Privacy

Data controller

The controller of your personal data on this website and platform is GOLDEN INVEST d.o.o. za poslovanje nekretninama (trading as Golden Invest Group), Ulica Josipa Hatzea 22F, 23000 Zadar, Croatia, OIB 18084438757. For anything concerning your personal data, write to info@goldeninvestgroup.com or call +385 99 378 8900. We have not appointed a data protection officer.

What we collect

When you apply for membership, we collect the information you give in the application form: your name, email address and, if you give them, your phone number and acquiring entity; your country of residence and nationality; the purpose and intended use of the acquisition, whether it is your first acquisition in Croatia, budget band, timeframe, regions of interest, property type and any exclusion criteria; whether you need financing, already own property in Croatia or have engaged Croatian legal counsel; your source of funds; how you heard about us (optional); and the consents you give. Source of funds and other sensitive application fields are encrypted at rest.

The fields marked as required in the form are needed to assess your application; without them we cannot process it. Phone number, acquiring entity, exclusion criteria, how you heard about us and marketing consent are optional.

If your application is approved, we also hold your account and session data. As a member, you can send us messages (an inquiry about a specific listing, or a general message from the Contact page). For each message we hold its text, your account, the listing it concerns, when it was sent and whether we have marked it as handled; the text is encrypted at rest. You can also save listings; for each we hold your account, the listing and when you saved it.

When you use the application or sign-in form, Cloudflare Turnstile processes your IP address and browser signals to protect the form against bots. When you sign in, we record your IP address and browser (user agent) with your session for security. If you complain to us, we keep your complaint and our reply. If we act for you on a transaction, we collect the identity and source-of-funds information described in our AML statement.

Why we process your data

We process your data to assess your membership application and, if it is approved, to give you access to the platform (steps at your request before a contract, and performance of the membership contract, Article 6(1)(b) GDPR). On the same basis we read and answer your messages, keep the listings you save, and send ourselves an email notification of each new application so that we can review it promptly.

Where you give it, we use your consent to send you updates (Article 6(1)(a) GDPR); you may withdraw it at any time, without affecting earlier processing.

We process data to operate and secure the platform, including bot protection, sign-in security records and limits on how many messages an account can send, and to establish or defend legal claims (legitimate interests, Article 6(1)(f) GDPR). Our interests are keeping the platform, our members and our records secure and being able to show what happened if a dispute arises.

We process data to meet our legal obligations (Article 6(1)(c) GDPR), in particular customer due diligence under the Croatian Anti-Money Laundering and Terrorist Financing Act before we act on a transaction, keeping consumer complaints for one year under the Consumer Protection Act, and accounting and record-keeping duties.

We do not use your saved listings or your messages for advertising or profiling.

Who receives your data

We use these processors: Cloudflare, Inc. (hosting, database, file storage and bot protection; see International transfers); Brevo (Sendinblue SAS, France), which sends our transactional emails such as application confirmations, decisions and account activation; and Plus Hosting Grupa d.o.o., Pula, Croatia, which hosts our own email mailboxes. Those mailboxes receive our notification of each new application, which contains your name and a link to the application but none of your other answers; a short notice that a member message is waiting, without its content; and any email you exchange with us.

Cloudflare also acts as an independent controller of the bot-protection signals it uses to improve Turnstile; see Cloudflare's Turnstile privacy addendum (cloudflare.com/turnstile-privacy-policy).

When you proceed with a transaction, we share the information needed with the professionals and parties involved, for example notaries, lawyers, banks and the other party to the sale. We disclose data to public authorities where the law requires it, for example the Anti-Money Laundering Office, inspectorates and courts. We do not sell your data.

Within Golden Invest Group, applications and member messages, with your name and email address, can be seen only by our administrators, who sign in with two-step verification. Your saved listings are shown only to you; we access them only when you ask for a copy or erasure of your data, or when this is strictly necessary to maintain the platform.

Cookies

We use only cookies and similar storage that are strictly necessary: a session cookie when you sign in, a cookie that remembers your cookie-banner choice, and Cloudflare Turnstile on the application and sign-in forms. We do not use analytics, advertising or profiling cookies. Our Cookie notice lists each item, its purpose and how long it is kept.

No automated decision-making

Every membership application is reviewed and decided by a person on our team. We do not use automated or algorithmic processing to approve or reject an application, and no decision producing a legal or similarly significant effect on you is made without human review. Turnstile's bot check protects the form and is not a decision about your application.

How long we keep your data

Applications we reject: 18 months from the decision, so that we can deal with a re-application or a claim; the application is then anonymised, which removes your name, contact details and answers.
Applications still under review, approved applications and member accounts: for as long as the application is open or your account exists.
Member messages and saved listings: for as long as your account exists. A saved listing is deleted when you remove it, and when we remove that listing from the platform.
Sign-in sessions: a session ends after 12 hours without activity and after 7 days at most (2 hours and 24 hours for administrators). The record of the session, with IP address and browser, is kept with your account.
Consumer complaints and our replies: one year from receipt.
Anti-money-laundering records: ten years after the business relationship ends.
Our security record of actions on the platform, for example that an application was decided or a message was sent: kept permanently. It never contains the text of your messages.
Database backups: kept so that the service can be restored after a failure.

When we act on a request to erase your data, we delete or anonymise it as described under Your rights, except information the law requires us to keep, which we keep only for as long as required.

International data transfers

Cloudflare, Inc. is based in the United States and may process data outside the European Economic Area. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and we rely on the European Commission's adequacy decision for that framework (Article 45 GDPR). Brevo and Plus Hosting are established in the European Union. You can ask us for more information about these transfers at info@goldeninvestgroup.com.

Your rights

Under the General Data Protection Regulation you have the right to access the personal data we hold about you, have inaccurate data corrected, have data erased, restrict processing, receive your data in a portable format, object to processing based on our legitimate interests, and withdraw any consent you have given. To exercise these rights, write to info@goldeninvestgroup.com. The Anti-Money Laundering Act may restrict access to data collected for anti-money-laundering checks.

If you are a member, the copy of your data we provide includes the messages you have sent us, with their text, and every listing you have saved. When we act on a request to erase a member's data, we delete your messages and saved listings, and we delete or anonymise the rest of your account record by removing your name, contact details, sign-in details and application answers. Our security record of actions on the platform cannot be altered and is kept after erasure; it never contains the text of your messages.

You have the right to lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, azop.hr, or with the supervisory authority of the EU member state where you live or work.