Privacy Policy

1. Controller

[Firmenname des Betreibers, z. B. Vellesta GmbH], [Straße und Hausnummer], [PLZ und Ort], Germany – email: info@vellesta.com

2. Hosting

The platform is operated on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; server location Falkenstein, Germany). When the platform is accessed, technically necessary data (IP address, time, page requested, user agent) is processed in server logs (Art. 6 (1) (f) GDPR – secure operation). A data processing agreement is in place with Hetzner.

3. Cookies

We only use technically necessary cookies (Art. 6 (1) (f) GDPR; Section 25 (2) TDDDG):

• Session cookie for login (deleted on logout)
• „ui-theme“ to store the light/dark setting (12 months)

No tracking or marketing cookies are used; a consent banner is therefore not required.

4. Account and agency data

On registration we process name, email address, password (as a hash only) and agency data (Art. 6 (1) (b) GDPR – performance of contract). For verification as an agency we process voluntarily submitted professional credentials (e.g. association membership, licence or register numbers).

5. Property, search and client data of agencies

Agencies store property data, search profiles and client contacts of their own clients on the platform. In this respect, the operator acts as processor (Art. 28 GDPR) for the respective agency; a data processing agreement is concluded on registration. Client contacts, internal notes and search contact data are never visible to other agencies. Only property data (masked address on request) and – only if explicitly shared – anonymised search criteria are visible in the agent network.

6. Emails

System emails (e.g. matching notifications, password reset) are sent via Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany) as processor. Notification emails can be switched off at any time under „My profile“.

Exposé and client emails are sent by each user via their own email account. Optionally, users can connect their own inbox (IMAP) – strictly read-only. Only sender, subject, date and a short preview of emails whose sender is in the agency's client list are taken over; all other emails are neither stored nor displayed.

Inbox and email history are private: they are visible only to the respective user – not to other members of the agency, not to other users and not to us as operator. Credentials, subject lines and previews are stored encrypted only; the text of sent emails is not stored at all. When a user account is removed from an agency, its email history is deleted.

7. Payments and invoices

Subscriptions are processed via Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands); payment data (e.g. card details) is collected directly by Mollie and not stored on our servers. Invoices are created via easybill GmbH (Düsselstr. 21, 41564 Kaarst, Germany). Legal basis: Art. 6 (1) (b) and (c) GDPR.

8. Electronic signature

Cooperation agreements can be signed electronically. For this purpose we run a self-hosted Documenso instance on our own server (sign.vellesta.com) – signature data does not leave our infrastructure. Signed documents are stored encrypted outside the public web directory.

9. Maps, geocoding, exchange rates and cadastral data

• Map display: OpenStreetMap tiles (OpenStreetMap Foundation). When the map is loaded, your IP address is transmitted to the tile server (Art. 6 (1) (f) GDPR).
• Address and area search as well as geocoding are carried out server-side via Nominatim (OpenStreetMap Foundation, United Kingdom) or an equivalent map service configured by the operator. Only search terms or property addresses are transmitted, no user or client data; results are cached for 30 days. Assigning a property to a country is done without an external service.
• Exchange rates for properties in foreign currencies are obtained daily as public reference rates of the European Central Bank – without transmitting personal data.
• Spanish cadastral references are determined server-side via the public service of the Spanish cadastral authority (Dirección General del Catastro) – only property coordinates are transmitted.

10. Translation and AI assistant

On request, we translate interface texts, exposé content and email drafts via DeepL SE (Maarweg 165, 50825 Cologne, Germany) as processor. Only the texts to be translated are transmitted.

When a property is created from an uploaded exposé (PDF, “Smart Upload”), the pages as images, the extracted text and preview images of the photos it contains are sent to Anthropic PBC (548 Market Street, San Francisco, CA 94104, USA) to recognise property details and classify photos, provided the operator has enabled the AI assistant. Contact details, names and exact addresses in the exposé are flagged as sensitive and not shared with the agent network. Transfers to the USA are based on the EU standard contractual clauses. The PDF itself is not stored; only the selected photos and floor plans and the reviewed property details are stored.

11. Web exposé enquiries

If you send an enquiry via a public web exposé, your details (name, email, phone if provided, message) are transmitted to the offering agency and processed there as a client enquiry (Art. 6 (1) (b) GDPR – pre-contractual measures). The respective agency is the controller for any further processing.

12. Storage period

We store account and agency data for the duration of the contractual relationship; statutory retention obligations (e.g. for invoices) remain unaffected. Server logs are deleted regularly. Backups are kept for 14 days.

13. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to lodge a complaint with a data protection supervisory authority. Please contact info@vellesta.com.