Privacy Policy
1. Who We Are
Estapick SH.P.K. ("Estapick", "we", "us") operates the Estapick digital real estate platform at estapick.com. Estapick is the controller of the personal data described in this policy.
Registered address: Rr. Tirana, Kompleksi Afarist Ramiz Sadiku, Prishtina, Republic of Kosovo.
For any question about this policy or about your personal data, contact us at info@estapick.com.
2. What This Policy Covers
This policy covers the Estapick website and platform, the enquiry and contact forms on it, and forms we operate on third-party platforms — including lead forms shown on Facebook and Instagram. It does not cover websites operated by other companies that we link to, including the websites of estate agencies listed on the platform. Those sites have their own privacy policies.
3. Information We Collect
Account information. When you register we collect your email address, first and last name, business name where applicable, phone number, year of birth, and your notification preferences. If you sign in with Google we receive your email address, name and Google account identifier from Google.
Agency and professional information. If you represent an agency we collect the agency name, registration number, website, street address, contact email and phone, a description, the year established, and details of your agents including their names, email addresses, phone numbers, job titles and profile photographs. We also store documents you upload to verify the business.
Enquiries and leads. When you contact an agency or request a viewing through the platform we collect your name, phone number, email address, your message, and any preferred viewing date and time.
Content you save. Favourite listings and any private notes you add to them, saved searches, saved locations — including the addresses and coordinates you save as home or work — and listing comparisons you run.
Usage information. The searches you run, including the free-text wording of those searches, the listings you view, and the comparisons you generate.
Payment information. Card payments are processed by our payment provider. Estapick does not store your full card number. To complete 3-D Secure authentication, your IP address, browser user agent, language, time zone and screen size are collected and passed to the provider.
Technical information. Our servers record the IP address, browser user agent, requested address and, where you are signed in, your account identifier for each request.
Information stored on your device. We store your sign-in tokens, your language preference, and a list of the listings you have recently viewed in your browser's local storage. This stays on your device and is not sent to our servers.
4. Why We Use Your Information
To provide the platform and perform our contract with you: creating and managing your account, publishing listings, delivering enquiries to the relevant agency, and processing subscriptions and payments.
For our legitimate interests: keeping the platform secure, preventing fraud and abuse, understanding how the platform is used, and improving our services.
With your consent: sending newsletters and marketing messages, where you have opted in. You can withdraw consent at any time.
To meet legal obligations: accounting and tax requirements, and responding to lawful requests from public authorities.
5. Lead Forms on Facebook and Instagram
Some of our advertisements on Facebook and Instagram include a form you can fill in without leaving those platforms. If you submit one, Meta passes us the answers you gave along with the identifiers of the advertisement and the form. The questions asked, and the consent options presented alongside them, are shown to you on the form itself before you submit it, and those consent options govern what we may do with your answers.
We use this information to respond to your enquiry about property listed on the Estapick platform. We retrieve it from Meta shortly after you submit the form and store it on our own systems, where it is subject to this policy.
Meta's own collection and use of your information on its platforms is governed by Meta's privacy policy rather than this one. You can review the information you have submitted through lead forms in your Facebook account settings.
7. Who We Share Your Information With
We do not sell your personal data. We share it with the following categories of recipient, each of which acts either as a processor on our instructions or as a controller in its own right.
- Estate agencies and their agents
- When you submit an enquiry or request a viewing, your name, phone number, email address and message are passed to the agency responsible for that listing so they can respond to you. That agency uses your information under its own privacy policy.
- Amazon Web Services
- Hosting of the platform and database, storage of uploaded media, and delivery of transactional email such as password resets and enquiry notifications. Frankfurt, Germany.
- Our payment provider
- Processing of card payments and 3-D Secure authentication, which involves your IP address, browser user agent, language, time zone and screen size.
- OpenAI
- Powers the AI-assisted search and the AI listing comparison. The wording of your search and the details of the listings being compared are sent to OpenAI to generate a result.
- Maps, place information and travel-time calculations — where you use travel times, the coordinates of the locations you have saved are sent to Google; translation of listing and agency content; sign-in, if you use Google to sign in; and analytics.
- Meta
- Advertising measurement through the Meta Pixel, lead forms submitted on Facebook and Instagram, and messaging where you choose to contact an agent over WhatsApp.
- Contentsquare
- Analysis of how visitors interact with pages on the site.
- Cloudflare
- Content delivery and protection of the website, including determining which regional version of the site to show you.
We may also disclose personal data where we are required to do so by law, or where it is necessary to establish, exercise or defend legal claims.
8. Where Your Information Is Held
The Estapick platform and database are hosted on Amazon Web Services in the eu-central-1 region (Frankfurt, Germany). Media files are stored in the same region, and our transactional email is sent from it.
Some of the recipients listed above process personal data outside Kosovo and the European Economic Area, including in the United States. Where that happens we rely on the safeguards offered by those providers, including standard contractual clauses where applicable.
9. How Long We Keep Your Information
We keep your account information for as long as your account is open. When an account is deleted we remove the associated listings, enquiries, saved content and sign-in credentials.
Some records are kept for longer where we are required to retain them — in particular records relating to payments and invoicing, which are subject to statutory accounting retention periods.
Enquiry and lead records, message logs and technical logs are retained for as long as necessary for the purposes described in this policy.
10. Your Rights
Subject to the conditions in applicable law, you have the right to request access to the personal data we hold about you; to have inaccurate data corrected; to have your data erased; to restrict or object to how we use it; to receive a copy in a portable format; and to withdraw consent where our use is based on consent.
To exercise any of these rights, email info@estapick.com. We will respond within one month. We may ask you for information to confirm your identity before we act on a request.
If you believe we have handled your personal data unlawfully, you may lodge a complaint with the Information and Privacy Agency of the Republic of Kosovo.
11. How to Delete Your Data
You can ask us to delete the personal data we hold about you at any time.
Email info@estapick.com with the subject line "Data deletion request". Send it from the email address associated with your account where possible, and tell us:
- your name, and the email address or phone number you used;
- whether you are asking us to delete your account, a specific enquiry you submitted, or an enquiry you submitted through a form on Facebook or Instagram.
We will confirm receipt, may ask for information to verify your identity, and will complete the deletion within one month of confirming who you are. If the request is complex we may extend that period and will tell you if we do.
When we delete your account we remove your profile, your listings, the enquiries connected to your account, your saved searches, saved locations and favourites, and your sign-in credentials.
Some information is kept after deletion where we are legally required to keep it — in particular records relating to payments and invoicing, which are subject to statutory accounting retention periods — or where it is needed to establish, exercise or defend legal claims. Records of administrative actions taken on accounts are also retained for security and audit purposes.
12. Security
Traffic between your browser and our servers is encrypted in transit. Passwords are stored as salted cryptographic hashes and are never stored in readable form. Access to production systems and to personal data is restricted to the personnel who need it, and administrative actions on user records are logged.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13. Children
The Estapick platform is intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact info@estapick.com and we will delete it.
14. Changes to This Policy
We may update this policy from time to time. The effective date at the top of this page shows when the current version took effect. Where changes are significant we will take reasonable steps to notify you, for example by email or through a notice on the platform.
15. Contact Us
Estapick SH.P.K.
Rr. Tirana, Kompleksi Afarist Ramiz Sadiku
Prishtina, Republic of Kosovo
Email: info@estapick.com