roompair.ie