Privacy Notice

1. Who we are

Cataloghomes.com is a trade name of Small Steps VOF, registered in Amsterdam, the Netherlands (KvK 57176558). We are the data controller for personal data collected through this platform. Questions about this notice can be sent to our contact form.

2. What data we collect

Home Seekers

• Email address and password (hashed)
• Saved favourites and search preferences
• Enquiry content and timestamps

Home Providers & Agents

• Name, company name, email address
• Country of origin and active markets
• Listing content (text, images, specifications)
• Billing information — only once paid features go live. No payment data is processed today.

All visitors

• IP address, browser type and referring URL (via server logs)
• Analytics data (page views, session duration) — collected cookie-free and without personal data, so no consent is required

3. How we use your data

• To operate and maintain your account
• To display and manage Listings
• To forward enquiries to the relevant Provider or Agent
• To process payments and send invoices
• To send transactional emails (account confirmation, password reset)
• To improve the platform through aggregated, cookie-free analytics
• To comply with legal obligations

We do not sell your data. We do not use your data for advertising purposes on external platforms.

4. Legal basis

We process personal data on the following legal bases under the GDPR:

• Contract performance — to provide the services you have registered for
• Legitimate interest — to operate and improve the platform, prevent fraud
• Consent — for non-essential cookies
• Legal obligation — for tax and invoicing records

5. Data sharing

We share personal data only where necessary:

• Supabase — database, authentication and storage (EU region: Frankfurt)
• Vercel — hosting
• Plausible — cookie-free, privacy-friendly analytics (EU)
• HubSpot — CRM for enquiries and newsletter
• Resend — transactional email
• Home Providers / Agents — when a Home Seeker submits an enquiry, their contact details are shared with the relevant party

Each of these processors operates under a data processing agreement. Stripe will be added as a payment processor once paid features go live; no payment data is shared today.

All processors are GDPR-compliant. We do not transfer data outside the EU/EEA without adequate safeguards.

6. Data retention

• Account data: retained for as long as your account is active, plus 12 months after deletion
• Enquiry data: 24 months
• Invoices and billing records: 7 years (Dutch legal requirement)
• Analytics data: aggregated and anonymised after 14 months

7. Your rights

Under the GDPR you have the right to: access your personal data; correct inaccurate data; request deletion (“right to be forgotten”); restrict or object to processing; and data portability.

To exercise any of these rights, email our contact form. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

8. Cookies

Essential cookies

We place a small number of strictly-necessary cookies that are required for the platform to function. These include session authentication and security tokens. They cannot be disabled.

Analytics

We use a privacy-friendly, cookie-free analytics tool (Plausible) to understand how visitors use the platform. No personal data is collected and no cookies are placed for this purpose.

No advertising or tracking cookies

We do not place advertising or third-party tracking cookies and do not share data with ad networks. If we ever introduce a service that requires non-essential cookies (for example, a CRM tracking script), we will show a consent banner on your first visit and only set those cookies after you accept.

9. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and role-based access controls. In the event of a data breach affecting your rights, we will notify you and the relevant authority within 72 hours.

10. Contact & complaints