Privacy Policy

The controller of personal data is the legal entity operating the platform:

Legal name

MB Habidesk

Company code

308166308

VAT number

not registered for VAT

Registered address

Skruzdėlių takas 23, LT-51336 Kaunas, LT

Email

[email protected]

Use the same email address for data protection matters.

• Account and identity data — first name, last name, email, password, phone number, data from external account sign-in. Used for account administration and security.
• Payment data — payment and payout history, invoices. Payment card details and the host's bank account are handled directly by our payment partner Stripe; we neither see nor store them.
• Tax data (DAC7) — taxpayer identification number, date of birth, company registration number, VAT number, registered address. Collected on the basis of a legal obligation, so that the platform can report host earnings to the tax authority as EU Council Directive 2021/514 requires.
• Listing and booking data — space addresses, photos, booking times, dispute history.
• Technical data — IP address, session data, browser settings.

• Performance of a contract (GDPR art. 6(1)(b)) — creating and administering your account, making bookings, collecting payments and paying out hosts, and correspondence about a specific booking.
• Legal obligation (GDPR art. 6(1)(c)) — issuing and retaining invoices, accounting, DAC7 reporting to the State Tax Inspectorate, and anti-money-laundering requirements.
• Legitimate interests (GDPR art. 6(1)(f)) — account and payment security, fraud prevention, technical logs and error monitoring, handling disputes and defending legal claims. You may object to processing on this basis.
• Consent (GDPR art. 6(1)(a)) — only where we ask for it separately. You can withdraw consent at any time, without affecting processing carried out before the withdrawal.

• Personal and account data — until the account is deleted. Deletion makes the account unreachable immediately and anonymises the email address and username; data tied to completed bookings is kept for the periods below.
• Accounting documents, invoices and the tax data reported under DAC7 — 10 years (in accordance with Lithuanian law).
• Dispute and booking history — 10 years (to protect against legal claims within the limitation period).
• Messages on a booking — kept with the booking itself. New messages cannot be sent once 14 days have passed since the booking ended, or once it is cancelled, but the conversation stays visible to both parties and may be used as evidence when a dispute is settled.

We do not sell or share your personal data for marketing purposes. Data may only be shared with the following partners:

The other party to a booking. Once a booking is confirmed, the renter sees the host's name, the exact address of the space, the access instructions and the host's phone number, and the host sees the renter's name and any message they left. From the moment a booking is created the two can also message each other on the platform; those messages are seen only by them and, when a dispute is raised, by a Habidesk administrator, who never writes in the conversation. The phone number is needed alongside messaging rather than instead of it: at a door that will not open a person calls rather than writes, and cannot wait for a reply. The legal basis is performance of the contract (GDPR art. 6(1)(b)). None of this is disclosed before confirmation.

A host you ask a question. You can ask a host a question from their listing without booking anything. They then see your first name, your question and the time you are asking about, if you had picked one; they do not receive your address, your phone number or your surname, and no money moves. The legal basis is your own request to make contact (GDPR art. 6(1)(b)). The conversation is seen only by the two of you and, when a dispute is raised, by a Habidesk administrator.

• Payment service providers. Payments and payouts run through Stripe, which also verifies a host's identity as part of opening their payout account — we use no separate identity-checking service.
• The State Tax Inspectorate (STI) — for legally required reports.
• Server, email, SMS and infrastructure providers. The main processors are Stripe (payments), Hetzner (servers), Cloudflare (content delivery and file storage), Resend (email), Twilio (SMS), Google (sign-in with a Google account and, with your consent, visitor statistics), DeepL (translating listing texts), Laravel (Nightwatch, which collects the platform's error and performance logs — these can contain the address of the page you were on and the identifier of your account) and Komoot (Photon, the address search in the listing and search forms: what you type into that one field is sent to it as you type).

The servers running the platform are located within the European Union. Some providers (Stripe, Twilio, Resend, Cloudflare, Google) are established in, or process data in, countries outside the European Economic Area; such transfers rely on the European Commission's standard contractual clauses or on an adequacy decision.

We use strictly necessary cookies and browser storage only: they keep you signed in and remember your chosen language and your cookie preference. The site would not work without them, so they do not require separate consent.

We measure visitor traffic with Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and does not fingerprint you — it neither identifies you personally nor follows you across sites. It therefore requires no separate consent.

With your consent, we use Google Analytics to see how many people look for spaces and where they drop off. Without consent it is not loaded at all: the script is only fetched once you tick the analytics cookies. The data is processed by Google Ireland Limited, and some of it may be transferred outside the European Economic Area under the European Commission's standard contractual clauses.

We use no marketing cookies. Should we start using them, we will ask for your consent first. Any consent can be withdrawn at any time through the cookie settings in the page footer.

We care deeply about the security of your data and your peace of mind. At any time you may:

• Check what data we hold about you.
• Request correction of inaccurate or outdated information.
• Delete your account in account settings, or ask us to remove your data. Deletion takes effect at once: the account cannot be signed into, your email address and username are anonymised, and your listings stop being shown publicly (inside bookings already made they stay visible to the other party, as part of that booking's record). Some data has to stay — invoices, accounting records and the history of completed bookings and disputes, for the periods in section 04 — because keeping it is a legal obligation rather than our choice.
• In certain cases, restrict or object to the processing of your data.
• Receive the data you gave us in a machine-readable format, or ask us to transfer it to another provider, where that is technically possible.
• Withdraw a consent you have given, at any time. Withdrawal does not affect processing that already took place.

Write to us at [email protected] and we will answer within one month. If you believe we are handling your data wrongly, you may also lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, Vilnius, [email protected]) — or with the supervisory authority of the country you live in.