Privacy

The controller is Ing. Mgr. Milan Pleško, Sasinkova 539/13, 915 01 Nové Mesto nad Váhom, Slovakia; [info@arealis.eu](mailto:info@arealis.eu); +421 948 900 909. Data protection officer, if appointed: not appointed, as the scale of processing does not require one. We process registration and identity data, listing text and images, contact and communication data, order and payment identifiers, records of consent and early-performance requests, complaints, security logs and Ari inputs. Purposes and lawful bases include performing contracts; meeting accounting and other legal duties; protecting the service and legal claims where supported by legitimate interests; and optional purposes under the stated lawful basis. An operational email to an advertiser about disclosure of a contact is not marketing; its lawful basis according to the actual workflow is performance of our contract with the advertiser for publishing the listing. Actual recipients are hosting — the operator's own server in Slovakia (internet connection Slovak Telekom, a.s.; domain management Websupport s.r.o.); payment gateways — PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, and, for card, Apple Pay, Google Pay and Link payments, Stripe Payments Europe, Limited, Ireland; email — we send outgoing email from our own mail server; incoming mail to @arealis.eu addresses is delivered by Forward Email LLC (USA) to a Gmail mailbox (Google); analytics — our own visitor measurement on our server without cookies or IP addresses (daily aggregate counts only), not shared with anyone; maps — our own map server maps.redimo.sk, the Photon geocoder (komoot GmbH, Germany) as a fallback for address search, and OpenStreetMap tiles (OpenStreetMap Foundation, United Kingdom) in the listing location form; sign-in through a third party, only if you choose it — Google, Meta (Facebook), Apple, X or GitHub; advertising after your consent — Google AdSense (Google Ireland Limited); videos in the Inspiration section — YouTube (Google Ireland Limited); and, for Ari, Mistral AI SAS, a company established in France. Ari requests go exclusively to Mistral AI; other AI providers are disabled. Mistral AI SAS processes content sent to the Ari feature as a processor under its DPA. The place and scope of processing depend on the endpoint, features and sub-processors used and may include transfers outside the EEA covered by the appropriate mechanism under the GDPR. The current list of sub-processors is available in the Mistral Trust Center. Other transfers outside the EEA and safeguards, if any: to the USA: Forward Email LLC and Google LLC (email), Stripe, Inc. (card payment processing) and, if you choose to sign in with them, Meta Platforms, Apple, X Corp. and GitHub; to the United Kingdom: OpenStreetMap Foundation under the European Commission's adequacy decision. Where a service provider transfers personal data to the United States, the transfer is based on the European Commission adequacy decision for the EU–U.S. Data Privacy Framework where the specific recipient and the relevant scope of processing are actively certified; otherwise, it is based on the European Commission Standard Contractual Clauses under Article 46 GDPR and, where required, supplementary safeguards. The portal does not use ipapi.co or Kloudend to determine location. The default country setting may be inferred locally in the browser from its time zone; this is only an approximate signal and is not treated as a precise location or as evidence of the customer’s country. Retention: account (account management, contract): while the account exists; after a deletion request 30 days for recovery, then erasure or anonymisation • sign-in session (security, legitimate interest): 7 days from last activity, at most 30 days • security sign-in logs (security, legitimate interest): 90 days; the record of an account erasure is kept permanently as proof the request was handled • system emails sent (contract, security): 180 days • listings and photos (contract): while published; a deactivated listing is deleted within 3 months • messages between users (contract): while the conversation exists; on account deletion we remove your name, the message stays with the other party • orders, payments and accounting records (legal obligation): 10 years after the year they relate to (Slovak Act No. 431/2002, Section 35) • records of acceptance of terms and early-performance requests (proof of contract, legitimate interest): for the term of the contract and 4 years after it ends • complaints, withdrawals and content notices (legal obligation, legitimate interest): 3 years after resolution • Ari conversations (contract): 30 days from last activity • Ari usage records (contract, abuse prevention): 365 days • Ari consent record (proof of consent): while the account exists, at most 3 years • analytics: daily aggregate counts only, without personal data; accounting records are retained as required by law. Depending on the processing, you may request access, correction, erasure, restriction or portability, object, withdraw consent prospectively, and complain to the Slovak Office for Personal Data Protection (Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk) or the supervisory authority in your country of residence. Send requests to [info@arealis.eu](mailto:info@arealis.eu). Details of profiling, automated decisions, data sources and whether provision is required: we do not carry out profiling or solely automated decision-making with legal or similarly significant effects; search results are ordered by the filters you choose and by promotion. We obtain data from you and, if you sign in with Google, Facebook, Apple, X or GitHub, also from that provider (name and email). An email address and password, or sign-in through a provider, are required to create an account; without them an account cannot be created.