Privacy policy
This notice describes how personal data is processed on ImmoIstrien.com. Missing details should be completed and legally reviewed before publication.
Controller
The controller is [company / operator], [street, postal code, city, Croatia]. Contact: [email], [phone]. TODO: complete the operator and contact details and obtain legal review before publication.
Technical session cookies
ii_user_session keeps signed-in users signed in and expires after 30 days. ii_admin_session maintains the administrator session and expires after 7 days. Both are signed session cookies with HttpOnly, Secure, Path=/ and SameSite=Lax. We do not use tracking cookies.
Hosting and web analytics
Vercel provides hosting, Vercel Blob stores account data and site content, and Vercel Web Analytics provides cookieless, aggregated usage analytics. The purposes are secure operation and understanding site usage. Depending on the service, data may include technical connection data (for example IP address, requested URL and timestamp), stored account/content data, and analytics such as page views, referrer and basic browser/device information. The legal basis is our legitimate interest in operating and improving the portal securely (Article 6(1)(f) GDPR). TODO: verify the exact Vercel fields, retention periods and storage locations, and execute or review a data processing agreement with Vercel.
Database
Neon acts as a database processor if the database is used in the relevant deployment. It may process listing, account and technical application data stored there to provide the portal's database functions. The legal basis is our legitimate interest in operating the portal and, for account functions, performance of the user relationship. TODO: confirm whether Neon is used and which data categories it processes, and execute or review a data processing agreement with Neon.
Listing data and images
Listing data and property photos are supplied by the respective agencies and feed providers. Cloudinary is used for Open Graph / preview images. When a Cloudinary image is requested, Cloudinary receives technical connection data such as IP address and browser information. TODO: verify the feed providers, Cloudinary configuration, data transfers and applicable safeguards.
Contact and external messaging apps
If you contact us by email or telephone, we process the contact details and message you provide to handle your request. WhatsApp and Viber links are optional and open only when you click them; the relevant provider then processes your data under its own terms. No automatic connection to WhatsApp or Viber is made.
Retention period
Session cookies expire after the periods stated above. Account, listing and communication data are retained only for as long as needed for their purpose or as required by law. TODO: set specific retention and deletion periods for each data category.
Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction of processing and data portability, and object to processing. Contact us at [email].
Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority. TODO: add the competent Croatian supervisory authority and its contact details.