Privacy Policy

⚠ DRAFT — legal review required. Replace placeholders in [square brackets] before publication. Legal basis: Regulation (EU) 2016/679 (GDPR), Austrian Data Protection Act (DSG), § 165 TKG 2021.

English is the published version. A German version is to follow and should be reviewed by the lawyer alongside it. Art. 12(1) GDPR requires this information to be given in clear and plain language; for data subjects in Austria that points to German, so the German version is not optional indefinitely — it is next.

Updated 16 October 2026. The three processors that were open are now named — SMTP2GO for transactional email, Sentry in its EU region for error monitoring, Google for sign-in and for the encrypted off-site backup — and section 6 has been corrected: it previously stated that no transfer takes place outside the EEA, which was not accurate once the processors were named.

What is still open, and must be settled before publication:

1. The ArvanCloud data centre. Registry geolocation says Frankfurt; registry data is self-declared and is not verification. The location must come from the provider in writing.
2. An Art. 28 processing agreement with each of the four processors, and the transfer basis for the three with parents outside the EEA.
3. The placeholders in square brackets. The German version follows after publication in English.

Version: 1.0 · In force from: 16 October 2026

---

Summary

We wrote this policy so that it can be read.

The full legal text follows. Where the two differ, the full text governs.

---

1. Controller

[Company name], [legal form] [Street and number], [postal code] Vienna, Austria Commercial register number: [FN ______]

Email: Kontakt@immovesto.com Telephone: [+43 ________]

1.1 Data protection officer

⚠ For the lawyer: A data protection officer is required under Art. 37 GDPR only where the core activity consists of regular and systematic monitoring of data subjects on a large scale, or of large-scale processing of special categories of data. Immovesto does neither: we perform no profiling, no tracking, and process no special categories of data. On this basis a DPO is not mandatory. To be confirmed. A voluntary appointment may nonetheless be worthwhile as a trust signal.

For all data protection matters, please contact Kontakt@immovesto.com.

---

2. Principles

We collect what is necessary and nothing beyond it. Every field on this platform exists because a calculation requires it or the law requires it. There is no field whose purpose is to learn more about you.

Calculations without an account are not stored. The figures you enter are processed for the duration of the calculation and are then gone. They are not written to any database, not logged, and not linked to your IP address.

Financial data is stored only on an explicit action by you. Logging in does not by itself cause any figure to be stored. Storage requires you to save.

---

3. What we process, why, and on what legal basis

3.1 Use without an account

Data: the values you enter into the calculator (purchase price, area, financing parameters, and where applicable income and savings).

Purpose: performing the calculation you requested.

Processing: the values are transmitted to our server, calculated, and the result is returned. They are not stored. No database record is created and no application-level log entry containing these values is written.

Legal basis: Art. 6(1)(b) GDPR — performance of a service requested by you prior to entering into a contract.

Retention: none. The data exists only for the duration of the request.

3.2 Server log files

Data: IP address, date and time of the request, requested URL, HTTP status code, transferred data volume, referrer URL, browser type and version, operating system.

Purpose: operating and securing the platform, detecting and tracing technical faults and attacks.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the secure and stable operation of our service. Our balancing of interests: the data is required for security, is not used to identify individuals, is not merged with other data, and is deleted on a short cycle.

Retention: [7 days — recommended; maximum 30 days], unless a specific security incident requires longer retention in an individual case.

Note: the values you enter into the calculator are not part of these log files. Calculation inputs are transmitted in the request body, which we do not log.

3.3 Account

Data: email address, password (stored only as a cryptographic hash, never in plain text), account creation date, last login.

Purpose: creating and administering your user account, authentication.

Legal basis: Art. 6(1)(b) GDPR — performance of the user contract.

Retention: for as long as your account exists. See section 7.

3.4 Saved calculations

Data: the calculation parameters you have explicitly saved. Depending on what you have entered, these may include financial circumstances (net household income, available equity, existing loan commitments), together with the property data used and the data vintage of the parameters applied.

Purpose: enabling you to retrieve and compare your calculations.

Legal basis: Art. 6(1)(b) GDPR — performance of the user contract; storage takes place only upon your explicit act of saving.

Retention: until you delete the calculation or your account.

Note: we record with every saved calculation which statutory and market parameters were in effect at the time. This is what allows an older result to remain reproducible. This record contains no additional personal data.

3.5 Reports of listings

Data: your user ID, the listing reported, the reason given, the time of the report, and our processing status.

Purpose: reviewing the listing, correcting incorrect information, preventing abuse of the reporting function.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the accuracy of listings and in protecting the platform against abusive reports.

Why an account is required: an anonymous report cannot be verified and can be used at scale against a competitor. Attributing a report to an account makes it verifiable and makes abuse traceable.

Disclosure: the provider of the listing is informed of the substance of the report so that they can respond to it. Your identity is not disclosed to the provider, unless we are legally obliged to do so.

Retention: [12 months] after conclusion of the review.

3.6 Enquiries about a property

Data: the data you enter into the enquiry form (name, email address, and where applicable telephone number and your message).

Purpose: forwarding your enquiry to the provider of the property.

Legal basis: Art. 6(1)(b) GDPR — performance of a pre-contractual measure requested by you.

Disclosure: this data is transmitted to the provider of the property, who becomes an independent controller for it. Your financial data, your calculations and your affordability results are not transmitted. The provider sees your enquiry, not your finances.

Retention: [6 months] on our side; thereafter the provider's own retention rules apply.

3.7 Estate agent accounts

Data: company name, commercial register number, address, contact person, email address, telephone number, trade licence data where applicable.

Purpose: administering the agent account, verifying that the account holder is a genuine market participant, invoicing where paid services are introduced.

Legal basis: Art. 6(1)(b) GDPR — performance of the contract; and Art. 6(1)(c) GDPR for retention required by commercial and tax law.

Retention: for as long as the account exists; thereafter 7 years where retention obligations under § 132 BAO and § 212 UGB apply.

3.8 Contact by email

Data: your email address and the content of your message.

Purpose: processing your enquiry.

Legal basis: Art. 6(1)(b) or (f) GDPR, depending on whether your enquiry relates to a contract.

Retention: [24 months], unless a longer period is required in an individual case.

3.9 Newsletter, where offered

Data: email address, time of subscription, confirmation of subscription.

Purpose: sending the newsletter you requested.

Legal basis: Art. 6(1)(a) GDPR — your consent, given through the double opt-in procedure.

Withdrawal: you may withdraw your consent at any time, with effect for the future, using the unsubscribe link in every message. Withdrawal does not affect the lawfulness of processing carried out before it.

Retention: until withdrawal; the record of consent is retained for a further [3 years] as evidence.

---

4. Cookies and similar technologies

We use only technically necessary cookies. We use no tracking cookies, no advertising cookies, no cross-site identifiers, and no third-party analytics services.

The free-allowance cookie holds a random identifier and nothing else. It is not readable by scripts, it is not shared, and it carries no information about you — it exists so that the free calculations can be counted for a visitor who has not registered. Deleting it resets the count; we do not attempt to recognise you by any other means.

Why you see no cookie banner: the consent requirement under § 165(3) TKG 2021 applies to storage that is not strictly necessary for providing the service. Technically necessary cookies do not require consent. The free-allowance identifier is necessary to deliver the free service you are using — without it the free calculations could not be offered at all — and it is used for no other purpose. Since we set no others, there is nothing to consent to.

You can block or delete cookies in your browser settings. Blocking the session cookie will prevent you from logging in.

---

5. Recipients and processors

We disclose personal data only where necessary for the operation of the platform, and only on the basis of a data processing agreement pursuant to Art. 28 GDPR.

What Sentry does and does not receive. Error reports are stripped before they leave our server. The request body is removed in full — the calculation endpoints carry income and savings in the body, and there is no version of that which is safe to transmit. Cookies, the session cookie among them, and the query string are removed. Any field whose name contains password, token, secret, authorization, cookie, session, csrf, api_key, income, salary, savings, equity, cash, deposit, net_worth, iban or bank is replaced with [redacted], wherever it appears. We send no performance traces, because those would describe sessions in which nothing went wrong.

What Google receives for a backup. The database dump is encrypted on our server with age before it is uploaded, using a public key; the private key is not on the server. Google stores ciphertext it cannot read. This is still a transfer of personal data and is treated as one in section 6.

What Google receives for sign-in. Only if you choose "Sign in with Google". Google learns that you authenticated to our application; we receive your Google account identifier, your email address, whether Google has verified it, and your name. We set no Google analytics, advertising or font resources: the website loads no third-party resources on page load at all.

⚠ The hosting provider is registered in a third country, and the data centre is still unconfirmed. ArvanCloud Global Technologies L.L.C is registered in the United Arab Emirates, for which the Commission has issued no adequacy decision.

Public IP geolocation services place the server in Frankfurt am Main, Germany (AS57568). That is consistent, and it is not verification: those services read the same registry entry, which is declared by the block's holder rather than checked by anybody. One source repeated three times is one source.

Three things must be settled in writing with the provider before this policy is published, and the outcome decides what the table above may say:

1. the city and country of the data centre, confirmed by the provider;
2. a processing agreement under Art. 28 GDPR;
3. whether administrative or support access happens from outside the EU/EEA — if it does, that is a transfer under Chapter V and section 6 must name its legal basis, most likely Standard Contractual Clauses plus a transfer impact assessment.

Until then this policy says the location is unconfirmed. Naming a country we have not verified would be the one kind of error a privacy policy cannot afford. Naming a country we have not verified would be the one kind of error a privacy policy cannot afford.

We do not sell personal data. We do not pass it to advertising networks, data brokers, credit agencies or banks.

---

6. Transfers to third countries

This section used to say that no transfer takes place outside the EEA. That was not accurate once the processors were named, and it is corrected here rather than left standing.

Our processors keep the data in the EU, and three of them have parent companies outside it. A parent company outside the EEA is not by itself a transfer — but access by that parent, or by support staff located outside the EEA, is one, and that is what has to be established per provider.

Where a transfer to a third country takes place, it will rest on an adequacy decision under Art. 45 GDPR — for the United States, the EU–US Data Privacy Framework, where the recipient is certified under it — or on appropriate safeguards under Art. 46 GDPR, in practice the Standard Contractual Clauses together with a transfer impact assessment.

⚠ To be completed before publication. For each processor above: the contracting entity, a signed Art. 28 processing agreement, and the transfer basis relied on. This policy must state the outcome, not the intention.

---

7. Retention and deletion

⚠ Server logs are not currently retained for a fixed period, and this policy will not claim one. They are written by the container runtime and rotated by size — three files of 10 MB each — so how far back they reach depends on traffic rather than on a date. A figure cannot be stated here honestly until a time-based retention is configured.

For the operator: configure a retention period and state it here. A retention policy that depends on traffic volume is not something Art. 13(2)(a) GDPR can be answered with.

Deletion of your account. You can delete your account at any time in settings. There is no waiting period, no form and no request for a reason. We ask for your password — not as a hurdle, but because a stolen session must not be able to destroy your account.

Your account data, your saved reports, your bookmarks and your enquiries are removed and cannot be restored.

If you hold an agency account, one thing works differently and it is worth stating plainly. Your published listings are withdrawn from the market but not erased. Buyers have run their own calculations against those listings and kept the results, and deleting the listings would leave those reports describing a property we say never existed. What is removed is everything that identifies you: your name, your address, your login. The listings remain as a record of what was on the market, with no person attached.

Excluded from deletion is data we are required by law to retain — in particular accounting records where invoices have been issued (§ 132 BAO, § 212 UGB). Such data is restricted from further processing and used only for the purpose that requires its retention.

Inactivity. If you have not logged in for 24 months, we notify you at your registered email address and erase the account after a further 30 days if it remains unused.

Backups, and why deletion takes a month to finish. The database is backed up nightly. The dump is encrypted on our server before it leaves it, and the key that decrypts it is not kept on the server. Backups are deleted automatically after 30 days.

This means that when you delete your account, your data is gone from the live system immediately, and persists in the encrypted backups until the last one containing it expires — at most 30 days. We do not reach into backups to remove individual records: doing so would mean decrypting and rewriting every archive, which is a larger risk to everybody's data than waiting out the month. During that period the backups are not processed for any purpose other than restoring the service after a failure.

---

8. Your rights

Under the GDPR you have the following rights in relation to us:

Two of these rights you can exercise yourself, immediately, in settings: the export of all data held about you in a machine-readable format, and the complete deletion of your account. You do not need to write to us.

For all other requests, contact Kontakt@immovesto.com. We respond within one month. Where a request is complex, this period may be extended by two further months; we will inform you of any extension and of the reason for it.

8.1 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority in Austria is:

Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna dsb@dsb.gv.at · www.dsb.gv.at

---

9. Automated decision-making

We take no decisions about you.

The platform performs calculations and displays classifications — for example the range of purchase costs, the affordability bands, or the position of a price relative to transaction data. These are calculations, not decisions. They produce no legal effect concerning you and do not significantly affect you: no credit is granted or refused, no contract is concluded or terminated, and no offer is withheld from you on their basis.

There is therefore no automated decision-making within the meaning of Art. 22 GDPR, and no profiling within the meaning of Art. 4(4) GDPR: we build no profile of your behaviour, your preferences or your creditworthiness.

We also carry out no creditworthiness assessment. Our affordability calculation applies published lending standards to figures you have entered yourself. It is not a credit check, it is not a credit decision, and it binds no bank. Whether a bank finances you is decided by the bank.

⚠ For the lawyer: should the calculation logic be extended in future to include a scoring element, Art. 22 GDPR and the transparency obligations of Regulation (EU) 2024/1689 (AI Act) are to be re-examined.

---

10. Security

We protect your data by appropriate technical and organisational measures under Art. 32 GDPR, in particular:

• Transport encryption — all traffic is transmitted over TLS; the platform is not accessible without encryption.
• Passwords are stored only as salted cryptographic hashes using a modern algorithm. We cannot read your password and cannot recover it — we can only let you set a new one.
• Access control — access to production data is restricted to the persons who require it operationally, and is logged.
• Data minimisation by design — calculations without an account are not stored, and calculation inputs are not written to server logs. Data that does not exist cannot be breached.
• Encrypted backups, retained for [30 days].
• Updates — dependencies are monitored for known vulnerabilities and updated.

In the event of a data breach, we notify the supervisory authority within 72 hours pursuant to Art. 33 GDPR and, where there is a high risk to your rights, notify you directly pursuant to Art. 34 GDPR.

---

11. Data sources

The reference values used in our calculations do not originate from you and contain no personal data. We name them for transparency:

• Statistik Austria — transaction prices for residential property. Data source: Statistik Austria — data.statistik.gv.at (CC BY 4.0)
• Austrian legislation (RIS) — statutory rates for taxes and fees
• [Further sources as used] — each with source and data vintage stated at the point of use

---

12. Children

The platform is not directed at persons under 18 years of age. We knowingly process no data of children. Should we become aware that an account has been created by a minor, we will delete it.

---

13. Changes to this policy

We will amend this policy where our processing changes — for example when paid services are introduced or a new processor is engaged.

The current version is always available at this address, with the date of issue. In the event of material changes we will inform registered users by email before the change takes effect. We will not quietly extend the purposes for which your data is processed.

---

Version: 1.0 Effective from: 16 October 2026 Last updated: 16 October 2026