Privacy Policy

1. Introductory Provisions

The data controller is Apure s.r.o., with its registered office at Mikovíniho 1624/11, 831 02 Bratislava – Nové Mesto, Company ID: 57 431 531 (hereinafter referred to as "Controller").

This Privacy Policy informs data subjects about what personal data the Controller collects, for what purpose it is processed, on what legal basis, to whom it may be disclosed, and what rights data subjects have. This Policy has been prepared in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on Personal Data Protection.

Contact for personal data protection inquiries: privacy@seeki.eu

2. What Data We Collect

2.1 Data Provided by the User

When using the Platform, we collect data that the user voluntarily provides:

• Registration data: name, email address, login credentials (password in encrypted form).
• Listing data: property information, photographs, advertiser contact details.
• Communications: messages sent through the Platform, support requests, feedback.
• Search preferences: location, property type, price range, other criteria.
• Saved data: favorite listings, saved searches, monitoring agent settings.

2.2 Automatically Collected Data

When visiting the Platform, we automatically collect certain technical and operational data:

• Device data: browser type, operating system, screen resolution.
• Usage data: visited pages, used features, search queries.
• Location data: approximate geographic location based on IP address.
• Log data: access times, referring URLs, error logs.

2.3 Data from AI Interactions

When using the AI Assistant, we process text queries entered by the user, responses generated by the AI Assistant, and interaction metadata. The content of conversations with the AI Assistant may be processed by the AI technology provider (OpenAI).

2.4 Data Processed via Third-Party AI Integrations

When using Seeki.eu through ChatGPT or other AI assistant integrations, the following additional data may be processed:

• Phone number: provided voluntarily for agent contact and SMS notification delivery.
• Notification preferences: email, SMS, price drop, and new listing alert settings stored as part of your user profile.
• Authentication tokens: session credentials required for interactive widget functionality within the AI assistant. These tokens are transmitted through the AI provider's infrastructure to enable real-time features such as saving favorites and managing listings.
• Database connection parameters: technical identifiers required for widget rendering within the AI assistant interface.
• Listing analytics: aggregate view counts, favorite counts, and message counts for the user's own published listings.

2.5 Data Obtained from Publicly Available Sources (Aggregated Listings)

A core part of the Platform is the aggregation of property listings from publicly accessible real estate advertising portals and websites in the countries we cover: Seeki.eu operates as a pan-European market data and search layer. In doing so, we also process personal data of persons who are not our users:

• Listing content: property description, photographs, asking price, address and location.
• Advertiser identification: name, company or agency name, phone number and email address, as published at the source.
• Source identifiers: the identifier and the portal of the original listing. Each aggregated listing displays its origin portal on the Platform.

2.6 How We Handle Aggregated Advertiser Data

We never publish advertiser contact details. Enquiries and viewing requests are relayed through the Platform: the advertiser initially sees only the enquirer's first name and a masked contact, and full contact details (name, email address, phone number) are exchanged between the two parties only once a viewing is mutually confirmed, so that they can coordinate directly. Messages in contact threads never reveal contact details; replies travel through the Platform.

From publicly available data we also create profiles of real estate agencies. We may contact an agency at its published business address to verify the profile, offer it for claiming, or notify it of new reviews. Under Article 21(2) GDPR an agency or advertiser can object to such communications at any time; the objection is recorded on a suppression list so that the contact is not collected or used again.

Informing every advertiser individually would involve disproportionate effort within the meaning of Article 14(5)(b) GDPR, given the number of aggregated listings; this Policy constitutes the public information about that processing. All rights under Section 7, including objection and erasure, apply equally to advertisers whose data we obtained from public sources. Contact: privacy@seeki.eu.

3. Purpose of Processing

We process personal data for the following purposes:

• Service provision – operating the Platform, aggregating and displaying listings with source attribution, managing accounts, facilitating AI search.
• Enquiry intermediation – relaying messages and viewing requests between property seekers and advertisers without publishing contact details, and exchanging contact details between the parties once a viewing is confirmed.
• Agency profiles – creating and maintaining profiles of real estate agencies from publicly available data and enabling agencies to claim and manage them.
• Personalization – adapting content and recommendations based on user preferences.
• Security – protecting the Platform against misuse, fraud, and cyber threats.
• Analytics and market statistics – analyzing Platform usage to improve services, and compiling anonymized, aggregated market data (prices, sizes, locations) that no longer identifies any person.
• Communication – sending service notifications (for example viewing updates and saved-search alerts), responses to requests, and (with consent) marketing messages.
• Fulfillment of legal obligations – meeting legal requirements, maintaining records.

4. Legal Basis for Processing

We process personal data on the following legal bases in accordance with Article 6(1) of the GDPR:

• Performance of a contract (Art. 6(1)(b) GDPR): Processing necessary for the performance of a contract with the user – registration and account management, providing Platform functions to registered users, and processing and displaying listings created by the user.
• Legitimate interest (Art. 6(1)(f) GDPR): Processing necessary for the purposes of the legitimate interests of the Controller – aggregation and display of publicly available property listings, including advertiser contact data contained in them; creation of agency profiles and claim-related communications; intermediation of enquiries; security and protection of the Platform; analytics and service improvement; fraud prevention. The balancing test for the aggregated-data processing is available on request via privacy@seeki.eu.
• Consent (Art. 6(1)(a) GDPR): Processing based on the explicit consent of the user – sending marketing messages, use of analytics cookies. Consent can be withdrawn at any time.
• Legal obligation (Art. 6(1)(c) GDPR): Processing necessary to comply with a legal obligation of the Controller (e.g., accounting and tax regulations).

5. Sharing Data with Third Parties

We may share personal data with trusted service providers (processors) who assist us in operating the Platform. All processors are contractually bound to process data exclusively in accordance with our instructions and in compliance with the GDPR. The Controller does not sell personal data and does not provide it to third parties for their own marketing purposes.

In addition to processors, some data is shared with other users as part of the service itself: once a viewing is mutually confirmed, the two parties receive each other's contact details (name, email address, phone number) so that they can arrange the viewing directly.

Relocation service partners: if you send an enquiry to a featured relocation partner via the Platform, the partner receives your first name and your message; replies are relayed through the Platform. If the partner accepts your enquiry, your name and the contact details you provided (email address and/or phone number) are shared with them so they can contact you directly, and you receive the partner's contact details in return. Partners without such an agreement never receive any of your personal data; links to their websites carry only non-personal referral parameters.

• Supabase – hosting, database, authentication (EU, Frankfurt, Germany)
• OpenAI – AI assistant, language query processing (USA, with appropriate safeguards)
• Sentry – error and performance monitoring (EU)
• Google Analytics – web analytics, only with consent (USA, with appropriate safeguards)
• Cloudflare – content delivery, edge computing, worker hosting, machine translation, and video streaming for user uploads (global network, GDPR-compliant)
• Brevo (Sendinblue) – transactional email and SMS delivery (EU), and measurement of email campaign effectiveness, only with consent
• Microsoft Clarity – session recording and heatmap analytics, only with consent (USA, with appropriate safeguards)
• Backblaze – object storage for listing photographs and media (EU region)
• Google (Gemini) – AI processing of listing content: structured field recognition, description normalization, photo classification (with appropriate safeguards)
• DeepL and Microsoft Translator – translation of listing texts (EU / with appropriate safeguards)
• Stripe – payment processing (with appropriate safeguards)
• Expo (EAS) – mobile application updates (USA, with appropriate safeguards)
• Apify – hosting infrastructure for the collection of listings from public sources (EU)

6. International Data Transfers

The majority of personal data is stored and processed on servers in the European Union (Frankfurt, Germany).

In cases where data is transferred to the USA (OpenAI, Google, Microsoft, Stripe, Expo), we ensure appropriate safeguards in accordance with Chapter V of the GDPR, in particular through the EU-US Data Privacy Framework and standard contractual clauses approved by the European Commission.

7. Rights of the Data Subject

In accordance with the GDPR and Act No. 18/2018 Coll., you have the following rights:

These rights apply equally to advertisers and property owners whose personal data we obtained from publicly available sources. If you object under Article 21 GDPR or request erasure under Article 17 GDPR, we stop displaying the affected listing without undue delay and place minimal identifiers (the source-listing reference and, where applicable, your phone number or email address in normalized form) on a suppression list so that the data is not collected again.

• Right of access: You have the right to obtain confirmation as to whether your personal data is being processed, and if so, to access that data.
• Right to rectification: You have the right to request the correction of inaccurate or the completion of incomplete personal data.
• Right to erasure: You have the right to request the erasure of your personal data if one of the conditions set out in Article 17 of the GDPR is met.
• Right to restriction of processing: You have the right to request the restriction of processing of your personal data in the cases set out in Article 18 of the GDPR.
• Right to data portability: You have the right to obtain your personal data in a structured, commonly used, and machine-readable format and to transfer it to another controller.
• Right to object: You have the right to object to the processing of your personal data that is based on legitimate interest or is carried out for direct marketing purposes.

We will respond to your requests within 30 days at the latest. If you believe that the processing of your personal data is in breach of the GDPR, you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, https://dataprotection.gov.sk. You may equally lodge that complaint with the supervisory authority of the EU Member State where you habitually reside, where you work, or where the alleged infringement took place.

8. Cookies and Tracking Technologies

The Platform uses essential cookies to ensure proper functioning (localization, login status, security tokens) – no consent is required for these. Analytics cookies are stored only with the explicit consent of the user: Google Analytics 4, and Microsoft Clarity, which additionally records a replay of your visit (pages viewed, clicks, scrolling and mouse movement). Marketing cookies – used by Brevo to measure how our emails and campaigns perform – are likewise stored only with explicit consent. On the website, no analytics or marketing script is loaded before consent is given. Withdrawing consent stops the collection and deletes the corresponding cookies; data already collected by the analytics providers is then deleted under their retention periods (Section 10), as we cannot selectively delete it from their systems.

The user can change their cookie preferences at any time via the "Cookie settings" link in the Platform footer, or through browser settings. In the mobile app, the equivalent setting is under Profile.

Mobile application. The Seeki.eu app does not use cookies. It can measure in-app usage with Google Analytics 4 and Microsoft Clarity, the latter recording a replay of your session (screens opened, taps and scrolling). This measurement runs only after you explicitly allow it in the consent dialog shown when you first open the app, and you can change your decision at any time under Profile → Share usage data. We configure Clarity to hide content that can contain personal data – anything you type, your email address, and other people's names such as a viewing requester or a review author – so that it is not sent to Clarity. Switching the setting off stops both Google Analytics 4 and Microsoft Clarity.

Independently of cookies, we keep an aggregate count of page requests on our own servers: the page address, the language, the website you arrived from, the country and the type of device. This record contains no cookies, no IP address and no identifier, is never linked to an individual, and serves solely to measure overall traffic to the Platform. The legal basis is our legitimate interest in understanding how the Platform is used (Art. 6(1)(f) GDPR).

Error diagnostics. Independently of analytics consent, we operate technical error logging (Sentry) to detect and fix failures of the Platform; error reports can include your IP address and device information. The legal basis is our legitimate interest in keeping the Platform functional and secure (Art. 6(1)(f) GDPR).

9. Data Security

The Controller implements appropriate technical and organizational measures to protect personal data:

• Encryption: TLS 1.3 for all communication between the user and the server. AES-256 for data in the database.
• Access control: Strict role-based access control (RBAC) to personal data. Access minimization on a need-to-know basis.
• Incident response: An established security incident response plan. Notification to the supervisory authority within 72 hours and notification of affected data subjects in case of high risk.

10. Data Retention

We retain personal data only for the period necessary to fulfill the purpose of processing:

• Account data: for the duration of the account + 30 days after deletion.
• Listings created by users: retained in your account (including unpublished ones, so you can renew or restore them) until you delete your account or request erasure; then erased under the account-data period above.
• Aggregated listings: removed from public display immediately when the listing disappears at the source, expires, or a removal request or objection is upheld. Personal data contained in them (advertiser contact details, photographs) is erased within 90 days of removal; anonymized listing data (price, size, location, timing) is retained for market statistics. Copies in delivery caches expire within a further 90 days at the latest.
• Suppression list: source-listing references and normalized contact identifiers are retained for as long as needed to keep honoring removal requests and objections.
• Logs and security records: 12 months.
• Analytics data: Google Analytics event data up to 14 months; Microsoft Clarity recordings 30 days and aggregated statistics 13 months (retention on the providers' systems).
• Accounting and tax documents: 10 years (legal obligation).
• After account deletion, personal data will be erased in accordance with the above periods, except for data whose retention is required by applicable laws.

11. Contact Information

If you have any questions, requests, or complaints regarding the processing of personal data, you can contact us:

Email: privacy@seeki.eu

Postal address: Apure s.r.o., Mikovíniho 1624/11, 831 02 Bratislava – Nové Mesto

Supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, https://dataprotection.gov.sk