Privacy Policy
This Privacy Policy explains how DreamHouse UG (limited liability) (“DreamHouse”, “we”, “our”) collects, uses, discloses and protects your personal data when you interact with our websites, applications, services, products and tools (collectively, the “Services”).
Effective date: 1 June 2025
1. Scope and updating of this privacy policy
This Privacy Policy applies to your use of our Services, regardless of the device or platform you use to access them, including mobile devices and applications.
We may update this Privacy Policy at any time. If we make material changes, we will post the updated version on our website and indicate the effective date above. If you have registered with us, we will notify you of material changes via email.
2. Responsible person
The controller within the meaning of the General Data Protection Regulation (GDPR) is DreamHouse UG (limited liability), Am Brunnhölzl 17, 84106 Volkenschwand, Germany. References in this policy to “DreamHouse”, “we” or “our” always refer to this legal entity.
3. Data Protection Officer and contact person
We have appointed a Data Protection Officer (DPO) to oversee the protection of your personal data. If you have any questions about this policy or about data protection at DreamHouse, you can reach the DPO at:
DreamHouse UG (limited liability)
Am Brunnhölzl 17
84106 Volkenschwand, Germany
4. What personal data do we collect and process?
We collect personal data when you use our Services, create an account, fill out forms, update your settings, contact our support team, or otherwise interact with us. We also receive information from other sources, such as credit bureaus and data providers.
4.1 Data you provide directly
Examples include:
- Identifying information such as name, title, postal address, mobile number, email address, username, date of birth and VAT ID.
- Contact details and verification data, for example a phone number used to prevent and investigate illegal activities.
- Advertising data, transaction data (e.g. shipping address) and other content you create or link to your account, including listings, saved searches and watchlists.
- User reviews and messages you exchange with other users through our messaging tools.
- Financial information (e.g. credit card or bank details) when you use paid Services or third-party payment providers in connection with DreamHouse.
- Information submitted when reporting illegal content, including your name, email and any details you provide.
- Additional data you provide via forms, customer service calls (which may be recorded with your consent) or other contact methods.
- Other data we are legally authorised or required to process for identification, authentication or verification.
If you choose not to provide required information, you may be unable to register or use certain Services.
4.2 Data collected automatically
- Usage data associated with your account, such as saved searches or viewed ads.
- Interactions with our Services, including search queries, ad views, messaging activity and communications with customer support.
- Approximate and precise location data, depending on your device settings.
- Technical data including IP address, device and connection information, browser type, access times, language preferences and weblog data.
4.3 Data collected via cookies and similar technologies
We use cookies and similar technologies to collect activity and device data from the devices you use to access DreamHouse Services. This includes pages visited, session duration, links clicked, ad interactions, device information (model, OS version, browser), advertising identifiers, unique device tokens and IP address.
4.4 Data from other sources
- Publicly available data (e.g. demographic information).
- Credit agency data (e.g. for credit checks or identity verification).
- Data from providers offering demographic or interest-based advertising information.
We combine data you provide with data from these sources, ensuring that third parties are authorised to share it with us.
4.5 Data shared via social media
Social network links on our Services allow you to share content or recommend products. No personal data is transmitted to these networks unless you actively click their links. Once you do, the respective network’s privacy policy governs your data.
5. Purposes and legal bases of data processing
We process your personal data for various purposes and under different legal bases, including to provide and improve our Services, offer personalised experiences, communicate about your account, deliver customer support, provide marketing, and prevent fraud or illegal activity. The key legal bases are summarised below.
5.1 Contract performance — Article 6(1)(b) GDPR
We process data to:
- Conclude and perform contracts, including two-factor authentication via your registered phone number.
- Provide and operate Services, publish and distribute listings, connect you with relevant offers, measure and improve quality, and maintain security and functionality.
- Enable transactions and communications with other users, provide reviews and account management, and ensure overall service functionality.
- Resolve account issues, enforce fee collection and offer customer support via various channels.
- Provide location-based services based on general location data.
- Enforce our Terms, this Privacy Policy and other policies.
- Share listings and content with cooperating third-party providers under strict contractual safeguards.
Where necessary, we share data with:
- Other DreamHouse users.
- External operators of websites, applications, services and tools.
5.2 Legal obligations — Article 6(1)(c) GDPR
- Participating in legal proceedings, including identifying, investigating and prosecuting illegal activity.
- Preventing, detecting and deterring unlawful activity (e.g. fraud, money laundering, terrorism financing).
- Responding to GDPR rights requests and fulfilling statutory reporting obligations.
- Handling requests for information from third parties with legal claims.
- Processing reports of illegal content and complaints.
- Complying with consumer protection, platform and tax regulations.
- Ensuring information security of our Services and meeting statutory retention obligations.
Data may be shared with law enforcement, courts, regulatory authorities, third parties with statutory rights, tax authorities, external service providers and credit reporting agencies, in each case subject to legal review.
5.3 Vital interests — Article 6(1)(d) GDPR
We process data to detect, prevent and investigate unlawful acts that may harm your vital interests or those of others. Where required, we share data with law enforcement, courts, government bodies and service providers.
5.4 Legitimate interests — Article 6(1)(f) GDPR
We process data for our legitimate interests, provided they are not overridden by your rights. Measures include:
- Cooperating with authorities and courts to detect or investigate illegal activities.
- Protecting third-party interests in civil disputes.
- Preventing, detecting and investigating fraud, security breaches and policy violations.
- Screening reports for misuse or malicious content.
- Conducting identity checks and risk assessments.
- Monitoring and reviewing user content and messages to protect against fraud.
- Analysing and improving Services based on user feedback and technical data.
- Assessing customer service quality (including recorded calls with consent).
- Sending postal marketing (unless you object) and, where permitted, electronic marketing without explicit consent.
- Customising content, evaluating marketing campaigns and supporting joint services with partners.
- Ensuring compliance with tax and legal obligations.
- Exercising or defending legal claims, including between DreamHouse users.
Possible recipients include external service providers, other DreamHouse users, authorities, courts, credit bureaus, background check services, debt collection agencies and copyright holders.
Information about your right to object to processing based on legitimate interests is provided in the section “Your rights”.
5.5 Consent — Article 6(1)(a) GDPR
With your consent, we process personal data to personalise and measure advertising, analyse user behaviour for improvements, process precise location data, and provide specific services with third-party partners. You may withdraw your consent at any time.
We do not disclose or sell your personal data to third parties for marketing purposes without your consent.
5.6 Automated decision making
We may use technologies considered automated decision-making or profiling. We do not make automated decisions that have significant effects on you unless necessary for a contract, authorised by law or based on your consent. Details about your rights in this context appear in section 8.
6. International data transfer
Some recipients of your personal data are located outside your country. When transferring data to such recipients, we implement appropriate safeguards.
6.1 Transfers from the European Economic Area
We transfer data outside the EEA only on the basis of appropriate safeguards or adequacy decisions. Countries currently considered to provide adequate protection include Andorra, Argentina, Canada (PIPEDA), Switzerland, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, South Korea, New Zealand, Uruguay and the United Kingdom.
7. Storage period and deletion
We store personal data as permitted by law and only as long as necessary for the purposes described in this policy. Afterwards, we delete or anonymise data in accordance with our retention rules, unless legal obligations require longer storage (e.g. taxation, accounting, auditing). In Europe, retention periods typically range from 6 to 10 years for contracts and correspondence.
Where deletion is not possible, we may restrict processing (e.g. by blocking data) until statutory limitation periods expire. Our retention decisions depend on:
- Service provision: fulfilling contracts, improving services, ensuring security and maintaining records.
- Consent-based processing: retaining data for the period covered by your consent.
- Legal or contractual obligations: meeting statutory requirements and managing current or future legal claims.
Specific retention periods are documented in our internal Data Retention Policy.
8. Rights of the data subject
Subject to national law restrictions, you have the right to access, rectify, erase, restrict processing and transfer your personal data. You may withdraw consent, object to processing based on legitimate interests, and lodge a complaint with a supervisory authority.
Our competent supervisory authority is:
91504 Ansbach, Germany
Exercising your rights
You can:
- Withdraw consent at any time without affecting the lawfulness of prior processing.
- Request information about processed personal data, including purposes, categories, recipients, storage periods, source of data (where not collected from you) and the existence of automated decision-making.
- Request correction of inaccurate or incomplete data.
- Request deletion of data when processing is no longer necessary, subject to legal exceptions (e.g. freedom of expression, legal obligations, public interest or legal claims).
- Request restriction of processing if you contest accuracy, object to deletion, require data for legal claims or have objected to processing.
- Obtain a copy of data you provided in a structured, commonly used, machine-readable format and transmit it to another controller (“data portability”).
- Object to processing based on legitimate interests on grounds relating to your situation, including profiling. You can object at any time to direct marketing and related profiling.
We generally process rights requests free of charge. For manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act, as permitted by law.
To exercise your rights, please contact us using the details in section 3.
10. Data security
We protect your personal data with technical and organisational measures designed to minimise risks associated with loss, misuse, unauthorised access, disclosure and alteration. Measures include firewalls, encryption, access controls and physical safeguards at our data centres.