Rechtliches

Privacy Policy

Zuletzt aktualisiert: 3. November 2026

Dieses Dokument ist nur auf Englisch verfügbar.

1. About this policy

This Privacy Policy explains how Eproma Software Ltd ("Eproma", "we", "us", "our") collects and uses personal data when you:

  • visit www.eproma.io (the "Website");
  • contact us or request a demo;
  • create an account and start a free trial at crm.eproma.io;
  • subscribe to Eproma and use your customer account; or
  • deal with us as a business contact.

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data (Law 125(I)/2018), and the Regulation of Electronic Communications and Postal Services Law (Law 112(I)/2004).

Data inside the Eproma platform. When our customers (real estate agencies and agents) store data about their own clients, property owners, leads or other contacts in Eproma, or publish an agency website through Eproma, the customer is the controller of that data and we act only as its processor under Article 28 GDPR. That processing is governed by our Data Processing Agreement with the customer, not by this Privacy Policy. If you are a client of an agency that uses Eproma, please contact that agency about your data.

2. Who we are and how to contact us

The controller is Eproma Software Ltd, Pavlou Valdaseridi Street no. 6, #402, 6018 Larnaca, Cyprus, registration number HE 495427, email info@eproma.io.

We have not appointed a Data Protection Officer because we are not required to do so under Article 37 GDPR. For all data protection matters, please write to info@eproma.io.

3. Visiting the Website

What we collect. When you visit the Website, our servers automatically record technical data sent by your browser: IP address, date and time of the request, the page requested, the referring page, browser type and version, and operating system.

Why. To deliver the Website, keep it stable and secure, and detect and prevent attacks.

Legal basis. Our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).

How long. Server log files are deleted after 14 days, unless we need them longer to investigate a specific security incident.

4. Contact and demo requests

What we collect. When you use our contact form or "Book a demo": your name, work email address, agency name, country, team size and, if you provide them, your telephone number and message.

Why. To answer your enquiry, arrange and hold a product demonstration, and prepare a possible contract.

Legal basis. Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR).

How long. 24 months after our last contact with you, unless a contract follows (see section 6).

We manage enquiries in our own CRM system, hosted in Germany (see section 10).

5. Creating an account and free trial

What we collect. When you sign up at crm.eproma.io: your work email address, first and last name, mobile number, agency website and, if you provide it, your VAT number. We send a six-digit code to your email address to verify it. If you enter a VAT number, we check it against the European Commission's VIES database and may fill in your agency name from the public registry entry. We use your country to preset currency, language and property fields for your account.

Why. To create and secure your account, verify that you are a business, provide the free trial, and contact you about your trial.

Legal basis. Performance of a contract or steps at your request before entering into one (Article 6(1)(b) GDPR); our legitimate interest in preventing fake or abusive sign-ups (Article 6(1)(f) GDPR).

How long. If you do not subscribe after the trial, your account is restricted, and we delete the account and its data 30 days after the trial ends.

6. Subscription, billing and your customer account

What we collect. Company name, name of the contact person, billing email and address, VAT number, selected plan, payment method, transaction data, and the login and usage data of your authorised users.

Payment. Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). You enter card or bank details directly into Stripe's secure payment form inside the Eproma billing page; we never receive or store your full card number or IBAN. We only receive the payment status, card brand or payment type, the last four digits and the expiry date. Stripe acts partly as our processor and partly as an independent controller, in particular to meet its own legal obligations (for example anti-money-laundering rules and fraud prevention). See https://stripe.com/privacy.

Why. To conclude and perform the subscription, invoice and collect fees, calculate VAT, provide support, and prevent fraud.

Legal basis. Performance of a contract (Article 6(1)(b) GDPR); compliance with tax and accounting obligations (Article 6(1)(c) GDPR); our legitimate interest in preventing fraud and enforcing claims (Article 6(1)(f) GDPR).

How long. For the duration of the contract. After it ends, we delete account data, except invoices and accounting records, which we keep for six years from the end of the relevant tax year as required by Cyprus tax and VAT law.

Service messages. As a customer, you will receive messages about your account, invoices, security and important changes to the service. These are part of the contract and are not marketing.

7. Marketing to business contacts

If you are a customer or have given us your business email address in the context of an enquiry or sign-up, we may email you about our own similar products and services. We do this on the basis of our legitimate interest (Article 6(1)(f) GDPR) and section 106 of Law 112(I)/2004. All other marketing emails are sent only with your consent (Article 6(1)(a) GDPR).

You may object or withdraw consent at any time, free of charge, using the unsubscribe link in every email or by writing to info@eproma.io. Our marketing emails may record whether an email was opened and which links were clicked, so that we can improve them; you can prevent this by unsubscribing or by disabling images in your email program.

We use cookies and similar technologies only as described in our Cookie Policy. Non-essential technologies are used only with your consent (Article 6(1)(a) GDPR and section 99 of Law 112(I)/2004).

Consent management. We use Cookiebot, a service of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, to ask for and record your choice. Cookiebot processes an anonymised IP address, the date and time of your choice, browser information and the choice itself. Legal basis: our legal obligation to be able to demonstrate consent (Article 6(1)(c) GDPR) and our legitimate interest (Article 6(1)(f) GDPR). The consent record is kept for 12 months.

Website analytics. Only if you consent to "Statistics", we measure how visitors use the Website (for example, which pages are viewed, the referring website and the approximate device type) with a privacy-friendly analytics service (aico Analytics) provided to us by aiconomy AG, Mühleweg 4, 9325 Roggwil TG, Switzerland, as our processor and hosted in the European Union. A random visitor identifier is stored in your browser. We do not use the data to identify you, do not combine it with other sources, and do not share it with advertising networks. Analytics data is deleted after 13 months. Legal basis: your consent (Article 6(1)(a) GDPR). The analytics script itself is downloaded from collect.aico.swiss when a page loads, which transmits your IP address to that server; nothing is recorded or stored before your consent.

You can change or withdraw your consent at any time via "Cookie settings" in the footer of the Website.

We may also process personal data where necessary to comply with a legal obligation, for example tax retention rules or a request from a competent authority (Article 6(1)(c) GDPR), and to establish, exercise or defend legal claims or to prevent misuse (Article 6(1)(f) GDPR).

10. Who receives your data

We share personal data only with service providers that process it on our behalf under a data processing agreement (Article 28 GDPR), or with the recipients described in this policy:

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosting of the Website, the Eproma platform, file storage, backups and our CRM (data centre in Falkenstein, Germany);
  • Neue Medien Münnich (ALL-INKL.COM), Hauptstraße 68, 02742 Friedersdorf, Germany: email hosting and sending;
  • Usercentrics A/S (Cookiebot), Copenhagen, Denmark: consent management;
  • aiconomy AG, Roggwil TG, Switzerland (aico Analytics): website analytics, only with your consent (section 8);
  • Stripe Payments Europe, Limited, Dublin, Ireland: payment processing (section 6);
  • Google Ireland Limited, Dublin, Ireland: Google Calendar, only for users who connect it (section 15).

We may also disclose data to our legal, tax and accounting advisers, who are bound by professional confidentiality, and to public authorities where the law requires it. If we are involved in a merger, acquisition or sale of all or part of our business, personal data may be disclosed to the prospective buyer or successor under confidentiality, to the extent necessary (Article 6(1)(f) GDPR).

We do not sell personal data.

11. Transfers outside the European Economic Area

Our servers are located in Germany. Personal data may be transferred to the United States in the following cases: payment processing by Stripe, Google Calendar by Google, and the AI features of the platform, which use OpenAI (see our Data Processing Agreement). In each case the transfer is based on the EU-U.S. Data Privacy Framework (Article 45 GDPR) where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Article 46 GDPR). Our analytics provider aiconomy AG is established in Switzerland, for which the European Commission has adopted an adequacy decision (Article 45 GDPR). You can request a copy of the relevant safeguards from info@eproma.io.

12. Your rights

You have the right to:

  • access your personal data (Article 15 GDPR);
  • have inaccurate data corrected (Article 16 GDPR);
  • have your data erased (Article 17 GDPR);
  • restrict processing (Article 18 GDPR);
  • receive your data in a portable format (Article 20 GDPR);
  • withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Article 7(3) GDPR).

Right to object (Article 21 GDPR). Where we rely on our legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to direct marketing at any time, without giving reasons.

To exercise your rights, write to info@eproma.io. We will reply within one month. For complex or numerous requests, we may extend this by two further months and will tell you why. We may ask you to confirm your identity.

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you (Article 22 GDPR).

13. Complaints

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live or work, or where an alleged infringement took place. Our lead supervisory authority is:

Office of the Commissioner for Personal Data Protection
1 Iasonos Street, 1082 Nicosia, Cyprus (P.O. Box 23378, 1682 Nicosia)
Telephone: +357 22 818 456
Website: www.dataprotection.gov.cy

We would appreciate the chance to deal with your concern first, so please contact us at info@eproma.io.

14. Security

We use appropriate technical and organisational measures to protect personal data, including TLS encryption of all data in transit, encryption of stored data, access controls, logging and regular security updates.

15. Google Calendar integration

Users of the Eproma platform may choose to connect their own Google Calendar. This is optional and each user decides for their own Google account.

What Eproma accesses and why. Your Google account email address, to show which calendar is connected; read access to your calendars and events (title, location, start and end time, all-day flag and the event link) from 30 days in the past to 180 days in the future, only to show your own appointments in your Eproma calendar; and write access to events, to create, update and delete your Eproma tasks and viewings in your Google Calendar. By default Eproma creates a separate calendar named "Eproma"; you can choose your main calendar instead. Client names are included in these events only if you switch this on.

What Eproma does not do. Eproma does not sell Google user data, does not use it for advertising, does not use it to train or improve artificial intelligence or machine learning models, does not pass it to the Eproma AI assistant or any other AI service, and does not share it with anyone other than the hosting provider listed in section 10. Your Google appointments are visible only to you, not to other users of your agency. Our staff do not read your calendar data except with your express permission for a support request, where necessary for security, or where required by law.

Storage and deletion. Eproma stores your Google account email address, the access permission (encrypted) and a copy of the event details listed above on our servers in Germany. You can disconnect at any time under Settings, Integrations, Google Calendar, Disconnect. Eproma then revokes its access, removes the "Eproma" calendar it created, and deletes the stored permission and all stored copies of your calendar data. You can also remove Eproma's access at https://myaccount.google.com/permissions.

Legal basis. Performance of the contract for a function you choose to use (Article 6(1)(b) GDPR) and, for calendar data of other persons, our and your legitimate interest in managing appointments (Article 6(1)(f) GDPR).

Limited Use. Eproma's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

16. Children

The Website and our services are intended for businesses and professionals only. They are not directed at persons under 18, and we do not knowingly collect their data.

17. Changes to this policy

We may update this Privacy Policy when our Website, our services or the law change. The current version is always available on this page, with the date of the last update at the top.