Privacy Policy

Privacy Policy

Last updated: 26 October 2026

This Privacy Policy explains how Altea Immobilière SARL, operating the furnished.lu platform ("furnished.lu", "we", "us"), collects and uses your personal data when you visit our website, make a booking, sign a lease, or contact our support team. It should be read alongside our Booking and Rental Terms & Conditions, which describe the contractual relationship between you and furnished.lu.

1. Who is responsible for your data

The data controller is Altea Immobilière SARL, registered office at Hall 5, ZI Rolach, L-5280 Sandweiler, Luxembourg. For any question about how we handle your personal data, you can contact us at [email protected]. You also have the right to lodge a complaint with the Luxembourg supervisory authority, the CNPD (Commission nationale pour la protection des données), if you believe your rights under data protection law have not been respected.

2. What personal data we collect

Depending on how you interact with us, we may collect:

• Identity data: name, date of birth, nationality, and identification document details.
• Contact details: email address, phone number, postal address.
• Booking and stay data: dates, room and residence chosen, length of stay, preferences, and any options subscribed to (such as furnished Premium).
• Tenant file documents: proof of identity, proof of income, proof of employment or occupation, and any other supporting document you provide to have your file assessed.
• Payment data: processed and tokenised by Stripe; furnished.lu does not receive or store your full card number.
• Support correspondence: messages exchanged with our support team, including via chat, email, or telephone.
• Browsing and cookie data: information about how you use our website, collected via cookies and similar technologies (see clause 8).

3. Why we use your data, and on what legal basis

We use your personal data for the following purposes, each relying on a specific legal basis under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"):

• Performance of the contract: to process your booking, assess your tenant file, manage your lease, collect payments, and provide the services included in your rent (Article 6(1)(b) GDPR).
• Compliance with a legal obligation: to meet our accounting obligations and, where applicable, our obligations under anti-money-laundering rules (Article 6(1)(c) GDPR).
• Legitimate interest: to keep our platform and residences secure, to prevent and detect fraud, and to improve our services, always balanced against your rights and interests (Article 6(1)(f) GDPR).
• Consent: for marketing communications, non-essential cookies, and the storage of your card details by Stripe for future payments; you may withdraw this consent at any time (Article 6(1)(a) GDPR).

4. Assessment of your tenant file

When you book a room, the information and documents you provide are reviewed to assess whether your file can be validated. Certain automated tools may assist our team in organising and checking this information, but the final decision on your file is always taken by a member of our team, not by an automated system alone. If your file is not validated, you may ask us to explain the reasons for that decision and, if you disagree, you may contact us at [email protected] to have the decision reviewed.

5. Who receives your data

We share personal data only with recipients who need it to provide our services, namely:

• Stripe (Ireland/EU) — for processing payments and, with your consent, storing card details.
• Stripe Identity (Ireland/EU) — verification of your identity when your tenant file is assembled: your ID document is read and, with your explicit consent, compared biometrically with a selfie (Article 9 GDPR). The images are collected and stored by Stripe on our behalf: we only receive the outcome of the verification (identity confirmed or not, name, document type and issuing country), never the images or the full document number, and we request their deletion once your file is closed. This verification is based on pre-contractual measures and on our legitimate interest in preventing document fraud; the biometric check only takes place with your consent, given on the verification screen, and uploading your document manually always remains available as an alternative.
• Mailjet / Sinch (EU) — for sending transactional emails (booking confirmations, status updates, receipts).
• Zendesk — for managing support requests and tickets.
• HubSpot — as our customer relationship management (CRM) tool, to follow up on enquiries and bookings.
• Google Analytics — for website audience measurement.
• Cloudflare — for website security and content delivery.
• Anthropic — to provide artificial-intelligence assistance, including the website's conversational assistant and help with processing certain requests. Your exchanges are limited to what is necessary to answer your query, and none of your data is used to train Anthropic's models.
• Meta Platforms Ireland (Ireland / European Union): to publish our content on our Facebook and Instagram pages and, if you contact us on these networks (comment, Messenger or Instagram message), to receive these exchanges. We only keep the content of your message and the technical identifier provided by Meta, for as long as needed to reply or to pass your request on to our team. Replies to and sorting of these messages may be assisted by artificial intelligence (see Anthropic above); an automatically written message is always identified as such. For data that Meta processes on its own behalf, Meta's privacy policy applies.
• MixVoip — for telephony services, including logging calls related to customer follow-up. Where a call is recorded, you will be informed of this beforehand.
• Technical hosting providers located within the European Union.

We do not sell your personal data. We only share it with the recipients listed above, or where required by law.

6. Email tracking

The emails we send you may include measurement tools that let us see whether an email has been opened and whether a link within it has been clicked. We use this information to understand how well our communications work and to follow up on your enquiries and your stay. You can object to this tracking, or unsubscribe from non-essential communications, at any time by using the unsubscribe link included in our emails or by contacting [email protected].

6a. Photos of shared areas

To check the cleanliness of shared areas and run the “Clean residence” competition, our cleaning team photographs the shared areas of the residences every week before their visit (kitchens, shared bathrooms, living rooms, hallways). Legal basis: our legitimate interest in keeping our accommodation clean and rewarding the flatshares that take care of it. The photos must not show any person; any photo showing a person or a personal document is discarded. They are analysed by an artificial intelligence tool (Anthropic) that suggests a score, which our team checks. They are neither published nor shared with tenants, and they are deleted after 3 months.

6b. Requests sent through an AI assistant

You can search our homes from a third-party artificial intelligence assistant (for example ChatGPT, Claude or Le Chat) connected to our public search service. In that case we only receive your search criteria from the assistant (move-in date, budget, area, type of home), which do not identify you. If you ask to be contacted and agree to it, the assistant also sends us your name, your email address or phone number and a short summary of your request, so that our team can answer you. Legal basis: steps taken at your request before entering into a contract. This data is processed and kept like other enquiries and prospects (see “How long we keep your data”). Your conversation with the assistant is governed by its provider’s privacy policy: we have no access to it.

7. International transfers

Most of our service providers process data within the European Union or the European Economic Area. Where a provider processes data outside the EU/EEA, we rely on appropriate safeguards recognised under the GDPR, in particular the European Commission's standard contractual clauses, to ensure your data continues to benefit from an adequate level of protection.

8. Cookies

Our website uses cookies and similar technologies, which fall into three categories:

• Strictly necessary cookies: required for the website to function (for example, to keep you logged in or to remember items in your booking). These do not require consent.
• Audience-measurement cookies: used to understand how visitors use our website (for example, Google Analytics).
• Marketing cookies: used to personalise offers and measure the performance of our campaigns.

Except for strictly necessary cookies, we only place cookies with your consent, which you can give, refuse, or withdraw at any time through our cookie settings. Cookies are kept for a maximum of 13 months.

9. How long we keep your data

We keep personal data only for as long as necessary for the purposes described above. As a general guide:

• Enquiries and prospects that do not lead to a booking: up to 3 years from the last contact.
• Tenant files and lease-related data: for the duration of the lease, plus the applicable statutory limitation period.
• Accounting records: 10 years, in accordance with Luxembourg law.
• Cookies: a maximum of 13 months.

Where we have no ongoing legal or contractual reason to keep your data, we delete or anonymise it.

10. Your rights

Under the GDPR, you have the right to: access your personal data; request that it be corrected; request that it be erased; request that its processing be restricted; object to certain processing; request that it be transferred to you or to another provider (portability); and withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You may also give us instructions on what should happen to your data after your death ("directives post-mortem").

To exercise any of these rights, please contact us at [email protected]. We will respond within one month of your request, or explain why we need more time. You also have the right to lodge a complaint with the CNPD at any time.

11. Security of your data

We protect your personal data using appropriate technical and organisational measures, including encrypted connections (HTTPS), restricted access to personal data on a need-to-know basis, and logging of access to sensitive systems. Payment data is handled directly by Stripe under its own security standards; furnished.lu never has access to your full card number.

12. Children

furnished.lu is intended for adults. Our services are not directed at, and should not be used by, anyone under the age of 18.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, in particular to reflect changes in the law or in our services. The version published on our website is always the version in force. Please also refer to our Booking and Rental Terms & Conditions, which this Privacy Policy complements.

14. Contact

For any question about this Privacy Policy or about how we handle your personal data, please write to [email protected]. For general enquiries about your booking or stay, please contact [email protected] or +352 20 60 80.