1. Introduction

Welcome to Hestia ("we", "our", "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform at zuziestates.com (the "Platform").

This policy applies to all users of the Platform, including tenants, property owners, and brokers.

2. Data Controller

The data controller responsible for your personal data is:

• Company: Hestia
• Location: Bulgaria
• Email: contact@zuziestates.com

3. What Data We Collect

We collect and process the following categories of personal data:

3.1 Data you provide directly

• Account information: first name, last name, email address, phone number, profile picture
• Property listings: property details, addresses, photos, pricing
• Communications: messages exchanged between users through our chat system
• Reviews: broker reviews and ratings submitted by tenants
• Contracts: rental agreement data generated through the Platform

3.2 Data collected automatically

• Technical data: IP address, browser type, device information
• Session data: essential cookies required for authentication and security (CSRF tokens, session identifiers)

3.3 Data from third parties

• Social login: if you sign in with Google or Facebook, we receive your name, email, and profile picture from those services
• Google Maps: we use Google Maps to display property locations; Google may process your IP address when maps are loaded

4. How We Use Your Data

We process your personal data for the following purposes:

• To create and manage your account
• To publish and display property rental listings
• To enable communication between tenants and brokers
• To facilitate property viewing scheduling
• To generate and manage rental contracts
• To display broker reviews and ratings
• To verify user phone numbers via SMS
• To ensure platform security and prevent abuse
• To comply with legal obligations

5. Legal Basis for Processing

We process your personal data based on:

• Contract performance (Art. 6(1)(b) GDPR): processing necessary to provide the services you requested (account management, listings, messaging, viewings, contracts)
• Legitimate interest (Art. 6(1)(f) GDPR): platform security, fraud prevention, service improvement
• Consent (Art. 6(1)(a) GDPR): social media login, optional profile information
• Legal obligation (Art. 6(1)(c) GDPR): compliance with applicable laws

6. Cookies

We use only strictly necessary cookies that are essential for the Platform to function:

• Session cookie (laravel_session): maintains your logged-in state
• CSRF token (XSRF-TOKEN): protects against cross-site request forgery attacks

These cookies do not track you, do not profile your behavior, and are not shared with any third party. As strictly necessary cookies, they are exempt from consent requirements under GDPR.

We do not use any analytics, advertising, or tracking cookies.

7. Data Sharing

We do not sell your personal data. We may share your data with:

• Other users: your public profile information, listings, and reviews are visible to other Platform users
• Google: when Google Maps is loaded to display property locations, or when you use Google sign-in
• Facebook: only when you choose to sign in with Facebook
• SMS provider (Vonage): your phone number for verification purposes
• Law enforcement: when required by law or legal process

8. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, we will delete or anonymize your personal data within 30 days, unless retention is required by law.

Messages, reviews, and contract data may be retained for up to 5 years after account deletion for legal compliance purposes.

9. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability — receive your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time, without affecting prior processing

To exercise any of these rights, contact us at contact@zuziestates.com.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption of data in transit (HTTPS), secure password hashing, and access controls.

11. International Transfers

Your data is primarily processed within the European Union. When third-party services (Google, Facebook) process data outside the EU, they do so under appropriate safeguards such as Standard Contractual Clauses.

12. Children

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email or a notice on the Platform. The "last updated" date at the top reflects the most recent revision.

14. Contact

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

• Email: contact@zuziestates.com

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) at www.cpdp.bg.