( GDPR · Art. 28 )

Subprocessors

Technical partners · Hosting · Analytics tools

In accordance with Article 28 GDPR, EIRES Real Estate maintains an up-to-date list of subprocessors that have — even partial — access to the personal data you entrust to us. Each has signed a Data Processing Agreement (DPA) binding them to the same obligations as ours.

Any addition or replacement of a subprocessor is published on this page at least fifteen days before taking effect. To object to a new subprocessor, write to contact@eires.lu.

Supabase Inc. (AWS Frankfurt)
Purpose
Database hosting, authentication, edge functions, file storage.
Data categories
Prospect contact details, valuation requests, DSR records, consent logs.
Hosting
Frankfurt (DE) · UE
International transfers
No transfer outside the EU.
Read the DPA Privacy
Resend
Purpose
Sending transactional emails (valuation reports, acknowledgements, DSR verifications) and receiving the contact requests forwarded to us by property portals.
Data categories
Email address, first/last name, subject and body of transactional messages; for requests received from portals: the requester's name, contact details and message.
Hosting
États-Unis
International transfers
Transfer outside the EU — Standard Contractual Clauses (SCC) 2021 + DPF.
Read the DPA Privacy
Cal.com
Purpose
Appointment booking (property viewings, phone calls with Michael Eires).
Data categories
First/last name, email, chosen slot, optional notes.
Hosting
Allemagne · UE
International transfers
No transfer outside the EU on the EU Cloud plan.
Read the DPA Privacy
PostHog
Purpose
Product analytics (valuation funnel, conversion rates), only if you accept cookies.
Data categories
Pseudonymous identifier, navigation events, truncated IP.
Hosting
Union européenne (hébergement EU)
International transfers
EU hosting. No transfer outside the EU.
Read the DPA Privacy
OpenAI, L.L.C. (OpenAI Ads)
Purpose
Conversion measurement for our advertising in ChatGPT (completed valuation request), only if you accept cookies.
Data categories
Conversion event, ad click identifier (first-party __oppref cookie), technical browser data. No contact details.
Hosting
États-Unis
International transfers
Transfer outside the EU — Standard Contractual Clauses (SCC) 2021 + DPF.
Read the DPA Privacy
Meta Platforms Ireland Ltd. (Meta Pixel)
Purpose
Conversion measurement for our advertising on Facebook and Instagram (recorded valuation request), only if you accept cookies and when we run such campaigns.
Data categories
Page view, conversion event, first-party advertising identifiers (_fbp and _fbc cookies, fbclid click identifier), technical browser data. From our server (Conversions API): email and phone of the request in hashed form (SHA-256), IP address and browser.
Hosting
Irlande (UE) / États-Unis
International transfers
Joint controllers for collection and transmission (Meta Controller Addendum); possible transfers to the United States — SCC 2021 + DPF.
Read the DPA Privacy
Google Ireland Ltd. (Google Ads)
Purpose
Conversion measurement for our advertising on Google (recorded valuation request), only if you accept cookies and when we run such campaigns.
Data categories
Conversion event, ad click identifier (gclid, first-party _gcl_aw cookie), technical browser data. No contact details, no remarketing audience.
Hosting
Irlande (UE) / États-Unis
International transfers
Possible transfers to the United States — SCC 2021 + DPF.
Read the DPA Privacy
Google Ireland Ltd. (Google Analytics 4 / Tag Manager)
Purpose
Audience measurement (page views, referral source, device). The GA4 script loads as soon as you arrive on the site (Google Consent Mode, denied by default); the Tag Manager container only loads if you accept cookies.
Data categories
Before consent: anonymised measurement requests, no cookie or persistent identifier. After consent: first-party client cookie, navigation events, IP anonymised by default.
Hosting
Irlande · UE (traitement), infrastructure globale Google
International transfers
EU processing. Any transfer outside the EU governed by the 2021 SCC.
Read the DPA Privacy
Plausible Analytics
Purpose
Anonymous audience measurement (no cookies, no persistent identifier).
Data categories
No personal data. Anonymous per-page aggregates.
Hosting
Allemagne · UE
International transfers
No transfer outside the EU.
Read the DPA Privacy
Cloudflare
Purpose
CDN, DDoS protection, static asset caching; secondary copy of backups (R2 storage, EU jurisdiction, 90 days).
Data categories
IP address, HTTP headers, request logs (24 h). Backups: copy of the database (contact details, requests, files) and of uploaded documents, encrypted at rest.
Hosting
Mondial (edge), siège États-Unis · sauvegardes : UE (juridiction R2)
International transfers
EU edge prioritized. Backups stored in the EU (R2 jurisdiction). Transfers governed by SCC 2021 + DPF.
Read the DPA Privacy
Sentry
Purpose
JavaScript error monitoring and front-end performance (production).
Data categories
Stack traces, page URL, browser agent. No deliberate PII.
Hosting
Union européenne (région EU Sentry)
International transfers
EU hosting. No transfer outside the EU.
Read the DPA Privacy

Last updated : 10 October 2026

← Back to privacy policy

Subprocessors

Technical partners · Hosting · Analytics tools

Any addition or replacement of a subprocessor is published on this page at least fifteen days before taking effect. To object to a new subprocessor, write to contact@eires.lu.

Supabase Inc. (AWS Frankfurt)

Purpose: Database hosting, authentication, edge functions, file storage.
Data categories: Prospect contact details, valuation requests, DSR records, consent logs.
Hosting: Frankfurt (DE) · UE
International transfers: No transfer outside the EU.

Read the DPA Privacy

Resend

Purpose: Sending transactional emails (valuation reports, acknowledgements, DSR verifications) and receiving the contact requests forwarded to us by property portals.
Data categories: Email address, first/last name, subject and body of transactional messages; for requests received from portals: the requester's name, contact details and message.
Hosting: États-Unis
International transfers: Transfer outside the EU — Standard Contractual Clauses (SCC) 2021 + DPF.

Read the DPA Privacy

Cal.com

Purpose: Appointment booking (property viewings, phone calls with Michael Eires).
Data categories: First/last name, email, chosen slot, optional notes.
Hosting: Allemagne · UE
International transfers: No transfer outside the EU on the EU Cloud plan.

Read the DPA Privacy

PostHog

Purpose: Product analytics (valuation funnel, conversion rates), only if you accept cookies.
Data categories: Pseudonymous identifier, navigation events, truncated IP.
Hosting: Union européenne (hébergement EU)
International transfers: EU hosting. No transfer outside the EU.

Read the DPA Privacy

OpenAI, L.L.C. (OpenAI Ads)

Purpose: Conversion measurement for our advertising in ChatGPT (completed valuation request), only if you accept cookies.
Data categories: Conversion event, ad click identifier (first-party __oppref cookie), technical browser data. No contact details.
Hosting: États-Unis
International transfers: Transfer outside the EU — Standard Contractual Clauses (SCC) 2021 + DPF.

Read the DPA Privacy

Meta Platforms Ireland Ltd. (Meta Pixel)

Purpose: Conversion measurement for our advertising on Facebook and Instagram (recorded valuation request), only if you accept cookies and when we run such campaigns.
Data categories: Page view, conversion event, first-party advertising identifiers (_fbp and _fbc cookies, fbclid click identifier), technical browser data. From our server (Conversions API): email and phone of the request in hashed form (SHA-256), IP address and browser.
Hosting: Irlande (UE) / États-Unis
International transfers: Joint controllers for collection and transmission (Meta Controller Addendum); possible transfers to the United States — SCC 2021 + DPF.

Read the DPA Privacy

Google Ireland Ltd. (Google Ads)

Purpose: Conversion measurement for our advertising on Google (recorded valuation request), only if you accept cookies and when we run such campaigns.
Data categories: Conversion event, ad click identifier (gclid, first-party _gcl_aw cookie), technical browser data. No contact details, no remarketing audience.
Hosting: Irlande (UE) / États-Unis
International transfers: Possible transfers to the United States — SCC 2021 + DPF.

Read the DPA Privacy

Google Ireland Ltd. (Google Analytics 4 / Tag Manager)

Purpose: Audience measurement (page views, referral source, device). The GA4 script loads as soon as you arrive on the site (Google Consent Mode, denied by default); the Tag Manager container only loads if you accept cookies.
Data categories: Before consent: anonymised measurement requests, no cookie or persistent identifier. After consent: first-party client cookie, navigation events, IP anonymised by default.
Hosting: Irlande · UE (traitement), infrastructure globale Google
International transfers: EU processing. Any transfer outside the EU governed by the 2021 SCC.

Read the DPA Privacy

Plausible Analytics

Purpose: Anonymous audience measurement (no cookies, no persistent identifier).
Data categories: No personal data. Anonymous per-page aggregates.
Hosting: Allemagne · UE
International transfers: No transfer outside the EU.

Read the DPA Privacy

Cloudflare

Purpose: CDN, DDoS protection, static asset caching; secondary copy of backups (R2 storage, EU jurisdiction, 90 days).
Data categories: IP address, HTTP headers, request logs (24 h). Backups: copy of the database (contact details, requests, files) and of uploaded documents, encrypted at rest.
Hosting: Mondial (edge), siège États-Unis · sauvegardes : UE (juridiction R2)
International transfers: EU edge prioritized. Backups stored in the EU (R2 jurisdiction). Transfers governed by SCC 2021 + DPF.

Read the DPA Privacy

Sentry

Purpose: JavaScript error monitoring and front-end performance (production).
Data categories: Stack traces, page URL, browser agent. No deliberate PII.
Hosting: Union européenne (région EU Sentry)
International transfers: EU hosting. No transfer outside the EU.

Read the DPA Privacy