Privacy Policy

1. Data Controller

The data controller is Performoon OÜ (registry code 17001386), registered at Ahtri tn 12, 15551 Tallinn, Estonia. Contact: office@performoon.com. Performoon OÜ operates this website and is the controller of personal data collected via the lead forms.

2. Data We Collect

Data you submit via the contact and inquiry forms: name, phone number, email address, investment budget, preferred location, message content. In addition, we collect technical data via cookies and server logs: IP address, browser and device information, page visits, UTM parameters, referrer URL, consent timestamp and the URL of the page where the form was submitted.

3. Purposes and Legal Bases

• Responding to your inquiry and preparing an offer – steps taken prior to entering into a contract at your request (GDPR Art. 6(1)(b)).
• Sharing your data with our contracted sales partners to prepare and present offers – your consent (GDPR Art. 6(1)(a)), given by ticking the checkbox on the form.
• Newsletter and marketing communications – your separate, voluntary consent (GDPR Art. 6(1)(a)).
• Statistics and analytics (e.g. Google Analytics, Google Ads, Meta Pixel) – consent given through the cookie banner (GDPR Art. 6(1)(a)).

4. Contact via WhatsApp and Booking a Consultation

If you contact us via WhatsApp or book a consultation through our booking system (Cal.com), sending the message or completing the booking initiates the processing of the personal data you provide (name, phone number, email address, message content, booking date and details).

By sending a WhatsApp message or booking a consultation slot, you accept this Privacy Policy and consent to the transfer of your data to our contracted real-estate sales partners, who may contact you to present an offer.

Some of our partners operate outside the European Union, in Thailand or Dubai; these countries are not covered by an EU adequacy decision; the transfer is based on your consent (GDPR Art. 49(1)(a)).

The legal basis for responding to your inquiry itself is steps taken prior to entering into a contract at your request (GDPR Art. 6(1)(b)); the transfer to partners is based on the consent described above.

These contacts remain subject to the same retention, recipient and data subject rights rules as described elsewhere in this policy.

5. Recipients

Data submitted through the forms is shared with our contracted real-estate sales and advisory partners, who may use it solely to prepare and present offers to you. Specific partner companies are not named on this page. A current list of recipients is available from the data controller on request at the address above.

6. International Data Transfers

Some of our contracted sales partners are based in Thailand or Dubai, outside the European Union. There is currently no adequacy decision from the European Commission covering these countries, and our Thai or Dubai partners are not subject to EU data protection law (GDPR).

The legal basis for these transfers is your explicit consent under GDPR Art. 49(1)(a), given prior to submitting the form by ticking the relevant checkbox. You acknowledge that recipients in Thailand or Dubai are not subject to the supervision of EU data protection authorities and that the level of data protection may differ from that within the EU.

7. Retention

Leads are retained for 24 months from the last point of contact, after which they are deleted or anonymised. Records evidencing your consent (timestamp, text version, URL) may be retained beyond withdrawal of consent, in line with the accountability principle, for as long as needed to demonstrate legal compliance.

8. Processors

• Supabase (Supabase Inc.) – database and hosting
• Resend (Resend, Inc.) – transactional email delivery
• Google LLC – Google Analytics, Google Ads, Google Tag Manager
• Meta Platforms Ireland Ltd. – Meta Pixel (campaign measurement, consent-based) and operator of the WhatsApp messaging service. WhatsApp communication is also subject to Meta's own data processing practices and may involve processing outside the EU.
• Cal.com, Inc. – online booking system (consultation scheduling)
• Cloudflare, Inc. – hosting and CDN infrastructure

9. Your Rights

Under the GDPR you have the right to access, rectification, erasure ("right to be forgotten"), restriction of processing, objection, and data portability. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Send requests to: office@performoon.com.

You may lodge a complaint with:

• Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) – www.aki.ee
• Hungarian National Authority for Data Protection and Freedom of Information (NAIH) – naih.hu

10. Deletion Requests

You may request deletion of your data at any time by writing to office@performoon.com. Deletion requests are fulfilled within 30 days of receipt, unless a longer retention period is required by law.

11. Security

Data is transmitted and stored over encrypted channels (HTTPS/TLS). Access is limited to the narrowest necessary group and protected by appropriate technical and organisational measures.