Skip to main content
    EIRES

    ( GDPR · Art. 28 )

    Subprocessors

    Technical partners · Hosting · Analytics tools

    In accordance with Article 28 GDPR, EIRES Real Estate maintains an up-to-date list of subprocessors that have — even partial — access to the personal data you entrust to us. Each has signed a Data Processing Agreement (DPA) binding them to the same obligations as ours.

    Any addition or replacement of a subprocessor is published on this page at least fifteen days before taking effect. To object to a new subprocessor, write to contact@eires.lu.

    • Supabase Inc. (AWS Frankfurt)

      Purpose
      Database hosting, authentication, edge functions, file storage.
      Data categories
      Prospect contact details, valuation requests, DSR records, consent logs.
      Hosting
      Frankfurt (DE) · EU
      International transfers
      EU hosting (AWS Frankfurt). US company, not certified under the Data Privacy Framework: access from the United States (support, maintenance) is possible and governed by the Commission's standard contractual clauses (Supabase DPA).
      Read the DPA Privacy

    • Resend

      Purpose
      Sending transactional emails (valuation reports, acknowledgements, DSR verifications) and receiving the contact requests forwarded to us by property portals.
      Data categories
      Email address, first/last name, subject and body of transactional messages; for requests received from portals: the requester's name, contact details and message.
      Hosting
      United States
      International transfers
      Transfer outside the EU — Standard Contractual Clauses (SCC) 2021 + DPF.
      Read the DPA Privacy

    • Cal.com, Inc.

      Purpose
      Appointment booking (property viewings, phone calls with Michael Eires).
      Data categories
      First/last name, email, chosen slot, optional notes.
      Hosting
      Germany · EU
      International transfers
      EU hosting. US company: access from the United States is possible, governed by its Data Privacy Framework certification and by the standard contractual clauses.
      Read the DPA Privacy

    • PostHog Inc.

      Purpose
      Product analytics (valuation funnel, conversion rates), only if you accept cookies.
      Data categories
      Pseudonymous identifier, navigation events, truncated IP.
      Hosting
      European Union (EU hosting)
      International transfers
      EU hosting (European instance). US company: access from the United States is possible, governed by its Data Privacy Framework certification and by the standard contractual clauses.
      Read the DPA Privacy

    • OpenAI, L.L.C. (OpenAI Ads)

      Purpose
      Conversion measurement for our advertising in ChatGPT (completed valuation request), only if you accept cookies.
      Data categories
      Conversion event, ad click identifier (first-party __oppref cookie), technical browser data. No contact details.
      Hosting
      United States
      International transfers
      United States, standard contractual clauses (not certified under the Data Privacy Framework).
      Read the DPA Privacy

    • Meta Platforms Ireland Ltd. (Meta Pixel)

      Purpose
      Conversion measurement for our advertising on Facebook and Instagram (recorded valuation request), only if you accept cookies and when we run such campaigns.
      Data categories
      Page view, conversion event, first-party advertising identifiers (_fbp and _fbc cookies, fbclid click identifier), technical browser data. From our server (Conversions API): email and phone of the request in hashed form (SHA-256), IP address and browser.
      Hosting
      Ireland (EU) / United States
      International transfers
      Joint controllers for collection and transmission (Meta Controller Addendum); possible transfers to the United States — SCC 2021 + DPF.
      Read the DPA Privacy

    • WhatsApp Ireland Limited (WhatsApp Business)

      Purpose
      WhatsApp Business messaging (Cloud API): conversations with people who have consented to be contacted through this channel.
      Data categories
      Phone number, display name, message content and attachments, delivery status.
      Hosting
      Ireland (EU) / United States
      International transfers
      Transfers to WhatsApp LLC and Meta Platforms, Inc. — WhatsApp Business Data Transfer Addendum (SCC).
      Read the DPA Privacy

    • Google Ireland Ltd. (Google Ads)

      Purpose
      Conversion measurement for our advertising on Google (recorded valuation request), only if you accept cookies and when we run such campaigns.
      Data categories
      Conversion event, ad click identifier (gclid, first-party _gcl_aw cookie), technical browser data. No contact details, no remarketing audience.
      Hosting
      Ireland (EU) / United States
      International transfers
      Possible transfers to the United States — SCC 2021 + DPF.
      Read the DPA Privacy

    • Google Ireland Ltd. (Google Analytics 4 / Tag Manager)

      Purpose
      Audience measurement (page views, referral source, device). The GA4 script loads as soon as you arrive on the site (Google Consent Mode, denied by default); the Tag Manager container only loads if you accept cookies.
      Data categories
      Before consent: anonymised measurement requests, no cookie or persistent identifier. After consent: first-party client cookie, navigation events, IP anonymised by default.
      Hosting
      Ireland · EU (processing), Google global infrastructure
      International transfers
      EU processing. Any transfer outside the EU governed by the 2021 SCC.
      Read the DPA Privacy

    • Plausible Analytics (Plausible Insights OÜ)

      Purpose
      Audience measurement without cookies or persistent identifiers, loaded only after your consent.
      Data categories
      No personal data. Anonymous per-page aggregates.
      Hosting
      Germany · EU
      International transfers
      No transfer outside the EU.
      Read the DPA Privacy

    • Cloudflare

      Purpose
      CDN, DDoS protection, static asset caching; secondary copy of backups (R2 storage, EU jurisdiction, 90 days).
      Data categories
      IP address, HTTP headers, request logs (24 h). Backups: copy of the database (contact details, requests, files) and of uploaded documents, encrypted at rest.
      Hosting
      Worldwide (edge), headquartered in the United States · backups: EU (R2 jurisdiction)
      International transfers
      EU edge prioritized. Backups stored in the EU (R2 jurisdiction). Transfers governed by SCC 2021 + DPF.
      Read the DPA Privacy

    • Sentry (Functional Software, Inc.)

      Purpose
      JavaScript error monitoring and front-end performance (production).
      Data categories
      Stack traces, page URL, browser agent. No deliberate PII.
      Hosting
      European Union (Sentry EU region)
      International transfers
      Hosting in Sentry's EU region. US company: access from the United States is possible, governed by its Data Privacy Framework certification and by the standard contractual clauses.
      Read the DPA Privacy

    • Twilio

      Purpose
      Sending text messages (appointment confirmations and reminders, verification codes, notifications) and forwarding to the advisor of calls to the number shown after our ads.
      Data categories
      Phone number, message content, delivery status.
      Hosting
      United States
      International transfers
      EU-US Data Privacy Framework and standard contractual clauses.
      Read the DPA Privacy

    • OpenRouter, Inc.

      Purpose
      Gateway to the language models (OpenAI, Google) used by the "Anita" AI agent and our internal tools (drafting, transcription).
      Data categories
      Content of messages sent to the AI agent, texts submitted to internal tools, contact details if you write them in a message.
      Hosting
      United States
      International transfers
      United States. Not certified under the Data Privacy Framework: transfer governed by the standard contractual clauses.
      Read the DPA Privacy

    • Google Maps Platform (Google LLC)

      Purpose
      Address geocoding and autocomplete, nearby places, maps (valuation, property pages, brochures).
      Data categories
      Address entered, geographic coordinates, IP address of the request.
      Hosting
      United States
      International transfers
      EU-US Data Privacy Framework and standard contractual clauses.
      Read the DPA Privacy

    • NextImmo

      Purpose
      Property syndication to partner portals; valuation engine (Restimator) that computes the estimate from the property's address and features.
      Data categories
      Address and features of the property to be valued; content of the listings published.
      Hosting
      Luxembourg · EU
      International transfers
      No transfer outside the EU.
      Read the DPA Privacy

    • Microsoft Ireland Operations Ltd. (Microsoft 365)

      Purpose
      Team e-mail, calendar and documents (Outlook, OneDrive), synchronised with our management software.
      Data categories
      E-mails exchanged with the team, appointments, shared documents.
      Hosting
      Ireland · EU / United States
      International transfers
      EU-US Data Privacy Framework and standard contractual clauses.
      Read the DPA Privacy

    • DocRaptor LLC

      Purpose
      Generation of PDF documents (valuation reports, brochures).
      Data categories
      Content of the generated document: property address and features, name of the valuation report's recipient.
      Hosting
      United States
      International transfers
      Data Privacy Framework (certification active on 07/11/2026) + standard contractual clauses.
      Read the DPA Privacy

    • Upstash, Inc.

      Purpose
      Rate limiting on forms, against abuse.
      Data categories
      IP address and timestamps of requests, kept for the duration of the rate-limit window (a few minutes).
      Hosting
      United States
      International transfers
      EU-US Data Privacy Framework and standard contractual clauses.
      Read the DPA Privacy

    Last updated : 7 November 2026

    ← Back to privacy policy