Privacy Policy
Property Workshop is a directory for finding property professionals, publishing professional profiles and forwarding quote requests. This notice explains how we process personal data relating to visitors, registered professionals and people requesting quotes.
1. Data controller and contact
Controller: Burjob LLC (Delaware, USA). Registered address: 8 The Green, Suite A, Dover, DE 19901, USA. Registration number: 3220296. Email: support@propertyworkshop.eu. Website: https://propertyworkshop.eu. Send privacy questions and requests to this email address.
The contact form processes your name, reply address and message to answer your enquiry. Messages are forwarded to the platform's contact mailbox and are not stored in a separate application database. General enquiries are processed on the basis of our legitimate interest in answering them; pre-contractual enquiries may be processed under Article 6(1)(b) GDPR. Mailbox retention is governed by separate email rules. Security checks and sending limits protect the form.
2. Registration and user accounts
Registration involves your email address, password held by the authentication service, account identifier, authentication status and any marketing choice and its timestamp.
We process these details to create and operate your account, sign you in, identify you, provide the service and send account notifications. The legal basis is performance of a contract or steps taken at your request before entering into a contract under Article 6(1)(b) GDPR.
An account cannot be created without the required registration details. Your sign-in email address does not automatically become public.
3. Professional profiles and public display
Profiles contain the name, company name, biography, profile photograph or logo, professions, services and prices, service areas, languages, contact details, social links, portfolio images and custom profile address that you provide.
We use these details to present professionals, make them searchable and facilitate direct contact, under Article 6(1)(b) GDPR.
An approved profile's professional information is public. Phone numbers, contact email addresses, websites, WhatsApp details and social links are displayed according to the professional's visibility choices.
Search engines may index public profiles. Changes or deletions on the platform may appear later in search results and cached copies.
Professionals may upload only images and portfolio material they are entitled to publish and that do not infringe other people's rights.
4. Profile approval, verification and reports
Profile moderation and abuse handling involve profile status, verification requests, supporting information, relevant dates, administrator notes and the reasons and content of profile reports.
We process these details to maintain reliability, enforce publication rules and investigate abuse. The legal basis is our legitimate interest under Article 6(1)(f) GDPR.
Approval and verification are administrative decisions. Review and report information is not part of the public profile; publication status and an awarded verification badge may appear on the profile.
5. Quote requests
Quote requests contain the name, email address, phone number, requested service, location, message, preferred contact method, recipient profile identifier and submission time provided by the requester.
We process these details to forward and make available the quote request you asked us to send. The legal basis for the platform's quote-request service is Article 6(1)(b) GDPR.
The selected professional receives the request by email and in their account. Authorised administrators may access it as necessary for administration and troubleshooting.
The receiving professional is independently responsible as controller for their own processing of received information. A quote request is not marketing consent.
Provide only information necessary for contact. Do not include special-category personal data in your message.
6. Usage measurement
With analytics consent, our own event measurement records profile views, QR visits and clicks on phone, email, website, WhatsApp and social links.
Events may include the viewed profile identifier, event time, traffic source and campaign parameters. Browser analytics events do not store a visitor account identifier or raw IP address in the event table.
The purpose is to measure platform use and professional-profile reach. The legal basis is consent under Article 6(1)(a) GDPR, which you can withdraw in cookie settings.
Operational records needed to fulfil quote requests are processed separately from analytics consent.
7. Cookies and browser storage
The platform uses Supabase session data required for sign-in and email authentication to provide the authentication service you request.
Cookie choices are stored locally under iw-cookie-consent and may remain until you clear browser data.
After analytics consent, sessionStorage entries starting with view- help avoid counting repeated views multiple times within the same browser-tab session.
Supabase authentication cookies are generally named sb-…-auth-token or split variants of that name. The SDK's default cookie expiry is 400 days and may be refreshed. This is separate from an access token's validity period.
You can clear cookies and browser storage in your browser settings. Blocking essential authentication data may prevent sign-in.
8. Security and automated-traffic checks
For abuse prevention, we process a technical identifier derived from an IP address using a secret key. This is pseudonymised personal data.
Quote, contact and profile-report processes use Cloudflare Turnstile. The provider may process network and browser data needed for security checks.
The legal basis is our legitimate interest in protecting the system, users and service under Article 6(1)(f) GDPR.
9. Providers and data transfers
Supabase Pte. Ltd. provides the database, authentication and image storage; the selected primary storage region is Ireland. Vercel Inc. provides the web application, server functions, content delivery and operational logs. Websupport provides domain-related services. Purelymail provides email services. Cloudflare, Inc. provides Turnstile security checks.
To send notifications, the application passes the recipient, subject and message content to the email provider.
Selecting an EU hosting or storage region does not mean that every provider's background operations occur exclusively in the EU. Global content delivery, support or operations may involve processing outside the EU/EEA.
The conditions and safeguards for such transfers must be provided under the applicable provider agreements. Contact the controller for information about applicable safeguards.
We disclose personal data to authorities where required by law or in response to a lawful request.
10. Retention and deletion
| Data category | Retention period |
|---|---|
| User account, professional profile and associated images | For the lifetime of the account |
| Quote requests and associated messages | 180 days after receipt |
| Analytics events | 90 days after recording |
| Application copies of sent notification emails | 30 days after successful delivery |
| Failed email queue records | 30 days after creation |
| Closed profile reports and verification requests | 180 days after closure |
| Administrator operation logs | One year after recording |
| IP-derived abuse-prevention identifiers | 48 hours from the start of the relevant time window |
The daily deletion process removes affected records after the applicable retention period expires.
Account deletion removes the account, professional profile, related images and associated records due for deletion. Failed image deletions are retried.
Where a legal obligation or specific legal claim requires it, necessary information may be retained separately and only for as long as required for that purpose.
The platform cannot delete emails already delivered to a professional's mailbox. The recipient controls their further processing.
Provider backups and operational logs have separate retention rules; deletion from the application does not mean immediate deletion from every backup or log.
11. Marketing
We record your marketing choice and its timestamp. Marketing consent is not a condition of using the service.
Electronic marketing may be sent on the basis of consent. You can withdraw consent at any time by contacting support@propertyworkshop.eu or using the unsubscribe option supplied in a message.
12. Automated operation
The system may calculate profile completeness and search order automatically. Profile approval and verification are administered under the platform's moderation rules.
The platform does not use solely automated decision-making that produces legal effects or similarly significantly affects a person.
13. Your rights
Subject to the GDPR's conditions, you may request access to and a copy of your personal data, rectification of inaccurate data, erasure, restriction of processing and data portability.
You may object to processing based on legitimate interests and withdraw consent at any time. Withdrawal does not affect the lawfulness of earlier processing.
Send requests to support@propertyworkshop.eu. Where justified, we may ask you to verify your identity.
We generally respond within one month. Complex or numerous requests may require up to two additional months; we will notify you within the first month.
14. Complaints and remedies
You may complain to the Hungarian National Authority for Data Protection and Freedom of Information or seek a judicial remedy.
Nemzeti Adatvédelmi és Információszabadság Hatóság: 1055 Budapest, Falk Miksa utca 9–11, Hungary. Postal address: 1363 Budapest, Pf. 9. Website: https://www.naih.hu. Electronic case submission: https://www.naih.hu/online-ugyinditas.
15. Updates to this notice
We update this notice when the service or its processing changes. The current version is available on the website.
Document version: 24 October 2026.