- Why does IOM collect your personal data on the platform?
- Who processes your personal data and with whom are they shared?
- Security of personally identifiable information
- Changes to this privacy notice
- Rights and contact information
- Privileges and immunities and applicable law
- Data Sharing Agreement
- Update effective date
Why does IOM collect your personal data on the platform?
Personal data needed to use the housing matching functionalities of the PATHS Platform
IOM may collect personal information about you when you use the PATHS Platform to register (for) a housing listing or apply for support from an intermediary organization. The following categories of personal data are required:
For persons seeking housing:
- Name and contact details (email address, phone number)
- Demographic information relevant to housing: household size, age range, gender composition
- Information on current accommodation situation and residency status (to verify eligibility)
- Languages spoken (to support communication and appropriate matching)
- Housing preferences: location (region), size, accessibility needs, budget range
For property owners or housing providers:
- Name and contact details (email address, phone number)
- Property details (address, size, type, characteristics, rental conditions)
- Availability details and rental conditions
- Property ownership or management information (proof of ownership or mandate) if needed
For NGOs providing housing support:
- Organization name and contact details (email address, phone number, address)
- Contact person details (name, role, email, phone number)
- Area(s) of operation and type of support provided (e.g. social accompaniment, legal or administrative assistance, housing mediation, other types of support)
For all types of users:
- User account information (login credentials, language preference)
- Communication records related to housing matching (messages, notifications, status of the application and/or housing listing)
Information you choose to give us
You can choose to provide us with additional personal information, including:
- Additional Profile Information, such as personal description, and any additional profile information you may want to provide.
- User-generated content such as any photos or other content you choose to provide
Information automatically collected
When you use the PATHS Platform, IOM automatically collects certain information to help administer, protect, and improve the platform’s services. This information may include:
- Usage information such as searches for housings you have made, files downloaded, access dates and times and other actions on the PATHS Platform including the pages or content you view and links you click to third-party applications
- Device information such as IP address, hardware and software information, device information, and operating system.
- Cookies as described in IOM’s Cookie Policy for the PATHS platform
Who processes your personal data and with whom are they shared?
IOM collects personal data for one or more of the following purposes:
- Enable users to register and access the platform
- Verify eligibility and authenticity of users, listings, and intermediary organizations to ensure the integrity and security of the platform.
- Enable housing matching between refugees seeking housing and property owners or managers, based on relevant criteria such as location, size, budget, accessibility needs, and language compatibility.
- Allow NGOs to assist refugees throughout the matching process, including by sharing verified information with relevant partners (with consent where required).
- Facilitate communication and collaboration among users (beneficiaries, housing providers, and NGOs to support the housing search, application, and rental process.
- Provide personalized user experiences, such as displaying suitable listings or tenant profiles in the user’s preferred language and region.
- Monitor and improve platform performance through aggregated, anonymized data analysis to enhance functionality and user support services.
Personal data are used solely for these purposes and are not shared with third parties for commercial or unrelated objectives.
Security of personally identifiable information
IOM may share users’ personal data with:
- Platform co-administrators, notably Fedasil and Orbit vzw, in order to support the matching process between beneficiaries and housing solutions made available through the platform.
- Other registered and validated users of the platform including property owners and NGOs: in order to provide the requested services, including matching registered individuals to the housing listing, provide support during matching, facilitate communication with landlords and provide support with rental agreements.
- Service Providers: IOM may need to share some information you shared with us with the external service provider Assist Asia to ensure the improvement and/or maintenance of the platform and provide any required technical support.
Changes to this privacy notice
The PATHS Platform implements a series of technologies and security measures, such as encryption and/or authentication tools, in order to safeguard the information maintained on our systems from misuse, unauthorized access or disclosure, alteration, or loss.
Although IOM applies all reasonable means to ensure that the information you provide us is not used by third parties for purposes other than those described in this Privacy Notice, IOM cannot guarantee that unauthorized third parties will never be able to defeat those measures or use your personal information for improper purposes. You should be aware that no transmission of information via the Internet is ever totally secure. Transmission is therefore at your own risk, and IOM assumes no responsibility for the security of the information. IOM shall not be liable for any loss or damage arising from your use of the PATHS Platform (including any liability arising from any interruptions, delays, errors or lost data that may occur, bugs, Virus, Malicious Code, etc. )
While IOM makes every effort to ensure the materials available on its websites are free of any software virus, it cannot guarantee that the materials are free from any or all software viruses. IOM is not responsible for any loss or damage caused by software and related codes, including viruses and worms.
Rights and contact information
Please note that this Privacy Notice can change from time to time. If you return to this website after a period of more than one month, please check this Privacy Notice to confirm that you are aware of the details of the most recent update. The updated notice will be posted on this page and, if changes from the previous version are significant, a more prominent notice will be provided.
Your continued use of this Platform after we post a new Privacy Notice will constitute your acceptance of the new terms and the use of your personal information, including information previously given to us, under the conditions described in the updated Privacy Notice.
Privileges and immunities and applicable law
You can request IOM to (a) have information about the processing of your personal data by IOM, (b) access your personal data, (c) correct your personal data, and (d) delete your personal data. You may also object to the further processing of your personal data and/or withdraw your consent. IOM will need to verify your identity to be able to assess your request, and it may not always be able to comply, for example, due to safety and security considerations. IOM will assess this on a case-by-case basis and if a restriction is found to be applicable, you will be informed of our reasoning related to this. You can also submit complaints concerning the processing of your personal data by IOM.
You may exercise any of the above rights, submit complaints or obtain further information by contacting IOM at iombelgiumpaths@iom.int.
Data Sharing Agreement
Agreement on the Transfer of Personal Data Between International Organization for Migration (IOM) and all rental applicants, landlords and intermediary organizations on the PATHS digital platform
This Data Transfer Agreement is entered into by the International Organization for Migration, hereinafter referred to as “IOM”, a related organization of the United Nations, acting through its Country Office in Belgium and Luxembourg, Rue Belliard 35, 1000 Brussels, and all rental applicants, landlords, and intermediary organizations, hereinafter referred to as the “Receiving Party.” IOM and the Receiving Party are also referred to individually as a “Party” and collectively as the “Parties”.
- This Agreement aims to govern the sharing of personal data relating to rental applicants, landlords, and intermediary organizations for the purpose of facilitating access to housing through the relevant platform and associated support mechanisms.
- The sharing of personal data is limited to what is strictly necessary to achieve the following objectives;
- Facilitate rental applications and matching processes between beneficiaries and landlords
- Enable landlords to assess the suitability of applicants for rental properties
- Support conclusion and performance of rental agreements
- Enable landlords to assess the suitability of applicants for rental properties.
- Support the conclusion, administration, and performance of rental agreements.
- Enable IOM to analyze collected data for policy development and programmatic improvement, including the identification of housing barriers and enhancement of housing pathways, based exclusively on aggregated and/or anonymized data.
- Allow intermediary non-governmental organizations (NGOs) to support beneficiaries throughout the housing search and rental process, including verification of applicant information, facilitation of communication, mediation with landlords, and provision of administrative or legal assistance where required.
- Ensure the integrity, security, and proper functioning of the platform, including verification of the authenticity and eligibility of users, property listings, and intermediary organizations.
- Provide personalized and relevant housing options based on user-defined preferences, such as household size, accessibility needs, preferred location, and other relevant matching criteria.
- Facilitate communication and coordination among beneficiaries, landlords, NGOs, and platform administrators throughout the housing search, application, and rental lifecycle.
- Enable performance monitoring and service improvement through the analysis of aggregated and anonymized platform usage data, with the objective of improving user experience, accessibility, and operational effectiveness.
- Parties acknowledge that in respect of the selected Personal Data that is processed pursuant to the terms of this Agreement, each Party acts as a Data Controller and at no point do either Party intend to act as a Data Processor on behalf of the other Party or as joint Data Controllers.
DATA TRANSFER
- In accordance with its Data Protection Principles and the provisions of this Agreement, IOM may transfer to the Receiving Party the following categories of personal data relating to applicants, landlords, and authorized users (hereinafter referred to as the “Selected Personal Data”), insofar as such data is strictly necessary for the purposes set out in Article 1:
- Identification and contact details, including name, email address, and telephone number associated with user accounts.
- Demographic information, such as household size, age ranges, and household composition.
- Housing-related information, including current accommodation situation and residency status.
- Language preferences.
- Proof of property ownership provided by landlords for the purpose of listing verification.
- Communication records generated through the platform, including messages, notifications, and application or listing status information.
- Usage data, including search history, pages viewed, downloads, and timestamps, to the extent necessary for platform operation and improvement.
- Technical and device data, such as IP address, hardware and software details, and operating system information, collected for security, access control, and system integrity purposes.
- Cookie data, processed in accordance with the PATHS Cookie Policy.
No personal data shall be transferred or processed beyond what is necessary to achieve the purposes defined in this Agreement.
The Selected Personal Data is transferred by IOM to the Receiving Party exclusively to enable the operational implementation of housing search, matching, and rental support activities under the project.
In particular, the transfer of personal data enables intermediary non‑governmental organizations (NGOs), acting as operational partners, to:
- Verify beneficiary information and eligibility in relation to housing applications.
- Facilitate and support communication between beneficiaries and landlords.
- Assist beneficiaries with rental applications, mediation processes, and procedures related to the conclusion and management of rental agreements.
In addition, co‑administrators of the platform, including Fedasil, Orbit vzw, and other authorized NGOs with platform access, require access to personal data to:
- Validate property listings and ensure the integrity and proper functioning of the platform.
- Coordinate housing solutions and support appropriate matching between beneficiaries and available housing options.
Personal data shared under this Agreement shall not be processed for commercial purposes or for any purposes unrelated to the objectives of the project.
The Selected Personal Data is transferred and made available primarily in electronic format through secure systems and platforms, in accordance with the purposes set out in this Agreement.
Personal data shall be shared only with authorized users and entities, using appropriate technical and organizational measures to ensure confidentiality, integrity, and security.
Format of data sharing: Personal data is stored and shared primarily in electronic format, including but not limited to:
- User profiles, uploaded documents, messages, and application or listing status records.
- Digital logs and system‑generated information necessary for platform operation, security, and oversight.
Paper copies of personal data may be created by external organizations (such as NGOs) solely for case management or operational purposes. Such paper-based processing falls outside the platform’s internal data processing environment and remains subject to the confidentiality and data protection obligations of the respective organization.
Methods of data sharing: Personal data is shared using the following methods:
a) Secure online PATHS platform interface
- Access to personal data is governed by role‑based access controls, ensuring that NGOs, landlords, and co‑administrators access only the information necessary to perform their respective functions.
- Communication, application workflows, and listing management are conducted within the platform through secure internal functionalities.
b) Secure digital transfer to service providers
- Personal data may be transferred to technical service providers exclusively for platform maintenance, hosting, or technical support purposes.
- Such transfers are limited to data strictly necessary for these activities and are subject to appropriate confidentiality and security obligations.
c) Internal secure systems of authorized partners (IOM, Fedasil, Orbit vzw)
- Used for verification activities, matching coordination, monitoring, and oversight related to the project.
All transfers are protected by appropriate technical safeguards, including encryption, authentication mechanisms, and access controls.
OBLIGATIONS: Each Party warrants that it shall process personal data in accordance with its applicable data protection framework.
Obligations of the Receiving Party
- The Receiving Party warrants that it shall comply with the data protection safeguards outlined in this Agreement. In particular, the Receiving Party undertakes to:
- Use the selected Personal Data it receives from IOM exclusively for the specified purpose of transfer mentioned in Article 2.2. The Receiving Party shall make no other use of the selected Personal Data under the Agreement without IOM’s prior written consent.
- Implement and maintain technical and organizational measures to safeguard the security of the selected Personal Data and protect its confidentiality, integrity, and availability. Such measures must be proportionate to the sensitivity of the selected Personal Data.
- Maintain strict standards of confidentiality, employ appropriate access control measures and ensure that all transmissions of the selected Personal Data are encrypted.
- Take all reasonable steps to limit the access to the selected Personal Data on a strictly applied “need to know” basis to its authorized employees and agents.
- Take all reasonable steps to ensure that all its employees, agents and subcontractors abide by the confidentiality obligations under this Agreement.
- Prohibit any processing of the selected Personal Data which is not in accordance with the terms of this Agreement.
- Not further process, disclose, publish or transmit the selected Personal Data to any third party, without the prior written permission of IOM.
- Retain the selected Personal Data only to the extent, and in such a manner, that is necessary to fulfill the specified purpose(s) of transfer.
- Respect the rights of Data Subjects to access, correction, deletion, objection, and information regarding the processing of their Personal Data as per the obligations set out in the Receiving Party’s applicable data protection framework.
- Immediately notify IOM in writing upon becoming aware of any actual or suspected Personal Data Breach in respect of the selected Personal Data, in particular if the data breach is likely to result in personal injury or harm to the Data Subjects.
Dispute resolution:
- Any dispute, controversy or claim arising out of or in relation to this Agreement, or the breach, termination or invalidity thereof, shall be settled amicably by negotiation between the Parties.
- In the event that the dispute, controversy or claim is not resolved by negotiation within 3 (three) months of receipt of the notice from one Party of the existence of such dispute, controversy or claim, either Party may request that it be submitted to mediation in accordance with the UNCITRAL Mediation Rules in effect at the time of the dispute.
- In the event that mediation is not successful, either Party may submit the dispute, controversy or claim to arbitration in accordance with the UNCITRAL Arbitration Rules in effect at the time of the dispute no later than 3 (three) months following the date of termination of the mediation as per Article 9 of the UNCITRAL Mediation Rules. The number of arbitrators shall be one and the language to be used in the arbitral proceedings shall be English. The appointing authority shall be the Secretary General of the Permanent Court of Arbitration. The arbitral tribunal shall have no authority to award punitive damages. The seat of the arbitration shall be Geneva, Switzerland.
- All aspects of the dispute resolution as per paragraphs 1 to 3 of this Article shall be treated as confidential by the Parties and all others involved.
- The present Agreement as well as the arbitration agreement above shall be governed by the terms of the present Agreement and supplemented by internationally accepted general principles of law (including the UNIDROIT Principles of International Commercial Contracts) for issues not covered by the Agreement, to the exclusion of any single national system of law that would defer the Agreement to the laws of any given jurisdiction.
- This Article survives the expiration or termination of the present Agreement.
Use of IOM Name: The official logo and name of IOM may only be used by the Receiving Party in connection with this Agreement and with the prior written approval of IOM.
Status of IOM: Nothing in or relating to the Agreement shall be deemed a waiver, express or implied, of any of the privileges and immunities of the International Organization for Migration as an intergovernmental organization.
Breach of Agreement: The Parties acknowledge and agree that any breach of confidentiality obligations under this Agreement shall cause IOM and IOM beneficiaries substantial and irreparable damage. If the Receiving Party makes or threatens such breach in violation of this Agreement, IOM shall be entitled to immediate injunctive relief, or any other remedy available.
Assignment: The Receiving Party shall not assign any rights or obligations arising under this Agreement in part or all, unless specifically authorized by IOM in writing in advance.
Term and Termination: This Agreement may be terminated by one (1) months’ written notice to the other Party. However, where the Receiving Party is in breach of any of the terms and conditions of this Agreement, IOM may terminate the Agreement with immediate effect.
Severability: If any part of this Agreement is found to be invalid or unenforceable, that part will be severed from this Agreement and the remainder of the Agreement shall remain in full force.
Entirety: This Agreement embodies the entire agreement between the Parties and supersedes all prior agreements and understandings, if any, relating to the subject matter of this Agreement.
Update effective date
Nothing in this Privacy Notice shall be construed as constituting a waiver of the privileges or immunities of IOM, nor as its acceptance of the jurisdiction of the courts of any country over disputes arising out of this Privacy Notice. You understand that IOM’s processing of your personal data is governed by IOM’s regulations, rules and policies, to the exclusion of any national or regional system of law.
This Privacy Notice is effective as of 13 April 2026.
