Privacy Policy

The data controller for personal data collected through the inquiry form is the individual real estate agent using the Qualu platform for that specific inquiry. The agent's name is displayed on the form. Qualu acts solely as a data processor under Art. 28 GDPR and provides the technical infrastructure.

The following personal data is collected as part of a property inquiry:

• Full name (required)
• Email address (required)
• Phone number (optional)
• Maximum purchase budget
• Desired purchase timeline
• Financing status (e.g. pre-approved, cash)
• Preferred location / neighbourhood
• Additional notes (optional)

Technical data is also collected: IP address (for security checks), UTM parameters (for marketing attribution), and submission timestamp.

Your data is used solely to process your property inquiry and enable the responsible agent to contact you. The legal basis is your explicit consent under Art. 6(1)(a) GDPR, given before submitting the form. The CAPTCHA check to prevent automated abuse is based on the legitimate interest of the controller under Art. 6(1)(f) GDPR.

Your data is retained as long as an active business relationship with the agent exists, or until you request deletion. Data for inquiries that do not result in a business relationship is deleted within 24 months, unless legal retention obligations apply.

Your data is not sold to third parties. Technical service providers (e.g. Supabase for database hosting, Cloudflare for CAPTCHA services, OpenAI for the AI assistant) process data solely on instruction. Data processing agreements (DPAs) are in place. Transfers outside the EEA are based on EU Standard Contractual Clauses (SCCs). For AI processing, contractual settings are used to prevent use of your data for model training or general research purposes.

You have the right to:

• Access – a copy of your stored data (Art. 15 GDPR)
• Rectification – correction of inaccurate data (Art. 16 GDPR)
• Erasure – the "right to be forgotten" (Art. 17 GDPR)
• Restriction – restrict processing (Art. 18 GDPR)
• Portability – receive data in machine-readable format (Art. 20 GDPR)
• Objection – object to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawal of consent – at any time, with future effect (Art. 7 GDPR)

To exercise your rights, contact the agent named on the form directly. You also have the right to lodge a complaint with the relevant data protection supervisory authority.

The form does not use tracking cookies. Cloudflare Turnstile is used to protect against automated abuse. Turnstile uses technically necessary signals for bot detection without building personal behavioural profiles. For more information, see the Cloudflare Privacy Policy.