1. Data Controller

The data controller for personal data on the DomSpecialist platform is DomSpecialist d.o.o., registered in Slovenia (exact address will be published before launch). Hereinafter: "controller", "we" or "us". For all inquiries regarding the processing of your personal data, you may contact us at: [email protected].

2. Data We Collect

We collect the following categories of personal data on the platform:

• a) Registration data: first name, last name, email address, password (encrypted), phone number (optional), platform role.
• b) Profile data: company name, bio description, location, region, profile picture.
• c) Listing data: content of property or service listings, photographs, location information.
• d) Communication data: messages between users, inquiries, quotes.
• e) Technical data: IP address, browser type, operating system, cookie data, server logs.
• f) Usage data: search parameters, saved search settings, notification preferences.

3. Purposes and Legal Bases

We process your personal data on the following legal bases:

• a) Performance of a contract (Art. 6(1)(b) GDPR): to provide platform functionality, manage user accounts, publish listings, enable communication between users, and process inquiries.
• b) Consent (Art. 6(1)(a) GDPR): for sending notifications about new listings and specialists, analytics cookies, newsletter.
• c) Legitimate interest (Art. 6(1)(f) GDPR): to ensure platform security, prevent abuse, improve user experience, and perform technical maintenance.
• d) Legal obligation (Art. 6(1)(c) GDPR): to fulfill legal requirements, tax obligations, and orders from competent authorities.

4. Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• a) Account data: retained for the duration of your active account. After account deletion, data is anonymized within 30 days.
• b) Listing data: active listings are visible on the platform; deleted listings are anonymized within 30 days.
• c) Messages: retained for the duration of both users' active accounts. After account deletion, messages are anonymized.
• d) Technical data: server logs are retained for up to 90 days.
• e) Legal obligations: some data may be retained longer if required by law (e.g., tax documentation: 10 years).

5. Your Rights

Under the GDPR, you have the following rights:

• a) Right of access: you may request a copy of all personal data we hold about you.
• b) Right to rectification: you may request correction of inaccurate personal data.
• c) Right to erasure: you may request deletion of your personal data ("right to be forgotten"). You can also do this directly in your profile settings.
• d) Right to data portability: you may request transfer of your data in a structured, machine-readable format.
• e) Right to object: you may object to processing based on legitimate interest.
• f) Right to restriction of processing: you may request restriction of the processing of your data.
• g) Right to withdraw consent: you may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, write to [email protected]. We will respond to your request within 30 days. If you believe your rights have not been adequately addressed, you have the right to file a complaint with the Information Commissioner of the Republic of Slovenia (www.ip-rs.si).

6. Cookies

We use cookies on the platform to ensure functionality, improve user experience, and for analytics. Detailed information about cookies can be found in our Cookie Policy.

7. Third Parties and Processors

We may share your personal data with the following categories of third parties:

• a) Hosting provider: Hetzner Online GmbH (Germany) - server and data hosting.
• b) Email provider: Resend (USA) - sending transactional and notification emails. Data transfer to the USA is based on Standard Contractual Clauses.
• c) Analytics: data is processed to improve the platform and understand usage patterns.
• d) Payment processor: Stripe, Inc. (USA) - payment and subscription processing. Stripe receives your name, email address, and payment method details. Data transfer is based on Standard Contractual Clauses. More: https://stripe.com/privacy

7a. Social Login

The platform allows sign-in via external providers (Google, Facebook, Apple). When using social login, we receive the following data from the provider:

• a) First and last name (as listed in your provider profile)
• b) Email address associated with your provider account
• c) Profile photo (if available)
• d) Unique user identifier from the provider (for account linking)

We do not access your contacts, posts, or other data from the provider. The received data is used exclusively for creating and managing your account on the platform.

Note on Facebook SDK: The Facebook SDK may set additional cookies on your device when using Facebook login. These cookies are managed by Facebook and are subject to Facebook's Privacy Policy.

7b. AI Property Valuation

When you use the AI property valuation tool, we process and store the following data:

• a) Property details you enter: location (region, city), property type, size, year of construction, condition, and additional features.
• b) Valuation results: estimated value, price range, confidence score, comparable properties used in the calculation.
• c) Usage metadata: timestamp of valuation request.

This data is used to provide the valuation service, improve accuracy of future estimates, and maintain your valuation history. Valuation data is stored as long as your account exists. You can delete your valuation history at any time from your profile settings.

Legal basis: consent (GDPR Art. 6(1)(a)) — you actively request each valuation. You may withdraw consent and delete stored data at any time.

We have conducted a Data Protection Impact Assessment (DPIA) for our AI property valuation service in accordance with GDPR Article 35. This assessment evaluates the risks of automated processing of property data and ensures appropriate safeguards are in place.

8. Data Protection Officer

For all matters regarding data protection, contact us at: [email protected] or at DomSpecialist d.o.o., marked "Data Protection" (exact address will be published before launch).

9. Changes to Privacy Policy

We may update this privacy policy from time to time. We will notify you of material changes through the platform or by email. We recommend regularly reviewing this page.