Legal
Privacy policy
How personal data is handled on the Imperium Real Estate platform.
Draft — needs legal approval
This page is a structural draft prepared before launch. Sections marked below are placeholders: no company details, retention periods, legal bases or liability terms have been invented. The document takes effect only once reviewed and approved by a qualified adviser and completed with verified company information.
1. Who is responsible for your data
The data controller is the company operating the Imperium Real Estate platform. The registered details below must be completed before publication; they have not been assumed.
To be supplied — controller identity
- Registered company name
- Company registration number (UIC/EIK) and VAT number where applicable
- Registered address and country of establishment
- Privacy contact email address
- Data protection officer, if one has been appointed
2. What we collect and why
The table describes the processing activities that actually exist in the platform today. The legal basis for each is left open deliberately: it has to be determined and confirmed in legal review rather than guessed.
| Activity | Personal data | Source | Legal basis |
|---|---|---|---|
| Account registration and sign-in | Email address, password (stored hashed by the authentication service), sign-in timestamps, account role. | Provided by you when you create an account. | To be confirmed in legal review |
| Property and development enquiries | Name, email address, phone number where given, your message, and the listing or project it concerns. | Provided by you in the enquiry form. | To be confirmed in legal review |
| Viewing requests | Contact details, preferred dates and times, the property concerned, and the status of the appointment. | Provided by you in the viewing form. | To be confirmed in legal review |
| CRM communication | Message history, notes and activity timeline relating to your enquiry, visible to the agency, agent or developer responsible for the listing. | Created when you and the listing party communicate through the platform. | To be confirmed in legal review |
| Saved properties and developments | The listings and projects you save, linked to your account. | Created when you save an item. | To be confirmed in legal review |
| Property and development alerts | Your alert criteria, the project concerned and the alert status. | Created when you explicitly ask to be notified. | To be confirmed in legal review |
| Email communication | Recipient address, message type, delivery status (sent, delivered, bounced, complained) and suppression status. | Generated when we send you an email through our email provider. | To be confirmed in legal review |
| Usage analytics | A random first-party visitor and session identifier, page or listing viewed, device category, referrer type, campaign parameters in the URL and browser language. | Collected only after you allow analytics in the cookie settings. | To be confirmed in legal review |
| Owner, agent and developer accounts | Organisation details, team membership, the listings and projects you manage, and the leads assigned to you. | Provided by you or your organisation. | To be confirmed in legal review |
Needs legal approval: the legal basis for each processing activity, including any reliance on contract, consent, legal obligation or legitimate interests, and the balancing assessment where legitimate interests are used.
3. Who receives your data
Enquiries, viewing requests and the messages that follow are shared with the agency, agent or developer responsible for the listing or project you contacted. They act in relation to your enquiry and use their own records for it.
We also use service providers that process data on our behalf: hosting, database and authentication infrastructure, and an email delivery provider used for account, transactional and alert emails. Map tiles on map views are requested from an external map tile service by your browser.
To be supplied — processor list
Needs legal approval: international transfers, including whether any processor stores or accesses data outside the EEA and which transfer mechanism applies.
4. How long we keep data
Retention periods are not stated here because none have been set. They must be defined per category — accounts, enquiries and CRM records, viewing requests, alerts, email delivery logs and analytics events — and reflect the periods actually applied in the system.
To be supplied — retention schedule
5. Your rights
Under the applicable data protection rules you can request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you can object to processing based on legitimate interests. Where processing rests on consent, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
In practice today: you can update your account details and password in your account settings, manage which emails you receive on the email preferences page, pause or delete your alerts, remove saved items, and change your cookie choice at any time through cookie settings in the footer. For anything else — including access or erasure requests — contact us and the request is handled manually. There is no automated self-service deletion, and we do not claim one that does not exist.
You also have the right to lodge a complaint with a supervisory authority. Where Bulgarian law applies, the competent authority is the Commission for Personal Data Protection (CPDP / KZLD). Its official contact details and current complaint procedure are not reproduced here: they must be taken from the authority’s own current publications during legal review, not assumed.
To be supplied — rights handling
6. Consent and communication
We keep these separate. Creating an account, sending an enquiry or requesting a viewing does not subscribe you to marketing. Property and development alerts are only sent when you explicitly ask for them and can be paused or deleted. Service messages relating to an enquiry, a viewing or your account are sent because you are using the service. Marketing email is off by default and only sent if you switch it on.
Non-essential browser storage, including analytics, runs only after you allow it. See the cookie policy.
7. Security
Access to platform data is restricted per account and per organisation, enforced in the database rather than only in the interface. Passwords are handled by the authentication service and are not stored in readable form. Traffic runs over encrypted connections.
Needs legal approval: the wording describing technical and organisational measures, breach notification procedure and any certifications claimed.
8. Changes to this policy
When this policy changes we update this page and the effective date below. Material changes will be communicated through the platform or by email where appropriate.
To be supplied — version and effective date