Privacy Policy

1. Introduction

Aquileia Asset Management GmbH ("we," "us," "our," or "Company") operates the Castle Collector platform (the "Service"). We are committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

2. Controller Information

3. Information We Collect

4. Purpose of Processing and Legal Basis

We process your personal data under GDPR Article 6 for the following purposes:

• Contract performance: Providing the Platform and facilitating connections between buyers and sellers
• Legitimate interests: Improving the Platform, analytics, fraud prevention
• Legal obligation: Compliance with applicable laws and regulations
• Consent: Marketing communications and non-essential cookies

5. Data Sharing and Recipients

We are a curator platform and do not own listings. We share your data only as necessary and with appropriate safeguards:

• Sellers/Real Estate Agents: Property information and contact details necessary to facilitate inquiries
• Service Providers: Hosting providers, analytics providers (under Data Processing Agreements)
• Legal Requirements: Authorities when required by law or court order

We do not sell your personal data to third parties for marketing purposes.

6. Data Retention

• Account Information: Until you delete your account (then deleted within 30 days)
• Transaction Data: For 7 years (legal and tax requirements)
• Support Correspondence: For 3 years
• Marketing Communications: Until you unsubscribe
• Cookies: As specified in our Cookie Policy

You can request deletion of your data at any time, subject to legal obligations to retain certain information.

7. Your Privacy Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data we hold (Article 15)
• Right to Rectification: Correct inaccurate or incomplete data (Article 16)
• Right to Erasure: Request deletion of your data (Article 17)
• Right to Restrict Processing: Limit how we use your data (Article 18)
• Right to Data Portability: Receive your data in a structured format (Article 20)
• Right to Object: Object to processing for direct marketing or legitimate interests (Article 21)
• Right to Lodge Complaints: File a complaint with your local data protection authority

To exercise these rights, contact us at info@castlecollector.com. We will respond within 30 days.

8. International Data Transfers

Castle Collector operates within the European Union. If we transfer data outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for platform functionality and security
• Performance Cookies: Help us understand how users interact with our service
• Marketing Cookies: Used for targeted advertising (requires consent)

For full details, see our Cookie Policy.

10. Data Security

We implement industry-standard security measures to protect your data, including:

• SSL/TLS encryption for data in transit
• Encrypted data storage at rest
• Access controls and authentication mechanisms
• Regular security audits and vulnerability assessments
• Employee training on data protection

While we strive to protect your data, no method of transmission over the internet is completely secure.

11. Children's Privacy

Castle Collector is not intended for children under 13 years old. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

12. Third-Party Services and Data Processors

Castle Collector uses various third-party services to deliver our platform. Key services include:

For each service, we have Data Processing Agreements (DPAs) in place where required by law. All transfers of personal data to the USA are protected by Standard Contractual Clauses (SCCs) or similar legal mechanisms.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated to you via email or a prominent notice on our website. Your continued use of Castle Collector after changes constitutes your acceptance of the updated policy.

14. Contact Us