Privacy notice

8. BEP partner portal: accounts and authentication

The portal supports establishing and managing cooperation. We process business email, passwords through Supabase Auth, account IDs, confirmation and recovery operations and technical authentication data. Credentials are sent to Supabase Auth; the reviewer interface does not display passwords. Session and refresh tokens are held in your browser’s sessionStorage for authentication and renewal; signing out removes the local session. Email and password are required to create and access an account. Confirmation and recovery emails are operational messages, not advertising. Acknowledging this notice is not marketing consent.

9. Company profiles, offers and private documents

Required profile details are company, contact name, company type, country/seat and at least one specialism. Markets, website, phone/WhatsApp and description are optional. Timestamps are stored; the privacy acknowledgement timestamp is set when the profile is created, not a versioned consent record at Auth signup. Property/project and service records contain titles, countries, descriptions, prices, specifications, contractual/commission details and other information you enter, plus status and revision number. Submission requires the form’s mandatory information and confirmation of authority.

Uploads may include company evidence, brochures, images, floor plans, price lists and supplied or signed agreements, including personal data within them. We store the file, filename, path, account/offer association, document type, uploader and timestamp. Supply only necessary material, redact unnecessary details and inform affected contacts. The portal does not request health or criminal-record data or complete identity-document copies; do not upload these unsolicited.

Before upload, JPG, PNG and WebP images are resized and re-encoded in your browser; the portal stores only the prepared version. PDF and Office documents are not compressed by this feature. A local technical check assesses resolution, possible blur, contrast, brightness and differences introduced by image encoding. The stored advisory report includes dimensions, metrics, reasons and a technical status. Images are not sent to an external AI service for this check. These heuristics may be wrong and do not assess artistic quality or replace BEP visual review; they do not automatically reject a partner or authorise publication.

10. Internal review and recipients

Authorised BEP reviewers can access profiles, saved drafts, submitted offers and documents. Review status, feedback, reviewer ID and time are stored against an offer revision. Edits create a new revision; earlier approvals do not automatically apply. BEP conducts the review; this is not a solely automated decision. Registration or approval does not automatically conclude an agreement or publish material. Other partner accounts have no access. Existing research/outreach records are not automatically linked by email or company name.

Files are stored in a private Supabase bucket with owner/reviewer access. Signed download links last 60 seconds; anyone receiving a valid link can use it until expiry. Expiry does not delete the file or downloaded copies. Internal n8n notifications send company, country, event type and, where applicable, offer title to schmitz@beyondeuropeproperty.com, without document attachments. Queue events, delivery status and SMTP receipts are stored. Authorised technical administrators/providers may have necessary operational access. Later publication or disclosure to cooperation partners requires separate review and agreement; legally required disclosures remain possible.

11. Portal purposes, legal bases and providers

Where the GDPR applies, account administration, requested pre-contractual steps and contract performance rely on Article 6(1)(b) where the individual is a contracting party. For corporate contacts, internal review, access security and notifications, Article 6(1)(f) may apply (legitimate interests in reliable business relationships and secure operations), subject to a documented balancing assessment. Specific statutory retention obligations may rely on Article 6(1)(c). The acknowledgement checkbox supplies neither a legal basis nor advertising consent.

We use Supabase Pte. Ltd. (Singapore) for authentication, database and private file storage. The BEP project is configured in Frankfurt (eu-central-1). Regional storage does not exclude necessary international support, operations or CDN processing. Details: data locations and transfers and Supabase data processing terms, including standard contractual clauses.

Cloudflare, Inc. delivers the website and processes technical connection data; see Cloudflare data processing terms. Internal portal events are processed by self-hosted n8n on a server provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. This portal event processing does not use n8n Cloud. Confirmation, recovery and internal notification emails use Fastmail Pty Limited (Australia), via smtp.fastmail.com. See Fastmail data protection agreement and standard contractual clauses. The portal code loads neither Google Analytics nor Windsor.ai.

The Netcup DPA was concluded electronically on 20 October 2026. The linked processing terms of the other providers describe their contractual safeguards and standard contractual clauses. Information on safeguards applicable to your matter is available at info@beyondeuropeproperty.com. The partner portal currently addresses partner businesses and contacts outside the EU. We do not present an EU representative as appointed. If the intended user group changes, we reassess territorial applicability and any representation requirements.

12. Portal retention and deletion

Accounts, profiles, offers and documents are kept as long as needed for ongoing or specifically contemplated cooperation. On final rejection or termination, we assess outstanding matters and specific legal retention or evidence requirements. Unnecessary data is deleted; required contract/evidence records are restricted to their retention purpose. Incomplete registrations, inactive profiles and drafts are reviewed for continuing necessity during regular inventory reviews. No blanket automatic deletion after a fixed period is configured.

Send deletion requests to info@beyondeuropeproperty.com. After identity and retention checks, we block the relevant account's portal access. Private files, including orphan uploads, are removed through the storage service; portal records and the login account are then deleted. Queues and associated notification references are included. Saving full n8n execution contents is disabled for new internal portal notifications. Previously sent emails, older execution data and exports are reviewed and cleaned separately. The interface currently has no self-deletion feature.

Security logs and backups may remain until the relevant operational storage cycles expire; they are not used for further cooperation. Documented deletions must be reapplied after restoration. A minimal technical block record containing account ID and time may remain to prevent renewed access and accidental restoration. We explain any required retained data or limitations when handling your request. Immediate deletion from every backup is not promised.

13. Rights relating to the portal

Where the GDPR applies, you have rights of access, rectification, erasure, restriction and portability subject to statutory conditions. You may object to legitimate-interest processing on grounds relating to your particular situation. Consent actually given may be withdrawn prospectively at any time. You may complain to a competent supervisory authority, particularly in your habitual residence, workplace or place of an alleged infringement. Contact info@beyondeuropeproperty.com. Requests are normally answered within one month; we will explain any permitted extension and its reasons.

14. Interest portal: personal preferences and enquiries

The interest portal is for individuals seeking information about BEP offers and services. Registration does not commission paid advice. Name, phone number and introductory conversation are optional; communication can initially be entirely in writing. Email and password are required for an account. Saving a request requires at least one topic and acknowledgement of this notice.

We store account ID, email, selected topics and, where provided, name, phone/WhatsApp, preferred countries/regions, country-guidance request, timeframe, requested information, comments, interest in an introductory conversation, property purpose and optional budget range. We also store the privacy-notice version, acknowledgement and processing timestamps. Please do not enter passport numbers, health data or other sensitive information. No document upload is offered.

Before sign-in, clicking save keeps a pending draft only in this browser tab's sessionStorage. It ends when the tab closes; on the next load within that tab, drafts older than 24 hours are discarded. After email confirmation, return to this tab and sign in to save the draft to your account. Access tokens also use sessionStorage. Supabase Auth may store the originating portal as a technical navigation marker for email confirmation or recovery; this marker grants no access rights.

Interest profiles are separate from company profiles in the partner portal. An existing BEP login may be used for both; this does not create partner offers or grant access to another person's data. Authorised BEP reviewers can view requests and maintain a status and feedback visible in the relevant interest account, with timestamps and reviewer ID. Registration does not automatically classify you, commission services, publish your information or disclose your details to external partners. Registration alone does not subscribe you to a newsletter. Interest in a conversation is not a confirmed booking.

We use the information to answer your personal enquiry and prepare requested advice. Where GDPR applies, requested precontractual steps rely on Article 6(1)(b), and security/operational processing on Article 6(1)(f). Acknowledging this notice is not marketing consent. Optional newsletter subscription is separate and requires an explicit choice and any necessary email confirmation.

Authentication and data storage use the Supabase Frankfurt project described above; confirmation/recovery emails use Fastmail and website delivery uses Cloudflare. The provider, international-processing and rights information above applies accordingly. The interest portal loads no analytics or advertising scripts. Calendly opens only after you voluntarily follow the booking link; interest details are not passed in that link. See Calendly's privacy notice. A 30-minute calendar slot is reserved for an introductory conversation of approximately 15 minutes.

You can update your preferences in your account. Send access/deletion requests to info@beyondeuropeproperty.com. We retain enquiries as long as necessary for the requested exchange, outstanding matters or specific required records, and regularly review inactive matters for continuing necessity. Unneeded profiles and feedback are deleted. The limits described above for security logs, email copies and backups also apply. If you use both portals, we distinguish a request to remove a single profile from deletion of the entire login account.

After an enquiry is saved, we commit to a personal initial assessment within 48 hours, independently of newsletter subscription. We store a request ID, receipt time, response deadline and completion. Changes to an open request do not extend its deadline. Authorised BEP reviewers record the personally supplied assessment. Internal n8n notifications tell schmitz@beyondeuropeproperty.com about new requests and remind about unanswered cases after approximately 36 hours; they contain deadlines and a link to the protected overview, not full enquiry text. This does not automatically produce an assessment or send you an answer.

The additional newsletter choice is optional, unchecked by default and not a condition for an answer. It covers country information, property offers and news. When selected, we process the account's verified email, language, consent wording version and selection/withdrawal timestamps. New subscriptions receive a separate confirmation email through the existing newsletter system; no newsletter is sent without any required confirmation. Delivery uses Fastmail and self-hosted n8n. Where applicable, consent under Article 6(1)(a) GDPR is the basis. Consent can be withdrawn prospectively at any time through the unsubscribe link. A preference requested through this portal can also be withdrawn here. Manage subscriptions created elsewhere through the newsletter's unsubscribe link. Your enquiry and response deadline remain unaffected. Deleting the interest profile withdraws the subscription requested through that profile; necessary evidence and suppression records may remain.