Privacy policy

Who is the controller?

The controller is the business behind the ISVERO brand, a sales-platform studio for residential developers ("we"). ISVERO's offer in Poland is called Velora Real Estate. Full details of the controller (company name, address and organisation number) will be added before the website is used commercially.

For questions about your personal data, use the contact form and write "Personal data" in the message. We reply without undue delay and within one month at the latest.

What personal data do we process?

• Enquiry: name, email address, phone number with country code (optional), preferred language, the home you selected (optional) and your message, plus the date and the language version of the website.
• Abuse protection: a pseudonymised one-way hash of your IP address, used to limit the number of enquiries per address.
• Server logs: IP address, date and time, requested page and browser details, recorded automatically on every visit.

We do not ask for a personal identity number, income details or a mortgage approval. Providing data is voluntary, but without an email address we cannot reply.

Purposes and legal bases

• Replying to your enquiry and sending the material you ask for — steps at your request before any contract (Article 6(1)(b) GDPR). The tick box confirms that you want to be contacted about your enquiry.
• Protecting the form against abuse — our legitimate interest after a balancing test (Article 6(1)(f) GDPR).
• Running and securing the website with server logs — legitimate interest (Article 6(1)(f) GDPR). Logs are not combined with other data.

We send no newsletters or mailings and do not use your data for profiling or for decisions based solely on automated processing (Article 22 GDPR).

How long do we keep the data?

Enquiry data is kept until the correspondence ends and then for at most 12 months from the last contact; the copy of the enquiry in the forms service is deleted automatically after 12 months. Server logs are kept no longer than needed for operation and security. If a contract is concluded, data is kept as long as accounting and tax rules require.

Who do we share the data with?

We do not sell personal data or share it for marketing. We use providers that process data on our behalf under data processing agreements (Article 28 GDPR):

• Web hosting — OVHcloud; the server delivering the website is in the European Union (France).
• Forms service — OVHcloud; the server receiving and storing enquiries is currently in Canada.
• Email service established in the EU, which notifies us of a new enquiry.
• Mailbox provider that receives the notifications.

Provider names are available on request.

Where is the data processed?

The website is delivered from servers in the EU. Enquiries sent through the form are stored in Canada, which benefits from a European Commission adequacy decision (Decision 2002/2/EC; Article 45 GDPR). The mailbox provider may transfer data to the United States under the adequacy decision for the EU–US Data Privacy Framework (Article 45 GDPR).

Cookies and browser storage

The website uses no cookies, advertising pixels or social media plug-ins. Fonts and scripts are served from our own servers. That is why no cookie banner is shown.

If you choose a language yourself, the website keeps that choice in the browser's local storage (entry "lang_pref", for example "en") so that it opens in the same language next time. The entry contains no identifier and is not sent to us. Under the Swedish Electronic Communications Act (2022:482) no consent is needed for storage required for a service you have explicitly requested.

Your rights

You have the right of access to your personal data (Article 15 GDPR) and to request rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20), free of charge. We may need to confirm your identity before disclosing data.

Right to object (Article 21 GDPR): you may object at any time to processing based on our legitimate interest. A message through the contact form is enough.

Complaints

If you are unhappy with how we process your personal data, please contact us first. You always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se) or with the supervisory authority of the EU/EEA country where you live or work (Article 77 GDPR).

Changes

If our processing of personal data changes, we update this policy and the date above.