01 Introduction
Propertico is an online property listings service. Listings are published by real-estate agencies, their agents and private advertisers; visitors search them and contact the advertiser directly. This policy explains how we handle personal data in that process.
It applies to all data collected through https://propertico.hr/, the user portal and our emails. It has been drawn up in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation) and the Croatian Act implementing the GDPR (Official Gazette 42/18).
We have tried to write it plainly. If anything is unclear, or you want to exercise one of your rights, contact us at [email protected].
02 Controller and contact
The controller of personal data is:
For any data-protection question and to exercise your rights, contact us at [email protected] or by post to our registered address.
We have not appointed a data protection officer, because the conditions in Article 37 GDPR are not met. Data subject requests are handled by the company's management at the address above.
When the advertiser is an independent controller
When you send an enquiry about a listing, we pass your details to the advertiser. From that moment the advertiser becomes an independent controller of that data and is itself responsible for any further processing, including for informing you and honouring your rights. See the section on enquiries.
03 What data we collect
How much data we hold depends on how you use the platform.
Visitors (without an account)
Browsing listings requires no registration. When you visit we collect:
- technical access data — IP address, browser type and version, device, operating system, language, and the page you arrived from;
- usage data — which pages and listings you opened, the search terms you entered and the filters you selected;
- data from cookies and similar technologies, if you have consented to them — see the section on cookies;
- content you save to your own device — favourites, recently viewed listings and personal notes; while you are not signed in, that data stays in your device's browser.
Registered users
When you open an account we collect:
- first name, surname, email address and password in encrypted form (we never store passwords in readable form);
- telephone number with dialling code, if you enter one;
- date of birth, gender, country and profile photograph, if you enter them — these fields are optional;
- sign-in data from your Google account (name, email address, profile picture), if you sign in that way;
- your consent status for receiving news and promotional messages;
- the content you create in the portal — saved searches, favourites, personal notes on listings and your listing view history.
Advertisers
If you publish listings, we process the following in addition to the above:
- company or sole-trader details — name, VAT ID, address, office addresses and telephone numbers, website;
- contact person (agent) details — first name, surname, email address, telephone number and photograph, whether you enter them yourself or the agency supplies them through a data feed;
- listing content and a record of its changes;
- billing data — invoicing details, subscription and invoice history, and payment method data (of a card we keep only the brand, last four digits and expiry date);
- credentials for your system's data feed, which we store in encrypted form.
People sending enquiries
When you send an enquiry to an advertiser or to us, we collect:
- first name, surname, email address and telephone number;
- the content of your message and the listing it relates to;
- a cryptographic hash of your IP address and browser details, to protect the forms from abuse.
Other sources
- Agency data feeds — we import listings and agent details from the systems of agencies with which a technical connection is in place, on the agency's instruction and warranty.
- Publicly available sources — company data from public registers, to verify and correct business details.
- Incoming email — when you write to us, we store the message and the sender's details in our customer communication system.
We do not deliberately collect special categories of personal data (data on health, religion, political opinions and the like) and ask you not to include them in messages or listings.
04 Purposes of processing and legal bases
We process personal data only where there is a valid legal basis:
| Purpose | Data | Legal basis |
|---|---|---|
| Displaying the site and basic platform operation | technical access data, necessary cookies | legitimate interests (Art. 6(1)(f)) — secure and correct operation of the service |
| Running your account and providing portal features | account data, saved searches, favourites, notes | performance of a contract (Art. 6(1)(b)) |
| Passing your enquiry to the advertiser and responding to it | first name, surname, email, telephone, message | performance of a contract / steps taken at your request (Art. 6(1)(b)) |
| Publishing and displaying listings | listing data, advertiser and agent details | performance of the contract with the advertiser (Art. 6(1)(b)) |
| Protection against unsolicited and malicious messages | hashed IP address, browser details, form behaviour | legitimate interests (Art. 6(1)(f)) — service security and protecting advertisers |
| Saved-search alerts | email address, search criteria | consent (Art. 6(1)(a)); for signed-in users, performance of a contract (Art. 6(1)(b)) |
| Sending news and promotional messages | email address, name | consent (Art. 6(1)(a)) |
| Audience measurement and analytics | usage data, cookie identifiers | consent (Art. 6(1)(a)) |
| Advertising and measuring advertising performance | cookie identifiers, hashed contact details, IP address | consent (Art. 6(1)(a)) |
| Billing, invoicing and keeping business records | invoicing details, payment history | legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b)) |
| Handling complaints and legal claims | correspondence and related data | legitimate interests (Art. 6(1)(f)) — establishing and defending legal claims |
| Acting on reports of illegal content | details of the reporting party and the advertiser | legal obligation (Art. 6(1)(c)) under Regulation (EU) 2022/2065 |
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.
05 Recipients of data and transfers outside the EU
We do not sell data. We share it only with service providers who perform specific tasks for us (processors), with advertisers you send an enquiry to, and with the competent authorities where the law requires it.
Service providers
| Recipient | Purpose | What is transferred | Condition |
|---|---|---|---|
| Google Ireland (Google Analytics 4) | audience measurement | site usage data, cookie identifiers, truncated IP address | only with analytics consent |
| Google Ireland (Google Ads) | measuring advertising performance | cookie identifiers, conversion data | only with marketing consent |
| Meta Platforms Ireland (Pixel and Conversions API) | advertising and conversion measurement | cookie identifiers, IP address, browser details, and cryptographic hashes of email address, telephone number and name | only with marketing consent |
| Microsoft Ireland (Clarity) | usage analysis, session recordings and heatmaps | interface interactions, device details; input into form fields is masked | only with analytics consent |
| Functional Software, Inc. (Sentry) | monitoring technical errors and application stability | error diagnostics, technical browser details, and a recording of the part of the session in which an error occurred | legitimate interests — service security and correctness |
| Google Ireland (Gemini) | generating and translating content, and assisting search | listing text and the queries described in the section on artificial intelligence | performance of a contract and legitimate interests |
| Sendinblue SAS (Brevo) | sending the newsletter | email address | only with consent |
| Stripe Payments Europe, Ltd. | card payment processing | payment data, payer's name and email address | performance of a contract |
| OpenStreetMap Foundation | displaying the map on a listing page | your device's IP address when map tiles are fetched | performance of a contract — the map is part of the listing display |
| Hosting and mail server provider | running the platform and sending and receiving email | all data stored on the platform | performance of a contract |
Advertisers
We pass the data in your enquiry to the advertiser whose listing you enquired about — described in detail in the next section.
Authorities and others
We may disclose data to courts, the police and other competent authorities where the law requires it or where it is necessary to establish, exercise or defend legal claims. In the event of a corporate restructuring, data may pass to the legal successor.
Transfers outside the European Economic Area
Some of the service providers listed above are connected with companies established in the United States, so data may to some extent be transferred outside the EEA.
We make such transfers only with appropriate safeguards under Chapter V GDPR — on the basis of a European Commission adequacy decision (the EU–US Data Privacy Framework) or on the basis of standard contractual clauses adopted by the European Commission, together with additional technical and organisational measures. You can request a copy of the safeguards applied at [email protected].
06 Sending an enquiry to an advertiser
This is the most significant way in which your data reaches a third party, so we set it out separately.
When you complete the contact form on a listing page, we send your first name, surname, email address, telephone number and the content of your message by email to the advertiser — the agency that published the listing, its named contact person, or the private advertiser. The message is sent so that the advertiser can reply directly to your email address.
This is necessary for you to receive a reply and is the very purpose for which the form exists. Without passing on that data we cannot process your enquiry.
From the moment it is received, the advertiser becomes an independent controller of your data. It decides for itself how it will use the data and how long it will keep it, and must comply with data-protection law. Address requests concerning the advertiser's processing to the advertiser directly; on request we will help you identify who that is.
We also retain a copy of the enquiry — as proof of delivery, to handle complaints, to prevent abuse of the forms, and so that we can show the advertiser its received enquiries in the user portal.
We also send a confirmation of your enquiry to your email address.
If our security measures classify a message as unsolicited or malicious, it is not passed to the advertiser but is stored for manual review. If you believe your message was stopped in error, contact us and we will check it.
07 Cookies and tracking
We use cookies and similar technologies in four categories: necessary, preferences, statistics and marketing. Necessary cookies are always set because the site does not work without them; everything else is set only if you have consented.
We record and keep your choice as proof that consent was given, together with the time, the version of the notice and a cryptographic hash of your IP address. We do not store the original IP address.
The full list of cookies, how long they last, and how to change or withdraw your choice are set out in the Cookie Policy.
Data stored on your device
Besides cookies, we store some data directly in your device's browser — favourites, recently viewed listings, personal notes and your cookie choice. If you tick "Save my details for next time" on a contact form, your first name, surname, email address and telephone number are stored in a cookie on your device for up to a year so that we can fill the form in for you next time. You can turn that option off, and delete the data by clearing cookies in your browser.
08 Processing with the help of artificial intelligence
In a few places we use language models provided by Google (Gemini). What is processed is set out precisely below.
- Search assistance — if you use conversational search, we send your query to the model so that it can be translated into search criteria. With your analytics consent we record the text of the query, the criteria identified, the system's reply and the references of the listings shown, in order to improve the service and prevent abuse. Those records are deleted automatically after 14 days.
- Listing summaries and translations — we send listing text (title, description, property type and basic features) to the model to produce a summary and translations into other languages. No personal data is sent.
- Drafting email replies — in our internal communication system the model can suggest a draft reply. For that purpose the content of the correspondence, which may contain the sender's details, is sent to the model. A person always reviews and approves the draft before it is sent.
We take no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do not use these models to profile visitors or to determine the order in which listings are displayed.
The content we send to the model is not used to train public models.
09 How long we keep data
We keep data for as long as is necessary for the purpose for which it was collected, or for as long as the law requires. Once the period expires, data is deleted or irreversibly anonymised.
| Category | Retention period |
|---|---|
| Account data | while the account exists, and up to 12 months after closure for possible claims |
| Listings and their change history | while the listing is published, and up to 24 months after removal |
| Enquiries sent to advertisers | 24 months from receipt |
| Messages stopped as unsolicited | 6 months from receipt |
| Cookie consent records | 24 months from the last change, as proof that consent was given |
| Conversational search records | 14 days (deleted automatically) |
| Records of AI content generation | 90 days (deleted automatically) |
| Rate-limiting records | 48 hours (deleted automatically) |
| Email correspondence and contacts in the communication system | 36 months from the last message |
| Saved searches | until you delete them or unsubscribe from alerts |
| Invoices, contracts and accounting documents | 11 years from the end of the year to which they relate, under tax and accounting law |
| Data processed for legal claims | until proceedings conclude with final effect and limitation periods expire |
Aggregated and anonymised statistics that do not allow an individual to be identified (for example the number of listing views per day) are kept indefinitely.
10 Your rights
In relation to your personal data you have the following rights:
- Access — the right to know whether we process your data and to obtain a copy of it.
- Rectification — the right to have inaccurate data corrected and incomplete data completed.
- Erasure — the right to have data erased where it is no longer needed, where you withdraw consent, or where you successfully object to the processing.
- Restriction of processing — the right to ask us to store the data only, for example while we verify its accuracy.
- Portability — the right to receive the data you gave us in a machine-readable format and transmit it to another controller.
- Objection — the right to object to processing based on legitimate interests. You may object to processing for direct marketing at any time, and we will stop immediately.
- Withdrawal of consent — the right to withdraw consent at any time, without affecting the lawfulness of earlier processing.
How to exercise your rights
Send your request to [email protected]. We will reply without undue delay and at the latest within one month of receiving the request; that period may be extended by a further two months for complex requests, and we will tell you if it is. Exercising your rights is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse to act.
To protect data against unauthorised disclosure, we must reasonably establish your identity before acting, and may ask for further information.
Right to complain
If you believe our processing infringes your rights, you have the right to lodge a complaint with the supervisory authority — the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. We would be glad if you came to us first so that we can try to resolve the matter.
11 Data security
We apply technical and organisational measures appropriate to the risk: an encrypted connection (HTTPS) across the platform, storage of passwords only as cryptographic hashes, encryption of sensitive credentials, restriction of access to those who need it for their work, regular system updates and backups.
We generally do not store visitors' IP addresses in their original form, but as a cryptographic hash.
No system is completely secure. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you without delay and report the breach to the supervisory authority within 72 hours, in accordance with Articles 33 and 34 GDPR.
12 Minors
The platform is not intended for persons under 16 and we do not knowingly collect their data. If we learn that we have collected a minor's data without the appropriate consent of a parent or guardian, we will delete it without delay. Parents and guardians can contact us at [email protected].
13 Changes to this policy
We may amend this policy to comply with the law or to reflect changes in how the platform works. The version in force is always published on this page, showing the date of last modification.
We will inform you of significant changes affecting your rights in an appropriate way — by a notice on the site or by email if you hold an account. If a change requires your consent, we will ask for it before applying it.