Leadswap privacy statement Version 1.1, last updated 9 oktober 2026
1. Who we are
Leadswap (www.leadswap.nl) is an online marketplace where real estate agencies pass client requests (leads) and one-off assignments (jobs) to each other. Leadswap is a trade name of Frederik Meijer Holding B.V., Chamber of Commerce number 42039423, Afmijnstraat 53, 1187 ZZ Amstelveen, the Netherlands. Frederik Meijer Holding B.V. is the controller for the processing described in this statement. Privacy questions: privacy@leadswap.nl.
We have not appointed a data protection officer, as this is not required for an organisation of our size. You can contact us about anything privacy-related at the address above.
2. Who this statement is about
- A. Visitors to www.leadswap.nl.
- B. Agencies with an account, and their staff.
- C. People whose details are in a lead: home seekers, buyers, sellers, landlords and owners who asked a real estate agent for help. Please read section 4 in particular.
- D. People carrying out jobs, such as fellow agents and freelancers.
- E. Anyone who contacts us.
3. What data, why, on what basis and for how long
A. Visitors
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| IP address, browser data, pages requested, in server logs | Running and securing the website, fixing faults | Legitimate interest (Art. 6(1)(f)): a secure, working website | 30 days at most |
| Pages visited, referring website, country, device and browser type, without cookies and without a user ID (Vercel Web Analytics) | Understanding how the site is used, in aggregate | Legitimate interest: improving the site | The totals cannot be traced back to you |
| Technical cookies of the login service | Recognising login status, preventing abuse | Legitimate interest; see the cookie statement | See cookie statement |
We do not use advertising cookies, tracking pixels or analytics that follow you individually.
B. Agencies and staff
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, phone, role of the account holder and staff; login details | Creating and securing the account | Performance of contract (Art. 6(1)(b)) | As long as the account exists, then 12 months |
| Agency name, Chamber of Commerce number, VAT number and VAT status, address, service area, specialisations, profile text, profile photo, agency number | Marketplace profile, matching on service area, invoices | Performance of contract | As long as the account exists; invoice data 7 years |
| Leads posted and taken over, chosen success fee percentages, requests, transactions, community and forum posts | Running the marketplace, handling disputes | Performance of contract | As long as the account exists, then 12 months; transaction data 7 years |
| Reports of engagements, agreements and invoices, answers to status requests, the basis and calculation of success fees, verification documents | Establishing, invoicing, checking and paying out success fees | Performance of contract and legitimate interest: correct settlement | As long as settlement and any disputes last; as part of our accounts 7 years |
| Reviews and reputation score | Trust between agencies | Legitimate interest: a reliable marketplace | As long as the reviewed account exists; anonymised if the author's account is deleted |
| Payment and payout data (via Stripe), the stored payment method (SEPA mandate or card) for collecting success fees, reservations, success fees, payouts, invoices | Payments, collection, payouts, invoicing, tax filing | Performance of contract and legal obligation (Art. 6(1)(c); Dutch General Tax Act) | Payment method: as long as the account exists and a success fee may still be collected; financial data 7 years |
| Referral data (who referred whom, commissions) | Running the referral scheme | Performance of contract | As long as the scheme runs; invoices 7 years |
| Email preferences and notifications | Sending notifications about new leads, status and success fees | Performance of contract | As long as the account exists |
| Moderation and suspension decisions, abuse reports, admin log | Preventing abuse, legal duties under the Digital Services Act | Legitimate interest and legal obligation | 2 years after the decision |
C. People whose details are in a lead
| Data | Purpose | Legal basis | Retention at Leadswap |
|---|---|---|---|
| Name, phone number, email address | Passing them to the agency that takes over the lead, so it can contact you | Your consent (Art. 6(1)(a)), given to the agent who posted the lead | See section 4.4 |
| Your housing wish or situation: type of request, region, type of home, budget (as a range), desired period, financing status (only: approved, applied for, or not applied for); for a sale or letting: town, postcode and features of the home, with the address only after takeover | Showing agencies what the request is, without them knowing who you are | Your consent | See section 4.4 |
| Whether the agency that took over helped you further: date and type of engagement or agreement, that agency's fee, for a purchase or tenancy the address of the home and the price or rent; possibly a redacted engagement letter or invoice | Establishing and settling the success fee between agencies (section 4.2) | Legitimate interest (Art. 6(1)(f)): correct settlement of the fee | See section 4.4 |
| Details of your consent: date, channel, text version, reference | Being able to show that you consented | Legal obligation (Art. 7(1) GDPR) and legitimate interest | 2 years after the takeover or expiry of the lead |
| Your request to withdraw or delete | Carrying out your request and being able to show that we did | Legal obligation | 2 years |
We do not process special categories of data (such as health or religion), citizen service numbers (BSN) or copies of identity documents. Agencies are not allowed to put these in a lead.
D. People carrying out jobs
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, contact details, profile, responses to jobs | Assigning and carrying out jobs | Performance of contract | As long as the account exists, then 12 months |
Jobs are not paid through the platform. If we start doing so, we will have to report data on the people carrying out jobs to the Dutch Tax Administration (DAC7). We will update this statement before that happens.
E. Contact
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, contact details, content of your message | Answering your question | Legitimate interest | 2 years after handling |
4. Are your details in a lead?
4.1 How you end up on Leadswap
You asked a real estate agent (the provider) for help, for example to find a rental home. That agent could not (fully) help you and asked whether it may pass your request on to a fellow agency through Leadswap. Your request may only be on Leadswap if you explicitly said yes.
4.2 What happens
- The provider places your request on Leadswap. Other agencies only see the content of your request (such as region, type and budget), not your name, phone number, email address or the address of your home.
- An agency that wants to help you takes over the lead and pays Leadswap a fixed fee for it (the reservation).
- Only then does that one agency (the taker) receive your contact details. It contacts you about your request and, at that first contact, tells you who it is and how it got your details.
- If the taker actually helps you further with renting, letting, buying or selling (you engage that agency, or you conclude a purchase or tenancy agreement through it), the agency pays Leadswap a success fee: a share of its own fee. Leadswap passes part of it on to the provider. There is no success fee for property management.
- You pay Leadswap nothing, and you do not pay the taker more because of these fees. The agency may not pass them on to you.
- Your request is passed to one agency only. You are under no obligation and decide for yourself whether to continue with that agency.
4.3 Who is responsible for what
- The provider is responsible for asking your consent, informing you about it and keeping proof.
- Leadswap is responsible for the platform: security, shielding your contact details until takeover, retention periods, settling the success fee and handling your requests.
- For the period from posting to takeover, the provider and Leadswap have made joint arrangements (Article 26 GDPR). You can come to Leadswap with all your questions and requests, including those about the provider; we make sure they reach the right party.
- The taker is responsible for what it does with your details after the takeover. It may only use them for your request, may not sell them on and may not use them for other marketing. Its own privacy statement applies to its processing.
4.4 How long Leadswap keeps your details
- Lead not taken over: your name and contact details are deleted no later than 30 days after the lead expires or is withdrawn.
- Lead taken over, property management: we keep your name and contact details for up to 6 months after the takeover, to handle disputes between agencies and refunds. Then we delete them.
- Lead taken over, renting, letting, buying or selling (with a success fee): to establish whether the taker helped you and to settle the success fee, we keep your name, contact details and, for a sale or letting, the address of the home until 12 months after the end of the agreed period. That period is 6 months after the takeover if you are looking for a rental home and 12 months for other requests. Your details are therefore deleted no later than 18 or 24 months after the takeover. During that time we use them for this purpose only. The taker may also show us a redacted engagement letter or invoice for this; we use it for the check only. Amounts and dates that form part of our accounts are kept for 7 years, without your contact details.
- What remains (type of request, region, amounts) can no longer be traced back to you and is used for statistics only.
4.5 Withdrawing consent
You can withdraw your consent at any time, without giving a reason. You can do so with the agent you gave consent to, or directly with us via www.leadswap.nl/intrekken or privacy@leadswap.nl. You do not need an account. We will immediately remove your lead from the platform, tell the provider and any taker to stop, and delete your contact details. Withdrawal does not affect anything lawfully done before it. If your lead had already been taken over, we keep only what is needed to settle a success fee (section 4.4); you can object to that (section 9).
5. Who we share data with
Agencies
- Data in a lead: see section 4.
- We only tell the provider whether the taker helped you, when, and the amounts needed to calculate the provider's share; not the further content of your arrangements with the taker.
- Profiles, reviews and jobs are visible to other logged-in agencies.
- Leads and requests from agencies connected to Leadswap (MMRE, a trade name of Urban Amstel Ventures B.V.) are marked; they get no access to data that other agencies do not get.
Service providers working for us (processors)
We have data processing agreements with these parties. They may only use the data on our behalf.
| Party | What | Where |
|---|---|---|
| Vercel Inc. | Website hosting, server logs, cookieless statistics (Vercel Web Analytics), storage of profile photos and files (Vercel Blob) | US company; servers in the EU and the US; data may be processed in the US |
| Neon (Databricks) | Database | Servers in Frankfurt (Germany); US company |
| Clerk Inc. | Login and account security | Processing in the US |
| Resend (Plus Five Five, Inc.) | Sending email notifications | US company; emails also stored in the US |
| The provider of our business email | Our email, including privacy@leadswap.nl | Within the EEA, or outside it with the safeguards in section 6 |
| The provider of an AI service (language model) | Support with the weekly sample check of consent records and with administration; the service does not use our data to train models | Possibly in the US, with the safeguards in section 6 |
Clerk in turn uses Cloudflare, among others, to protect against abuse.
Independent controllers
| Party | What | Where |
|---|---|---|
| Stripe (Stripe Technology Europe Ltd, Ireland, and Stripe Payments Europe Ltd) | Payments, storing the payment method, payouts; identity checks on agencies receiving payouts; fraud prevention | EU, with transfers to Stripe Inc. in the US. Stripe decides itself how it uses data for identity checks and fraud prevention; see stripe.com/privacy |
| An independent accountant | Only if, in case of well-founded doubt, we have it checked whether a success fee was reported correctly | The Netherlands |
| Regulators, police, judicial authorities, Dutch Tax Administration | Only where the law requires us to | The Netherlands or EU |
We do not sell data to parties outside the platform and do not use it for third-party advertising.
6. Data outside the European Economic Area
Vercel, Clerk, Resend and Stripe are (part of) US companies and may process data in the US. This is permitted because these companies participate in the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Article 45 GDPR). Their data processing agreements also contain the European Commission's standard contractual clauses (Article 46 GDPR) as a fallback. The same applies to our email and the AI service if they process data outside the EEA: we only choose providers that participate in the Data Privacy Framework or offer standard contractual clauses. You can ask us for a copy of the relevant safeguards.
7. Security
We take appropriate measures, including encrypted connections (https), shielding lead contact details until takeover, role-based access, logged admin access, verification documents visible to Leadswap only, notification emails without the contact details of the people in leads, and processors with security certifications. If we discover a data breach, we report it to the Dutch Data Protection Authority and to the people concerned where required.
8. No automated decisions
We do not make decisions about people that are based solely on automated processing and that have legal or similarly significant effects. Leads are shown in order of posting; agencies choose for themselves.
9. Your rights
You have the right of access, rectification, erasure, restriction, objection (to processing based on legitimate interest) and data portability, and the right to withdraw consent. Send your request to privacy@leadswap.nl or by post to Leadswap, Afmijnstraat 53, 1187 ZZ Amstelveen, the Netherlands. We respond within one month. To avoid giving data to the wrong person, we may ask you to confirm that the request comes from you, for example via the email address or phone number in the lead. We do not ask for a copy of your identity document.
10. Complaints
If you are not satisfied with how we handle your data, please let us know first. You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
11. Cookies
See our cookie statement at www.leadswap.nl/cookies.
12. Changes
We may update this statement. The date at the top shows when it was last changed. We inform agencies by email of important changes.
Still open in this document (do not publish)
- Go-live date (header):
9 oktober 2026, filled in by the site. Notes on the choices: see the Dutch version.