Privacy Policy

Last updated: 8 October 2026

1. Introduction

This Privacy Policy explains what personal information we collect, how we use it, who we may share it with and why, and your choices and rights. It covers our website at https://www.vondereurope.com/, enquiries, applications and bookings, our accommodation and resident services before, during and after a tenancy or stay, newsletters and marketing, and recruitment.

Our website is not intended for children, and we do not knowingly collect personal data from children through it.

Who is responsible for your personal data

Vonder comprises the following legal entities, together referred to as the Vonder Group:

Vonder UK Limited: registered in England and Wales under company number 11623330, with its registered office at 61 Welbeck Street, London, United Kingdom, W1G 9XD.
Vonder X Management Limited: registered in England and Wales under company number 15747125, with its registered office at 61 Welbeck Street, London, United Kingdom, W1G 9XD.
Vonder Poland Sp. z o.o.: registered in Poland, with its office at ul. Puławska 17, 02-515 Warsaw, Poland. KRS: 0000800493; NIP: 5252799689; REGON: 384218856.
Vonder GmbH: registered in Germany, with its office at Schlüterstr. 32, Charlottenburg, Berlin, 10629, Germany. Registration number: HRB 150716.
Vonder Munich GmbH: registered in Germany, with its office at Schlüterstr. 32, Charlottenburg, Berlin, 10629, Germany. Registration number: HRB 206964.

References to “Vonder”, “we”, “us” and “our” mean the relevant Vonder Group entity responsible for processing your personal data.

Each Vonder Group entity is a data controller for the personal data it is responsible for. This means that it is responsible for deciding how it holds and uses personal information about you. The entity acting as controller depends on your relationship with us and the service involved. Where required, we identify that entity when collecting your data. For tenants and residents in Germany, the controller is Vonder GmbH or Vonder Munich GmbH, depending on the entity with which you have contracted.

Other Vonder Group entities may act as processors on behalf of the controller or as joint controllers where they jointly determine why and how personal data is processed. You can contact us for further information about these arrangements.

Vonder collects, stores and processes personal data relating to prospective tenants, tenants, residents, guarantors and website users in order to provide accommodation and property management services. This privacy notice sets out how Vonder collects and uses personal information about you before, during and after a tenancy or stay.

Vonder is committed to protecting the privacy and security of your personal information. Vonder is committed to being clear and transparent about how it collects and uses that data and to meeting its data protection obligations.

Vonder is committed to ensuring all processing is fair, transparent and proportionate, reflecting tenant rights under current legislation.

Data Protection Officer

Questions about this policy or our use of personal information may be directed to G. Gruper, Data Protection Officer. You can write to the Data Protection Officer at 61 Welbeck Street, London, United Kingdom, W1G 9XD or email DPO@vondereurope.com. These contact details are available to individuals in both the UK and the EU, including Germany and Poland.

2. Data protection principles

Vonder will comply with applicable data protection legislation, including the UK GDPR, the Data Protection Act 2018, as amended including by the Data (Use and Access) Act 2025, the EU General Data Protection Regulation (EU GDPR) and applicable national legislation, including Germany’s Federal Data Protection Act (BDSG) and Poland’s Act on the Protection of Personal Data of 10 May 2018. This means that the personal information we hold about you must be:

Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have explained to you clearly and not used in any way that is incompatible with these purposes.
Relevant to the purposes we have told you about and limited to those purposes only.
Accurate and kept up to date.
Kept only for such time as is necessary for the purposes we have told you about.
Kept securely.

3. What information does Vonder collect and process

We collect personal information that you provide when you engage with our services or use our website. We may also receive personal information about you from other people or organisations in the course of our legitimate business activities, as explained below.

Where anti-money laundering or other identity-checking obligations apply, we may need to obtain identification documents, such as your passport, identity card or driving licence. We will explain the relevant requirements when requesting this information.

Vonder collects and processes a range of personal information (personal data) about you, where necessary and proportionate for the service or tenancy. Personal data means any information about an individual from which the person can be identified.

This includes:

Identity and personal contact details, such as your name, title, address, email address, telephone number, date of birth, identification documents, national insurance or tax identification number where required, and car registration.
Background information such as previous landlord details, employer details, employer references, next of kin, dependants and emergency contacts.
Bank account details, payment details, bank references and credit check results.
Booking and tenancy details including renewals, joint tenants, other residents and guarantors.
Deposit information (if any) including return on tenancy termination.
Immigration / right to rent checks (properties in England only).
Rent, service charge and utilities payment records.
Recovery of arrears, claims or possession proceedings.
Repair, maintenance, resident support and health and safety records.
Breach of tenancy terms/complaints.
Council tax and utilities records, where applicable.
Housing benefit and other housing assistance records, where applicable.
Notices and correspondence regarding termination of tenancy.
Account and profile data, such as registration details, preferences, feedback and survey responses.
Building access and security data, such as access credentials, entry and exit records and CCTV footage where these systems operate.
Marketing and communications data, such as your marketing preferences, records of consent and, where you have consented, your interaction with newsletters.
Recruitment data, such as information in your CV, application and related correspondence.
General correspondence in all formats (letters, emails, text messages etc).

We may also collect, store and use the following special categories of more sensitive personal information:

Information about medical or health conditions, including whether or not you have a disability for which Vonder needs to make adaptations.

Vonder collects this information from a variety of sources. For example, data is collected from you directly when you make an enquiry, booking or application, create an account, request maintenance or resident support, subscribe to a newsletter, enter a competition or survey, submit feedback or a complaint, or apply for a role, and through correspondence during the tenancy. Vonder also generates its own records such as rent payment records.

We install CCTV in some of our premises for security purposes. The relevant premises have clear signs indicating that CCTV is in use.

In some cases, Vonder may collect personal data about you from third parties, such as:

References supplied by former landlords, employers and personal referees.
Information from credit reference agencies.
Other tenants, residents or neighbours.
Guarantors.
Local authorities.
CCTV recordings.
The police or other law enforcement agencies.
Department for Work and Pensions (UK only).
Utility companies or service providers.
Letting/managing agents.
Websites, booking platforms or online rental portals.
Other Vonder Group companies.

Data is stored in a range of different places, including in paper files and in Vonder’s IT systems (including Vonder’s email system).

We also use information that has been anonymised so that it can no longer identify you. Truly anonymous information is not personal data.

Website enquiries and technical information

Website enquiry, application and booking forms collect the information requested on the form, such as your name, email address, telephone number, preferred move-in date, the home or location of interest and any message or other information you provide. Please avoid sending sensitive information unless it is necessary and an appropriate channel has been provided.

Our website and its service providers also process IP addresses, browser, device and operating-system information, requested pages and resources, referring pages, timestamps, usage information and technical or security logs.

Our Cookies Policy describes the analytics and browser-storage technologies we use, their purposes, retention and available choices.

4. Why does Vonder process personal data

Vonder needs to process data to consider enquiries, bookings and applications, enter into and manage tenancies and accommodation agreements, and provide resident services. Where we are a party to a contract with you, we rely on contractual necessity or steps taken at your request before entering into that contract.

In addition, Vonder needs to process data to ensure that we are complying with our legal obligations.

In other cases, Vonder processes personal information where necessary for specific legitimate interests before, during and after the landlord–tenant relationship, such as record-keeping, administration of tenancy arrangements, payments and debt recovery, security and fraud prevention, disputes and investigations. Marketing communications are sent only where consent has been obtained or where otherwise permitted by applicable law. Submitting a website enquiry does not, by itself, subscribe you to marketing communications.

We use website enquiry information to respond, arrange viewings and provide requested information. We rely on our legitimate interests in responding to enquiries and operating our accommodation business, or, where applicable, steps taken at your request before entering into a contract with you.

We rely on legitimate interests to operate and secure the website and handle technical faults. Website analytics, advertising technologies and newsletter tracking rely on your consent.

For recruitment, we rely on steps taken before entering into an employment contract, applicable legal obligations and our legitimate interests in recruiting suitable staff and managing recruitment-related claims. Relevant national employment and data protection laws also apply.

In exceptional circumstances, we may process personal data where necessary to protect someone’s vital interests.

Where we rely on legitimate interests, we consider the impact on your rights and interests. You can contact our Data Protection Officer for further information about these assessments.

5. Situations in which we will use your personal information

Situations in which we will process your personal information are listed below:

To respond to enquiries and process bookings and applications.
To verify the identity of a proposed tenant/resident.
To decide on the suitability of a proposed tenant/resident.
To assess the financial standing/suitability of a proposed tenant/resident.
To check immigration status/right to rent (properties in England only).
To deal with joint tenants and residents who are linked to the tenancy.
To enter into a tenancy or accommodation agreement.
To secure payment of rent and performance of tenant obligations.
To collect rent and other payments.
To manage the tenancy and the property and provide resident services.
To keep accurate records relating to Vonder’s rental business.
To arrange repairs and maintenance of the property.
To monitor and enforce performance of tenant’s obligations.
To recover debts and/or obtain possession of a property.
To ensure Council Tax and utilities charges are billed and paid appropriately, where applicable.
To ensure that welfare benefits (such as Universal Credit and housing benefit) are paid where appropriate.
To handle tenancy termination and the return of any deposit.
To handle complaints.
To address health and disability issues relating to tenants/residents.
To create and keep CCTV recordings and building access records for security purposes.
To provide information to public or local authorities who are legally entitled to require this information.
To contact next of kin or close relatives in case of emergency.
To store emails, records of calls and other communications.
To send newsletters and marketing where you have consented or where otherwise permitted by law.
To administer competitions, prize draws and surveys.
To assess candidates and manage recruitment.
To comply with legal and regulatory requirements.
To bring and defend legal claims.
To prevent, detect and investigate crime and anti-social behaviour.

Not all categories will be collected in every case. This will depend on the nature of the tenancy or service and legal requirements.

6. CCTV and building access

Where CCTV operates, it is used for security, crime prevention and the protection of residents, staff and property. We rely on our legitimate interests in these purposes. Cameras are positioned to minimise intrusion into private areas, and footage is not used to monitor residents beyond security purposes. Access to footage is restricted to authorised personnel. We assess the privacy impact of CCTV and carry out a data protection impact assessment where required.

Where key fobs, mobile access or other entry systems are used, we may process access credentials and entry or exit records for security and operational purposes. We do not use access records for automated behavioural analysis, profiling or decision-making about residents.

You may request CCTV footage in which you are identifiable. Requests for footage are subject to legal requirements and the rights of other people shown in it.

7. Marketing and newsletters

We may send marketing where you have consented or where applicable law otherwise permits us to do so. Where our newsletter registration process uses a confirmation email, we may record the date, time and IP address associated with registration to document consent and prevent misuse.

Where you have separately consented, newsletters may contain tracking technologies that help us understand whether an email was opened and which links were selected. Unsubscribing from the newsletter also withdraws your consent to its tracking.

We do not share newsletter subscription data with third parties for their own marketing purposes without your express opt-in consent.

You can stop marketing emails by using the unsubscribe link or contacting our Data Protection Officer. Opting out does not prevent us from sending necessary service communications about a booking, tenancy, payment or other ongoing contractual matter.

8. If you fail to provide personal information

If you do not provide information that is necessary for a booking or tenancy application, a legal requirement or a requested service, Vonder may be unable to proceed. We will explain what is required and why. We do not rely on consent for processing necessary to perform a contract with you. If you do not provide contact details needed to respond to a website enquiry, we may be unable to handle it.

9. Change of purpose

Vonder will only use your personal information for the purpose for which it was collected and in accordance with this privacy notice, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will advise you of this and explain the legal basis which allows us to do so.

You should be aware that we may process your personal information without your knowledge or consent where this is required or permitted by law (e.g. fraud prevention, legal obligations).

10. Use of sensitive personal information

Special category data, such as health information, is processed only where we have both a lawful basis under Article 6 and an applicable condition under Article 9 of the UK GDPR or EU GDPR, together with any required condition under the Data Protection Act 2018 or applicable national law, such as the BDSG. Relevant purposes may include dealing with disability-related adjustments and health and safety matters, or establishing, exercising or defending legal claims. A general legal obligation alone does not remove the need for an applicable special category condition. We will provide further information about the relevant condition when needed for the particular processing.

11. Artificial Intelligence

Vonder may utilise approved Artificial Intelligence (AI) technologies to support administrative, analytical, drafting, customer service, marketing, operational efficiency, tenancy management, maintenance coordination and business support activities.

Any AI-assisted processing is subject to appropriate human oversight, governance controls and security safeguards.

AI is not used to make solely automated decisions or undertake profiling producing legal or similarly significant effects on tenants, residents, guarantors or other individuals.

Approved AI systems are configured so that model training using Vonder personal data is disabled unless specifically authorised through our governance processes and supported by an appropriate lawful basis and safeguards.

Where personal data is processed using AI-assisted tools, such processing will be undertaken in accordance with applicable data protection legislation and the Group AI Policy.

12. For how long do you keep data

Vonder will only hold personal information for as long as necessary to fulfil the purposes for which it was collected, including applicable legal, regulatory, tax, accounting and reporting requirements. When setting retention periods, we consider the type and sensitivity of the data, why we need it, the risk of harm from misuse, applicable limitation periods and whether we can achieve the purpose using less information.

In particular:

Tenancy records: tenancy-related personal information is typically retained for seven years following tenancy termination, taking account of legal obligations, limitation periods for claims and regulatory requirements.
Unsuccessful tenancy applications: retained for one year following the outcome of the application.
CCTV recordings: retained only for as long as necessary for their stated purposes. Retention varies by premises and recording system and is typically no longer than one year at a maximum, unless needed for an incident, investigation or legal claim. Relevant site notices or further information available on request explain the arrangements at a particular property.
Building access records: retained only for as long as necessary for security and operational purposes.
Unsuccessful job applications: normally deleted six months after the rejection decision is communicated, unless a lawful reason requires longer retention.
Successful job applications: relevant information becomes part of the employment record and is retained in accordance with applicable employment and legal requirements.

Data is minimised and access is restricted to authorised personnel.

Retention is assessed by category of information and purpose. The tenancy retention period does not automatically apply to all website analytics, cookies or technical records.

For website enquiries that do not develop into a booking or tenancy application, we determine retention by reference to the time needed to respond and complete follow-up, whether the enquiry remains active, and any relevant complaint, dispute or legal requirement. We review those records and delete or anonymise them when no longer needed.

Cookies, browser storage and analytics have separate retention arrangements described in our Cookies Policy. Technical logs are retained for security, troubleshooting and incident investigation only for as long as needed for those purposes. Deleted information may remain in restricted backup or recovery systems until the applicable backup cycle expires.

13. Automated decision making

Vonder does not rely upon solely automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Any credit referencing, tenancy suitability assessment, affordability assessment or profiling activity is subject to meaningful human review and decision-making.

14. Who is data shared with

Personal data is shared only where necessary and proportionate, and subject to appropriate contractual and confidentiality safeguards.

Your information will be shared internally, including with other Vonder Group companies providing administration, IT support and management reporting.

Website enquiries are initially handled by authorised Vonder staff. This does not prevent the necessary sharing described below where an enquiry progresses to a booking, application, tenancy or other service.

Vonder also shares your data with third parties where required by law, where it is necessary in order to administer the relationship with you or where we have another legitimate interest in doing so. Information can be shared with:

The owner of the property, where this is not Vonder.
Other Vonder Group companies.
Professional advisers, including lawyers, auditors, accountants, bankers and insurers.
Freeholder and/or their managing agent (for property in blocks of flats).
Existing or previous landlords.
Existing or previous employers.
Credit referencing agencies.
Debt collectors and tracing services.
Local authorities and government/public bodies.
Ombudsman/redress schemes.
Professional body/regulator.
Courts/Tribunals.
Police/enforcement agencies.
Banks/building societies.
Tenant’s/resident’s next of kin or close relatives in case of emergency.
Joint tenants and other residents.
Guarantors.
Tenancy Deposit Schemes, where applicable.
Housing benefit and other benefit administrators, where applicable.
HM Revenue & Customs or other relevant tax authorities, where applicable.
Council Tax authority, where applicable.
Property management and maintenance providers, contractors and trades people providing services at the property or involved in the administration and scheduling thereof.
Prospective purchasers of property.
Other landlords including where you apply to another landlord for a tenancy.
Payment processors and payment institutions, including the provision of one or more payment accounts, the processing of electronic payment transactions, access to account information services and access to payment initiation services.
Information technology, booking and communications service providers.
Cloud hosting providers.
Cyber security providers.
Software and platform providers.
Data storage providers.
Newsletter and marketing service providers acting on our behalf.
Third-party content and advertising providers, where you have consented or another applicable legal basis permits the relevant processing.
Approved AI service providers (where authorised and subject to appropriate safeguards).

Website service providers support hosting, content delivery, form processing, email delivery and mailboxes, security and analytics. Such processing is distinct from which Vonder staff receive enquiries.

Vonder Group recipients may be located in the UK, Germany, Poland, Ireland, Malta and Cyprus. External providers may be located in countries including Germany, Switzerland, the United States and Israel.

Where a provider acts as our processor, it must process personal data under our instructions and appropriate contractual safeguards. Other recipients may act as independent or joint controllers, depending on their role.

15. International transfers

Personal data may be transferred to, stored in or accessed from countries outside the United Kingdom or European Economic Area, including the United States and Israel, where necessary for the provision of services, information technology support, cloud hosting, operational activities or regulatory purposes.

Where such transfers occur, appropriate safeguards shall be implemented in accordance with applicable data protection legislation, including:

UK International Data Transfer Agreements (IDTAs).
UK Addenda.
European Commission Standard Contractual Clauses (SCCs).
Adequacy Regulations or Adequacy Decisions.
Transfer assessments and supplementary safeguards where necessary.
Other legally recognised transfer mechanisms.

Some providers use global networks or allow access from other countries, including the United States. We do not represent that all processing takes place in the UK or EEA.

Where applicable, transfers may also rely on the EU–US Data Privacy Framework or the UK Extension to it for covered recipients and transfers. You can request further information, including a copy of relevant contractual safeguards, by contacting our Data Protection Officer.

16. Cookies and third-party website services

We use cookies and similar technologies to operate our website and, where required with your consent, support analytics, advertising and third-party content. Please see our Cookies Policy for details of the technologies used, their purposes and how to manage your preferences.

Our website may include maps, review widgets, social media integrations and other content supplied by third parties. These services may receive personal data, such as your IP address, when they load. We activate them in accordance with applicable consent requirements.

We use hosting providers and content delivery services to operate the website and deliver its resources. These providers may process technical connection information, including your IP address, when serving content. Our web fonts are hosted locally by us or our approved hosting providers.

17. How does Vonder protect data

Vonder takes the security of your data seriously. Vonder has internal policies and controls in place to prevent your data being lost, accidentally destroyed, misused or disclosed.

Security measures may include:

Access controls.
Encryption.
Cyber security monitoring.
Vulnerability management.
Incident response procedures.
Staff training.
Business continuity and disaster recovery controls.

Further information about our security measures is available on request, subject to appropriate security and confidentiality restrictions. We review these measures and improve them as reasonably necessary.

When Vonder engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

18. Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please be sure to keep us informed if your personal information changes during the booking or tenancy application process or during the course of a tenancy.

19. Your rights

As a data subject, you have a number of rights. You can:

Access and obtain a copy of your data on request (known as a “data subject access request”).
Ask Vonder to correct inaccurate or incomplete information.
Request erasure of your personal information, for example where it is no longer necessary for the purposes for which it was collected.
Object to the processing of your data where Vonder is relying on its legitimate interests as the legal ground for processing.
Ask Vonder to suspend the processing of your personal data for a period of time if data is inaccurate or there is a dispute about its accuracy or the reason for processing it.
Request restriction of processing in certain circumstances.
Request data portability where applicable.
Withdraw consent where processing is based on consent.
Request human intervention and contest decisions where rights relating to automated decision-making apply.

Your right to object

You may object to processing based on legitimate interests on grounds relating to your particular situation. You have an absolute right to object to processing for direct marketing, including related profiling.

Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Website choices are explained in our Cookies Policy. Contact our Data Protection Officer to exercise other rights.

20. Changes to this Privacy Policy and contacting us

We may update this Privacy Policy to reflect changes in the law, our business or the way we process personal information. The current version will be published on our website with its last-updated date. Where required, we will provide additional notice. An update to this policy does not itself constitute consent to new processing.

To exercise your rights or ask a question, contact G. Gruper, Data Protection Officer, at 61 Welbeck Street, London, United Kingdom, W1G 9XD or via DPO@vondereurope.com.

We normally respond to rights requests within one month. Where permitted by law, we may extend this by up to two further months because of the complexity or number of requests; we will explain the extension within the initial month. We may need to verify your identity. Rights are subject to applicable legal conditions and exemptions, which we will explain where relevant.

If you believe Vonder has not complied with your data protection rights, you can raise a concern with us through the contact details above. We will handle it under our data protection complaints procedure. You also have the right to complain to a data protection supervisory authority, including:

United Kingdom: the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.
Germany: the competent state data protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information where applicable.
Poland: the President of the Personal Data Protection Office (UODO).

If you live or work in the EU, you may also complain to the supervisory authority in your country of residence or place of work. You do not have to contact us before complaining to a supervisory authority.

21. External websites and resident platforms

Where we direct you to a third-party platform, for example for payments, maintenance reporting or resident services, information submitted there is processed through that service. Please read its privacy information, including the identity of the organisation responsible for your information. Use of a third-party platform does not remove Vonder’s responsibilities for information it receives or uses in managing your booking, tenancy or request.

Other external websites linked from our website have their own privacy arrangements.