Privacy

Last updated: 27 October 2026

This policy explains which personal data Kot360 handles, why, on what legal basis, how long it is kept and which rights you have under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1. Who is responsible?

Kot360 is run by Ulixes Consulting BV, Elegemstraat 186, 1700 Dilbeek, enterprise number 0795.420.685 ("Kot360", "we").

Kot360 connects students with landlords of student rooms. Who is responsible for your data depends on what you do:

• The landlord is the controller of everything you share with a landlord through Kot360: a visit request, a question, an application, a place on a waiting list, your student file, your contract, rent, deposit, repairs and inspections. The landlord decides what happens with that data. Kot360 processes it on the landlord's behalf as a processor, under a data processing agreement (Article 28 GDPR). For questions about that data, you can contact the landlord directly or contact us and we pass your request on.
• Kot360 is the controller of the data we need to run the platform itself: user accounts and logins, the accounts of landlords and their team members, our invoices to landlords, security and audit logs, and the public website.

We have not appointed a data protection officer, because the law does not require it for our activities. You can reach us for every privacy question at help@kot360.be.

2. Which data, why, and on which legal basis

2.1 Visiting the website

• What: technical data your browser sends (IP address, browser type, the pages you open) and the cookies described in our cookie policy.
• Why: to show the website, keep it secure and remember your language.
• Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).

2.2 Contacting a landlord as a guest (no account)

When you book a visit, ask a question, apply for a room or join a waiting list, you only give your name, email address, phone number, language, the period you are looking for and an optional message. We record when and for what you gave your agreement, with your IP address, as proof.

• Why: so the landlord can organise the visit, answer your question or handle your application, and so you can follow or cancel your request through the link in our emails.
• Legal basis: steps you ask for before a possible rental contract (Article 6(1)(b) GDPR). The waiting list is based on your consent (Article 6(1)(a) GDPR): you can leave it at any time with the link in every reminder.
• Controller: the landlord (Kot360 is processor).

2.3 After the landlord decides to go ahead with you

Only then does the landlord ask for more: date of birth, home address, school and study, and the contact details of up to two parents or guardians. Your national register number is optional; if you give it, it is stored encrypted. You choose which parents receive copies of the contract and the rent overview.

• Why: to prepare the offer and the rental contract and to check whether a parent has to co-sign (for example when you are under 18).
• Legal basis: preparing and performing the rental contract (Article 6(1)(b) GDPR).
• Controller: the landlord.

2.4 Your student account and the Kot360 app

To use the app you create an account with your email address and a password (stored only as a secure hash). One account works for every landlord you rent from. If you allow it, we send push notifications to your device; we then store the technical subscription of your browser.

• Why: to let you log in, see your contract, payments, deposit and repairs, and to notify you.
• Legal basis: performing our terms of use (Article 6(1)(b) GDPR); push notifications only with your permission (Article 6(1)(a) GDPR), which you can withdraw in your browser or in the app.
• Controller: Kot360 for the account itself; the landlord for the rental data you see in it.

2.5 The rental: contract, rent, deposit, repairs and inspections

Depending on the services the landlord uses, the following data is processed:

• Contract and signatures: the contract, the people who sign it, the time and proof of signature. Online signatures go through Yousign.
• Rent: the rent schedule, the structured payment reference, payments and reminders. If the landlord connects their bank account (through Ponto), incoming transfers on the landlord's account are read to tick off rent automatically, including the name and account number (IBAN) of the payer. IBANs are stored encrypted.
• Deposit: the form and amount of the deposit, its status and the release agreement.
• Repairs: your description, photos, comments and planned visits.
• Inspections: the move-in and move-out reports, with photos, meter readings and confirmations.
• Legal basis: performing the rental contract (Article 6(1)(b) GDPR) and the landlord's legal obligations, for example on deposits and accounting (Article 6(1)(c) GDPR).
• Controller: the landlord.

2.6 Landlords and their team

• What: name, email, phone, password hash, role in the team, company details (name, address, VAT number, IBAN), the addresses of the houses, invoices, usage of paid options and the payment mandate with Mollie.
• Why: to provide the service, bill it and support you.
• Legal basis: performing the contract with the landlord (Article 6(1)(b) GDPR) and our accounting obligations (Article 6(1)(c) GDPR).
• Controller: Kot360.

2.7 Address suggestions and translations

When you type an address in a form, the text you type is sent from our server to Google (Places API) to suggest matching addresses. Your IP address and the rest of your file are not sent. Coordinates of houses on the map come from OpenStreetMap (Nominatim), not from Google.

• Legal basis: our legitimate interest in correct addresses and an easy form (Article 6(1)(f) GDPR). You can always fill in the fields yourself without using the suggestions.

Automatic translation: when a landlord switches it on, the descriptions they write (houses, rooms, shared spaces and their page) are sent from our server to Anthropic (Claude API), which translates them into the other languages of Kot360. Only those texts are sent. A landlord can always write or correct each language themselves.

• Legal basis: our legitimate interest and the landlord's in showing students the information in their language (Article 6(1)(f) GDPR).

2.8 Interviews with landlords (research)

Before building Kot360 for landlords, we ask landlords about their way of working through an online interview.

• What: the number of rooms, the cities, how you work today, the time steps take, what goes wrong, what you spend and which price you find reasonable. Optional: your name, email address and phone number, the other landlords you mention, and whether you want to be contacted.
• Why: to understand landlords' needs and decide what to build. If you ask for it, to contact you for a demo or when we have a solution for the problems you described.
• Legal basis: your consent (Article 6(1)(a) GDPR) for your name and contact details, which you can withdraw at any time; our legitimate interest in market research (Article 6(1)(f) GDPR) for the answers themselves. Without contact details the answers are anonymous.
• Analysis: to draw conclusions, the answers of all interviews are sent to Anthropic (Claude API) without names, email addresses, phone numbers or the landlords you mention.
• Against fake answers: we note how long the interview took, through which invitation link it came, and a code derived from your internet connection (not your IP address itself) to spot repeated submissions. That code is erased after 30 days. If you leave an email address, we send one email to confirm it. When we switch it on, Cloudflare Turnstile checks that you are not a robot. Legal basis: our legitimate interest in reliable research (Article 6(1)(f) GDPR).
• Controller: Kot360.

2.9 Security, support and abuse

We keep an audit log of important actions (for example signatures, downloads of documents, account deletions and every time a Kot360 staff member looks at a landlord account to help them). Support staff only look at an account to solve a problem, and every such session is logged.

• Legal basis: our legitimate interest in protecting the platform, the users and their data and in preventing fraud (Article 6(1)(f) GDPR).

2.10 What we do not do

• We do not sell personal data and do not use it for advertising.
• We do not use tracking or advertising cookies.
• We do not take automated decisions about you (Article 22 GDPR): the landlord decides who gets a room.

3. Who receives the data?

• The landlord you contact or rent from, and the team members the landlord gives access.
• People you choose, such as the parents or guarantors you add.
• Our service providers (sub-processors), only for the service they provide and bound by contract:

• Authorities, only when the law obliges us.

4. Transfers outside the European Economic Area

Most data stays in the EU. Some providers above can process data outside the EEA:

• United Kingdom (OpenStreetMap): covered by an adequacy decision of the European Commission.
• United States (Google, Anthropic, Cloudflare, Apple, Mozilla): the providers are certified under the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses apply.

Only the minimum leaves the EU: for address suggestions the text you type, for automatic translations the descriptions to translate, for maps and fonts your IP address, for push notifications a short message.

5. How long do we keep data?

When a landlord ends their Kot360 subscription, we delete or return the data we processed for them within [DELETION DAYS] days, unless the law requires us to keep it.

6. Your rights

You have the right to:

• access your data and get a copy (Article 15);
• have incorrect data corrected (Article 16);
• have your data erased (Article 17), unless we or the landlord must keep it by law;
• restrict the processing (Article 18);
• receive your data in a structured, machine-readable format (portability, Article 20);
• object to processing based on legitimate interest (Article 21);
• withdraw your consent at any time, without affecting what happened before (Article 7(3)).

On your account page, under Your data, you can download everything Kot360 keeps about you (Download my data) and delete your account (Delete my account). For everything else, write to help@kot360.be. We answer within one month; for complex requests this can be extended by two months, and we will tell you why. We may ask you to prove who you are.

For data a landlord controls (sections 2.2, 2.3 and 2.5), the landlord decides on your request; we help the landlord answer it.

7. Security

We protect your data with, among other things:

• encrypted connections (HTTPS) and encrypted storage of national register numbers, bank account numbers and bank access tokens;
• strict separation between landlords, enforced in the database itself;
• passwords stored only as a secure hash, and two-factor authentication for Kot360 staff;
• access on a need-to-know basis, with every support session logged;
• daily backups, stored in the EU.

If a data breach is likely to put your rights at risk, we (or the landlord) report it to the Data Protection Authority within 72 hours and inform you without delay when the risk is high (Articles 33 and 34 GDPR).

8. Minors

Kot360 is meant for students, who are often 17 or 18 when they look for a room. When a student is under 18, a parent or guardian usually co-signs the contract; the landlord sets this rule.

9. Complaints

Please contact us first at help@kot360.be; we would like to solve the problem. You can always lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be, or with the authority of the EU country where you live or work.

10. Changes

We update this policy when Kot360 changes. The date at the top shows the latest version. We inform you by email or in the app about important changes.