Data controller
The controller of your personal data is ΠΕΡΣΗΣ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΕΙΑ (ΠΕΡΣΗΣ Ι.Κ.Ε. — PERSIS P.C.), VAT No. 800882264, Rhodes Tax Office, registered office at Georgiou Seferi 108, Rhodes, 85100, Greece, GEMI (Companies Registry) No. 143888520000, which operates the home.gr platform.
Contact for personal data matters: privacy@home.gr.
We have not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR are not met. Your requests are answered directly by the controller.
What data we process
Account data
Full name, email address, password in encrypted form (a hash — never stored in readable form), optionally a phone number, registration date and email verification status.
Alerts without an account
If you ask for alerts about new listings without creating an account, we keep your email address and the search criteria — nothing else. How long we keep them, on which basis and how they are erased: section 12.
Listing details
For owners: the area and address of the property, floor area, storey, number of rooms, furnishings, price and what it includes, availability, description and the photos you upload. Some of these are public by definition — that is the purpose of a listing.
Messages
The content and metadata (sender, recipient, time) of the messages you exchange with other users inside the platform, and the contact requests you send.
Reports and blocks
When you report a listing, a user or a message, we keep who made the report, what it concerns, the reason you picked, your optional comment, its status and the reasoning on which it was closed. When you block a user, we keep who blocked whom, when, and the optional reason.
This information is visible only to you and to the person reviewing the report. We do not disclose who submitted a report to the person it concerns, and there is no list anywhere of who has blocked someone. See also section 09 of the terms of use.
Signing in with Google or Apple
You can sign in with a Google or Apple account instead of a password. In both cases we never see your password: the provider identifies you and returns a signed token to us.
From Google we request three fields only — openid, email, profile — and receive: your permanent Google identifier, your email address and whether it is verified, your display name and the address of your profile picture. We do not request and do not obtain access to Gmail, Contacts, Drive, Calendar or any other Google service.
From Sign in with Apple we receive the identifier Apple generates and an email address — either your real one or an anonymous relay, as you choose. Apple provides your name only the first time you approve the sign-in. Nothing else from your Apple account.
What we do with them: we keep the provider’s identifier so we can recognise you at your next sign-in. The email becomes your account email — and if the provider certifies that it is verified, it links you to an existing account with the same email instead of creating a duplicate. The name pre-fills your profile. This data is used solely for identifying you and for your account: we do not sell it, do not pass it to advertising networks or data brokers, and do not use it for advertising, targeting or training models.
They are deleted together with your account. You can also revoke access at any time from your account settings at Google or Apple — that stops future sign-ins; it does not by itself delete your home.gr account.
Technical data and logs
IP address, browser type and version, operating system, date and time of the request, referring page and application errors. This data is generated automatically by the infrastructure and is necessary for operation and security.
Contacting us
Whatever you send us by email — message content, contact details and any attachments.
iOS app
The app requests three permissions, and only when you press the corresponding button — never on launch:
- Location (while using the app only): exclusively when you press “My location” while listing a property, so the point can be placed on the map. Your position is not recorded in the background and the exact point is never published: the public sees only a circle of 150–1,200 metres around a shifted position.
- Camera: only when you choose “Take a photo now” for a listing photo.
- Photos and Files: when you pick images for your listing. The app does not scan your library — the iOS picker runs separately and gives us only what you selected.
If you turn on notifications, we store the device token, the platform and a device name, so we know where to send them. It is erased when you turn them off or delete your account.
The app contains no advertising networks, does not track your activity across other apps or websites, and does not share data with data brokers.
Usage measurement
We keep our own, first-party measurements of what works on the platform. The IP address is not stored in the measurements: we keep only a cryptographic digest (SHA-256) with a secret that changes every day, and we delete it after 38 days. We do not consider it anonymous: it is pseudonymised data, which is why we keep it briefly and give it to no one. We do not use Google Analytics or any other third-party tool.
First, what we do not do: the measurement sets no cookie, gives you no visitor identifier and does not follow you across other websites. No data goes to any third party — the events go only to our own database. On an ordinary visit we write nothing to your device: the counter reads only the language you chose and the two opt-out switches.
What we measure: which page you opened and how far down you scrolled it, which external link you clicked, which search you ran and how many results it returned, which listing you viewed, which step of the listing form you reached, and the milestones of your account (sign-up, sign-in, booking request, message). A search sends the area from the closed list of areas — never what you typed.
What each row keeps: the event name, the time, the page address without the query string, the name of the website you came from, device type, operating system and browser as derived values — never the full user-agent —, screen width, country, language, and the digest of the IP. Whatever the page itself sends passes through a closed list of fields: anything not declared there is discarded before it is stored.
If you are signed in, the row also keeps your account number. That means the measurement is linked to you for as long as it lives. It does not come from a cookie set by the counter — it comes from the same sign-in token that keeps you logged in.
Why we keep them: to know which pages work, where listing a property stalls, and what breaks on which device. Legal basis: legitimate interests — Article 6(1)(f). You may object at any time (section 07). If your browser sends Do Not Track, no measurement leaves your device.
How long they live: up to 26 months. Measurements are stored in monthly files, and on the 1st of each month the entire file that has passed 25 months is deleted — see section 06. After that only daily totals remain: counts per page, device and country, with no IP digest and no account number.
Campaign measurement — only if you agree
First, what we do not do: without your “I agree” we do not store the campaign details in the link that brought you here. We send campaign details to no one — not Google, not Meta, not anyone else — for advertising measurement. We do not keep the Google click identifier (gclid). If you decline, you use home.gr without any restriction.
A link to one of our campaigns may contain campaign details: source, medium, campaign name, content or keyword (utm). Not every link has them. We keep no other identifiers from the link.
If you agree, we store on your device, for 30 days from your arrival through the campaign link, whichever of these are present, for the most recent campaign you arrived from. A newer campaign replaces an older one. Neither a direct visit nor signing in renews the 30 days. If you create an account during that period, we store them with your account. When you create a listing, we copy your account’s campaign details to it.
If your device holds campaign details from before 13/09/2026, 15:38, we delete them the next time you open one of our pages, before they are read or sent.
If you do not agree, or close the window without choosing, we store nothing from the campaign.
Why: to know which campaigns lead to sign-ups and listings, and not to pay for those that don’t.
Legal basis: your consent — Article 6(1)(a) GDPR. For storage on your device, also Article 4(5) of Law 3471/2006.
How long they live: on your device, 30 days from your arrival through the campaign link. With your account, at most 12 months from sign-up. With a listing, at most 12 months from its creation. Edits and republishing do not renew that limit. After that they are deleted. They are also deleted when you delete your account.
Your consent lasts 6 months from the last time you pressed “I agree”. If it expires without you agreeing again, we stop and delete, without undue delay, the campaign details that relied only on it. If you agree again, what was deleted does not come back and the 12 months do not restart.
You can withdraw your consent at any time through “Consent settings”. We will then stop collecting and using your data for campaign measurement and delete the campaign details stored on your device. Personal campaign attribution data retained solely on the basis of that consent will be deleted without undue delay.
Who receives them: no one, for advertising measurement. They are stored only with our infrastructure providers, on our behalf (section 04).
The campaign details we had collected before measurement was paused on 13/09/2026 at 15:38 (Greece time) — with accounts, listings and usage measurements — were deleted from our active database on 14/09/2026 at 00:47 (Greece time), together with every Google click identifier (gclid). We kept only three total counts for the period 08–09/2026, until 14/09/2027, with no account number, address or other identifier: how many accounts had details of one Google campaign, how many had details from all other sources combined, and how many of them created listings with campaign details. The counts are of accounts, not people; the third is part of the first two.
We store your choice about campaign measurement, when you made it and the version of the notice shown to you. Your choice is stored on your device and, if you are signed in, is also recorded with your account.
Your choice applies for 6 months from when you made it; neither a visit nor signing in renews it. After that we ask you again, the next time you arrive through a campaign link. If you are not signed in, your choice stays only on your device: we keep no list of the people who declined. If you sign up within 30 days of your choice, the choice on your device is also recorded with your new account.
If you are signed in when you answer, we keep a record of your answer with your account: the purpose, your answer (agree or do not agree) and when you gave it, the text and version of the notice you saw, the language, the version of this policy and your internal account number. A withdrawal is recorded as a new “do not agree” entry; earlier entries are not changed. The record contains no campaign details.
Each record relating to a period of consent expires 24 months after that consent ends — by withdrawal or by expiry. The expiry date is set once; neither renewed consent nor signing in moves it. A refusal with no earlier acceptance expires 6 months after it was made. The same applies to an acceptance during which no campaign details were linked to your account or listings. If you delete your account, the current consent period closes and the record’s retention runs from then; deadlines already set are not extended. After deletion, the record remains with the internal number, which is pseudonymised data, not anonymous data.
Why: if anyone disputes that details were linked with your consent — you, the Data Protection Authority or a court — it is the only thing that shows the link had a basis. It does not appear on any screen or report used by our team, and it is not used for measurement or advertising. Legal basis: legitimate interests — Article 6(1)(f) GDPR, for the establishment, exercise or defence of legal claims.
We neither seek nor request special categories of data (Article 9 GDPR). Please do not include such information in listings or messages.
Minors
The service is intended for adults and the terms of use require you to be 18. We do not address children and do not knowingly collect their data.
For the record: under Law 4624/2019 (Article 21), processing a minor’s data on the basis of consent is lawful in Greece from the age of 15; below that, the consent of the holder of parental responsibility is required. If we identify an account belonging to a minor, we delete it.
Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account | Account data | Performance of a contract — Article 6(1)(b) |
| Publishing and displaying listings | Listing details, photos | Performance of a contract — Article 6(1)(b) |
| Communication between users | Messages, account details | Performance of a contract — Article 6(1)(b) |
| Security, prevention of fraud, abuse and spam | Technical logs, metadata | Legitimate interests — Article 6(1)(f) |
| Reviewing reports and protecting users | Reports, the reported content, account details | Legitimate interests — Article 6(1)(f) |
| Blocking communication at your instruction | The pair of accounts, time, optional reason | Performance of a contract — Article 6(1)(b) |
| Improving and stabilising the service | Technical logs, application errors | Legitimate interests — Article 6(1)(f) |
| Our own measurements of platform usage | Usage events, page without the query string, device, country, language, IP digest; account number when you are signed in | Legitimate interests — Article 6(1)(f) |
| Measuring our campaigns | Campaign details (utm), with your account and listings | Consent — Article 6(1)(a) (revocable at any time) |
| Proof of consent choices | Answer, time, text and version of the notice, language, policy version, account number | Legitimate interests — Article 6(1)(f) (establishment, exercise or defence of legal claims) |
| Proof that we told you about changes to the texts | Version of the texts, channel (email or notice), time, account number | Legitimate interests — Article 6(1)(f) (to show that we gave the notice described in section 11) |
| Responding to support requests | Contact details, message content | Legitimate interests or performance of a contract |
| Newsletter emails about platform news | Email, name | Consent — Article 6(1)(a) (revocable at any time) |
| Alerts about new listings without an account | Email address, search criteria | Consent — Article 6(1)(a) (revocable at any time) |
| Meeting tax and accounting obligations | Invoicing details for optional services | Legal obligation — Article 6(1)(c) |
Where processing is based on our legitimate interests, we have balanced those interests against your rights and freedoms. You can ask for the relevant documentation and exercise your right to object.
Recipients and processors
We do not sell or rent personal data. Your data is made accessible only to the recipients below, to the extent necessary for the platform to work:
| Recipient | Role | Location |
|---|---|---|
| Neon | Database hosting | European Union |
| Amazon Web Services (S3) | Storage of listing photos | Frankfurt, Germany (EU) |
| Resend | Sending transactional email (verification, notifications) | See section 5 |
| MapTiler | Displaying maps and geocoding areas | Europe |
Other users: when you publish a listing or send a message, the relevant details become visible to their recipients. This is inherent in how the platform works.
Public authorities: only where there is a legal obligation or a lawful request.
A contract under Article 28 GDPR has been or will be concluded with every processor before the platform goes into production. We do not use third-party analytics tools or user-profiling tools, and our pages load no advertising networks or pixels. We advertise on Google and Meta, but we give them no data to measure the ads. When you agree to campaign measurement, we keep the campaign details with our infrastructure providers, not with Google or Meta (section 02). We keep our usage measurements ourselves, in our own database. If any of this changes, this policy will be updated before it is switched on.
International transfers
We aim to keep your data within the European Economic Area. The database and the photos are hosted on infrastructure inside the EU.
Some providers may process limited data (e.g. email addresses for message delivery) outside the EEA, or may have support functions outside the EEA. In those cases the transfer relies on an adequacy decision of the European Commission or on Standard Contractual Clauses (SCCs), with appropriate supplementary measures.
You can request a copy of those safeguards at privacy@home.gr.
Retention periods
We keep data only for as long as is needed for the purposes for which it was collected:
| Category | Retention |
|---|---|
| Account data | For as long as the account is active; deleted within 30 days of a deletion request |
| Listings and photos | For as long as they are published; up to 12 months after withdrawal, so you can restore them |
| Messages | Up to 24 months from the last exchange |
| Reports | Up to 24 months from their closure — needed so a repeated incident can be recognised as such |
| Blocks | For as long as they are in force; deleted as soon as you lift them |
| Alerts without an account | 12 months from sign-up; before that period ends a final email goes out, and clicking the link renews the subscription. Unsubscribing erases the record immediately |
| Technical logs | Up to 12 months |
| Usage measurements | Up to 26 months — the IP digest is deleted after 38 days; monthly files, and on the 1st of each month the entire file that has passed 25 months is deleted. After that only daily totals remain, with no IP digest and no account number |
| Campaign details from before 13/09/2026, 15:38 | Deleted from the active database on 14/09/2026 at 00:47 (Greece time). Only three total counts of accounts for 08–09/2026 remain, with no identifier, until 14/09/2027 |
| Campaign details on your device | 30 days from your arrival through the campaign link, only with consent; deleted when you withdraw |
| Campaign details with account and listings | At most 12 months (account: from sign-up · listing: from its creation). Sooner, without undue delay, if you withdraw or your consent expires without a new agreement, or if you delete your account |
| Consent choice on your device | 6 months from the choice; neither a visit nor signing in renews it |
| Record of your answer with your account | 24 months after the consent it relates to ends — by withdrawal or expiry; the date does not move. A refusal with no earlier acceptance, or an acceptance with no linked details: 6 months from the choice. When you delete your account, the current consent period closes; deadlines already set are not extended. |
| Notices about changes to our terms and policies | Which version of the texts we emailed you or showed you in your account, and when. 12 months from sending or display; signing in does not renew them. After that it is deleted automatically. |
| Backups | Database change history for instant restore: 1 day. |
| Invoices for optional services | As long as tax legislation requires |
Once those periods end, the data is deleted as the table sets out. Total counts, with no account number or other identifier, remain only in the two cases the table expressly describes: the daily totals of usage measurement and the three campaign-origin counts, until 14/09/2027.
Your rights
Under the General Data Protection Regulation (EU) 2016/679, you have the following rights:
- Access — to find out which of your data we process and to receive a copy.
- Rectification — to have inaccurate data corrected or incomplete data completed.
- Erasure (“the right to be forgotten”) — to have your data deleted, where no ground for retention applies.
- Restriction of processing in specific circumstances.
- Portability — to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
- Objection (Article 21 GDPR) — to object to processing based on our legitimate interests, such as usage measurement.
- Withdrawal of consent — where processing rests on consent, you can withdraw it at any time, without affecting the lawfulness of processing before the withdrawal. For campaign measurement, you withdraw it through “Consent settings”, which you find on every page.
How you exercise them
Send an email to privacy@home.gr from the address registered on your account. We reply without undue delay and at the latest within one month; that period may be extended by a further two months for complex requests, and we will tell you if it is.
If you have no account — you only gave your address for alerts about new listings — send from the address you declared there. See section 12.
Where there are reasonable doubts about your identity, we may ask for additional verification. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
Right to lodge a complaint
If you consider that the processing of your data infringes the law, you have the right to lodge a complaint with the supervisory authority:
Hellenic Data Protection Authority
1-3 Kifisias Avenue, 115 23 Athens, Greece
Website: www.dpa.gr
We would be glad, though, if you contacted us first — most of the time the matter is resolved straight away.
Security
We apply appropriate technical and organisational measures to protect your data:
- Encrypted data transmission over HTTPS/TLS across the whole platform.
- Passwords stored exclusively as cryptographic hashes — never in readable form.
- Restricted access to the data, only for those who need it to run the service.
- Database change history for instant restore (1 day) and separation of development and production environments.
- Choosing infrastructure providers that operate within the EU.
No method of transmission or storage is completely secure. In the event of a breach posing a high risk to your rights, we will inform you and notify the Authority, as Articles 33 and 34 GDPR require.
We hold no third-party security certifications, and we do not claim to.
Cookies and local storage
The platform uses a minimal set of strictly necessary cookies. It also stores data on your device — your language, your display preferences and, if you are listing a property, the draft of the form together with the exact address you typed. For campaign details we ask for your consent first — see “Campaign measurement” in section 02. We use no third-party cookies and no third-party analytics tools. Our own measurements use no cookies — see section 02.
The full list — every key, what it holds, how long it lives and whether it is personal data — is in section 03 of the Cookie policy.
Changes to this policy
We may update this policy when the platform’s features, our providers or the legal framework change. The date of the last update is shown at the top of the page.
For material changes we will notify registered users by email or by a notification within the platform.
Alerts about new listings without an account
You can ask for alerts about new listings without an account: you type your address inside the search and that is it. No sign-in is needed.
First, what we do not do: we do not ask for your name, we do not create an account for you, and we send you nothing else — no platform news, no offers. Only listings that match this search.
Purpose: to notify you of new listings that match the criteria you gave.
What we keep: your email address and the search criteria — area, price, length of stay and whatever else you picked.
Legal basis: your consent — Article 6(1)(a). You give it by typing your address yourself. You can withdraw it at any time, without affecting the lawfulness of what was done before the withdrawal.
How long it lasts: 12 months from the day you signed up. Before that period is up, a final email goes out asking whether you still want it — and if you click the link, the subscription is renewed from the start. If you do nothing, it is erased. The emails we send do not reset the clock; only a click of yours does.
Unsubscribing erases the whole record — your address and the criteria together. Nothing stays behind, “switched off”, in a list of ours. The link is inside every email you receive; one click is enough, with no sign-in.
We send no confirmation message when an address is registered. The first email that arrives is the first alert — and it carries the erasure link inside it.
For internal statistical purposes we record a pseudonymised (cryptographically hashed) fingerprint of the IP address. That fingerprint is not linked to your email and is kept in our aggregate statistics even after you unsubscribe.
It is the same measurement described in section 02, with the periods of section 06.
Your rights, without an account
You have every right listed in section 07. You exercise them by sending an email to privacy@home.gr from the address you declared: it is the only thing linking the subscription to you, and it is enough (Articles 11 and 12(2) GDPR). Where there are reasonable doubts that the address is yours, we may ask for additional information (Article 12(6)).
For erasure you do not even need that: the link inside the email erases it immediately.
The controller is ΠΕΡΣΗΣ Ι.Κ.Ε. (PERSIS P.C.) — full details in section 01. Recipients and transfers: sections 04 and 05. If you believe something was not done properly, you have the right to lodge a complaint with the Hellenic Data Protection Authority — section 08.
What you’re interested in on home.gr
If you like, you can tell us whether you’re looking for a home, want to list a property, or both. This is optional.
We only save your choice if you tap “Confirm” or “Save”. Opening a link or seeing a choice preselected does not save anything.
We keep it in your account so you can see and change it. It doesn’t change what you can do on home.gr. It doesn’t affect publishing listings or your professional declaration. We don’t use it for ads or to send you other emails.
We save your choice with your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with “Remove choice” in your account. Your choice is deleted when you remove it or delete your account. Withdrawing consent doesn’t affect the lawfulness of processing carried out before the withdrawal.
We also keep a short record of when you confirmed, changed or removed your choice and which version of this notice you saw, together with the internal number that links it to this consent. We do not retain your entire account for this purpose. We need it to be able to show that your choice was saved with your consent, if this is ever disputed. After you remove your choice or delete your account, we keep it on the basis of our legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f) GDPR), not on the basis of the consent you withdrew. We delete it automatically 24 months after you remove your choice or delete your account, whichever happens first; deleting your account later does not extend this period. If there is a specific complaint or legal dispute, we may retain only the necessary information for as long as needed for that case, with documented reasons and periodic review. Access to this record is limited to the authorised people who handle data protection matters and legal claims. It is not used for any other purpose.
You can exercise your right of access or object to our keeping this record by writing to privacy@home.gr. We will consider your request in line with the conditions set out in the GDPR.
To store your choice, we use the infrastructure providers listed in section 04, who process the data on our behalf. Information about transfers and security measures is in the relevant sections of this policy.