Privacy Policy

This Privacy Policy sets out the rules for processing and protecting the personal data of Dimdom users in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

Protecting user privacy is our priority. We are committed to processing personal data in accordance with applicable law.

The controller of personal data is:

When using the service we collect the following personal data:

3.1. Registration data

• Email address
• Password (stored in encrypted form)

3.2. Listing data

• Contact phone number
• Contact person (optional)
• Property location

3.3. Invoicing data (optional)

• Name / company name
• Address
• VAT ID

3.4. Technical data

• IP address
• Browser and operating system type
• Cookie data
• Service activity history

We process personal data for the following purposes:

• Registration and user account management
• Publishing real estate listings
• Enabling contact between users
• Processing payments for premium services
• Issuing VAT invoices
• Communication with users (notifications, responding to enquiries)
• Ensuring service security and preventing abuse
• Analysing statistics and improving the service
• Fulfilling legal obligations

Legal bases for data processing:

• Performance of a contract (Art. 6(1)(b) GDPR) - registration, publishing listings, service provision
• Consent (Art. 6(1)(a) GDPR) - marketing, newsletter (if applicable)
• Legitimate interests (Art. 6(1)(f) GDPR) - security, analytics, pursuing claims
• Legal obligation (Art. 6(1)(c) GDPR) - accounting, taxes

The Service uses cookies to ensure proper operation, user authentication, remembering preferences, and traffic analysis.

Detailed information about the use of cookies can be found in our Cookies Policy.

Personal data may be shared with the following entities:

• Payment operators - dpay.pl - processing online payments
• Email service providers - Resend - sending notifications
• Hosting - hosting service provider - data storage
• Accounting office - bookkeeping services (if applicable)
• Government authorities - upon request of authorised authorities

All subprocessors act under data processing agreements compliant with the GDPR.

Users have the following rights:

• Right of access - to obtain information about processed data
• Right to rectification - to correct inaccurate data
• Right to erasure - "right to be forgotten"
• Right to restriction of processing - to suspend certain operations
• Right to data portability - to receive data in a machine-readable format
• Right to object - to processing for marketing purposes
• Right to withdraw consent - at any time
• Right to lodge a complaint - with the supervisory authority

To exercise your rights, please contact us at: kontakt@dimdom.pl

8.1. Data export (GDPR: Art. 15 and 20)

Users may request a copy of their data and data portability in machine-readable format via the account panel (Profile → Account). The request is processed asynchronously.

• You will receive a download link by email.
• The link is valid for a limited time (typically up to 48 hours).
• The download is one-time — the link expires after use.
• The export file is automatically deleted after download (usually within about 1 hour).
• The export includes profile data, listings, payments, metadata, and uploaded files (e.g. photos).

8.2. Account closure / right to erasure (GDPR: Art. 17)

Users may initiate account closure in the panel (Profile → Security → Danger Zone). Once submitted, the account is logged out and data is anonymised as soon as possible.

Due to legal obligations (e.g. tax and accounting requirements), some data may be retained for the required period (e.g. invoicing data and transaction history), while data that enables user identification is replaced with anonymous data.

Data retention periods:

• Account data - until account deletion or withdrawal of consent
• Data in active listings - for the duration of the listing activity + 30 days
• Transaction history - 5 years (accounting and tax requirement)
• VAT invoices - 5 years (tax regulations)
• System logs - up to 12 months (security)
• Audit logs (GDPR) - up to 7 years (compliance and security trail)
• Data export files - temporarily (until download; deleted automatically after download)
• Data for pursuing claims - for the limitation period

We apply the following security measures:

• SSL/TLS connection encryption
• Password hashing in the database (bcrypt)
• Protection against CSRF and XSS attacks
• Regular software updates
• Security monitoring and event logging
• Restricted access to personal data
• Data backups