Privacy Policy

The data controller is Lan Prijatelj s.p., operator of the portal Nepremicnine.eu.

General enquiries: podpora@nepremicnine.eu

Data protection contact (DPO): dpo@nepremicnine.eu

Depending on how you use the portal, we may process the following categories of data:

• Identity and contact data: name, email, phone number, display name.
• Account data: login identifier (Firebase UID), language settings, notification preferences, last login date.
• Listing data: address, description, price, location, photos, property details, advertiser contact details.
• Agency data: name, email, phone, address, logo, team members, CRM webhook URL (if provided).
• Inquiries (leads): name, email, phone, message, viewing date, language, related listing.
• Billing and subscription data: selected plan, subscription status, Stripe identifiers (we do not store full payment card numbers).
• Technical data: IP address (possibly hashed), access time, device type, log records, cookies.
• User preferences: favourites, saved searches, view history (when logged in).

We process personal data for the following purposes on these legal bases (GDPR Article 6):

• Providing and operating the portal, accounts, and listings – contract performance or pre-contractual steps (Art. 6(1)(b)).
• Processing inquiries and forwarding them to advertisers – contract / legitimate interest (Art. 6(1)(b) and (f)).
• Agency plan payments and subscriptions – contract and legal obligation (Art. 6(1)(b) and (c)).
• Security, abuse prevention, inquiry rate limits, CAPTCHA – legitimate interest (Art. 6(1)(f)).
• Email alerts for saved searches, price changes, and system messages – contract or legitimate interest; marketing only with consent (Art. 6(1)(a)/(b)/(f)).
• Visit analytics (Google Analytics 4) – consent via cookie banner (Art. 6(1)(a)).
• Compliance with legal obligations (e.g. accounting) – legal obligation (Art. 6(1)(c)).

Registration uses Firebase Authentication for identity verification. Login data at that level is also processed by Firebase (Google) as a processor.

We retain account data while the account is active. After deletion we erase or anonymise data within a reasonable period, unless retention is required by law or legal claims.

Listing and agency data is publicly displayed on the portal to the extent defined by the advertiser. Agencies may configure a CRM webhook to automatically forward inquiries to their own systems.

Agency team members access data within permissions set by the agency owner.

When you submit an inquiry, your contact details are forwarded to the selected advertiser or agency. The advertiser is an independent controller or processor for further processing, depending on context.

To prevent abuse we may store a hashed IP address and apply hourly submission limits.

Inquiries are retained for up to 24 months after last activity, unless law or an agency agreement requires a longer period.

Agency plan payments are processed by Stripe Payments Europe Ltd. or an affiliated Stripe entity as an independent payment data controller. We do not store full payment card details on our servers.

We receive only data needed to manage subscriptions (e.g. payment status, Stripe customer and subscription identifiers, billing period).

Accounting and tax records are retained as required by law (typically up to 10 years).

We use essential cookies for site operation (e.g. language, session, theme) and may use Google Analytics 4 cookies only if you consent in the cookie banner.

Rejecting analytics cookies does not affect basic portal use. You can change consent at any time by clearing stored consent in your browser and refreshing the page.

• Essential cookies / localStorage: portal operation, language, cookie consent.
• Analytics cookies (GA4): visit statistics, events (search, favourites, inquiries) – only with consent.
• Security: Cloudflare Turnstile on inquiry forms.

We may share personal data with trusted service providers that help us operate the portal:

• Hosting and infrastructure (e.g. Google Cloud, Vercel).
• Firebase Authentication (Google).
• Stripe (payments).
• Resend or SendGrid (email).
• Mapbox (maps).
• Cloudflare (security, CDN, Turnstile).
• Google Analytics 4 (analytics, with consent).
• Agencies and advertisers (inquiries).
• Competent authorities when required by law.

Some providers (e.g. Google, Stripe, Vercel) may process data outside the EU/EEA. In such cases we ensure appropriate safeguards such as EU Standard Contractual Clauses or adequacy decisions where available.

• Account data: until account deletion + up to 30 days for technical erasure.
• Listings: until listing removal or account/agency deletion.
• Inquiries: up to 24 months.
• Subscription and accounting data: up to 10 years (tax law).
• Technical logs: up to 90 days.
• Cookie consent: until changed in browser or localStorage cleared.

We apply appropriate technical and organisational measures (encryption in transit, role-based access, firewall, database backups, restricted admin access).

Despite these measures, no internet transmission can be guaranteed completely secure.

Under the GDPR you have the following rights, where legal conditions are met:

• access to your personal data;
• rectification of inaccurate data;
• erasure ('right to be forgotten');
• restriction of processing;
• data portability;
• objection to processing based on legitimate interest;
• withdrawal of consent (without affecting lawfulness before withdrawal).

Send requests to dpo@nepremicnine.eu or podpora@nepremicnine.eu. We respond within the GDPR timeframe (usually within one month).

You may also delete your account via user profile settings.

If you believe processing violates the law, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia (https://www.ip-rs.si).

We may update this policy from time to time. Material changes may be communicated via the portal or email. The current version is published on this page.