Privacy Policy

ARTICLE 2

What we process

Depending on how you use the platform, we process:

• —Account data — name, email address, password hash, language, currency and unit preferences, notification settings;
• —Buyer profile data — phone number, country of residence, investment preferences (budget, regions, property types, intended use);
• —Verification data — identity information and source-of-funds information submitted for the one-time buyer check, and company information (registration number, documentation) for seller verification. Documents are stored in restricted storage;
• —Compliance records — a tamper-evident log of contact requests, kept to meet anti-money-laundering obligations (Wwft);
• —Listing and activity data — listings you publish, saved listings, saved searches, contact requests, reviews, messages sent through contact forms;
• —NOVA conversations — the messages you exchange with the NOVA assistant and the search criteria it derives, linked to your session and (when signed in) your account;
• —Technical data — IP address, device and browser information, and usage logs needed for security and performance;
• —Cookie data — as described in the cookie banner; analytics and marketing cookies are only set with your consent.

ARTICLE 3

Why we process it, and on which legal basis

• —Operating your account and the platform — performance of a contract (Art. 6(1)(b) GDPR);
• —Buyer and seller identity checks, the compliance log, and fraud prevention, compliance with legal obligations, in particular the Wwft, and our legitimate interest in a safe marketplace (Art. 6(1)(c) and (f));
• —Connecting you with sellers — performance of a contract: your contact details and brief are shared with the seller or agent you choose to contact;
• —Matching, saved-search alerts and the NOVA assistant — performance of a contract and, for optional personalisation, your consent;
• —Transactional and onboarding email — performance of a contract; marketing email only with your consent or under the existing-customer exception, always with an unsubscribe;
• —Analytics and product improvement — our legitimate interest in improving the platform, with consent for non-essential cookies;
• —Establishing, exercising or defending legal claims — our legitimate interest.

Where we rely on legitimate interest you can object at any time (Article 8). Where we rely on consent you can withdraw it at any time, without affecting earlier processing.

ARTICLE 4

Who receives your data

We share personal data only where needed:

• —The seller or agent you choose to contact — your name, contact details and brief;
• —Processors that host and run the platform — including Supabase (database, authentication, storage), Vercel (hosting), Stripe (payments), Resend (email), Mapbox (maps) and Anthropic (the language model behind NOVA). Each processor is bound by a data-processing agreement;
• —Competent authorities — where the law requires it, including under the Wwft;
• —Professional advisers — where necessary for legal claims, under confidentiality.

We never sell personal data.

ARTICLE 5

Transfers outside the EEA

Some processors process data outside the European Economic Area (for example in the United States). Where that happens, we rely on an adequacy decision of the European Commission or on the Commission's Standard Contractual Clauses, with additional safeguards where required. You can request a copy of the relevant safeguards via info@onoracapital.com.

ARTICLE 6

How long we keep data

• —Account and profile data — for the life of your account, then deleted or anonymised within 12 months;
• —Verification and compliance records — five years after the end of the business relationship or the relevant transaction, as required by the Wwft;
• —Invoices and administration — seven years, as required by Dutch tax law (Algemene wet inzake rijksbelastingen);
• —Listings — for the duration of publication plus a reasonable archival period;
• —NOVA conversations — 180 days of inactivity, after which the session is deleted;
• —Technical logs — up to 12 months for security purposes.

Backups are rotated on a fixed schedule; data removed from production disappears from backups within that cycle.

ARTICLE 7

How we protect data

We apply technical and organisational measures appropriate to the risk: encryption in transit, hashed credentials, role-based access with row-level security on the database, restricted storage for verification documents, tamper-evident compliance logging, and the principle of least access for staff. No system is perfectly secure; if a breach is likely to result in a risk to you, we notify the Dutch Data Protection Authority and, where required, you, in accordance with Articles 33–34 GDPR.

ARTICLE 8

Automated decision-making and profiling

Listing matching, saved-search alerts and the NOVA assistant rank listings against the preferences you provide. These are recommendations only — they produce no legal effect and no similarly significant effect within the meaning of Article 22 GDPR.

Identity check outcomes (buyer and seller) are always reviewed by a person before a request is declined.

ARTICLE 9

Your rights

Under the GDPR you have the right to:

• —access the personal data we hold about you (Art. 15);
• —rectification of inaccurate data (Art. 16) — most data you can correct directly in your account settings;
• —erasure ("right to be forgotten", Art. 17) — you can file the request directly from your account settings; note that data we must keep under the Wwft or tax law is retained for the statutory period;
• —restriction of processing (Art. 18) and objection to processing based on legitimate interest (Art. 21);
• —data portability (Art. 20);
• —withdraw consent at any time where processing is based on consent.

Send requests to info@onoracapital.com; we respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority of your residence.

ARTICLE 10

Children

The platform is intended for persons of 18 years and older. We do not knowingly process data of minors; if you believe a minor has provided us data, contact us and we will delete it.

ARTICLE 11

Changes to this policy

We may update this policy, for example when we add features or processors. Material changes are announced on the platform or by email. The effective date at the top always reflects the current version.