Realenza is a closed professional network for licensed real-estate agencies and brokers. This policy explains what personal data we process, why, on what legal basis, who else sees it and how long we keep it.
It is written for two audiences: the people who use the platform on behalf of a member organization, and anyone who opens a client link that a broker has sent them. If you are in the second group, section 8 is the part written for you.
The controller of the personal data described in this policy is:
The entries in square brackets are completed once the incorporation of the company is finalised, and this page is updated at the same time.
We have not appointed a data protection officer, because we are not required to. Privacy questions and requests go to info@realenza.com and are handled by the management.
Realenza is a business platform. Almost all the personal data in it is professional contact data of people acting for a company: a name, a work e-mail address, a work telephone number, a brokerage licence number, and a record of what they did in the system.
Three things are deliberately absent by design, and they shape everything that follows:
This policy does not cover how a Member handles the personal data of its own clients. That is the Member own responsibility, under its own privacy notice.
We do not process special categories of personal data, and Members must not upload them.
Most of it comes from you or from the Member you work for: the registration form, the profile, the listings, the messages.
Some of it is generated by using the platform: counters, the audit trail, session records, API usage. When a broker opens a listing of another agency, that agency sees the name of the broker, the agency the broker works for and the time of opening; within an agency, members see which colleague opened or changed a listing, when, and what was changed.
Before a registration is approved we check the applicant against the official register of real-estate brokerage agencies — in Croatia the register kept by the Croatian Chamber of Economy — and, where relevant, we check the VAT number in the European VIES system. This is a manual check performed by an administrator. We record the outcome of the check, not a copy of the register.
We do not process personal data for marketing. We send no newsletters, we run no advertising, and there is nothing to opt out of.
We do not sell personal data, and we do not share it with anyone for their own purposes.
For accounts, membership administration, invoicing and the security of the platform, we are the controller and this policy applies.
For the content a Member publishes and the messages it writes, the Member decides what goes in. If a Member includes personal data there, the Member is the controller of it and warrants that it has a legal basis; we make that content available as part of running the platform. Where the roles of the parties require it, the data protection terms are settled in the membership agreement.
A broker that sends a client link is acting for its own client, under its own privacy notice. We are not that broker processor for the relationship with the client, because the client data never reaches us — the broker sends the link itself.
The portal sets exactly three cookies and no others:
The first two are strictly necessary for signing in; the third stores a preference you set yourself.
Two further items are kept in the browser local storage on your own device and are never transmitted to us as such: the display currency you selected, and, for brokers, the current selection of listings you are assembling into an offer.
There are no analytics cookies, no advertising or profiling cookies, no tracking pixels and no social-network buttons anywhere in the platform. We use no analytics or advertising service of any kind. That is why there is no cookie banner.
Two features do load content from third parties directly into your browser, and you should know about them: map tiles in the broker portal are fetched from the OpenStreetMap and Esri tile services, and where a listing has a YouTube video, the thumbnail is fetched from Google servers and the player itself — in its no-cookie variant — loads only after you click play. In both cases your IP address becomes visible to that provider, as it does with any content loaded from the internet. We embed no other third-party content.
The address a listing agency enters is sent from our server to the OpenStreetMap geocoding service to place it on the map. That request contains the property address, not the identity of any person.
This section is for the visitor of a page under /s/ or /c/ — the private property page or offer a broker prepared for you.
You do not need an account and we do not ask who you are. We do not learn your name, your e-mail address or your telephone number from the page.
When you open the page, the opening is counted so that the broker can see whether and how often it was read, and we store the time, your IP address and your browser identification string. That is the whole of the processing your visit causes. The legal basis is legitimate interest, Article 6(1)(f): the broker who sent you the offer has a legitimate interest in knowing whether it arrived and was opened.
The broker may have typed a private label to remember which client a link was for — for example a family name. Only that broker sees it; it is not shown on the page and no other Member can see it.
No cookie is set on the page and no script tracks you. If the property has a YouTube video, opening the video slide loads a thumbnail from Google, and the player loads only if you press play — see section 7. The page is excluded from search-engine indexing.
The link stops working on its expiry date, or immediately if the broker revokes it.
The page carries the name and contact details of the broker who prepared it. Your relationship over the property is with that broker; questions about how they handle your data, and requests concerning it, go to them.
All processing takes place on infrastructure located in the European Union, and we choose processors on that basis.
We do not transfer personal data outside the European Economic Area and we do not rely on standard contractual clauses. If that ever needs to change, this policy is updated and the change announced before it takes effect.
We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires.
When a period ends, the data is deleted or irreversibly anonymised. Backups are overwritten in the ordinary backup cycle, and data restored from a backup is subject to the same rules.
Passwords are stored only as Argon2 hashes. Refresh, reset and invitation tokens, and API keys, are stored only as hashes; API keys are shown once and cannot be recovered afterwards.
Traffic runs over HTTPS. Session cookies are httpOnly and, in production, restricted to secure connections. Sessions are stateless and rotate; reuse of a refresh token revokes the whole family of tokens for that user.
Access is role-based and isolated per organization: every query is scoped so that a Member can reach only its own data and the network data it is entitled to see. Sign-in attempts and public endpoints are rate limited, and unusual access patterns can be throttled or blocked.
Client-facing images are watermarked and photographs are stripped of embedded metadata, including GPS coordinates, when they are processed. Exact locations are reduced to an area before they leave the system towards another organization.
The database is not reachable from the internet, backups are taken regularly and kept encrypted off-site, and access by our staff follows the least-privilege principle.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to the rights of the people concerned, we notify the supervisory authority within 72 hours and, where the risk is high, the people affected.
Under the GDPR you have the right of access to your data, the right to have it corrected, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object to processing based on our legitimate interest.
Much of this you can do yourself: any user can correct their own profile, and an organization administrator can correct the company data and deactivate a user account.
For anything else, write to info@realenza.com. We answer within one month; if a request is complex we may extend that by up to two further months and will tell you why within the first month. We may need to verify who you are before acting.
Some data cannot simply be deleted on request while it is still needed — the audit trail exists precisely so that it cannot be edited away, and accounting records are kept for the period the law prescribes. Where we cannot comply, we explain why.
If your request concerns data that a Member controls — the content of a listing, or a message a Member wrote — we forward the request to that Member and assist them in answering it.
You may also lodge a complaint with a supervisory authority. In Croatia that is the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. You may also complain to the authority of the country where you live or work.
No decision producing legal effects concerning you, or similarly significantly affecting you, is taken solely by automated means, and we do not carry out profiling.
Approval of a registration, moderation of content, suspension of an organization and the award of partner status are all decided by a person. The automatic mechanisms that do exist — the demotion and expiry of listings that have not been confirmed, and rate limiting — act on listings and on requests rather than on people, and can be reversed by a person.
The date at the top of this page tells you which version is in force. We update the policy when the platform changes or when the law requires it.
A material change is announced in the platform and by e-mail to organization administrators before it takes effect. Earlier versions are available from us on request.
For any question about this policy, or to exercise a right, write to info@realenza.com.
Postal address: [REALENZA d.o.o. — in formation], [street and number], [postal code] [city], Croatia.