Privacy Policy

This policy explains what personal data we collect when you fill in a contact form on a Kvadra-powered site, how we use it, who we share it with, and the rights you have under the General Data Protection Regulation (GDPR) and equivalent local law.

Who we are

The data controller is the property project running the form you submitted (for the form you just used, that is the team identified in the form's title). The CRM software that processes submissions on the controller's behalf is Kvadra. For requests addressed to the data controller, contact the project team through the channel that brought you to the form (the WhatsApp number or email shown on its “Thank you” screen).

What we collect

• From the form itself: the name, phone number, email address and interest preference you enter, plus any free-text comment you leave.
• Submission metadata: the timestamp of your submission and the version of this privacy policy you saw at that moment, stored as proof of consent.
• Browser headers: we read your Accept-Language header to pre-fill the country code in the phone field — that header value is not stored once the form has rendered.
• If you continue on WhatsApp / Instagram / email: the metadata of your conversation (sender, channel, timestamps, message contents) flows into our CRM via respond.io so the sales team can answer you.

We do not use cookies on the form, do not run analytics scripts on it, and do not embed third-party pixels.

Why we collect it (legal basis)

• Consent — you tick the “I agree to the processing of my personal data” checkbox before submitting. You can withdraw consent at any time (see “Your rights” below).
• Legitimate interest for following up on your inquiry — once you ask about an apartment, contacting you about it is the obvious next step.
• Legal obligation for retaining records once you become a customer (tax, anti-money-laundering, contractual disputes).

Who we share it with

We share submission data only with the processors needed to actually contact you and run the sales process. Each of them is bound by a Data Processing Agreement and may not use the data for their own purposes:

• Hetzner Online GmbH (Falkenstein, Germany) — the server that hosts the CRM database. Data stays inside the EU.
• respond.io — omnichannel inbox we use to receive WhatsApp / Instagram / Facebook Messenger / Telegram messages from you. Your messages and your channel-specific contact ID are processed there. respond.io operates under its own privacy terms (see respond.io/privacy-policy).
• Meta Platforms / Google — only if you originally reached us via a Facebook Lead Ad or a form synced through Google Sheets. In that case the source platform sees the same data you submitted to it directly. We never share form-submission data back to ad platforms for retargeting.

We do not sell your data. We do not transfer it to advertising networks or data brokers.

How long we keep it

• Active leads: while we're in contact and for up to 24 months after the last interaction, so we can answer follow-up questions or new inquiries.
• Contracts and payments: for the period required by tax and accounting law in the controller's jurisdiction (typically 7–10 years).
• Forms you submitted but never followed up on: deleted after 24 months of inactivity.

International transfers

Our primary servers are in Germany. respond.io stores conversation data outside the EU; the platform relies on Standard Contractual Clauses (SCCs) for such transfers. If you contact us through WhatsApp, Meta Platforms is the channel operator and your message metadata may be processed by Meta in the United States under SCCs as well.

Your rights

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — ask us to delete your data when it's no longer needed for the purpose it was collected.
• Restriction — ask us to stop using your data while we sort out a dispute or correction.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, by replying “UNSUBSCRIBE” (or the equivalent in your language) on the channel we're talking on, or by writing to the controller using the contact in the form's thank-you screen.

To exercise any of these rights, contact the project team through the channel that brought you to the form. We will reply within 30 days.

Right to complain

If you believe we're mishandling your data, you can complain to the data protection authority of your country of residence (in Germany: BfDI; in Austria: DSB; in Italy: Garante). You don't have to contact us first.

Changes to this policy

When we update this policy, the “Last updated” date at the top changes. The version you saw at the moment you ticked the consent checkbox is recorded with your submission, so you can always check what you actually agreed to.

← Back to home