Privacy Policy

This Privacy Policy describes how the ImoHub platform collects, uses, stores and protects the personal data of its users in accordance with applicable European and Bulgarian legislation on the protection of personal data.

The controller of the personal data collected through the Platform is:

• Company name: AyaTech LTD
• UIC: 208698687
• Registered address: 9 Detelina Str., Primorski District, Varna 9000, Bulgaria
• Email: [email protected]
• Phone: +359 897 034 949
• Website: https://imohub.bg

Data Protection Officer (DPO): Delyana Mirchovska, contact email: [email protected]

Depending on how you use the Platform, we collect the following categories of personal data:

• Account data: first and last name, email address, phone number, password (stored in hashed form), profile photo.
• Profile data: user type (regular user, broker, organisation/agency), organisation name, professional role.
• Listing data: property address, descriptions, photos (EXIF metadata is automatically removed to protect privacy), videos, price, property features.
• Communication data: chat messages between users, date and time of messages, read status. The Platform is entitled to analyse the content of chat conversations for security and abuse-prevention purposes, in accordance with the Terms and Conditions.
• Preference data: favourite listings, saved searches, filters, notification settings.
• Location data: user-provided location and IP-based geolocation. Browser geolocation is disabled by default and requires explicit consent.
• Payment data: transaction history, type of paid service, dates. Bank card data is processed directly by Stripe and is not stored by ImoHub.
• Document data: documents uploaded through the document management feature as part of property transactions.
• Technical data: IP address, browser and device type, operating system, language, date and time of access, session data.
• Cookie data: cookie identifiers, analytics data, behaviour when using the Platform. Details are provided in the Cookies section.

When signing in with Google or Apple we receive your name and email address from the respective provider. We do not receive your password from these providers.

We process your personal data for the following purposes:

• Providing the Platform's services - creating and managing profiles, publishing listings, and enabling communication between users via chat.
• Processing payments - processing paid services via Stripe.
• Sending notifications - system notifications for new messages, listing changes and transaction status.
• AI Assistant - processing queries to the AI assistant for the purpose of providing informational answers.
• Personalisation - improving search results and recommendations based on preferences and saved searches.
• Improving the Platform - analysing usage patterns in order to improve functionality.
• Security - preventing abuse, fraud and unauthorised access, including analysis of chat communications where there is a specific suspicion of a violation.
• Compliance with legal obligations - tax, accounting and other applicable law.

For each processing purpose we apply a specific legal basis:

• Performance of a contract - registration and account management, publishing listings, chat between users, payment processing, subscription management, use of the AI Assistant. Without these data we cannot provide the services.
• Your consent - marketing communications and newsletters, analytics and marketing cookies, browser geolocation. Consent may be withdrawn at any time, without affecting the lawfulness of processing prior to its withdrawal.
• Legitimate interest - improving the Platform, preventing abuse, sending system notifications, personalising search results, analysing chat messages where there is a specific suspicion of a violation. For each such processing activity we carry out a balancing test between our interests and your rights. The relevant documentation is available upon request.
• Legal obligation - retention of accounting records, tax reporting, responding to requests from competent authorities.

We retain personal data only for the period necessary to fulfil the purposes for which it was collected, or as required by law:

• Account data - for the lifetime of the account, plus 30 days after a deletion request.
• Listing data - for the duration of the publication, plus 6 months after deactivation for archival purposes.
• Chat messages - up to 3 years from the last message in the conversation, or until the account is deleted, whichever is earlier.
• Documents from property transactions - up to 5 years from completion of the transaction.
• Payment and transaction data - 5 years from the date of the transaction.
• Analytics data - up to 26 months.
• Server logs - 90 days.
• Cookie data - session (until the browser is closed), functional (up to 1 year), analytics (up to 2 years).

After the retention periods expire, data is deleted or irreversibly anonymised.

ImoHub does not sell personal data to third parties. We share data only in the following cases:

• Stripe (Stripe, Inc., USA) - payment processing. Bank card data is processed directly by Stripe. ImoHub does not store card data.
• Google (Google LLC, USA) - authentication via Google Sign-In, analytics via Google Tag Manager, maps via Google Maps, voice input for the AI Assistant, push notifications via Firebase.
• Apple (Apple Inc., USA) - authentication via Apple Sign-In.
• Fireworks AI (Fireworks AI, Inc., USA) - processing of queries submitted to the AI Assistant. The data is not used to train AI models.
• Hetzner Online GmbH (Germany) - hosting of the server infrastructure. Data is stored on servers within the European Union.
• Other users - contact information included in listings is visible to Platform users. Chat messages are shared between the participants in the conversation.
• Competent authorities - where required by law or by a court or administrative order.

A data processing agreement is concluded with every processor acting on our behalf, guaranteeing adequate protection measures.

Some of your data is transferred to recipients in the USA. These transfers take place subject to the following safeguards:

• Stripe - certified participant in the EU-US Data Privacy Framework. Additional measures: TLS encryption, tokenisation of card data.
• Google - EU-US Data Privacy Framework and Standard Contractual Clauses. Additional measures: IP anonymisation in Analytics.
• Apple - EU-US Data Privacy Framework and Standard Contractual Clauses. Minimal data transfer.
• Fireworks AI - Standard Contractual Clauses and a transfer impact assessment. The data is not retained after processing.

ImoHub's server infrastructure is hosted by Hetzner in Germany, which means that the core data remains within the EU.

You may obtain a copy of the applicable safeguards by contacting us at [email protected].

The Platform uses cookies and similar technologies. On your first visit a banner is displayed through which you can manage your preferences.

• Strictly necessary cookies (no consent required) - session cookies for authentication, a cookie storing your cookie-consent choice, and language preferences. These are required for the normal operation of the Platform.
• Analytics cookies (consent required) - Google Analytics via Google Tag Manager. Analysis of traffic and user behaviour. The data is anonymised. Retention: up to 2 years.
• Marketing cookies (consent required) - cookies for targeted advertising and remarketing. Retention: up to 2 years.

The Platform also uses localStorage to store user preferences (language selection, interface settings) and Socket.io to provide real-time connectivity for chat and notifications. The use of localStorage for these functional purposes is based on legitimate interest, as it is required for the normal operation of the Platform.

You can change your preferences at any time via the cookie-management button at the bottom of the website or through your browser settings. More information: www.allaboutcookies.org. Detailed information is available in the Cookie Policy at https://imohub.bg/en/cookie-policy.

You have the following rights in respect of your personal data:

• Right of access - to receive confirmation whether we process data concerning you, and a copy of that data.
• Right to rectification - to request correction of inaccurate data. Basic information can be corrected directly in the profile settings.
• Right to erasure - to request deletion of your data. Deletion may be refused where the data is necessary to fulfil a legal obligation.
• Right to restriction - to request temporary restriction of processing in certain circumstances.
• Right to portability - to receive your data in a structured, machine-readable format.
• Right to object - to object to processing based on legitimate interest. You have an unconditional right to object to processing for direct marketing.
• Right to withdraw consent - where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right not to be subject to automated decisions - not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise your rights, send a request to [email protected] or to: 9 Detelina Str., Primorski District, Varna 9000. We will reply within 1 month. For complex or numerous requests the period may be extended by up to 2 months, of which you will be informed.

If you consider that the processing of your data infringes applicable law, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592; www.cpdp.bg; [email protected].

The Platform is intended for legally capable persons who have reached the age of 18, in accordance with the Terms and Conditions. We do not knowingly collect personal data of persons under 18 years of age.

If we establish that we have collected data relating to a minor, we will take steps to delete it without delay. If you are a parent or guardian and believe that a minor has provided data to the Platform, please contact us at [email protected].

ImoHub applies appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit via TLS/SSL.
• Hashing of passwords using modern cryptographic algorithms. Passwords are never stored in readable form.
• Restricted access to personal data, granted only to authorised personnel.
• Regular security assessments and system updates.
• Servers located in the EU (Hetzner, Germany) with physical and network security.
• Automatic removal of EXIF metadata from uploaded photos.

In the event of a security breach that could result in a risk to your rights, we will notify the CPDP within 72 hours. If the risk is high, we will notify you personally without undue delay via email and/or a notice on the Platform.

ImoHub applies the principles of data protection by design and by default:

• We only collect data necessary for providing the services.
• Geolocation is disabled by default and requires an explicit action by the user.
• Marketing communications require an explicit opt-in.
• EXIF metadata is automatically removed from uploaded photos.
• For high-risk processing activities, data protection impact assessments have been carried out and are available to the supervisory authority upon request.

The AI Assistant provides informational answers based on your queries. It does not make automated decisions that produce legal or similarly significant effects on you.

The Platform uses automated algorithms to personalise search results and recommend listings based on your behaviour and preferences. These recommendations have no legal effect and can be disabled in your profile settings. You are informed of this functionality through this Policy at the time of registration.

This Policy may be updated from time to time. In the event of material changes we will notify you via email and/or a notice on the Platform at least 30 days in advance.

The current version is available at: https://imohub.bg/en/privacy-policy

For questions regarding the processing of personal data or to exercise your rights:

• Controller: AyaTech LTD, UIC 208698687
• Address: 9 Detelina Str., Primorski District, Varna 9000, Bulgaria
• Phone: +359 897 034 949
• Email: [email protected]
• DPO: Delyana Mirchovska, contact email: [email protected]

Supervisory authority: Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592; www.cpdp.bg; [email protected].