Privacy Policy

(1) The controller of personal data processed through the ATRIUMA platform (the website opportunities.atriuma.com and the related websites, mobile applications and programming interfaces — the “Platform”) is Dzhovi IT EOOD (Джови ИТ ЕООД), UIC 206829497, with its registered seat and address as entered in the Bulgarian Commercial Register (“ATRIUMA”, “we”).

(2) For any question about personal data and to exercise your rights, contact us at privacy@atriuma.com.

(3) This Policy is issued under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), the Bulgarian Personal Data Protection Act and the Bulgarian Electronic Communications Act.

ATRIUMA is a technology platform for discovering, researching and managing real estate. It brings together listings from agencies and owners, a map with market, cadastral, urban planning and transport information, an artificial intelligence assistant for property search, an agency directory, tools for saving and sharing properties, and tools for managing your own properties (expenses, leases, tenants, defects). ATRIUMA is not a real estate agency and is not a party to transactions between users, agencies and owners.

3.1. Account and identity data

• name, email address, username, profile picture, preferred city and country;
• phone number and its verification (the code is sent by SMS);
• sign-in data: hashed password, two-factor authentication settings, data from your Google or Apple account when you choose that sign-in;
• session data: IP address, browser and device type, sign-in time;
• chosen mode (home or business), preferred property types and search criteria.

3.2. Usage data

• saved properties, notes and shared lists, including their members (name, email and profile picture are visible to other members);
• viewed properties — which listings you opened, how many times and when;
• viewed agency profiles;
• neighbourhood votes (stored only as an irreversible cryptographic fingerprint);
• technical data: IP address, requested page address, date and time, browser type — in server logs.

3.3. Conversations with the artificial intelligence assistant

We store the content of conversations — your messages, the assistant's answers, the suggested properties and, for registered users, your name and profile picture. For conversations without an account, we recognise you by a pseudonymous identifier in a cookie, and to prevent abuse we compute a daily-rotating cryptographic fingerprint of your IP address and browser data. We do not store the IP address itself for this purpose.

3.4. Inquiries and requests to agencies and owners

When you send a listing inquiry, a viewing request or a request for assistance or representation, we process your name, phone number, email (if provided), message, preferred contact time, property details and the time you consented to your data being passed on. An agency's phone number is shown only to signed-in users.

3.5. Data about your own properties

• name, address, type and purpose of the property, purchase price and date, notes;
• co-owners and tenants — the email addresses you send invitations to, and their names once accepted;
• lease agreements — rent, deposit, terms, notices, change requests;
• expenses, recurring payments (including lender, outstanding balance and interest rate), utility account numbers, insurance and taxes;
• defects and their photos, payment requests and their status.

3.6. Listings published by owners

Title, description, price, area, address and coordinates, cadastral identifier, photos, videos, floor plans and documents. By default, the exact location is hidden and the map shows an approximate area. Floor plans and documents are not public by default.

3.7. Payment data

When you use a paid service, the payment is processed by a licensed payment service provider (Stripe). We store only a customer identifier and subscription details and never receive your full card details.

• the central ATRIUMA identity service — your account data at each sign-in;
• Google and Apple — name, email and profile picture when you sign in with them;
• real estate agencies — listings, photos, broker names and phone numbers, replies to your inquiries;
• public registers and open data — cadastral data of the Bulgarian Geodesy, Cartography and Cadastre Agency, OpenStreetMap and Wikipedia data, municipal planning and transport data;
• publicly available listings (for example imot.bg) — to compute market statistics and when you import a listing yourself.

Cadastral information on the Platform is shown without owner data. Where a public source contains personal data, we process it only to the extent necessary for the stated purpose and anonymise or aggregate it where possible.

5.1. Performance of a contract (Art. 6(1)(b) GDPR)

Creating and maintaining your account; saving and sharing properties; managing your own properties; publishing listings; passing your inquiries and requests to the agencies and owners you choose; running the assistant; providing paid services.

5.2. Legal obligation (Art. 6(1)(c) GDPR)

Accounting and taxation of paid services; handling notices of unlawful content under Regulation (EU) 2022/2065; responding to lawful requests from public authorities.

5.3. Legitimate interest (Art. 6(1)(f) GDPR)

• Platform security and prevention of fraud, spam and excessive use;
• customer service — ATRIUMA staff may review assistant conversations to reply, route them to a suitable agency or improve quality, and, when you call from a verified phone number, your saved and viewed properties;
• improving the Platform through aggregated data on interest in properties, agencies and neighbourhoods;
• personalising results based on viewed and saved properties;
• establishing, exercising and defending legal claims.

You may object to processing on this basis at any time (see section 12).

5.4. Consent (Art. 6(1)(a) GDPR)

Visit statistics (see section 7.2); sending marketing communications and notifications not directly related to the service; and other processing for which we expressly ask for consent. Consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.

(1) The assistant and the listing description feature use OpenAI language models. Your messages and the necessary context (such as search parameters and property data) are sent to the provider to generate a reply. We do not use your conversations to train third-party models.

(2) When you look for a specific property, the assistant may send a short inquiry to the relevant agency's chat assistant, and an ATRIUMA staff member may hand the conversation over to the agency, including a transcript and a note. The agency processes the data it receives as an independent controller.

(3) Do not enter sensitive data into the assistant (health, financial passwords, personal identification numbers, etc.). The assistant does not make decisions with legal effects for you.

7.1. Strictly necessary

• atriuma_opportunities_guest — pseudonymous identifier of conversations without an account, up to 1 year;
• atriuma_opportunities_area_voter — prevents repeated neighbourhood votes, up to 1 year;
• atriuma_opportunities_visitor — counts active visitors, 1 day;
• identity service cookies (atriuma_identity*) — keep you signed in;
• browser local storage — language, theme, saved and viewed properties without an account, listing and inquiry drafts, view settings, sign-in data for the current session.

This data is necessary to provide the service you expressly requested and is stored under Art. 4a(2) of the Electronic Communications Act without prior consent.

7.2. Statistics

We use PostHog (servers in the EU) for visit statistics only if you consent (Art. 6(1)(a) GDPR and Art. 4a(1) of the Electronic Communications Act). We ask when you first visit, with equally prominent “Accept” and “Decline” buttons and no preselected choice. Until you accept, we do not load PostHog, store no statistics identifier on your device and send no statistics data.

With your consent, we record only page views with generalised addresses (without search parameters, advertising identifiers or referrers) and, for signed-in users, a pseudonymous account identifier. We do not collect IP addresses, record sessions or track clicks. The identifier is kept in the browser's local storage.

We keep your choice in the browser's local storage so we do not ask again. You can change it or withdraw consent at any time via “Cookie settings” at the bottom of the page. On withdrawal, we delete the statistics identifier from your browser and stop sending data. Withdrawal does not affect the lawfulness of processing before it.

7.3. Maps

Maps are loaded from Mapbox. When a map is shown, your browser connects to Mapbox servers, which receive your IP address and the visible map area. When you place a pin for your property, its coordinates are sent to Mapbox to look up the address.

8.1. Independent controllers

• real estate agencies and owners — data from your inquiries, requests and handed-over conversations;
• other users — members of shared lists and of your properties see your name, email and profile picture;
• Google and Apple — when you sign in with them;
• public authorities — where required by law.

8.2. Processors

We engage providers that act on our instructions under a contract in accordance with Art. 28 GDPR:

• Railway — hosting of applications and databases;
• Cloudflare — file storage, content delivery and protection;
• OpenAI — language models for the assistant and listing descriptions;
• Pinecone and Twilio — chat assistants of agencies connected to the Platform;
• MailerSend — email delivery;
• SMSAPI.bg — SMS for phone verification;
• OneSignal — mobile notifications;
• PostHog — visit statistics (EU);
• Mapbox — maps, place search and address lookup;
• Stripe — payment processing (for paid services).

Some of the providers in section 8.2 are established in or process data in the United States. Transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified under it, or on the European Commission's standard contractual clauses together with supplementary safeguards. You can request information on the applicable safeguards at privacy@atriuma.com.

10.1. General rule

We keep personal data only as long as it is needed for the purpose for which it was collected. We then delete it or irreversibly anonymise it so that it can no longer be linked to you. Anonymised data is no longer personal data and may be used for statistics.

10.2. Inactive accounts

• an account is considered inactive when there has been no sign-in or other activity in it for 24 months;
• at least 30 days before anonymisation we send a notice to the account's email; if you sign in during that period, the account stays active;
• once the period expires, we anonymise the account within 30 days: we delete the name, email, phone number, picture and sign-in data, saved properties, notes, conversations and data about your properties, and irreversibly separate records needed for statistics from your identity;
• data we are required by law to keep is retained only for the statutory period and only for that purpose.

10.3. Specific periods

• account data and related content — until the account is closed or anonymised as inactive;
• conversations without an account and their identifiers — up to 12 months after the last activity;
• conversations you delete — hidden immediately and permanently deleted within 30 days;
• cryptographic fingerprints for abuse prevention — up to 30 days;
• invitations to shared lists and properties — until accepted or expired;
• inquiries and requests to agencies — up to 24 months at ATRIUMA; the agency keeps them under its own policy;
• visit statistics — up to 24 months in pseudonymous form;
• server logs — up to 90 days; security and sign-in records — up to 12 months;
• accounting records for paid services — 10 years under Art. 12 of the Bulgarian Accountancy Act;
• data needed for a legal dispute — until it is finally resolved or the limitation period expires.

10.4. Closing your account

When you close your account, we delete your account data, saved properties, property management data, views and requests to agencies within 30 days, except the data in section 10.3 that we are required by law to keep. Backups are overwritten in their normal cycle, and no later than 90 days.

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), hashing of passwords and tokens, encryption of external sign-in data, two-factor authentication, role-based staff access control, pseudonymisation of identifiers and data minimisation. In the event of a security breach likely to result in a risk to you, we notify the Commission for Personal Data Protection within 72 hours and, where the risk is high, you as well, in accordance with Art. 33 and 34 GDPR.

Under Art. 15–22 GDPR you have the right:

• to access your personal data and obtain a copy;
• to rectify inaccurate or incomplete data;
• to erasure (“right to be forgotten”);
• to restrict processing;
• to data portability — to receive your data in a structured, machine-readable format;
• to object to processing based on legitimate interest, including profiling for direct marketing;
• to withdraw consent at any time;
• not to be subject to a decision based solely on automated processing that produces legal effects for you.

Send requests to privacy@atriuma.com. We reply within one month, which may be extended by two further months for complex or numerous requests, in which case we will let you know. We may ask you to confirm your identity. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

If you believe the processing infringes your rights, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or with the supervisory authority in the Member State where you live or work. We recommend contacting us first so we can resolve the matter.

The Platform is intended for persons aged 18 or over. We do not knowingly collect data of children under 14 (Art. 25c of the Personal Data Protection Act). If we discover that we have received such data without the consent of a parent or guardian, we delete it.

We may update this Policy when our services or the law change. We notify registered users of material changes by email or through the Platform before they take effect. The date of the current version is shown at the top of this document.

This Policy is drawn up in Bulgarian and English. In case of discrepancy, the Bulgarian text prevails.