Skip to main content

    Legal information

    Privacy policy

    EIRES Real Estate is committed to full transparency on the identity of the publisher, the processing of personal data and the use of cookies. This page consolidates the legal disclosures required by Luxembourg law and by the European GDPR.

    Legal notice

    Site publisher

    Company name
    EIRES Real Estate S.à r.l.
    Legal form
    Private limited liability company (S.à r.l.)
    Registered office
    44, Rue de Hunsdorf — L-7324 Mullendorf
    Legal representative
    Michael Eires
    Luxembourg trade register
    B237302 — public register
    Intra-EU VAT number
    LU31482128
    Phone
    +352 28 13 83-1
    Email
    contact@eires.lu

    Editorial director

    Pursuant to article 5 of the amended Luxembourg law of 14 August 2000 on electronic commerce, the editorial director of eires.lu is Michael Eires, manager of EIRES Real Estate S.à r.l., reachable at contact@eires.lu.

    Regulated activity — real estate agent

    EIRES Real Estate S.à r.l. carries out the activity of real estate agent within the meaning of the Luxembourg law of 2 September 2011 governing access to the professions of real estate agent, property administrator, condominium trustee and real estate developer. The company holds establishment authorisation no. 10107455 / 1 issued by the Ministry of the Economy of the Grand Duchy of Luxembourg — under Luxembourg law this document is the official title to practise the profession (the local equivalent of a professional card). EIRES Real Estate is also an Approved Member of the Fédération Immobilière du Luxembourg (FIL), of which its founder Michael Eires serves as President.

    Professional indemnity insurance

    In accordance with the requirements of the Grand Ducal regulation of 21 December 2011 implementing the law of 2 September 2011, EIRES Real Estate S.à r.l. holds a professional indemnity and operating liability insurance policy underwritten by Foyer Assurances S.A. (12, rue Léon Laval, L-3372 Leudelange, Luxembourg), under policy no. 20519345. Cover: €2,500,000 per claim and per insurance year for Professional Liability, and €2,500,000 per event for Operating Liability. Territorial scope: Grand Duchy of Luxembourg. A current certificate is provided on request to contact@eires.lu.

    Valuation fees

    The online valuation offered on eires.lu is free and without commitment. The on-site valuation, carried out by an advisor at the client's home or at the property, is complimentary when a sales mandate is signed at the end of the meeting. Failing the signature of a mandate, the visit and on-site appraisal service are billed on quotation, communicated to the client prior to the intervention. This pricing is restated in the order form provided before any visit not covered by a mandate.

    Anti-money laundering & counter-terrorism financing (AML/CTF)

    EIRES Real Estate S.à r.l. is a regulated obliged entity for the purposes of anti-money laundering and counter-terrorism financing under the amended Luxembourg law of 12 November 2004, as amended by the law of 13 February 2018, and is supervised on that basis by the Administration de l'Enregistrement, des Domaines et de la TVA (AED). Accordingly, EIRES Real Estate applies customer due diligence measures (identification of the principal, of the beneficial owner and of the source of funds) for every real estate transaction, in line with applicable regulations.

    Hosting

    eires.lu is delivered through a content delivery network (CDN) operated by Cloudflare, Inc. — 101 Townsend Street, San Francisco, CA 94107, USA — phone +1 (888) 993-5273. The backend API (database, authentication, server functions) is operated by Supabase Inc. in Amazon Web Services data centres located in the European Union (Frankfurt region, eu-central-1).

    All content on this site (texts, images, photographs, videos, graphics, logos, trademarks, database) is the exclusive property of EIRES Real Estate S.à r.l. or of its partners. Any reproduction, representation, modification, publication or adaptation, in whole or in part, is prohibited without prior written authorisation.

    Consumer dispute mediation

    In accordance with the Luxembourg law of 17 February 2016 transposing directive 2013/11/EU on alternative dispute resolution for consumer disputes, the client may refer the matter to the National Consumer Mediation Service (mediateurconsommation.lu) or to the European online platform (consumer-redress.ec.europa.eu/index_fr).

    Cookie policy

    In accordance with the amended Luxembourg law of 30 May 2005 on the protection of privacy in the electronic communications sector and with the GDPR, eires.lu uses a deliberately limited number of measurement tools and never sets a non-essential cookie or identifier before your explicit consent. The list below is exhaustive and is updated whenever the technical configuration of the site changes.

    Strictly necessary cookies (no consent required)

    • Language preference (FR / EN / DE) — duration 12 months.
    • Authenticated session for the private / VIP area (Supabase Auth, httpOnly JWT) — session duration.
    • Cookie banner choice (accept/refuse memory) — duration 12 months, localStorage.

    Anonymous audience measurement (no third-party cookie)

    • Plausible Analytics — cookieless audience measurement, hosted in the EU, aggregated and anonymised. No user identifier, no third-party sharing. Loaded unconditionally (legal basis: legitimate interest, art. 6.1.f GDPR).

    Tools subject to your explicit consent

    • Google Analytics 4 (property G-H5EQR7VNYC, operated by Google Ireland Ltd.) — audience measurement (page views, referral source, device). The script loads as soon as you arrive on the site, with Google's Consent Mode defaulted to "denied": until you accept, no cookie or persistent identifier is set, but anonymised measurement requests (page view, referrer, user agent, no identifier) are sent to Google for aggregate statistical modelling. A first-party measurement cookie (maximum duration 13 months) is only set after explicit acceptance.
    • Google Tag Manager (container GTM-MBLDL9C2, operated by Google Ireland Ltd.) — technical loader enabling the conditional firing of other measurement or marketing tags. No advertising tag is currently active. Cookies are dropped only after acceptance. Maximum duration 13 months.
    • PostHog (product analytics) — anonymised analysis of journeys and feature usage statistics (Property Matcher, property pages, VIP area). 1st-party ph_* cookie + localStorage entry dropped only after acceptance. Duration 12 months. EU hosting. Can be revoked at any time via the cookie banner.
    • Supabase Realtime / Edge Functions (Cloud) — backend service powering live features (portfolio KPIs, VIP visit tracking, live-pulse statistics). No third-party cookie is dropped. Processing is strictly necessary for the dynamic features to operate. EU hosting.

    Managing your consent

    The cookie banner lets you refuse or accept non-essential tools with strictly equivalent visual weight (Refuse and Accept are presented with equivalent emphasis). You may withdraw or change your consent at any time via the "Manage cookies" link in the site footer, or by clearing cookies in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

    Privacy policy (GDPR)

    Data controller

    EIRES Real Estate S.à r.l., represented by Michael Eires.
    Contact: contact@eires.lu — +352 28 13 83-1

    Data collected, purposes and legal bases

    • Valuation form: identity, contact details, property address, characteristics, optional photos. Purpose: produce the value statement, qualify the request, get in touch. Legal basis: pre-contractual measures (art. 6.1.b GDPR) and legitimate interest in qualified follow-up (art. 6.1.f GDPR).
    • Contact form / appointment booking: name, email, phone, message, time slots. Purpose: respond to the request, schedule a meeting. Legal basis: pre-contractual measures (art. 6.1.b GDPR) or legitimate interest (art. 6.1.f GDPR).
    • Anita AI chat (virtual assistant): message content, email/phone if provided, qualification scoring (HOT/WARM/COLD). Purpose: conversational assistance and qualified commercial follow-up. Legal basis: consent (art. 6.1.a GDPR) when opening the chat and legitimate interest in qualification (art. 6.1.f GDPR).
    • Newsletter / property alerts: email, language, sending preferences. Purpose: editorial news and new property alerts. Legal basis: explicit consent (art. 6.1.a GDPR), revocable at any time via the unsubscribe link.
    • Private / VIP area: login credentials, preferences, off-market browsing history, financial documents transmitted. Purpose: experience personalisation, access to confidential dossiers. Legal basis: contract performance (art. 6.1.b GDPR).
    • GDPR data subject requests (DSR): email, hashed IP, reason. Purpose: verify the requester identity and log the request. Legal basis: legal obligation (art. 6.1.c GDPR, articles 15-22 GDPR).
    • Cookie consent log: pseudonymous client identifier, hashed IP, accepted/refused categories, timestamp. Purpose: evidence of consent. Legal basis: legal obligation (art. 7.1 GDPR).
    • AML/CTF compliance (clients under mandate): ID document, proof of address, identification of the beneficial owner, source of funds. Purpose: anti-money laundering due diligence. Legal basis: legal obligation (art. 6.1.c GDPR + amended law of 12 November 2004).
    • Anonymous audience measurement: URL visited, device type, country, referer. Purpose: site improvement. Legal basis: legitimate interest (art. 6.1.f GDPR).
    • Technical and security logs: IP, user-agent, admin action timestamps. Purpose: information system security, access traceability. Legal basis: legitimate interest (art. 6.1.f GDPR).

    Automated decisions and profiling (art. 22 GDPR)

    Some site features rely on algorithmic processing: the Property Matcher (recommendation of properties based on the criteria you declare) and the internal qualification scoring of valuation requests (HOT / WARM / COLD prioritisation to set the call-back time). These are decision-support tools intended for our staff: no decision producing legal effects on you, or affecting you significantly, is taken in a fully automated manner. You may at any time request a human review, contest the result or express your point of view at contact@eires.lu.

    Retention periods by category

    • Valuation requests converted into a mandate: 3 years from the last contact, then 5-year archive for accounting obligations.
    • Valuation requests not converted: 13 months (CNIL/CNPD recommended duration for B2C prospection).
    • Valuation drafts (auto-save): 14 days, automatic purge.
    • Anita AI conversations (raw logs): 6 months, then anonymisation.
    • Anita HOT/WARM converted leads: 3 years; COLD non-converted leads: 13 months.
    • Visit / appointment requests (Cal.com): 3 years after the appointment date.
    • Unsubscribed newsletter subscribers: 3 years (proof of consent and of unsubscription).
    • Private / VIP area data: as long as the account is active, then 12 months after deletion.
    • Accounting data (signed mandates, invoices): 10 years in line with Luxembourg legal obligations.
    • AML/CTF data: 5 years after the end of the business relationship (amended law of 12 November 2004).
    • GDPR data subject requests (DSR): 3 years after closure, for proof of processing.
    • Cookie consent log: 12 months.
    • Technical logs, admin access and security audit: 12 to 24 months.

    Recipients

    Your data is strictly reserved to authorised EIRES Real Estate staff. It may be transmitted to the technical partners listed below (hosting, transactional email, analytics) and — only with your consent — to listing portals or to our broker for financing pre-qualification. No data is sold or transferred for third-party commercial purposes.

    Technical sub-processors

    Exhaustive list of sub-processors that may process your data on behalf of EIRES Real Estate (GDPR art. 28). All operate under a data processing agreement with documented safeguards. The detailed list with links to official DPAs is available at /en/privacy/subprocessors.

    Sub-processorPurposeLocationTransfer safeguard
    Supabase Inc. / AWS eu-central-1Database, authentication, edge functions, storageGermany (EU)EU — no transfer
    Cloudflare, Inc.CDN, network security, WAF, DNSUnited States (global cache)EU-US Data Privacy Framework + SCCs
    ResendTransactional emails (valuation, contact, DSR)United StatesEU-US Data Privacy Framework + SCCs
    TwilioSMS notifications (appointments, alerts)United StatesEU-US Data Privacy Framework + SCCs
    Cal.comOnline appointment bookingGermany (EU)EU — no transfer
    OpenAI, L.L.C. & Google LLC (LLM models)LLM models powering the Anita assistant (via technical AI gateway)United StatesEU-US Data Privacy Framework + SCCs
    SentryApplication error monitoringEuropean Union (Sentry EU region)Sentry DPA · EU hosting
    Plausible AnalyticsCookieless audience measurementGermany (EU)EU — no transfer
    PostHog (consent-based)Anonymised product analyticsEUEU — no transfer
    Google LLC — GTM (consent-based)Tag managerIreland (EU) / United StatesEU-US Data Privacy Framework + SCCs
    Google Maps GeocodingAddress geocoding (valuation, map)United StatesEU-US Data Privacy Framework + SCCs
    NextImmoProperty syndication to partner portalsLuxembourg (EU)EU — no transfer

    Transfers outside the EU

    Some technical sub-processors (Cloudflare, Resend, Twilio, Google, OpenAI) may process data from the United States. These transfers are framed by their certification under the EU-US Data Privacy Framework (adequacy decision 2023/1795) and/or by the signature of standard contractual clauses approved by the European Commission (decision 2021/914), in line with articles 45 and 46 GDPR. No transfer is made to a country lacking an appropriate legal framework.

    Your rights

    In accordance with articles 15 to 22 of the GDPR, you have the following rights at any time:

    • Right of access and right to a copy of your data
    • Right to rectification
    • Right to erasure ("right to be forgotten")
    • Right to restriction of processing
    • Right to data portability
    • Right to object on legitimate grounds
    • Right to withdraw your consent at any time
    • Right to give post-mortem instructions
    • Right not to be subject to a fully automated decision (art. 22)

    The simplest way to exercise your rights is via our dedicated form /en/privacy/my-data (email verification, processed within 30 days). You may also write to contact@eires.lu attaching proof of identity.

    Data protection contact

    Pursuant to article 37 GDPR, EIRES Real Estate is not required to appoint a formal Data Protection Officer (DPO). For the sake of transparency, the single point of contact for any question relating to the processing of your personal data is:

    • Contact : Michael Eires, manager
    • Email : contact@eires.lu
    • Postal address : 44, Rue de Hunsdorf — L-7324 Mullendorf — Luxembourg

    Complaints

    If, after contacting us, you believe that your rights have not been respected, you may lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD), the Luxembourg supervisory authority: cnpd.public.lu.

    WhatsApp Business — message processing

    We use WhatsApp Business (Cloud API) as a conversational channel. This processing is separate from the website and requires a timestamped opt-in (form, verbal, VIP or import) logged in our GDPR register.

    GDPR legal basis

    • Consent (art. 6.1.a) for marketing messages (property alerts, off-market VIP, greetings).
    • Legitimate interest (art. 6.1.f) for transactional messages tied to an ongoing service (appointment confirmation, offer received, notary, key handover).
    • Contract performance (art. 6.1.b) for messages tied to a signed mandate (weekly report, listing, preliminary contract).

    Data collected via WhatsApp

    • Phone number (channel identifier).
    • Content of exchanged messages (text, images, documents).
    • Send / receive / read timestamps.
    • Delivery status and conversation category (Meta).
    • Timestamped consent (IP, user-agent, source, template).

    Processor: Meta Platforms Ireland Ltd

    Meta Platforms Ireland Ltd — Merrion Road, Dublin 4, D04 X2K5, Ireland. Hosting of WhatsApp Business Platform infrastructure (Cloud API). DPA: WhatsApp Business Terms of Service. End-to-end encryption between EIRES and you. Transfers outside the EU framed by EU-US Standard Contractual Clauses (SCC).

    Retention period

    • 24 months for message bodies (beyond: automatic anonymisation, metadata kept for statistics only).
    • Consent retained for the entire relationship + 3 years after last exchange (GDPR art. 7.1 evidence).
    • Opt-out register retained indefinitely (Meta obligation + compliance proof).

    Your rights

    • Instant objection: send STOP (or UNSUBSCRIBE / OPT-OUT / REMOVE / HALT) to our WhatsApp number. Immediate automatic processing.
    • Access / rectification / erasure: email contact@eires.lu.
    • Portability: full export of your conversations on request.
    • Complaint: CNPD (cnpd.public.lu).

    Automated decision-making

    No automated profiling within the meaning of GDPR art. 22 is performed on WhatsApp data. Internal classification (prospect / client / VIP) remains under final human decision.

    Last updated: . EIRES Real Estate reserves the right to amend this policy to reflect regulatory developments. The version in force is always the one published on this page.