PRIVACY POLICY OF DOMNEED.SI

1. Controller of personal data

The controller of personal data in respect of processing for which DomNeed.si determines the purposes and means is:

• Nicole Daniel Svetovanje s.p.
• short company name: Nicole Daniel s.p.
• Address / registered office: Rakuševa ulica 8, 1000 Ljubljana, Slovenia
• Registration number: 7381867000
• Tax number: 74738518
• Email: support@domneed.si

In this Privacy Policy, the terms DomNeed, DomNeed.si, we, us, our and Controller are used.

2. Privacy contact

For questions concerning personal data, the exercise of data-subject rights, or this Privacy Policy, you may contact:

support@domneed.si

DomNeed has not currently appointed a separate Data Protection Officer — DPO.

The absence of a separately appointed DPO does not restrict the user's right to contact the Controller directly or to contact the competent supervisory authority.

3. Who this Policy applies to

This Policy may apply to:

• visitors to DomNeed.si;
• registered users;
• private property owners;
• buyers;
• tenants;
• landlords;
• sellers;
• real-estate agents;
• representatives of real-estate agencies and companies;
• sole traders and entrepreneurs;
• investors and property developers;
• persons submitting an inquiry concerning a listing;
• persons reporting a problematic listing;
• persons contacting support;
• other persons whose personal data are processed in connection with the use of DomNeed.

4. Principles of processing

DomNeed seeks to process personal data:

• lawfully, fairly and transparently;
• for specified and lawful purposes;
• only to the extent necessary for the relevant purpose;
• with reasonable measures to ensure accuracy;
• no longer than justified by the purpose of processing or applicable law;
• using appropriate technical and organisational security measures.

5. Account data

Depending on how the service is used, DomNeed may process:

• first name and surname;
• email address;
• telephone number;
• user identifier;
• account type;
• preferred language;
• registration date;
• date of last sign-in, where available through the authentication system;
• email-confirmation status;
• contact settings;
• marketing-consent settings;
• other technical account data.

Some fields are necessary for creating and operating an account, while others are provided voluntarily by the user.

6. Password and authentication

DomNeed uses Supabase Auth / Lovable Cloud infrastructure for authentication.

The current user interface supports sign-in using an email address and password.

The password is transmitted to the authentication system for secure processing and is not stored by DomNeed in plain text.

DomNeed must not ask a user to provide their password by email, in an ordinary support message, or through a listing form.

7. User session

To maintain a signed-in user session, the authentication system uses session and refresh tokens.

Under the current browser architecture, authentication-session data may be stored in the browser's localStorage under a technical Supabase key.

Users should take this into account when using a shared or third-party device and should sign out of their account after use.

8. Private-profile data

A profile may contain:

• full name;
• email address;
• telephone number;
• account type;
• preferred language;
• agency name;
• website;
• agency logo, if that function is used;
• permitted contact-method settings;
• verification statuses;
• marketing settings;
• technical creation and update timestamps.

Not all of these data are publicly available.

9. Professional and business information

A professional profile may contain:

• publisher role;
• full legal name of the company or entrepreneur;
• registered office;
• registration number;
• business email address;
• business telephone number;
• website;
• agent name;
• real-estate licence number;
• verification status;
• other information required for professional publication.

10. Publisher roles

DomNeed may process the user's role in connection with a publication, including:

private_owner — a private owner or authorised private individual;

real_estate_agency — a real-estate agency or professional real-estate intermediary;

business_owner — a company or entrepreneur offering the property directly;

investor_developer — an investor or property developer.

The role is used for operation of the listing, compliance with requirements applicable to professional publishers, public identification, and determination of the applicable contractual or consumer flow.

11. Listing data

Depending on the type of property, DomNeed may process:

• listing title;
• description;
• property type and subtype;
• transaction type;
• price;
• currency;
• rent;
• deposit;
• additional costs;
• commission, where applicable;
• ownership information;
• rent-payment terms;
• floor area;
• land area;
• number of rooms;
• bedrooms;
• bathrooms;
• floor;
• total number of floors;
• year built;
• renovation year;
• condition;
• parking;
• heating;
• energy certificate;
• features and amenities;
• new-build information;
• rental conditions;
• availability date;
• minimum rental period;
• furnishing information;
• pet allowance;
• student allowance;
• maximum number of occupants;
• utility costs;
• video or virtual-tour links;
• listing status;
• creation, modification and publication dates;
• technical and moderation data.

12. Address and location data

DomNeed may store:

• country;
• region;
• municipality;
• settlement;
• city;
• street;
• house number;
• formatted address;
• geographic coordinates;
• location source;
• location-verification information.

The exact address may be necessary for the proper functioning of search, maps, listing editing and internal location verification.

13. Protection of the exact address

The exact address of a property is not a publicly accessible field of the public listing database.

In particular, the following are not made available through ordinary public browser access:

• street;
• house number;
• full formatted address;
• internal precise coordinates.

Where exact-address hiding is enabled for a listing — and this protection is applied by default to new listings — only an approximate location is supplied to the public map, such as the settlement centroid or another technically rounded location.

Precise coordinates may continue to be stored internally and may be made available to the listing owner or an authorised administrator through a protected server-side mechanism.

14. Property photographs

Users may upload photographs of a property.

Before storage, images are technically processed: orientation is normalised, images are converted into working sizes, and they are re-encoded.

The original photograph file in its original form is not stored as a publicly accessible original.

During re-encoding, embedded EXIF metadata, including GPS coordinates contained in the photograph, are not retained in publicly delivered images.

This reduces the risk of unintentionally disclosing location information through photograph metadata.

15. Public listing data

A published listing is, by its nature, intended for public viewing.

Depending on the type of listing and publisher role, publicly available information may include:

• property title and description;
• photographs;
• price;
• characteristics;
• approximate location;
• public map coordinates;
• property information;
• contact-person name;
• publisher type;
• public professional identity;
• indication of available contact methods.

16. Public professional information

For a professional publisher, a public listing may contain:

• publisher role;
• legal name;
• registered office;
• agent name, where applicable;
• licence number, if provided and intended for display;
• website;
• information that the real-estate agency is advertising its own property, where applicable.

The registration number stored in the business profile, internal verification status, internal business email and internal business telephone number do not automatically become public.

17. Historical publisher identity

DomNeed retains immutable historical information concerning the professional identity associated with a listing at the time of publication or unpublication.

This may include:

• role;
• legal name;
• registered office;
• agent name;
• licence number;
• website;
• confirmation of authority;
• information that the agency was advertising its own property;
• time at which the information was captured.

This history is used to establish who advertised a property, and in what capacity, at the relevant time.

A later change to the profile does not overwrite an already stored historical record.

18. Listing telephone number and email address

A publisher's telephone number and email address are not made available to anonymous users as ordinary publicly readable database fields.

Where the publisher has enabled the relevant contact method, DomNeed may reveal it to a visitor on request through a protected server-side mechanism.

To protect against bulk data collection and abuse, DomNeed applies request-rate limits, technical measures against automated access, and security-event logging.

19. Listing inquiries

Where a user submits an inquiry to a publisher through the designated form, DomNeed may process:

• sender's name;
• email address;
• telephone number, if provided;
• message text;
• language;
• identifier of the registered sender, where applicable;
• related listing;
• date and time of the inquiry.

These data are made available to the owner of the relevant listing because this is the purpose of the inquiry function.

Access to inquiries is restricted to the sender, the owner of the relevant listing, and authorised system roles where applicable.

20. Reports and notices concerning listings

A user may report a problematic, suspicious or unlawful listing to DomNeed.

In that case, the following may be processed:

• listing identifier;
• reporter identifier, where the reporter is authenticated;
• reason for the report;
• free-text details;
• date of the report;
• status of its review.

A report may also be submitted without a reporter identifier where the relevant flow allows this.

The identity of the reporter is not disclosed to the listing owner as an ordinary part of the report.

21. Support

Where a user contacts DomNeed, we may process:

• name;
• email address;
• telephone number, if provided;
• content of the communication;
• correspondence history;
• account or listing information necessary to resolve the matter;
• date and time of communication.

The principal support address is:

support@domneed.si

DomNeed.si business email is operated through Google Workspace. When business email is used, the relevant data are also processed through the infrastructure of the email-service provider.

22. WhatsApp and other external channels

The DomNeed interface may contain a link allowing users voluntarily to contact DomNeed through WhatsApp.

If a user independently chooses this external channel, their account data and message content are also processed by the relevant WhatsApp service provider in accordance with that provider's own terms and privacy policy.

A user is not required to use WhatsApp to exercise rights under this Policy and may always contact support@domneed.si.

23. Main purposes of processing

DomNeed may process personal data for:

• creating and maintaining an account;
• authentication;
• restoring access;
• managing the profile;
• creating and publishing a listing;
• managing listings;
• displaying properties;
• operating search and maps;
• providing contact functions;
• processing listing inquiries;
• storing favourites and user settings;
• processing payments;
• billing;
• confirming contracts;
• maintaining legal evidence;
• fulfilling consumer-law obligations;
• providing user support;
• moderation;
• fraud prevention;
• protecting the platform;
• investigating abuse;
• accounting and tax records;
• complying with requests from public authorities;
• protecting legal claims;
• ensuring and improving the technical operation of the service.

24. Performance of a contract

Processing may be based on necessity for the performance of a contract or in order to take steps at the user's request before entering into a contract.

This may apply, for example, to:

• creation and operation of an account;
• publication of a listing;
• operation of a professional profile;
• provision of search and maps;
• contact functions;
• conclusion of the listing-publication service contract;
• application of the Payment Terms;
• billing;
• provision of the contract confirmation;
• processing of payment status.

25. Legal obligation

Processing may be necessary for compliance with legal requirements.

This may relate in particular to:

• accounting;
• tax documentation;
• legal identification;
• consumer information;
• evidence of contractual actions;
• responding to competent public authorities;
• compliance with obligations concerning unlawful content or moderation;
• other obligations of the Controller.

26. Legitimate interests

DomNeed may process data on the basis of legitimate interests where those interests are not overridden by the rights and freedoms of the user.

Such interests may include:

• website security;
• protection of user accounts;
• prevention of abuse;
• combating fraud;
• limiting automated harvesting of contact information;
• protection against spam;
• technical diagnostics;
• ensuring evidentiary records of actions;
• moderation;
• protection of the rights of DomNeed and other users;
• establishment, exercise or defence of legal claims.

27. Consent

Where consent is required by law, processing is carried out on the basis of freely given consent.

This may apply, for example, to:

• marketing emails;
• certain optional storage or tracking technologies, if introduced;
• other types of processing for which consent is expressly requested.

Consent may be withdrawn for the future.

Withdrawal of consent does not affect the lawfulness of processing carried out lawfully before withdrawal.

28. Acceptance of the legal bundle

At registration, DomNeed retains evidence of the required legal action.

This may include:

• user identifier;
• legal-bundle version;
• Terms of Use version;
• Listing Rules version;
• Privacy Policy version;
• language;
• acceptance source;
• trusted timestamp.

Historical records are protected and cannot be arbitrarily overwritten by the user.

29. Acknowledgement of the Privacy Policy

At registration, the user accepts the Terms of Use and Listing Rules and confirms having been informed of the Privacy Policy in accordance with the applicable interface.

This action does not constitute consent to every possible processing of personal data.

Each processing operation must have its own applicable legal basis.

30. Payment Terms and publication evidence

Before publication, where required, DomNeed may store:

• user identifier;
• listing identifier;
• Payment Terms version;
• withdrawal-information version;
• Terms of Use version;
• language;
• source;
• pricing snapshot;
• applicable price;
• currency;
• consumer status;
• publisher role;
• first-publication information;
• trusted acceptance time;
• time at which the acceptance was consumed for publication.

31. Request for immediate commencement of the service

For a consumer's first publication, DomNeed may store separate evidence of the user's explicit request for the service to begin before expiry of the statutory withdrawal period.

This information is linked to the specific user, listing and publication event.

32. Contract confirmation

For a consumer's first publication, DomNeed creates an immutable contract confirmation.

Such confirmation may contain:

• user identifier and email address;
• listing identifier and title;
• time of contract conclusion and first publication;
• applicable versions of legal documents;
• evidence of the request for immediate commencement of the service;
• applicable pricing snapshot;
• information concerning the right of withdrawal;
• Controller information;
• language.

The confirmation is made available to the user through a protected personal page and can be downloaded.

It is currently provided within the application; separate automated delivery of such confirmation by transactional email is not connected.

33. Publication history

DomNeed retains a history of publication and unpublication events.

These records may contain:

• user;
• listing;
• type of event;
• status;
• time;
• historical publisher identity.

The history is used, among other things, to establish the first publication, contractual history, billing periods and compliance with legal obligations.

34. Billing data

DomNeed may process and retain:

• billing period;
• billing cycle;
• billing items;
• applicable price;
• currency;
• payment due date;
• grace period;
• payment-obligation status;
• pricing snapshot;
• applicable promotional status;
• historical entitlement to a promotional price;
• identifier of the related listing.

35. SumUp

DomNeed uses SumUp to process payments.

When creating a payment, DomNeed sends SumUp the data necessary to create the checkout, including:

• internal reference;
• amount;
• currency;
• merchant code;
• payment description;
• technical redirect and return URLs.

DomNeed does not send the user's name, email address or home address to SumUp as part of its own checkout-creation request, unless a future change to the integration makes such information necessary.

36. Payment-card data

The user enters payment-card information directly in the SumUp hosted-checkout environment.

DomNeed does not store:

• full card number;
• CVV/CVC;
• PIN;
• payment-card credentials that would, by themselves, allow a payment to be carried out.

SumUp may independently collect and process payment and technical information relating to the payer in accordance with its own privacy policy and obligations as a payment-services provider.

37. What DomNeed receives from SumUp

DomNeed may retain limited payment information:

• provider;
• checkout reference;
• provider checkout ID;
• provider transaction ID;
• hosted checkout URL;
• amount;
• currency;
• status;
• payment time;
• failure reason;
• sanitised technical provider response.

The stored technical payload is limited to an approved set of fields and is not intended to store payment-card data.

38. Marketing consent

Marketing consent is separate, voluntary and disabled by default.

DomNeed may retain:

• current consent state;
• date of consent;
• previous state;
• new state;
• language;
• source of the change;
• time of the change.

The history of giving and withdrawing consent is retained separately as evidence.

39. Marketing communications in the current system

No automated marketing-email platform is currently connected to DomNeed.si.

Providing marketing consent does not, by itself, currently cause automated marketing emails to be sent.

If such a system is connected in the future, the relevant processing must take place only where the required legal basis exists, and this Policy will be updated where necessary.

40. Google Maps Platform

DomNeed uses Google Maps Platform, including Maps and Places/Geocoding functions.

These functions are loaded in the user's browser.

When maps are used, Google may receive technical data directly from the browser, including the IP address, browser information, map-request data, coordinates and related technical information.

41. Address geocoding

When a publisher enters a property address, the entered address string may be transmitted from the browser to Google Maps/Places in order to convert the address into geographic coordinates or identify the relevant place.

This means that the precise address entered by the user when creating a listing may be transmitted to Google in order to perform the requested geocoding function.

DomNeed stores precise location data separately from the approximate location displayed publicly.

42. Google Fonts and external technical resources

DomNeed may load fonts through Google Fonts services.

Certain frontend technical resources may also be loaded through external CDNs such as unpkg.

Where the browser makes a direct request for such resources, the external provider may technically receive the IP address, user-agent, request time and information necessary to deliver the resource.

DomNeed does not use these connections as a behavioural-advertising or user-profiling system.

43. Cloudflare and protection against automated access

DomNeed may use Cloudflare Turnstile or related edge infrastructure to protect against automated requests, abuse and bots.

In that case, Cloudflare may receive:

• IP address;
• technical request parameters;
• challenge token;
• other information necessary for request verification and security.

Turnstile may, for example, be activated when certain protective limits on access to contact information are exceeded.

44. Lovable

DomNeed uses Lovable infrastructure for application hosting and execution, builds, publication and server-side functions.

In the course of serving the website, the technical provider may process request data including IP address, user-agent, URL, time and other technical information.

45. Lovable Cloud / Supabase

DomNeed uses Lovable Cloud / Supabase for its principal backend infrastructure.

Depending on the relevant function, this infrastructure processes:

• database data;
• authentication;
• user profiles;
• listings;
• photographs;
• storage;
• legal records;
• payment history;
• server-side functions;
• provider technical logs.

The region of the particular project is not directly exposed to the user by the application's current configuration.

46. Providers and recipients

Depending on the function used, personal data may be processed by, or technically accessible to:

• Lovable — hosting and application runtime;
• Lovable Cloud / Supabase — database, authentication and storage;
• Google — Maps, Places/Geocoding, Fonts and email infrastructure where applicable;
• Cloudflare — network layer and Turnstile;
• SumUp — payment processing;
• unpkg and related CDN infrastructure — delivery of frontend resources;
• professional advisers of the Controller, where necessary;
• public or supervisory authorities, where disclosure is required by law;
• other DomNeed users only where disclosure forms part of the requested function, for example where an inquiry is sent to the owner of a listing.

Depending on the particular service and the provider's legal terms, a provider may act as a processor, an independent controller, or in another legal capacity.

47. Processing outside the EEA

Some technical providers use global infrastructure.

Accordingly, in certain circumstances personal data may be processed outside the European Economic Area.

Where GDPR requirements concerning international transfers apply to such a transfer, an appropriate safeguard recognised by law must be used, such as:

• an adequacy decision;
• Standard Contractual Clauses adopted by the European Commission;
• another valid mechanism permitted by applicable law.

The specific mechanism depends on the provider, the type of processing, and the provider's current contractual documentation.

48. LocalStorage and SessionStorage

DomNeed uses browser storage for technical and user functions.

It may contain:

• Supabase authentication-session data;
• a record of the user's cookie/consent choice;
• selected language;
• temporary legal-registration state;
• signup draft;
• unsaved listing draft;
• information necessary to return to the previous search page;
• other technical settings.

Some records are removed after the relevant action is completed, while others remain until replaced, expired or deleted by the user or browser.

49. Cookie-consent record

DomNeed stores information concerning the user's cookie/consent selection, including:

• version;
• language;
• decision;
• selected categories;
• date of the selection.

The current system requests renewal or reconfirmation of this selection after a specified period, which under the current configuration is 180 days.

50. Analytics and advertising technologies

DomNeed.si does not currently load:

• Google Analytics;
• Google Tag Manager;
• Meta Pixel;
• Microsoft Clarity;
• PostHog;
• Plausible;
• Sentry as a user-tracking system;
• other known advertising or session-replay tools.

Analytics and marketing categories may exist in the consent-management interface, but no active services are currently assigned to those categories.

51. Sale of data and behavioural advertising

DomNeed does not sell users' personal data.

The current system does not include:

• behavioural advertising networks;
• uploads of user lists to advertising platforms;
• advertising audience-matching mechanisms;
• targeting based on user profiles;
• third-party advertising pixels.

52. IP address

A raw IP address may be processed temporarily within server or edge infrastructure for request delivery, protection against abuse, Turnstile verification and other security functions.

In DomNeed's own database, security events do not store the ordinary raw IP address. Instead, DomNeed uses a cryptographically transformed identifier — a salted IP hash.

This hash is used to limit abuse without requiring storage of the original IP address in the principal security-event record.

53. Rate limiting

To prevent automated data harvesting, spam, repeated login attempts and other abuse, DomNeed uses rate limiting.

Temporary rate-limit records may be associated with:

• hashed IP address;
• user;
• normalised email address;
• particular protected function.

Current technical rate-limit buckets are automatically removed after approximately 24 hours.

54. Security events

DomNeed may retain:

• event type;
• severity;
• user identifier;
• technical subject;
• hashed IP;
• limited metadata;
• event time.

These data are used to investigate abuse, maintain security and protect users and the platform.

55. Provider logs

Infrastructure providers, including Lovable, Supabase, Cloudflare, Google and SumUp, may maintain their own system and security logs.

Depending on the provider, these may include:

• IP address;
• user-agent;
• date and time;
• request information;
• session identifiers;
• technical errors;
• security information.

The precise content and retention periods of such provider logs are determined by the relevant provider and are not fully controlled by DomNeed through application code.

56. Moderation data

For moderation purposes, DomNeed may process:

• listing status;
• internal or user-facing reasons for restrictions;
• reports of violations;
• moderation note;
• administrative actions;
• related evidence.

An internal moderation note is not a public field.

The listing owner may receive moderation information intended for them through a protected server-side mechanism, while internal administrative information is not publicly disclosed.

57. Administrative audit trail

DomNeed may retain an internal audit log of administrative actions.

Such a record may contain:

• administrator identifier;
• business email address;
• action;
• object type and identifier;
• limited context;
• time.

The audit log is used for security, accountability of administrative actions and investigation of problems.

58. Automated technical rules

DomNeed uses automated technical rules, for example, for:

• checking required fields;
• verifying publication eligibility;
• verifying the existence of required legal acceptance;
• determining the applicable price;
• allocating limited promotional capacity;
• generating billing cycles;
• location verification;
• filtering and sorting;
• rate limiting;
• bot protection;
• preventing duplicate inquiries.

59. Absence of profiling and Article 22 decisions

DomNeed does not currently use:

• scoring-based user profiling;
• personalised advertising profiles;
• algorithmic user-reliability scores;
• automated systems deciding whether a person may enter into a property transaction;
• AI moderation that independently makes final legally significant decisions;
• recommendation profiling.

Decisions to reject a listing for moderation reasons are made by a human administrator.

Ordinary deterministic technical checks are not intended, by themselves, to constitute solely automated decision-making producing legal or similarly significant effects.

60. General retention principle

Personal data are retained for as long as necessary for the relevant purpose and applicable legal basis.

For certain categories, the law prescribes mandatory retention periods.

For other categories, necessity is assessed taking into account:

• existence of an account or contract;
• need to provide the service;
• accounting and tax requirements;
• security;
• fraud prevention;
• limitation periods for legal claims;
• need to prove acceptance of legal documents or contractual actions.

61. Account

Account data are generally required for the duration of the account.

The current application does not implement an automatic fixed account-deletion period and does not provide the user with a self-service button for complete account deletion.

A user may request deletion by contacting:

support@domneed.si

After receiving such a request, DomNeed assesses which data can be deleted and which data must or may lawfully continue to be retained.

62. Deletion of a listing

A user may delete their own listing through the user interface where the relevant function is available.

Deletion ends the ordinary public display of the listing.

Associated stored photograph files are removed from operational storage in accordance with the current technical procedure.

63. Information that may remain after deletion of a listing

Deletion of the current listing does not automatically delete:

• publication history;
• historical publisher identity;
• legal acceptances;
• Payment Terms acceptances;
• contract confirmation;
• billing items;
• payment records;
• other data necessary for legal, financial, security or audit evidence.

64. Legal evidence

Legal acceptances, Payment Terms evidence, marketing-consent history and contract confirmations are technically protected against ordinary modification or deletion by users.

The application does not currently impose a single automatic deletion period for these categories.

They are retained to the extent necessary to prove contractual relationships, comply with law, satisfy accounting obligations and protect legal claims.

65. Payment and accounting data

Billing cycles, billing items and payment records may be retained for as long as necessary for:

• fulfilment of payment obligations;
• accounting;
• tax reporting;
• proof of payment;
• fraud prevention;
• dispute resolution;
• compliance with other lawful obligations.

Ordinary deletion of such records by the user is not provided.

66. Marketing-consent history

The history of giving and withdrawing marketing consent may be retained as evidence of when consent existed and what its state was.

Withdrawal of consent changes the current legal basis for future marketing processing, but does not necessarily require destruction of historical evidence of the lawful giving or withdrawal of consent.

67. Moderation and security records

For moderation reports, security events and certain audit records, the application does not implement one uniform automatic fixed retention period.

They are retained to the extent necessary for:

• reviewing a report;
• security;
• investigation of abuse;
• prevention of repeated violations;
• evidence of administrative actions;
• protection of legal claims.

Short-lived rate-limit records are deleted separately according to their technical retention period.

68. Backups and external systems

After deletion from the principal active system, certain data may temporarily remain:

• in backups;
• in provider logs;
• in email systems;
• in payment systems;
• in documentation that must be retained by law.

Such data should not return to ordinary active use except where necessary for restoration, security or compliance with legal obligations.

69. Right to information

The user has the right to receive transparent information concerning the processing of their personal data in cases provided for by applicable law.

This Policy forms part of that information.

70. Right of access

Where the statutory conditions are met, the user may request confirmation as to whether DomNeed processes their personal data and may obtain access to the relevant data and required information concerning the processing.

71. Right to rectification

The user may correct certain profile data directly.

Where information cannot be corrected through the user interface, the user may contact DomNeed.

This includes, in particular, correction of inaccurate personal data.

72. Right to erasure

In cases provided for by the GDPR, the user may request erasure of personal data.

The right to erasure is not absolute.

DomNeed may continue to retain data where necessary, for example:

• to comply with a legal obligation;
• for accounting or tax records;
• for the establishment, exercise or defence of legal claims;
• on other grounds permitted by law.

73. Right to restriction of processing

In cases provided for by law, the user may request restriction of the processing of particular personal data.

74. Right to object

Where processing is based on legitimate interests, the user may, where the legal conditions are met, object to such processing on grounds relating to their particular situation.

For direct marketing, the right to object applies in accordance with applicable law and separately from the possibility of withdrawing marketing consent.

75. Data portability

Where the conditions of the GDPR are met, the user may have the right to receive data they provided in a structured, commonly used and machine-readable format and to exercise the right to data portability.

DomNeed does not currently provide a self-service function for a complete privacy export.

A request may be sent to support@domneed.si.

76. Withdrawal of consent

Where processing is based on consent, the user may withdraw that consent for the future.

Marketing consent can be changed through the relevant account settings.

Cookie/consent preferences can be changed through the Cookie Settings interface.

77. Verification of the requester's identity

Where there is a reasonable risk that personal data could be disclosed to the wrong person, DomNeed may request additional information necessary to verify the identity of the requester.

We should not request more information than is reasonably necessary for such verification.

78. How to submit a privacy request

A request concerning access, rectification, erasure, restriction, objection, portability or another privacy-related matter may be sent to:

support@domneed.si

DomNeed handles such requests within the time limits prescribed by applicable law.

79. Right to lodge a complaint

The user has the right to lodge a complaint with the competent data-protection supervisory authority.

For a Controller established in Slovenia, the competent authority is:

Informacijski pooblaščenec Republike Slovenije

Information Commissioner of the Republic of Slovenia

Lodging a complaint with the supervisory authority does not exclude other administrative or judicial remedies.

80. Technical and organisational measures

DomNeed applies reasonable technical and organisational measures designed to protect personal data.

These include or may include:

• access controls;
• secure authentication;
• Row Level Security;
• separation of user, administrator and service-role privileges;
• restriction of public access at column level;
• protected connections;
• private storage;
• signed URLs;
• rate limiting;
• Turnstile;
• IP hashing for internal security events;
• append-only audit records;
• protection of critical legal evidence against modification;
• logging of administrative actions;
• server-side verification of sensitive requests.

No internet-based system can guarantee absolute security.

81. Public and restricted access

The principal tables containing personal data are protected by access-control rules.

Anonymous visitors do not have ordinary access to:

• profiles;
• business profiles;
• user inquiries;
• billing;
• legal evidence;
• contract confirmations;
• full contact details;
• exact address;
• internal precise coordinates;
• moderation notes.

Public access is provided only to information necessary for public listings and related functionality.

82. Use by minors

DomNeed is a real-estate service and is not specifically directed at children.

DomNeed does not currently collect users' dates of birth and does not perform automated age verification during registration.

A person who, under applicable law, cannot independently enter into the relevant contract should not independently enter into a paid publication contract without the necessary involvement of a legal representative.

DomNeed does not provide child-specific profiles or functions specifically intended for children.

83. Changes to this Policy

DomNeed may update this Policy, for example, because of:

• changes in law;
• changes in categories of data;
• connection or removal of a provider;
• introduction of a new function;
• changes to payment or technical processes;
• changes to retention periods;
• introduction of analytics or marketing technology;
• changes in the ways rights may be exercised.

The current version is published on DomNeed.si with the relevant version or date.

84. Material changes

Where there is a material change to processing, DomNeed may additionally notify registered users or present updated information through the user interface.

If a particular new processing operation requires consent, it must not rely solely on the fact that the user was previously informed of an older version of the Privacy Policy.

85. Language versions

This Policy may be published in:

• Slovenian;
• English;
• German;
• Russian.

Once approved, the Slovenian version is the principal legal version of DomNeed.si for relationships governed by Slovenian law, without prejudice to the user's mandatory rights and the information actually provided to them in another language.

86. Related documents

This Policy should be read together with:

• the Terms of Use of DomNeed.si;
• the Listing Rules;
• the Payment Terms;
• the Cookie Policy.

These documents govern different aspects of use of the platform and do not replace one another.

87. Contact

For all questions concerning this Policy and personal data:

• DomNeed.si
• Nicole Daniel Svetovanje s.p.
• Rakuševa ulica 8
• 1000 Ljubljana
• Slovenia
• Email: support@domneed.si

88. Version and date

Document version: 2026-08

Date: August 2026

This version reflects the actual architecture of DomNeed.si as at the date of its preparation.