Privacy Policy

1. Who we are (Data Controller)

OrigiRE Technologies operates the OrigiRE Platform (origire.com) and OrigiRE Invest. For questions about this policy or your data, contact us at office@origire.com.

2. What personal data we process

• Account data: email, name, role, authentication identifiers.
• Property and deal data: details you enter about properties, deals, valuations, contacts.
• Third-party contact data: agents, sellers, buyers, service providers whose details are shared with us by our users or scraped from public real-estate listings (e.g. Spitogatos).
• Usage data: pages viewed, actions taken, device/browser, IP address, referrer.
• Submissions: forms, inquiries, GDPR requests.
• Investment information requests: the investment path selected, name, email, optional phone and message, country of residence, declared investor type and a dated record of the acknowledgements accepted. A declaration is not verified investor eligibility. Do not send identification documents, banking information or sensitive financial records through the public form.

3. Purposes and lawful bases (Art. 6 GDPR)

• Providing the service — contract (Art. 6(1)(b)).
• Analytics, security, fraud prevention, product improvement — legitimate interests (Art. 6(1)(f)).
• Analytics cookies (Google Analytics, Microsoft Clarity) — consent (Art. 6(1)(a)), gathered via our cookie banner.
• Legal and tax obligations — legal obligation (Art. 6(1)(c)).
• Marketing emails to opted-in users — consent, withdrawable at any time via unsubscribe.
• Investment information enquiries — consent to store and use your submitted details to respond and record correspondence (Art. 6(1)(a)). Submitting a request does not opt you into marketing. Necessary legal-obligation or legal-claim records may be retained on a separate applicable lawful basis after consent is withdrawn.

4. Third-party contact data (scraped and shared)

The platform contains contact details of real-estate professionals (agents, phones, offices) sourced from publicly available listings and from data our users enter. Lawful basis is our legitimate interest in operating a professional B2B real-estate intelligence tool. If you are one of those individuals you can object or request erasure via the request form; we will remove or suppress your details within 30 days unless we have an overriding legal ground to retain them.

5. Retention

• Account data: while the account is active, plus up to 6 months after deletion for backup rotation.
• Form-attempt logs: 12 months, then automatically purged. Saved contact and investor enquiries are separate correspondence records, not form-attempt logs; automatic expiry is not currently configured for those records. You may request erasure, subject to applicable legal retention grounds.
• Activity log: 24 months, then automatically purged.
• Notification / nudge history: 12 months, then automatically purged.
• Deal, property, and financial records: as long as required by Greek tax/AML law (typically 5–10 years).

6. Recipients / processors

• Lovable Cloud (database, authentication and storage).
• Cloudflare (edge network, DDoS protection).
• Google Analytics 4 & Microsoft Clarity (only with your consent).
• Email delivery providers for transactional and marketing email.
• Payment processors when transactions occur.

A current subprocessor list is available on request.

Investor enquiries appear in the restricted team contact-request inbox and a notification is sent to office@var-management.com. They are not available to anonymous visitors. Country and declared investor type help the team assess whether further contact and restricted investment information are lawful; the enquiry form does not perform automated eligibility approval.

7. International transfers

Where a processor is outside the EEA, transfers rely on adequacy decisions or the EU Standard Contractual Clauses.

8. Your rights (Chapter III GDPR)

• Access, rectification, erasure ("right to be forgotten").
• Restriction and objection to processing.
• Data portability (machine-readable export).
• Withdraw consent at any time (does not affect prior processing).
• Lodge a complaint with the Hellenic Data Protection Authority — dpa.gr.

Signed-in users can self-serve export and deletion from their profile. Anyone can file a request at /privacy/request.

9. Security

Transport encryption (TLS), encryption at rest at the database layer, row-level security on user data, principle of least privilege for staff access, and audit logging of admin actions.

10. Automated decision-making

Valuation and matching features produce statistical estimates but do not constitute automated decisions with legal or similarly significant effects on you under Art. 22 GDPR.

11. Changes

Material changes will be highlighted on this page and (where we have your email) notified by email.