Data processing agreement
Last updated: 15 October 2026
This data processing agreement forms part of the terms of service of EstateVitrine. It applies automatically as soon as you (the agent or agency) use an account, and governs how we process personal data that you record through EstateVitrine, as referred to in Article 28 of the General Data Protection Regulation (GDPR).
1. Parties and roles
- Controller: you, the agency with an account on EstateVitrine.
- Processor: EstateVitrine, KvK 63456842, Meppelerstraatweg 18, 8022 AH Zwolle, the Netherlands.
2. Subject, nature and purpose
We process personal data solely to provide the EstateVitrine service to you: publishing your listings, receiving and showing enquiries, scheduling and confirming viewings, recording offers, sending messages to people with a saved search, and showing reports to your sellers.
3. Types of data and data subjects
| Data subjects | Data |
|---|---|
| Prospective buyers and buyers | Name, email address, phone number, language, message, preferred viewing times and time zone, search wishes (type, location, price, rooms), offers and their conditions, notes you add yourself |
| Sellers | Name and email address (for the report page) |
| Your staff | Name, email address, role |
You do not record special categories of personal data (such as health data or national identification numbers) in EstateVitrine.
4. Our obligations as processor
- We only process the data on your instructions, as set out in this agreement and through the way you use the platform, and not for our own purposes.
- Everyone at our side who has access to the data is bound by confidentiality.
- We take appropriate technical and organisational security measures, including: encrypted connections (HTTPS), hashed passwords, separation of data per agency, role-based permissions within an agency, and regular backups.
- We assist you, as far as reasonable, with requests from data subjects (access, correction, deletion) and with any data protection impact assessment.
- We make available the information needed to demonstrate that we comply with this agreement.
5. Sub-processors
You give general authorisation for the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| IONOS SE | Hosting, storage and sending email | Germany (EU) |
| Anthropic, PBC | AI texts, translations and photo recognition, only when you use those features. Only property details and property photos are sent; do not put personal data in property texts. | United States, under the European Commission's standard contractual clauses |
We will inform you by email at least 30 days before engaging a new sub-processor. You may object on reasonable grounds; if we cannot resolve this together, you may terminate the agreement free of charge. We impose the same obligations on sub-processors as set out in this agreement.
6. Data breaches
If we discover a personal data breach affecting you, we will notify you without undue delay, and no later than 48 hours after discovery, at your agency's email address. We will provide the information you need to notify the supervisory authority and the data subjects yourself, where required.
7. Retention and deletion
- You decide how long you keep data and can delete enquiries, viewings, offers and saved searches in the dashboard. People with a saved search can unsubscribe themselves via the link in every email.
- After your account ends you can request an export of your data. We then delete the personal data within 30 days, unless a legal obligation requires us to keep something. Data disappears from backups automatically within the retention period of those backups.
8. Transfers outside the EU
We only transfer personal data to countries outside the European Economic Area with appropriate safeguards under the GDPR, as stated above for the sub-processors.
9. Duration and liability
This agreement runs for as long as we process personal data for you. The liability provisions of the terms of service apply. In case of conflict between this agreement and the terms of service, this agreement prevails as regards the processing of personal data.
10. Contact
Questions about this agreement or the processing of personal data: info@estatevitrine.com. If you would like a signed copy for your records, let us know.
This is a translation. In case of differences, the Dutch version prevails.