Privacy Policy
1. Controller
Ante Milic
Mainzer Straße 14
70499 Stuttgart, Germany
Email: info@trogirpropertyguide.com
2. Hosting
This website is hosted by Vercel Inc. (USA). When you visit the site, the hosting provider technically processes connection data (such as IP address, requested page, browser information) in server logs to deliver the website securely.
[PLACEHOLDER — final wording on Vercel, data processing agreement and third-country transfer to be completed after review.]
3. Cookies & consent
This website uses a consent banner. Technically necessary storage (your cookie choice, saved in your browser's local storage) is always active. Optional analytics (see below) runs only after you actively consent in the banner. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer.
4. Web analytics (Google Analytics 4)
If — and only if — you consent in the cookie banner, this website uses Google Analytics 4, a web analytics service of Google Ireland Ltd. Google Consent Mode v2 is configured with all storage denied by default; without your consent, no Google Analytics script is loaded and no analytics cookies are set. If you decline, the website works without any analytics tracking.
With your consent, Google Analytics records page views together with pseudonymous usage data such as approximate location, browser and device information. We use this solely to understand which pages of the guide are useful. IP addresses are not stored by Google Analytics 4. You can withdraw your consent at any time via the "Cookie settings" link in the footer; analytics stops from that moment.
[PLACEHOLDER — final wording on data retention period, Google as processor and third-country transfer (EU–US Data Privacy Framework) to be completed after legal review.]
5. Contact form & email
If you contact us via the contact form or by email, we process the details you provide (name, email address, your message) to answer your enquiry.
The contact form is processed by Formspree Inc. (USA), which receives your form entries and forwards them to our email address. Your data is used solely to deliver your message.
[PLACEHOLDER — final wording on Formspree as processor (data processing agreement, third-country transfer, retention period) to be completed after legal review.]
6. Waiting list for property listings
Purpose and legal basis
On our properties pages you can ask to be notified once a checked listing matches what you are looking for. We process the details you enter for that single purpose. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future; every email we send contains an unsubscribe link.
What we process
Only the following is stored: your email address, the language of the page you signed up on, the areas you selected, the property type, the budget range, your optional free-text note, whether you gave the optional second consent, the time at which each consent was given, and the version identifier of the consent text you agreed to.
We do not collect a name, a postal address, a phone number, or any advertising or profiling identifier. The waiting-list form does not set cookies and does not feed our web analytics: the analytics event triggered on a successful signup contains only the page language, the page path, a form type and whether the optional consent was given — never your email address, your note, your budget or any other entry.
Two separate consents
The first consent covers notifications from us and is required to join the list. The second consent is optional, separate, and not pre-ticked: it permits us to pass your contact details to a named licensed estate agency if that agency has a matching property. You will be told which agency before any transfer takes place. If you do not give this second consent, you still receive notifications; nothing is passed on.
Double opt-in
After you submit the form you receive an email with a confirmation link. Your entry only becomes active once you click it. Unconfirmed entries are not used. The time of confirmation is recorded as evidence that consent was given.
Processor
The waiting list and the confirmation emails are operated by Brevo, with whom we have concluded a data processing agreement under Art. 28 GDPR. [PLACEHOLDER — exact Brevo contracting entity and address, to be inserted once the account is set up; Brevo assigns the entity based on the customer's location.]
According to Brevo's data processing agreement, hosting is provided by Google Cloud Platform (servers in Belgium), Scaleway/Iliad and OVH (France) and Hetzner Online GmbH (Germany). Brevo additionally uses Cloudflare (content delivery and web application firewall, servers in the USA and the EU) and Zendesk (support ticketing, EU and USA).
Transfers outside the EU
Brevo states in its data processing agreement that customer data is also processed outside the European Economic Area. For such transfers Brevo relies on the EU Standard Contractual Clauses together with additional measures, and for Cloudflare and Zendesk additionally on the EU-US Data Privacy Framework.
Your IP address
When you submit the form, our server-side endpoint uses your IP address once, in memory, to limit how many submissions can be made in a short period. It is combined with a random value generated at runtime and reduced to a cryptographic hash. The IP address itself is not stored, not written to any log, and not passed to Brevo.
Storage and deletion
We delete waiting-list entries at your request and when you unsubscribe. Beyond that, we intend to delete entries after 24 months without any interaction. [PLACEHOLDER — Brevo offers no built-in rule that deletes contacts automatically after a period of inactivity, so this 24-month deletion is currently a manual step. Either establish and document a recurring manual review, or state a retention period here that is actually enforced. Do not leave this claim standing unless the review actually happens.]
Brevo undertakes in its data processing agreement to destroy or anonymise customer data within 100 days of the end of the contract.
Where the form is processed
The endpoint that receives your entry runs as a serverless function on our hosting provider in the Frankfurt region (Germany). It forwards your entry to Brevo and keeps no copy.
7. Newsletter
Purpose and legal basis
If you sign up for our newsletter, we process your email address for the sole purpose of sending that newsletter. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future; every newsletter email contains an unsubscribe link.
What we process
Only the following is stored: your email address, the language of the page you signed up on, the time at which you gave consent, and the version identifier of the consent text you agreed to. We do not collect a name, a postal address, a phone number, or any advertising or profiling identifier for the newsletter.
Double opt-in
After you submit the newsletter signup form you receive an email with a confirmation link. Your subscription only becomes active once you click it. Unconfirmed sign-ups are not used.
Processor
The newsletter and its confirmation emails are operated by Brevo, the same processor used for the waiting list described in section 6 above. The sub-processors, hosting locations and third-country transfers described there apply equally here and are not repeated.
Newsletter and waiting list are separate
The newsletter and the property waiting list (section 6) are two separate, independent consents, stored on two separate Brevo lists. Signing up for one does not sign you up for the other, and withdrawing one consent has no effect on the other.
Your IP address
When you submit the newsletter form, our server-side endpoint uses your IP address once, in memory, to limit how many submissions can be made in a short period. It is combined with a random value generated at runtime and reduced to a cryptographic hash. The IP address itself is not stored, not written to any log, and not passed to Brevo.
No additional browser storage
The newsletter signup form does not set cookies and does not write anything to local storage.
8. Fonts
The fonts used on this website ("Playfair Display" and "Montserrat") are self-hosted on our own web space. No connection to Google Fonts or any other third-party font service is made when pages load.
9. Your rights
[PLACEHOLDER — standard GDPR rights section: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, complaint to a supervisory authority — final wording after review.]
10. Updates to this policy
[PLACEHOLDER — versioning note and date of last update.]