Privacy Policy
Last updated: 7 April 2026
1. Introduction
DreamProp ("we", "us", "our") is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018, and the ePrivacy Regulations (S.I. No. 336 of 2011, as amended).
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and your rights as a data subject. It applies to all users of the DreamProp website and services.
The data controller responsible for your personal data is DreamProp, contactable at info@dreamprop.eu.
2. Personal Data We Collect
We collect only the personal data necessary to provide our service:
2.1 Account Information
- Name — to personalise your experience and emails
- Email address — to log you in, send your property digest, and communicate service updates
- Password — stored as a one-way cryptographic hash (bcrypt); we never store or can access your plaintext password
2.2 Search Preferences
When you set up your property filter, we store your search criteria including:
- Preferred countries and regions
- Price range
- Property type preferences (house, apartment, villa, etc.)
- Bedroom, bathroom, and size requirements
- Feature preferences (pool, garden, sea view, etc.)
These preferences are not personal data in themselves but are linked to your account.
2.3 Payment Information
If you make a purchase, payment card details are collected and processed entirely by our payment processor, Stripe, Inc. We never receive, store, or have access to your full card number. We receive only a tokenised reference, your billing email, and payment status from Stripe.
2.4 Technical Data
Our servers automatically record limited technical data when you visit the site:
- IP address (for security and abuse prevention)
- Browser type and operating system
- Pages visited and timestamps
We do not use any third-party analytics, advertising trackers, or tracking pixels.
3. How We Use Your Data
We process your personal data for the following purposes and legal bases under GDPR Article 6:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Sending your weekly property digest email | Performance of a contract (Art. 6(1)(b)) |
| Matching properties to your saved search criteria | Performance of a contract (Art. 6(1)(b)) |
| Processing payments | Performance of a contract (Art. 6(1)(b)) |
| Sending service-related communications (e.g. password resets, account confirmations) | Performance of a contract (Art. 6(1)(b)) |
| Preventing fraud and ensuring security | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations (e.g. tax records for payments) | Legal obligation (Art. 6(1)(c)) |
We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects on you.
4. Cookies and Similar Technologies
We use only strictly necessary cookies that are essential for the website to function:
| Cookie | Purpose | Duration |
|---|---|---|
| dreamprop_session | Maintains your authenticated session | 2 hours (or until you log out) |
| XSRF-TOKEN | Prevents cross-site request forgery attacks | 2 hours |
| remember_web_* | Keeps you logged in if you select "Remember me" | 5 years (or until you log out) |
These cookies are exempt from consent requirements under the ePrivacy Regulations as they are strictly necessary for the provision of the service you have requested. We do not use any analytics, advertising, or tracking cookies.
5. Third-Party Data Processors
We share personal data only with the following third-party processors, all of whom are contractually bound to protect your data under GDPR Article 28:
| Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing | Email, payment token | USA (EU SCCs in place) |
| Postmark (ActiveCampaign) | Transactional email delivery | Name, email, email content | USA (EU SCCs in place) |
| Bunny.net | Font delivery (CDN) | IP address (via browser request) | EU |
Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) as approved by the European Commission, in accordance with GDPR Article 46(2)(c).
6. Data Retention
We retain your personal data only for as long as necessary:
- Account data — retained while your account is active. If you delete your account, all personal data is removed within 30 days.
- Search preferences — deleted when you delete your account or clear your filter.
- Email history — records of which properties were sent to you are retained while your account is active, then deleted with your account.
- Payment records — retained for 7 years after the transaction to comply with Irish tax and accounting obligations (Taxes Consolidation Act 1997).
- Server logs — automatically deleted after 90 days.
7. Your Rights Under GDPR
As a data subject, you have the following rights. You can exercise any of these by contacting us at info@dreamprop.eu:
- Right of access (Art. 15) — You can request a copy of all personal data we hold about you. We will respond within one month.
- Right to rectification (Art. 16) — You can update your name and email from your profile page, or ask us to correct any inaccurate data.
- Right to erasure (Art. 17) — You can delete your account from your profile page, or request that we erase all your data. We will do so within 30 days, except where we are legally required to retain certain records.
- Right to restriction of processing (Art. 18) — You can ask us to temporarily stop processing your data while a dispute is resolved.
- Right to data portability (Art. 20) — You can request your data in a structured, machine-readable format (JSON or CSV).
- Right to object (Art. 21) — You can object to processing based on legitimate interests. You can also stop receiving digest emails at any time by deactivating your filter from the dashboard.
- Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
We will respond to all data subject requests within one calendar month, as required by GDPR Article 12(3). If a request is complex, we may extend this by a further two months and will inform you accordingly.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit using TLS/HTTPS
- Passwords hashed using bcrypt with appropriate cost factor
- CSRF protection on all form submissions
- Database-backed sessions with automatic expiry
- Regular security updates to all software dependencies
9. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by GDPR Article 34, describing the nature of the breach and the measures taken or proposed to address it.
10. Children's Data
DreamProp is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the website. The "Last updated" date at the top of this page indicates when the policy was last revised.
12. Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Data Protection Commission (An Coimisiún um Chosaint Sonraí), the Irish supervisory authority:
- Data Protection Commission
- 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
- Phone: +353 (0)1 765 0100 / 1800 437 737
- Email: info@dataprotection.ie
- Website: www.dataprotection.ie
13. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:
- Email: info@dreamprop.eu