Privacy Notice

Controller

The controller for the website and direct account relationship is the company named below. For customer-managed property records, n-Objects may also act as a processor under a separate data processing agreement.

Controller

[LEGAL COMPANY NAME]

Address

[REGISTERED BUSINESS ADDRESS]

Privacy contact

[DATA PROTECTION OFFICER OR PRIVACY CONTACT]

Processed data

• Account and authentication data, including name, company, email address, password authentication metadata, OAuth provider identifiers, session cookies, and password reset events.
• Operational property management data entered by users, including contacts, tenants, owners, suppliers, companies, addresses, contracts, events, tasks, calendar records, meter readings, and uploaded documents.
• Payment reference data stored in the platform, including account holder, IBAN, BIC, SWIFT, validity dates, and related company or contact references.
• Support and notification data, including assignment emails, recipient addresses, event titles, and message delivery metadata.
• AI assistant data, including user prompts, assistant responses, conversation history, action drafts, tool-run metadata, and optional audio files submitted for transcription.
• Technical data, including IP address, browser data, device data, request logs, security logs, language preference, and performance events.

Purposes and legal bases

• Providing the platform, user accounts, authentication, settings, documents, and property management workflows: contract performance or pre-contractual steps.
• Security, abuse prevention, session handling, troubleshooting, and fraud prevention: legitimate interests and legal obligations where applicable.
• Legal, tax, accounting, and compliance records: legal obligations.
• Email notifications and password reset messages: contract performance, legitimate interests, or legal obligations depending on the context.
• Analytics and non-essential performance measurement: consent, where required.
• External maps, third-party media, and similar non-essential integrations: consent or an explicit user request, depending on implementation.
• AI assistant and audio transcription: contract performance for requested assistant features; consent may be required for optional voice recording access in the browser.

Cookies and similar technologies

Strictly necessary cookies and storage are used for authentication, security, language preference, and requested platform functionality. Non-essential analytics, maps, media, or tracking technologies should only load after consent or a deliberate user action.

Recipients and subprocessors

• Supabase for authentication and document storage.
• Vercel and database hosting providers for application hosting, logs, deployment, analytics, and database infrastructure.
• Resend for transactional emails.
• OpenAI for AI assistant responses and audio transcription when those features are used.
• Google and Microsoft for OAuth login when selected by the user.
• Google Maps for map embeds when loaded by the user or after consent.
• OpenStreetMap Nominatim for address search requests.

International transfers

Some subprocessors may process data outside Germany or the European Economic Area. Where required, n-Objects relies on adequacy decisions, EU Standard Contractual Clauses, data processing agreements, supplementary safeguards, or another valid transfer mechanism.

Retention

Personal data is kept only as long as needed for the relevant purpose, contractual relationship, statutory retention obligation, dispute handling, security, backup, or legitimate operational need. Customer-controlled operational records are deleted or returned according to the customer agreement and the data processing agreement.

Your rights

Depending on the circumstances, data subjects may request access, rectification, erasure, restriction, portability, and objection to processing. Consent can be withdrawn with future effect. Complaints may be lodged with a competent data protection authority.

Supervisory authority

[COMPETENT DATA PROTECTION AUTHORITY]