Privacy Policy
Draft last updated: 29 September 2026.
Draft for the new portal. Compare it with the platform's canonical policy and confirm actual processing before publication. It does not replace the current policy at vesteri.com.
1. Controller and contact
The controller is Time2Show, Inc., operating under the Vesteri brand, at 1111B S Governors Ave STE 20579, Dover, DE 19904, USA. For personal data matters, contact privacy@vesteri.com or write to that address, identifying Vesteri as the relevant service.
This document concerns users of the Vesteri property portal. Regulation (EU) 2016/679 (GDPR) applies to processing within its scope. Notices for particular forms, events or separate services may supplement this policy.
2. Accounts and use of the portal
The data involved depends on the features you use. It may include contact and identification details submitted during registration, profile information, language preferences, property enquiries and support correspondence. If you publish listings, it also includes information and materials you choose to publish.
Fields necessary for a particular service should be identified on the relevant form. Without information necessary to create an account or handle an enquiry, that action may not be possible. Optional features remain voluntary. Do not include unnecessary health information, identity documents or other people's personal information in listings or messages.
3. Purposes and legal bases
The following proposed scope must be confirmed for the portal before launch:
| Purpose | GDPR basis |
|---|---|
| Creating and operating an account, providing a requested service, or handling a pre-contractual request | Article 6(1)(b), where necessary for a contract or steps requested before entering one |
| Meeting statutory duties, including applicable accounting obligations | Article 6(1)(c) |
| Protecting accounts and services, handling complaints, establishing or defending claims | Article 6(1)(f), subject to necessity and assessment of the user's rights |
| Voluntary marketing, optional analytics or personalisation requiring consent | Article 6(1)(a) and applicable communications and terminal equipment rules |
Consent can be withdrawn without affecting the lawfulness of earlier processing. A contractual basis does not automatically cover every operation performed within the portal.
4. Recipients and publication
Infrastructure, communications, support and other service providers may be needed to operate the service. Providers processing data on the controller's behalf should act under appropriate agreements. Information may also be disclosed to competent authorities where legally required.
Before a property enquiry is sent, users need information about its recipient and the data shared. Developers or agencies may be independent controllers of subsequent processing. Information intentionally published in listings may be visible to portal visitors. Check the audience and your authority to share the materials before publication.
5. Cookies and technical data
Loading the service requires technical handling of the connection. Depending on deployment, device information, IP addresses and security events may be processed. A separate cookie policy addresses cookies and similar technologies.
The settings of the marketing website at vesteri.com do not establish how the new portal is configured. Technology categories, providers and lifetimes must reflect the actual deployment.
6. AI, events and profiling
Using the Vesteri brand does not itself enable event recording, an AI assistant, behavioural analysis or scoring. If these features are introduced, users should first receive information about the data, purposes, legal bases, recipients, retention periods and profiling rights. Where consent is required, processing must wait until valid consent is obtained.
Before publication, the controller must determine whether any decisions are made solely by automated means and produce legal or similarly significant effects, and provide the relevant disclosures if applicable.
7. Transfers outside the EEA
A US corporate address alone does not establish server locations or access arrangements. Before publication, identify processing and access locations, recipients and applicable safeguards for transfers outside the European Economic Area. This draft does not assert a particular hosting location or a recipient's certification status.
8. Retention
Data should be retained only as necessary for the stated purpose: operating accounts and services, resolving correspondence, meeting a particular legal duty, or handling claims. Keeping consent records requires its own justification. Backups should have a defined rotation cycle.
Before publication, specify the actual periods or sufficiently precise criteria for accounts, listings, enquiries, logs, messages, backups and any recordings. Retention periods from a different service are not automatically applicable.
9. Your rights
Subject to the GDPR's conditions, you may request access, rectification, erasure, restriction or portability. You may object to processing based on legitimate interests and withdraw consent. The right to object to direct marketing also covers related profiling.
Send requests to the contact in section 1. Requests should be answered without undue delay, normally within one month; any extension is subject to the GDPR. You may complain to Poland's President of the Personal Data Protection Office at uodo.gov.pl, or another competent supervisory authority. See “Data deletion” for information about erasure requests.
10. Policy changes
The current policy should be available in the portal with its update date. Material changes should be communicated appropriately. Updating a policy does not itself replace consent where consent is required.