Privacy policy

Who we are

GLOBARIS operates this international property portal. We are the controller of the personal data described in this policy — meaning we decide why and how it is processed.

For any question about this policy, or to exercise any of the rights below, write to privacy@globaris.example. We answer data-protection requests within one month, as Article 12(3) of the GDPR requires.

What we collect

We collect only what the site needs in order to work. Depending on how you use it, that is:

• Account details — your email address, your name, and the password you choose (stored only as a scrypt hash, never in readable form).
• Profile details, if you are a partner, advisor or team member — agency, phone number, photo, professional title, biography, credentials, languages and the city or country you cover. This information is deliberately public: it appears on your profile page.
• Enquiries and messages — what you write to a seller, advisor or manager, including any photos you attach.
• Viewing requests — the property, the date and time you propose, and any note you add.
• Saved properties — the listings you add to your favourites.
• Property-management and off-market requests — the property address and type, any notes you provide, and the outcome of the request.
• Listings, if you are a partner — the property details and photographs you upload for publication.
• Preferences — the language and display currency you choose.
• Technical data — your IP address, used to rate-limit sign-in attempts and public forms so the site cannot be brute-forced or used to send spam.

Why we use it, and on what legal basis

Every use below is tied to a lawful basis under Article 6 of the GDPR. We do not process your data for anything else without telling you first.

• To run your account, publish listings, and deliver the messages, enquiries and viewing requests you send — performance of a contract, Art. 6(1)(b).
• To keep the service secure: rate limiting, bot protection on public forms, session management and abuse prevention — our legitimate interest in a service that is not overrun by attackers, Art. 6(1)(f).
• To send service email you have asked for — an enquiry receipt, a viewing reminder, a notification that someone replied — Art. 6(1)(b) and (f).
• To measure how the site is used, and to show advertising — your consent, and only after you give it, Art. 6(1)(a). You may withdraw it at any time from the cookie settings link in the footer, as easily as you gave it.
• To meet legal obligations, such as responding to a lawful request — Art. 6(1)(c).

Who else sees it

We do not sell your personal data, and we never have.

When you send an enquiry or request a viewing, the relevant partner, advisor or manager on our platform receives it — that is the point of sending it. They act as an independent controller for whatever they then do with it.

We also use a small number of processors, who handle data on our instructions and for nothing else:

• Vercel — hosting, content delivery and cookieless traffic measurement.
• Neon — the managed PostgreSQL database where site data is stored.
• Cloudflare — Turnstile bot protection on public forms.
• Google — advertising, and analytics if you consent to it. Google Fonts also serves this site's typefaces, which means your browser contacts Google to fetch them.

Where your data goes

The database is hosted in the European Union. Some providers are US-headquartered and may process data outside the EEA. Where that happens, the transfer relies on the European Commission's Standard Contractual Clauses or on an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified under it.

How long we keep it

Account data is kept for as long as your account exists. Ask us to delete it and we will, unless a specific legal reason requires us to keep something.

Enquiries, messages and viewing records are kept while they remain useful to both sides of the conversation, then removed. Sessions expire on their own — after 30 days, or 7 days for staff accounts. Rate-limit records are short-lived and clear themselves.

Cookies expire on the schedule set out in the cookie policy.

Your rights

Under the GDPR you may, at any time and free of charge:

• Ask what we hold about you, and receive a copy of it — Art. 15.
• Have inaccurate details corrected — Art. 16.
• Have your data deleted — Art. 17.
• Ask us to restrict how we use it — Art. 18.
• Receive your data in a portable, machine-readable form — Art. 20.
• Object to processing we base on legitimate interests — Art. 21.
• Withdraw a consent you have given, without affecting what was lawful before you withdrew it — Art. 7(3).

Cookies

The site sets a small number of strictly necessary cookies, and nothing else until you allow it. Analytics and advertising cookies are off by default and are set only after you accept them.

The cookie policy lists every cookie by name, purpose and lifetime.

How we protect it

Passwords are stored as scrypt hashes and are never readable — not by us, and not by anyone reading the database. Session identifiers are 256-bit random values. Traffic is served over HTTPS under a content security policy, and sign-in, registration and every public form are rate-limited in the database so the limit holds across servers.

No system is perfectly secure. If a breach ever puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.

Complaints

If you think we have handled your data badly, please tell us first at privacy@globaris.example — most things are quickest to fix directly.

You also have the right to complain to a data-protection supervisory authority, either in the EU country where you live or work, or where the problem happened. In Czechia that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects how we use your data, we will say so plainly rather than leaving you to spot it.