Locari takes the data protection admin off your plate during the rental process: consent is collected automatically, its status is tracked, and applicant data is deleted automatically once a rental case is finished. You stay in control at all times.
What Locari does automatically: send consent emails, send reminders (day 1, 3, 5), expire consent after 10 days without response and delete the data, and clean up finished rental cases once the retention period ends. What you decide: whether to withdraw a consent manually, whether to delete applicant data early, which privacy policy is linked in the application form.
Common Tasks
- Check an applicant's consent status
- When applicant data is deleted
- Delete an applicant on request
- View and track consents
- GDPR checklist for your team
- Understand consent emails and language
Where to Find Data Protection in Locari
Everything around consent lives inside the relevant rental case, in the Consents tab. There you see:
- the privacy policy linked for this listing (Locari template, your own URL, or your own PDF),
- the list of all consents from the applicants of this rental case, with status, request date, reminders, and channel.
The applicant profile also shows the consent status for reference. Managing consent (reminder, withdrawal, deletion) happens in the Consents tab of the rental case.
How To
Check data protection at first contact
- A new applicant contacts you — Locari automatically sends the consent email.
- Example: Applicant Schmidt receives an email in German (listing in Germany) to consent to AI-assisted profile evaluation.
- Open the rental case > Consents tab — the status per applicant is shown as "Pending", "Granted", "Declined", "Withdrawn", or "Expired".
Handle a manual deletion request
- Applicant writes: "Please delete my data."
- Open the rental case > Consents tab and find the applicant.
- While the process is still active: inform first, delete after it ends — applicants can withdraw their application themselves at any time via the withdrawal link.
- Delete via the Delete data button in the consent table — deletion runs immediately and completely.
What Locari Manages Automatically
Consent (Art. 6(1)(a) and Art. 22 GDPR)
- Consent email at first contact — in the language of the listing (DE/AT/CH: German, FR: French, GB: English)
- Reminders on day 1, 3, and 5 for outstanding consent (max 3)
- Automatic expiry after 10 days without response — applicant data is then deleted automatically
Automatic Deletion After Completion
Once a rental case is completed, Locari automatically schedules deletion of the applicant data after a retention period of 180 days (evidence preservation under German anti-discrimination law, AGG). You don't need to configure anything. More under Data Deletion.
Data Subject Rights
- Art. 15 Access / Art. 20 Data portability: On an applicant's request you, as the controller, provide the information. Locari stores applicant data in a structured form in the applicant profile.
- Art. 16 Rectification: Edit applicant data directly in the applicant profile.
- Art. 17 Erasure: manually via Delete data or automatically after the retention period expires.
- Art. 7(3) / Art. 21 Withdrawal and objection: The withdrawal link in every consent email is permanently valid — a withdrawal triggers immediate data deletion.
Views and Fields
"Consents" Tab in the Rental Case
The consent table shows per applicant:
- Applicant (email address)
- Status: Pending / Granted / Declined / Withdrawn / Expired
- Requested: date of the first consent email
- Reminders: number of reminders sent (0–3)
- Method / channel and IP address (in the overview of completed consents)
- Actions: Send reminder (only when status is "Pending") and Delete data
Clicking a row opens the detail view with all timestamps and — for granted consent — the Withdraw consent button.
Privacy Policy per Listing
In the same tab you choose which privacy policy applicants of this rental case receive:
- Locari template (recommended, generated from your account data)
- own URL or own PDF — in which case Locari shows a ready-made data-processing clause to include in your own policy.
Audit and History
After a complete deletion, the consent record remains anonymized (the email is replaced by an anonymized identifier; timestamps and status are retained), to provide proof to supervisory authorities (Art. 7(1) GDPR).
Deleting via Delete data removes the applicant's profile, documents, communication, and notes irreversibly. If consent had already been granted, only the anonymized consent record remains as proof; if consent was still pending, that record is removed as well.