Privacy policy

Who is responsible for your data

Fastigheter.ax is run by Winter Agency Åland Ab, business ID 2842775-1. We are the controller of the processing described here. If you have questions or want to exercise your rights, contact us at [email protected].

What data we process and why

Visitor statistics. If you consent to statistics cookies, we use Google Analytics to see how the website is used, for example which pages are visited and from which country. The app asks the same question the first time you open it, and you can change your choice under More. Analytics processes your IP address and information about your device, and in the app a random ID for the installation. The app does not use the phone’s advertising ID. The legal basis is your consent, which you can withdraw at any time.

Our own property statistics. We count how many times a property is clicked through to the agent’s website and how many times an ad is clicked. The counting happens on our own server and stores no cookies. So that the same visitor is not counted many times, we store a hash of the IP address together with the property or ad and the day. It is used for nothing else and is deleted automatically within two days. The statistics we keep are only a count per property or ad and day and cannot be linked to you. The legal basis is our legitimate interest in the statistics being accurate.

Map. When you open the map, the map images are fetched from OpenStreetMap, whose servers then receive your IP address.

Your location. If you tap the button for your location on the map, the browser or the phone first asks whether you allow it. Your location is only used on your device, to show where you are on the map. It is not sent to us and is not stored. The map images for the area shown are fetched as before.

Account and sign-in. If you choose to sign in, we process your email address and an internal user ID. If you sign in with Google, we get your email address from Google. If you sign in with Apple, we get your email address, or an address from Apple that forwards to it if you choose to hide it, and your name if you share it. If you sign in with an email link, an email with a one-time link is sent to the address you enter. Properties you add to your favorites are stored with your user ID. We also store the language you last used on the website or in the app, so that emails to you are written in that language. The data is used to keep you signed in, give you access to what belongs to your account and send you the notifications and emails you have chosen, as described below. The legal basis is performing what you have asked for.

Push notifications. If you allow notifications in the app, it gets an address for notifications (a token) from Firebase Cloud Messaging, which delivers the notifications to the phone through Apple or Google. If you are not signed in, we store nothing about the installation ourselves, and the app subscribes with Firebase to the general notifications you have chosen under More. If you are signed in, we store the installation with your user ID: its token, whether the phone runs iOS or Android, which notifications you have chosen, the language the app is shown in and when the app was last heard from, for at most ten installations per account. This lets us send your notifications, including those about your saved searches and favorites, to the right phone and in your language. The legal basis is performing what you have asked for.

Saved searches. If you save a search, we store its name, the filters it follows and how it should notify you with your user ID, for at most ten saved searches per account. When new listings, properties back on market or price reductions match it, we send, as you have chosen for that saved search, a push notification to phones where you are signed in to the app and have allowed notifications, and an email with a link to unsubscribe to your account’s confirmed email address. Of each send-out we store only counts, not who received it. The legal basis is performing what you have asked for.

Notifications about favorites. If the price of one of your favorites changes, or the agent takes the property off their website, we send a push notification to phones where you are signed in to the app and an email to your account’s confirmed email address. Both are on until you turn them off, the push notifications in the app under More and the emails there or on the website; your choice for the emails is stored with the account. The legal basis is performing what you have asked for.

Purchases. When you buy a property report or boost a property, we store your email address, your name if you give it, what you bought, the amount and the date, to deliver the purchase and show your receipts. If you boost a property, we email you a report on how many have clicked on it, every day while the boost runs and the day after it ends. If you unsubscribe from those emails, we store your address only as a hash, so we know not to email it. On the website you pay through Stripe, and in the app through the App Store or Google Play, which process the payment. We get a short notice of each purchase in our internal chat tool. The legal basis is performing the purchase and our obligation to keep accounting records of it.

Server logs and error reports. Our website and our servers log technical data, such as IP address and browser, for operation and security. To stop abuse, we limit how often the same IP address can request sign-in links or start purchases, and how many sign-in links the same email address can get. We then store a hash of the address with a count, which is deleted automatically within two days. If an error occurs on the servers, or the app crashes or runs into an error, a technical error report is sent to Sentry. The report from the app contains information about the device, such as model and operating system, the app’s version and what happened in the app just before the error, but not your account or your email address. It is sent regardless of what you have answered about statistics. The app also asks Firebase Remote Config whether the version you have still works, and then sends a random ID for the installation, the app’s version and the phone’s operating system. The legal basis is our legitimate interest in the website and the app working and being secure.

Who we share data with

We never sell your data. We use the following providers, who process data on our behalf:

• Google (Firebase for sign-in, database, push notifications and the app’s version check, Analytics)
• OpenStreetMap Foundation (map images)
• Vercel (hosting of the website)
• Sentry (error reporting)
• Stripe (payments on the website)
• Apple and Google (payments and delivery of push notifications in the app)
• Mailgun (sending sign-in links, property reports and emails about saved searches, favorites and boosts)
• Slack (internal notices about purchases)

Some of them may process data outside the EU and the EEA. The transfer then takes place with the safeguards the General Data Protection Regulation requires, as a rule the European Commission’s standard contractual clauses.

How long we keep data

Data linked to your account is kept as long as the account exists. You can delete the account yourself, in the app under More or at fastigheter.ax/en/delete-account, or ask us to do it. The account is then deleted with your favorites, saved searches and choices of notifications and language, and the data about the app installations linked to the account. The data about your purchases is kept without your name and your email address for as long as the Accounting Act requires. Statistics in Google Analytics, error reports in Sentry and the installation’s ID in Firebase are kept for the retention periods that apply to each service. Our own property statistics contain no personal data and are kept without a time limit. Backups of the database are kept for 30 days.

A saved search is also deleted when you delete it. The data about an app installation is deleted when you sign out in the app, when the app notices that you have turned off notifications in the phone’s settings, and when Firebase reports that the installation no longer exists, and automatically when the app has not been heard from in 180 days. An installation that has not been heard from in 60 days gets no notifications until the app is opened again. When we send the boost emails, we note a shortened part of the address’s hash for each day and property, so the same email is not sent twice, and delete it automatically after 30 days. The hash of an address that has unsubscribed from the boost emails is kept without a time limit, so that the choice holds, and is deleted if you delete an account with the same confirmed address.

Cookies

Necessary cookies are used for the website to work, for example to keep you signed in and to remember the language you have chosen for a year. These do not require consent. Statistics cookies are only set if you consent to them, and you can change your choice at any time. In the same way, the app only stores what it needs to work, and statistics only if you have said yes.

Your rights

You have the right to know what data we have about you, to have it corrected or erased, to ask for the processing to be restricted, to object to processing based on legitimate interest, and to get your data in a machine-readable format. If you have given your consent, you can withdraw it at any time.

Contact us at [email protected] and we will help you. If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the supervisory authority.

Changes

If we change how we process personal data, we will update this page and the date at the top.