Privacy Policy

Last updated: April 2026

1. Overview

This privacy policy explains how FARAWAYHOME OÜ ("FARAWAYHOME", "we", "us", or "our") collects, uses, and protects your personal data when you use our websites (www.farawayhome.com and app.farawayhome.com) and related services (collectively, the "Platform"). We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR), the Estonian Personal Data Protection Act, and other applicable data protection laws.

2. Controller

The controller responsible for data processing on this Platform is:

FARAWAYHOME OÜ
Tornimäe 5, 10145 Tallinn, Estonia
VAT ID: EE102783607
Company registration number: 17081333
Email: welcome@farawayhome.com

3. Data Protection Contact

For all questions regarding data protection at FARAWAYHOME, please contact us at:

Email: dpo@farawayhome.com

4. What Data We Collect

4.1 Data You Provide to Us

When you register for an account, submit an inquiry, or otherwise interact with the Platform, we may collect the following personal data:

  • Name (first name, last name, salutation)
  • Email address
  • Phone number and/or mobile number
  • Company name and job position
  • Residential or business address
  • Date of birth (where required for identity verification)
  • Inquiry details (desired move-in and move-out dates, number of adults, children, and infants, pet information, and personal messages to landlords)
  • Any additional information you voluntarily provide in free-text fields

4.2 Data Collected Automatically

When you visit the Platform, our systems automatically collect certain technical data, including:

  • IP address
  • Browser type and version
  • Operating system
  • Referring URL
  • Pages visited and actions taken on the Platform
  • Date and time of access
  • Device information

4.3 Data Collected Through Cookies and Similar Technologies

We use cookies and similar technologies to operate the Platform, analyse usage, and improve our services. For details on individual cookies and how to manage your preferences, please see Section 8 (Cookies and Consent Management) below.

4.4 Server Log Files

Our hosting provider automatically collects and stores information that your browser transmits in server log files. This includes:

  • Browser type and version
  • Operating system
  • Referring URL
  • Hostname of the accessing device
  • Time of the server request
  • IP address

These data are not combined with other data sources. The basis for this processing is Art. 6(1)(f) GDPR. We have a legitimate interest in ensuring the technical stability and security of the Platform and in diagnosing errors.

4.5 Contact Form

If you send us a message via a contact form, we collect the data you enter on the form, including your contact details, in order to process your inquiry and any follow-up questions. We do not share this data without your permission.

This data is processed on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR in responding to inquiries directed to us. Where your inquiry relates to a specific rental listing or our brokerage services, the processing may also be based on pre-contractual measures taken at your request pursuant to Art. 6(1)(b) GDPR.

We retain the data you provide via the contact form until you request its deletion or the purpose for its storage no longer applies (e.g., after your inquiry has been fully resolved). Mandatory statutory retention periods remain unaffected.

4.6 Registration on This Platform

You can register on our Platform to access additional features. The data you provide during registration will be used solely for the purpose of providing and managing the service for which you registered. All mandatory fields during registration must be completed in full; otherwise, we may reject the registration.

We use the email address provided during registration to notify you about important changes to the Platform or to our services, such as technical updates.

Registration data is processed on the basis of contract performance pursuant to Art. 6(1)(b) GDPR. Your registration constitutes a contractual relationship with FARAWAYHOME under our General Terms & Conditions, and processing your registration data is necessary to provide and manage our brokerage services.

We store the data collected during registration for as long as you remain registered on the Platform. Statutory retention periods remain unaffected.

4.7 Authentication via Third-Party Providers

You may register or log in using your existing account with a supported third-party authentication provider (currently Google, Apple, and Microsoft).

Sign in with Google

When you authenticate via Google, we receive your email address, first name, last name, and profile picture. Google's authentication service may set cookies and transmit your IP address to Google's servers.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://policies.google.com/privacy

Sign in with Apple

When you authenticate via Apple, we receive your email address, first name, and last name (provided on first authentication only). Apple offers the option to hide your real email address by providing a private relay address. We support Apple's Hide My Email feature.

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland
Privacy policy: https://www.apple.com/legal/privacy/

Sign in with Microsoft

When you authenticate via Microsoft, we receive your email address, first name, and last name. Microsoft's authentication service may set cookies and transmit your IP address to Microsoft's servers.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Privacy policy: https://privacy.microsoft.com/en-us/privacystatement

We use data received from these providers solely to create and manage your account on the Platform. We do not receive your password from any SSO provider. Legal basis: Art. 6(1)(b) GDPR (contract performance).

If you register using an SSO provider and later also register with the same email address using a different method (or vice versa), we may link these identities to a single account to prevent duplicate accounts and ensure a consistent experience.

4.8 Processing of Customer and Contract Data

We collect, process, and use personal data only insofar as it is necessary to establish, perform, or modify a contractual relationship with us. This is done on the basis of Art. 6(1)(b) GDPR. We collect and use your personal data when accessing the Platform (usage data) only to the extent required to enable you to use our services or to bill you accordingly.

Customer data is deleted after completion of the contractual relationship, unless longer retention is required by law.

We transmit personally identifiable data to third parties only to the extent necessary to fulfil the terms of your contract. This includes, in particular, transmission to: partner landlords/providers involved in your inquiry or booking (name, contact details, inquiry details, and identity verification documents), payment service providers for the processing of commissions, and credit reference agencies for creditworthiness checks (see Section 5.5). Your data will not be transmitted for any other purpose unless you have given your express consent. Your data will not be disclosed to third parties for advertising purposes without your explicit consent.

4.9 Encrypted Payments

If you enter into a contract which requires you to submit payment information (e.g., bank account details for direct debits or credit card data), we require this data to process your payment. All payment transactions are conducted exclusively via encrypted SSL/TLS connections. You can verify an encrypted connection by checking that the URL in your browser begins with "https://" and a lock icon is displayed.

In the case of encrypted communication, any payment details you submit to us cannot be read by third parties.

5. Purposes and Legal Basis for Processing

We process your personal data for the following purposes:

5.1 Contract Performance (Art. 6(1)(b) GDPR)

  • Creating and managing your user account
  • Processing rental inquiries and facilitating communication between tenants and landlords/providers
  • Sending transactional emails related to your account, inquiries, appointments, and contractual notifications (these are operational communications and cannot be unsubscribed from)
  • Identity verification for tenants and providers
  • Processing registration data

5.2 Legitimate Interests (Art. 6(1)(f) GDPR)

  • Ensuring the security and proper technical functioning of the Platform
  • Detecting and preventing fraud and abuse (including bot protection)
  • Analysing Platform usage to improve our services and user experience
  • Maintaining server log files for error diagnosis and security monitoring
  • Error tracking and performance monitoring
  • Responding to contact form inquiries
  • Verifying commission entitlements in connection with brokerage agreements

5.3 Consent (Art. 6(1)(a) GDPR)

  • Placing non-essential cookies (analytics, advertising)
  • Sending marketing communications or saved search alerts (you can unsubscribe at any time)
  • Processing data via third-party analytics tools where consent is required

5.4 Legal Obligation (Art. 6(1)(c) GDPR)

  • Complying with tax, accounting, and other legal requirements applicable to our business operations, including the reporting obligations under EU Directive 2021/514 (DAC7) for digital platform operators (see Section 5.6 below)

5.5 Creditworthiness Checks and Tenant Pre-Screening

As part of the rental brokerage process, FARAWAYHOME and/or the provider may conduct creditworthiness checks on prospective tenants. This processing is necessary for the purposes of our legitimate interest (Art. 6(1)(f) GDPR) in assessing the creditworthiness of tenants to protect providers from rental defaults and to facilitate informed decisions on rental applications.

The creditworthiness check may involve:

  • Verification of identity documents submitted by the tenant
  • Assessment of the information provided in the rental application
  • Where applicable, obtaining credit information from third-party credit reference agencies

Where automated decision-making is used in the creditworthiness assessment that produces legal effects concerning the tenant or similarly significantly affects them (including decisions to decline a rental application), you have the right under Art. 22 GDPR to: obtain human intervention in the decision, express your point of view, and contest the decision. To exercise these rights, please contact us at welcome@farawayhome.com or dpo@farawayhome.com.

5.6 DAC7 Reporting (EU Directive 2021/514)

As a digital platform operator facilitating property rentals, FARAWAYHOME is legally required under EU Directive 2021/514 (DAC7) and applicable implementing legislation to collect and report certain information about providers (sellers) and their transactions to tax authorities. The data collected for DAC7 purposes includes:

  • Full legal name
  • Date of birth
  • Primary address
  • Tax Identification Number (TIN)
  • VAT number (where applicable)
  • Address(es) of rented property/properties
  • Land registry reference number (where available)
  • Rental days per listing per quarter
  • Total consideration received per quarter
  • Commissions or fees retained by FARAWAYHOME

Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation).

Recipients: the Estonian Tax Authority (Maksu- ja Tolliamet), which automatically exchanges this information with the competent tax authorities of other EU Member States.

Retention: DAC7 reporting data is retained for the period required by the applicable implementing legislation (typically 5–10 years from the end of the reporting period).

Consequences of non-provision: if a provider fails to provide the required data after two requests within 60 days, FARAWAYHOME is legally obligated to suspend the provider's account and withhold payments until the data is provided in full. This obligation arises from DAC7 implementing legislation and cannot be waived.

6. Third-Party Services and Data Processors

We work with the following third-party service providers to operate and improve the Platform. Where these providers process personal data on our behalf, we have entered into appropriate data processing agreements.

6.1 Analytics

PostHog

We use PostHog (posthog.com) to analyse how users interact with our Platform. PostHog collects data such as pages visited, actions taken, and technical device information to help us improve our service. For registered users, PostHog may receive a hashed user identifier to help us understand usage patterns. No directly identifiable personal data (such as email addresses or names) is transmitted to PostHog. Data is stored on PostHog's EU servers. You can opt out at any time by adjusting your cookie preferences via our consent manager, by contacting us, or by adjusting your browser settings.

Provider: PostHog, Inc.
Privacy policy: https://posthog.com/privacy

Google Analytics

We use Google Analytics to analyse website traffic. IP anonymisation is enabled, meaning your IP address is truncated within the EU before being transmitted to Google. Google Analytics uses cookies to generate statistical information about website usage. You can prevent data collection by Google Analytics by adjusting your cookie preferences or by installing the Google Analytics opt-out browser add-on.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://policies.google.com/privacy
Opt-out: https://tools.google.com/dlpage/gaoptout

6.2 Advertising

Google Ads Conversion Tracking

We use Google Ads to measure the effectiveness of our advertising campaigns. When you click on one of our ads served by Google, a conversion tracking cookie may be set. This cookie does not identify you personally; it allows us to determine the total number of users who interacted with a specific ad. You can disable conversion tracking cookies by adjusting your cookie preferences or browser settings.

Provider: Google Ireland Limited
Privacy policy: https://policies.google.com/privacy

6.3 Authentication

Sign in with Google

You may register or log in to the Platform using your Google account. When you choose this option, Google transmits certain profile data to us, including your name, email address, and profile picture. We use this data solely to create and manage your account on the Platform. Google's authentication service may set cookies and transmit your IP address to Google's servers.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://policies.google.com/privacy

Sign in with Apple

You may register or log in to the Platform using your Apple ID. When you choose this option, Apple transmits certain profile data to us, including your name and email address. Apple offers the option to hide your real email address by providing a private relay address. We use this data solely to create and manage your account on the Platform.

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland
Privacy policy: https://www.apple.com/legal/privacy/

Sign in with Microsoft

You may register or log in to the Platform using your Microsoft account. When you choose this option, Microsoft transmits certain profile data to us, including your name and email address. We use this data solely to create and manage your account on the Platform. Microsoft's authentication service may set cookies and transmit your IP address to Microsoft's servers.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Privacy policy: https://privacy.microsoft.com/en-us/privacystatement

6.4 Email

Mailgun

We use Mailgun for sending transactional emails (account confirmations, inquiry notifications, password resets, etc.). Mailgun processes the recipient's email address and email content on our behalf. Data is processed on Mailgun's EU servers (api.eu.mailgun.org).

Provider: Sinch Email (Mailgun), 112 E Pecan St #1135, San Antonio, TX 78205, USA
Privacy policy: https://www.mailgun.com/legal/privacy-policy/

6.5 Newsletter

If you subscribe to our newsletter, we collect your email address and, optionally, your name to send you updates about new listings, market insights, and Platform features. We use Mailgun to deliver these emails. You can unsubscribe at any time by clicking the "unsubscribe" link included in every newsletter or by contacting us at welcome@farawayhome.com. Upon unsubscription, your email address will be removed from our newsletter distribution list. Legal basis: Art. 6(1)(a) GDPR (consent).

6.6 Hosting and Infrastructure

Amazon Web Services (AWS)

We use AWS for hosting our Platform and storing files (including property images and documents). Data is stored in the EU region (eu-west-1, Ireland).

Provider: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg
Privacy policy: https://aws.amazon.com/privacy/

Cloudflare

We use Cloudflare as a content delivery network (CDN) and reverse proxy for our Platform. All HTTP traffic to and from the Platform passes through Cloudflare's network, meaning Cloudflare processes IP addresses, request metadata, and browser information for every visitor. We also use Cloudflare Turnstile to protect certain forms on the Platform from automated abuse. Turnstile analyses browser behaviour to distinguish legitimate users from bots. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring platform security and performance).

Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA
Privacy policy: https://www.cloudflare.com/privacypolicy/

6.7 Error Monitoring

Sentry

We use Sentry to detect and diagnose technical errors on the Platform. Sentry may receive technical data such as error messages, stack traces, browser information, and in some cases, IP addresses. Data is stored on Sentry's EU servers (de.sentry.io).

Provider: Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
Privacy policy: https://sentry.io/privacy/

6.8 Bot Protection

Cloudflare Turnstile

We use Cloudflare Turnstile to protect certain forms on the Platform from automated abuse. Turnstile analyses browser behaviour to distinguish legitimate users from bots. This processing is based on our legitimate interest in preventing spam and fraud.

Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA
Privacy policy: https://www.cloudflare.com/privacypolicy/

6.9 Maps

Google Maps

On property listing pages, we may embed Google Maps to display the approximate location of apartments. When Google Maps is loaded, your browser establishes a direct connection to Google's servers, transmitting your IP address and browser data.

Provider: Google Ireland Limited
Privacy policy: https://policies.google.com/privacy

6.10 Video Embeds

Vimeo

Some property listings may include embedded Vimeo video tours. When a page containing a Vimeo embed is loaded, a connection to Vimeo's servers is established. Vimeo receives your IP address and information about which page you visited.

Provider: Vimeo, Inc., 555 West 18th Street, New York, NY 10011, USA
Privacy policy: https://vimeo.com/privacy

YouTube

Some property listings may include embedded YouTube video tours. When a page containing a YouTube embed is loaded, a connection to Google's servers is established. YouTube receives your IP address and information about which page you visited. If you are logged into your YouTube/Google account, YouTube may associate your browsing behaviour with your profile.

Provider: Google Ireland Limited (YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA)
Privacy policy: https://policies.google.com/privacy

6.11 Fonts and Icons

Google Fonts

We use Google Fonts to ensure a consistent visual presentation of the Platform. Fonts are self-hosted on our own servers and no connection to Google's servers is established when fonts are loaded. No personal data is transmitted to Google through the use of Google Fonts.

Font Awesome

We use Font Awesome to display icons on the Platform. Font files are self-hosted on our own servers. No personal data is transmitted to Font Awesome through the use of icons.

6.12 Consent Management

Usercentrics

We use Usercentrics as our Consent Management Platform (CMP) to obtain and manage your cookie and tracking preferences in accordance with applicable data protection regulations. Usercentrics stores your consent preferences.

Provider: Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany
Privacy policy: https://usercentrics.com/privacy-policy/

6.13 Payments

Payments are currently processed via direct bank transfer. No third-party payment processor is used.

7. Data Transfers to Third Countries

Some of our service providers are based in the United States or other countries outside the European Economic Area (EEA). Where personal data is transferred to countries without an adequate level of data protection as determined by the European Commission, we ensure appropriate safeguards are in place, such as:

  • EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR
  • The EU-U.S. Data Privacy Framework, where applicable
  • Other appropriate safeguards as required by law

We conduct Transfer Impact Assessments (TIAs) where required to evaluate whether the legal framework of the recipient country provides adequate protection. You may request a copy of the relevant safeguards by contacting us at welcome@farawayhome.com or dpo@farawayhome.com.

8. Cookies and Consent Management

8.1 What Are Cookies?

Cookies are small text files stored on your device by your browser. They help us operate the Platform, remember your preferences, and understand how you use our services.

8.2 Types of Cookies We Use

Strictly Necessary Cookies

These cookies are essential for the Platform to function (e.g., session management, authentication, CSRF protection, cookie consent preferences). They cannot be disabled. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Analytics Cookies

These cookies help us understand how visitors interact with the Platform by collecting information such as pages visited and actions taken. They are only set with your consent. Legal basis: Art. 6(1)(a) GDPR (consent).

Advertising Cookies

These cookies are used to measure the effectiveness of our advertising campaigns. They are only set with your consent. Legal basis: Art. 6(1)(a) GDPR (consent).

8.3 Managing Your Preferences

You can manage your cookie preferences at any time through our Usercentrics consent banner, which appears on your first visit and can be accessed again via the cookie settings link in our website footer. You can also configure your browser to block or delete cookies, although this may affect the functionality of the Platform.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

  • Account data: Retained for the duration of your account and deleted within 30 days of account termination, unless longer retention is required by law.
  • Inquiry data: Retained for the duration of the business relationship plus 3 years (limitation period).
  • Commission-related records: Retained for 12 months from last referral or rental agreement, then for 3 years (limitation period).
  • Server log files: Retained for up to 90 days for security and error diagnosis purposes.
  • Analytics data (PostHog): Maximum 12 months, configurable.
  • Invoicing and contractual records: 7 years (Estonian Accounting Act, § 12).
  • Tax records: 7 years (Estonian Taxation Act, § 58).
  • DAC7 reporting data: As required by implementing legislation (typically 5–10 years from the end of the reporting period).
  • Cookie consent records: 3 years.

10. Your Rights

Under the GDPR, you have the following rights with regard to your personal data:

  • Right of access (Art. 15 GDPR) — You have the right to request confirmation of whether your personal data is being processed and to obtain a copy of that data.
  • Right to rectification (Art. 16 GDPR) — You have the right to request correction of inaccurate personal data.
  • Right to erasure (Art. 17 GDPR) — You have the right to request deletion of your personal data, subject to legal retention obligations.
  • Right to restriction of processing (Art. 18 GDPR) — You have the right to request that we restrict the processing of your personal data under certain circumstances.
  • Right to data portability (Art. 20 GDPR) — You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
  • Right to object (Art. 21 GDPR) — You have the right to object to the processing of your personal data based on legitimate interests. Where we process data for direct marketing purposes, you have an absolute right to object.
  • Rights related to automated decision-making (Art. 22 GDPR) — Where we use automated decision-making that produces legal effects concerning you or similarly significantly affects you (such as creditworthiness assessments), you have the right not to be subject to such a decision, the right to obtain human intervention, the right to express your point of view, and the right to contest the decision.
  • Right to withdraw consent (Art. 7(3) GDPR) — Where processing is based on your consent, you may withdraw your consent at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at welcome@farawayhome.com or dpo@farawayhome.com. We will respond to your request within one month. If your request is complex or we receive a large number of requests, we may extend this period by two further months, in which case we will inform you within the initial one-month period.

11. Right to Lodge a Complaint

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for FARAWAYHOME OÜ is:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
Phone: +372 627 4135
Email: info@aki.ee
Website: https://www.aki.ee

You may also lodge a complaint with the supervisory authority in your EU/EEA member state of habitual residence or place of work.

12. Information for Data Subjects Whose Data Is Obtained from Third Parties (Art. 14 GDPR)

In the course of our brokerage activities, FARAWAYHOME may receive personal data about tenants from providers (landlords/agencies), for example the name and contact details of a tenant who has concluded a rental agreement with a provider for a property that was referred by FARAWAYHOME.

Categories of data: Name, contact details, and rental agreement details.

Source of data: The provider (landlord or agency) with whom the tenant has concluded a rental agreement.

Purposes and legal basis: We process this data for the purpose of verifying our commission entitlements under our brokerage agreements with providers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in verifying contractual commission claims).

Recipients: This data is used internally by FARAWAYHOME only and is not shared with third parties.

Retention: This data is retained for the duration of the commission verification period (12 months from referral or last rental agreement) plus the applicable limitation period (3 years), and then deleted.

Your rights: As a data subject, you have the same rights as described in Section 10 above, including the right to access, rectification, erasure, restriction, objection, and data portability. To exercise these rights, contact us at welcome@farawayhome.com or dpo@farawayhome.com.

13. SSL/TLS Encryption

The Platform uses SSL/TLS encryption for all data transmissions. You can verify an encrypted connection by checking that the URL in your browser begins with "https://" and a lock icon is displayed.

14. Opposition to Unsolicited Communications

We expressly prohibit the use of contact data published in our legal notice or on the Platform for the purpose of sending unsolicited advertising or promotional materials. We reserve the right to take legal action against senders of unsolicited commercial communications (spam).

15. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that data promptly.

16. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our data processing practices, legal requirements, or the services we use. The latest version will always be available on our Platform. We encourage you to review this page periodically. Material changes will be communicated via the Platform or by email where appropriate.

17. Contact

If you have any questions about this privacy policy or our data processing practices, please contact us:

FARAWAYHOME OÜ
Tornimäe 5, 10145 Tallinn, Estonia
VAT ID: EE102783607
Company registration number: 17081333
Email: welcome@farawayhome.com
Data protection contact: dpo@farawayhome.com