Legal
Privacy Policy
Last updated: Sep 30, 2026
1. Controller and contact
PEAK ESTATE d.o.o. is the controller of the personal data described in this policy.
PEAK ESTATE d.o.o., Put Duge Njive II 4, 21212 Kaštela, Croatia. OIB 60476676073. Registered in the Register of Real Estate Brokers at the Croatian Chamber of Economy (HGK) under no. 64/2026. Email: info@peakestate.hr. Phone: +385 97 668 3789.
Data protection enquiries are handled directly by our management. Please write to info@peakestate.hr with the subject line "Privacy".
2. Scope and summary
This policy explains how we process personal data when you visit peakestate.hr, contact us through our website, our advertising on Facebook and Instagram, WhatsApp, email or phone, and when you become a client of our brokerage and advisory services.
In short:
- Enquiries and briefs are read by the founders personally and treated as confidential.
- We do not sell personal data, and we never pass the content of your brief to advertising platforms.
- Analytics and advertising tools (Google Analytics, Meta Pixel) and Google Maps run only if you consent in our cookie banner. You can withdraw that consent at any time.
- As a licensed real estate broker we are legally required to identify our clients and keep certain records, including under anti-money-laundering law.
3. Where your data comes from
Most data comes from you directly: through our website forms (private enquiry, off-market access, corporate enquiry, confidential sale, property information request, property listing), Meta instant forms, WhatsApp, email, phone, meetings and viewings.
Where relevant, we also receive data from:
- Partners who introduce you to us at your request, such as the international Keller Williams network, cooperation and advisory partners, lawyers or other brokers.
- A co-buyer, family member, company or representative acting on your behalf.
- Public registers, such as the land registry, the cadastre, the court register and the register of beneficial owners, to verify ownership and identity as required by law.
- Advertising platforms (Meta), in the form of campaign reports and, where you have consented, measurement data about your interaction with our ads.
- Our website, which collects technical data automatically (section 7).
4. What data we process
| Category | Examples |
|---|---|
| Identity and contact | Name, email, phone, nationality or country of residence, preferred language |
| Enquiry and brief | Budget, locations, purpose, timeframe, property type, free-text notes |
| Property data (sellers) | Address, land registry and cadastral data, documents, photos, price expectations |
| Client due diligence (AML/KYC) | Copy of identity document, date and place of birth, address, OIB or foreign tax number, politically exposed person status, beneficial owners of companies, source of funds and wealth |
| Contract and transaction | Brokerage agreements, viewing confirmations, offers, correspondence, invoices, payment records |
| Company clients | Company name, registration data, representatives and their contact details |
| Communication | Emails, WhatsApp messages, notes of calls and meetings |
| Website and device | IP address, browser, device, pages visited, referring page, time of access |
| Cookies and advertising | Cookie identifiers, ad interactions, conversion events |
We do not ask for special categories of data, such as health data, religious beliefs or political opinions. Please do not include them in your brief.
5. Purposes and legal bases
We process each category of data only for the purposes below, on the legal basis stated next to each.
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to your enquiry and preparing an offer or brokerage agreement | Art. 6(1)(b): steps prior to a contract at your request |
| Providing brokerage and advisory services: viewings, negotiations, coordination with lawyers and notaries | Art. 6(1)(b): performance of a contract |
| International referral within the Keller Williams network, at your request | Art. 6(1)(b): performance of a contract |
| Client identification, risk assessment and reporting under the Croatian Anti-Money Laundering and Terrorist Financing Act | Art. 6(1)(c): legal obligation |
| Record-keeping under the Real Estate Brokerage Act, accounting and tax law | Art. 6(1)(c): legal obligation |
| Following up on your brief with properties and opportunities that match it | Art. 6(1)(f): our legitimate interest in serving clients. You can object at any time. |
| Newsletter and market updates, if you subscribe | Art. 6(1)(a): consent |
| Operating and securing the website, server logs, preventing misuse | Art. 6(1)(f): our legitimate interest in a secure, functioning website |
| Website analytics (Google Analytics) | Art. 6(1)(a): consent |
| Advertising measurement and remarketing (Meta Pixel) | Art. 6(1)(a): consent |
| Interactive maps on property pages (Google Maps) | Art. 6(1)(a): consent |
| Remembering your cookie choice | Art. 6(1)(f): our legitimate interest in not asking again. The choice is stored only in your browser. |
| Establishing, exercising or defending legal claims, including commission claims | Art. 6(1)(f): our legitimate interest in protecting our rights |
6. Do you have to provide your data?
Fields marked as required in our forms are needed to answer your enquiry. Without them we cannot respond.
Before we can act for you as broker, the law requires us to identify you and, for companies, their beneficial owners. If this information is not provided, we must decline or end the business relationship.
All other information is voluntary. Consent to cookies is never a condition for using our website or our services.
7. Website, cookies and consent
Hosting and server logs. Our website is hosted by Vercel (Vercel Inc., USA), acting as our processor. When you visit it, technical data such as IP address, browser, device, pages requested and time of access is processed in server logs to deliver the site and keep it secure (Art. 6(1)(f) GDPR). All data is transmitted over HTTPS.
Consent. Under the Croatian Electronic Communications Act, which implements the EU ePrivacy Directive, cookies and similar technologies that are not strictly necessary may only be used with your consent. On your first visit, our cookie banner lets you accept all, decline all, or choose by purpose (statistics, marketing, maps). Until you accept, analytics tools, advertising tools and Google Maps remain blocked. Legal basis: Art. 6(1)(a) GDPR together with that Act. Strictly necessary cookies are used without consent because the website cannot function without them.
Withdrawal. You can change or withdraw your consent at any time via "Cookie Settings" in the website footer, as easily as you gave it. When you withdraw, the cookies of the tool concerned are deleted from your browser and the tool is stopped. Withdrawal does not affect processing carried out before it.
Consent management. The banner is part of our own website; no third-party consent service is involved. Your choice is stored only in your browser (local storage entry peak_consent_v2), together with its date, and is not transmitted to us. It is kept for 12 months; after that, or when we add a new tool, we ask again.
If you decline. No analytics or advertising scripts are loaded, no such cookies are set, and no data is sent to Google Analytics or Meta.
Cookie list. The cookies used, with provider, purpose and lifetime, are listed in our Cookie Policy. Lifetimes range up to a maximum of 24 months.
8. Analytics and advertising
Every tool in this section runs only after you consent in our cookie banner (section 7).
Google Analytics 4. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to understand how visitors use our website, for example pages viewed, time on site, approximate location, device and traffic source, so that we can improve it. Google Analytics uses pseudonymous identifiers, not your name. It does not log or store IP addresses; it uses them only briefly to derive an approximate location. Google acts as our processor under its data processing terms. We keep analytics data for no longer than 14 months.
Meta Pixel. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We use it to measure the effectiveness of our ads on Facebook and Instagram, to record conversions such as a submitted enquiry, and to show our ads to people who have visited our website or who have similar interests. The pixel processes cookie identifiers, pages visited, events, browser and device data, and your IP address. The content of your brief is never transmitted to Meta.
Joint controllership with Meta. For the collection of this data on our website and its transmission to Meta, we and Meta are joint controllers under Art. 26 GDPR. Our arrangement follows Meta's Controller Addendum. You can exercise your rights against either of us. For all further processing, Meta is the sole controller under its privacy policy. Website audiences on Meta are kept for no longer than 180 days.
9. Meta lead forms, WhatsApp, social media and maps
Meta instant forms. If you respond to one of our ads on Facebook or Instagram through an instant form, you enter your details on Meta's platform. Meta processes this data as its own controller and makes it available to us. From that point we are the controller and use the data to answer your request (Art. 6(1)(b) GDPR). We store leads in Google Workspace (Google Ireland Limited, acting as our processor) and in our CRM.
WhatsApp. If you contact us via WhatsApp Business, the service is provided by WhatsApp Ireland Limited. Messages are end-to-end encrypted, but WhatsApp processes metadata such as your phone number, time and device under its own privacy policy and may share it within the Meta group, including outside the EU. We may ask structured questions to understand your brief. Using WhatsApp is optional; you can always reach us by email or phone instead.
Social media. We maintain profiles on Instagram and LinkedIn. When you interact with them, the platform operators (Meta Platforms Ireland Limited; LinkedIn Ireland Unlimited Company) process your data under their own privacy policies. Where a platform provides us with page statistics, we may be joint controllers with it for that limited processing. We receive these statistics only in aggregated form.
Google Maps. Interactive maps on our property pages are loaded from Google (Google Ireland Limited) only after you accept cookies in our banner. Google may then set cookies and process your IP address under its own privacy policy (Art. 6(1)(a) GDPR). Without consent, a map image stored on our own website is shown instead.
10. Confidentiality and recipients
Briefs and enquiries are read by the founders personally and treated as confidential. Within Peak Estate, access is limited to the founders and authorised staff bound by confidentiality. We do not sell or rent personal data.
We share data only to the extent necessary, and only with:
| Recipient | Purpose |
|---|---|
| Service providers acting as our processors: Vercel (hosting), Google Workspace (email, documents, lead storage), our CRM provider, IT support, accountants | Running our business, under data processing agreements (Art. 28 GDPR) |
| The other party to a transaction (seller, buyer, landlord, tenant) and their broker | Arranging viewings and negotiations, limited to what is needed |
| Lawyers, notaries, tax advisors, surveyors, translators, banks | Where engaged on your instruction or needed to complete the transaction |
| Keller Williams network and cooperation partners | Where you ask for an international referral or introduction, or to confirm an introduction the partner made to us |
| Google and Meta | As described in sections 8 and 9 |
| Authorities and courts | Where required by law, for example the Anti-Money Laundering Office, the Tax Administration, inspection authorities or courts |
11. Transfers outside the EEA
Some providers, in particular Google and Meta, may process data in the United States. Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission. Where a transfer is not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Where you ask us to work with parties outside the EEA, for example your adviser abroad or a Keller Williams office in another country, we transfer the data because it is necessary for the service you requested (Art. 49(1)(b) and (c) GDPR).
12. How long we keep data
We keep data only as long as the purpose requires or the law obliges us to. After that we delete or anonymise it.
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a brokerage relationship | Deleted or anonymised 24 months after last contact |
| AML/KYC due diligence records | 10 years after the end of the business relationship or transaction, as required by the Anti-Money Laundering and Terrorist Financing Act |
| Accounting records and invoices | 11 years, as required by the Accounting Act |
| Brokerage agreements, viewing confirmations, transaction correspondence | Term of the contract plus 5 years; longer while a claim is pending or where the records also serve AML or accounting purposes |
| Newsletter subscription | Until you unsubscribe |
| Cookie choice | Stored in your browser for up to 12 months |
| Server logs | A short period set by our hosting provider for security purposes |
| Google Analytics data | Up to 14 months |
| Advertising audiences | Meta: up to 180 days |
| Cookies | Up to 24 months, as listed in our Cookie Policy |
13. Automated decisions and profiling
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Every brief is reviewed by a person.
With your consent, Meta uses data from our website to build advertising audiences and to decide which ads you see. This is profiling for advertising purposes. You can stop it at any time by withdrawing your consent under "Cookie Settings".
14. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), to object to processing (Art. 21), and to withdraw consent at any time with effect for the future (Art. 7(3)).
To exercise your rights, write to info@peakestate.hr. We respond within one month. For complex requests this period can be extended by two further months, in which case we will tell you why. We may ask you to confirm your identity. Requests are free of charge unless they are manifestly unfounded or excessive.
Some rights are limited by law. We cannot erase data that we must keep under anti-money-laundering or accounting law. Anti-money-laundering law may also prohibit us from telling you whether information has been reported to the authorities.
Your right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. Where we use your data to send you property opportunities or other direct marketing, you can object at any time without giving reasons, and we will stop. Simply write to info@peakestate.hr.
Right to lodge a complaint. You can complain to the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop.hr. You may also complain to the supervisory authority in the EU country where you live or work.
15. Security, data about others and minors
Security. We protect personal data with technical and organisational measures appropriate to the risk. These include encrypted transmission (HTTPS), restricted and password-protected access, confidentiality obligations, and data processing agreements with all processors. No transmission over the internet is completely secure. Please send identity documents only through the channel we indicate to you.
Data about other people. If you give us personal data about others, such as a co-buyer, family member or company representative, please make sure you are entitled to share it and that they are aware of this policy.
Minors. Our services are intended for adults. We do not knowingly collect personal data from persons under 18.
16. Changes and language versions
We update this policy when our services, tools or the law change. The current version, with its date, is always available on this page. Where a change requires your consent, we will ask for it.
This policy may also be provided in Croatian and German. In case of discrepancy, the English version prevails.