1. Data controller
The data controller is Crossfunding S.à r.l. (RCS B 222685 (Luxembourg Trade and Companies Register)), publisher of the platform Moïen.
Registered office: 9 rue du Laboratoire, L-1911 Luxembourg
Data protection contact: This information is being finalised and will be available soon., or through the contact form.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account | First name, surname, email address, password (stored only in an irreversibly encrypted form), Google identifier if you sign in with Google | You |
| Profile | Profile information you provide, role (guest, tenant, landlord, agency), membership of a portfolio or team | You |
| Listings and properties | Address (not published), description, photos, property documents, calendar, prices, subletting permission status | Landlords, agencies |
| Bookings and rentals | Dates, number of guests, amounts, references, history, accepted documents, lease, rent, rent receipts, inventory reports, notice, security deposit | You and the other party |
| Payment | Amounts, payment status and references. Moïen neither collects nor retains your card numbers: when online payment is enabled, they are entered and processed directly by Stripe. | You, Stripe |
| Identity / verification | No identity documents are currently collected. If identity verification is introduced, this policy will be updated before it goes live. | - |
| Introductions and viewings | Introduction record (property, applicant, landlord/agency, contact and viewing dates, post-viewing responses, lease declaration, rent, optional lease document), acceptance of undertakings with version and timestamp | You and the other party |
| Messages | Messages between members and with Moïen support relating to a booking or rental | You |
| AI listing assistance | Photos, documents, text or voice recordings you submit to pre-fill a listing, and the suggestions generated | Landlords |
| Technical data | IP address, browser type, connection and error logs, timestamps | Automatic |
| Cookies and storage | See the Cookie policy | Automatic / your choice |
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Create and manage your account, authenticate you | Performance of a contract (Terms of use) |
| Publish and manage listings, portfolios and teams | Performance of a contract |
| Process bookings, rentals, rent, rent receipts and related messages | Performance of a contract |
| Collect and pay out payments, apply service fees | Performance of a contract; legal obligations (accounting and tax) |
| Track long-term rental introductions, viewings and lease declarations, and prove that a rental originated through Moïen (including leases signed outside the platform) | Performance of a contract; legitimate interests (billing commission, preventing circumvention) |
| Verify and display the "Subletting authorised with Moïen" status | Performance of a contract; legitimate interests (reliable listings) |
| Pre-fill a listing using AI assistance at your request | Performance of a contract (feature requested by you) |
| Send service emails (confirmation, reset, notifications) | Performance of a contract |
| Security, fraud prevention, technical logging | Legitimate interests |
| Display the Google Maps map | Consent ("Functional" category) |
| Respond to enquiries and requests to exercise rights | Legitimate interests; legal obligation |
4. Recipients and processors
Your data is accessible only to authorised Moïen personnel and, where relevant, the other party to your booking or rental (host, landlord, agency, tenant, subtenant). We do not sell your data.
We use the following categories of providers, bound by contract and acting on our instructions:
- Application hosting, database, authentication and private file storage;
- Service email delivery (infrastructure located in the European Union);
- Online payment: Stripe, when enabled;
- Mapping: Google (Google Maps), only with your consent;
- Google sign-in, only if you choose it;
- AI model provider, only when you use AI listing assistance.
We may disclose data to authorities when required by law.
5. Transfers outside the European Economic Area
Some providers (including Google, Stripe and the AI provider) may process data in the United States. These transfers rely on the EU-U.S. Data Privacy Framework where the provider participates, or on the European Commission's standard contractual clauses.
6. Retention periods
| Data | Duration |
|---|---|
| Account and profile | While the account is active, then deletion or anonymisation after closure, unless legally required otherwise |
| Bookings, rentals, invoices and accounting records | For the duration of the relationship, then the statutory retention period applicable to accounting and tax records |
| Introduction records and acceptances | For as long as necessary to prove the rental's origin and recover commission, then the applicable limitation period, subject to legal validation |
| Messages | For the duration of the relevant booking or rental, then limited archiving in the event of a dispute |
| Files submitted to AI assistance | Retained with the relevant property until deleted by the landlord or until the property is deleted |
| Technical logs | Limited period necessary for security |
| Cookie choices | Until changed; requested again whenever the policy is updated |
7. Subletting permissions
The "Subletting authorised with Moïen" badge reflects an actual status recorded by Moïen. It appears only when the landlord or agency has granted permission from their account. This status is retained with the identity of the person who granted it and the date. It is never inferred from data displayed in the browser.
Permissions and related documents (landlord's agreement, amendments, rental documents) are stored in a private area accessible only to the relevant parties and authorised Moïen personnel.
8. Your rights
You have the following rights:
- Access : obtain a copy of your data;
- Rectification : correct inaccurate data, including through your account area;
- Erasure : request deletion of your data, subject to statutory retention obligations;
- Restriction of processing;
- Portability : receive the data you provided to us in a structured format;
- Objection to processing based on our legitimate interests;
- Withdrawal of consent at any time, without affecting the lawfulness of earlier processing ("Manage cookies" link at the bottom of the page).
To exercise your rights, write to us through the contact form. We respond within one month.
9. Complaints
You may lodge a complaint with the supervisory authority: National Commission for Data Protection (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, cnpd.public.lu, or with the authority in your country of residence in the European Union.
10. Security
Access is encrypted (HTTPS). Each item of data is accessible only to its owner and authorised parties, with access rules enforced on the server. Private files are stored in non-public areas. Passwords are never stored in plain text.
Last updated: 26 October 2026.