Privacy Policy

1. Introduction

Kotira ("we", "our", "the Platform") is committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, and your rights under the EU General Data Protection Regulation (GDPR) and Finnish data protection law.

By using Kotira, you consent to the data practices described in this policy.

2. Data We Collect

We collect the following categories of personal data:

• Account data: Name, email address, and password (stored as a secure hash).
• Profile data: Phone number and other optional profile information you provide.
• Listing data: Property details, images, and descriptions you submit.
• Pricing and subscription data: Chosen plan, subscription status, billing events, and campaign-plan eligibility period.
• Compliance verification data: Agency declarations (including licensing/compliance confirmations), business verification status, supporting identity/authorization documents where provided, review notes, and related onboarding audit logs.
• Usage data: Pages visited, search queries, and interactions with listings.
• Communication data: Messages and inquiries sent through the platform.
• Technical data: IP address, browser type, device information, and cookies.

3. How We Use Your Data

We use your data for the following purposes:

• To create and manage your account.
• To display and manage property listings.
• To manage pricing plans, subscriptions, and campaign-plan eligibility and duration.
• To verify agency onboarding declarations, licensing representations, and compliance eligibility.
• To prevent fraud, misuse, and policy violations, and to protect platform trust and safety.
• To send transactional emails such as password resets and inquiry notifications.
• To improve the platform's functionality and user experience.
• To respond to your support requests.
• To comply with legal obligations.

We do not sell your personal data to third parties.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract performance: To provide the services you have registered for.
• Legitimate interests: To improve and secure the platform.
• Legitimate interests: To verify agency declarations and maintain platform integrity and trust.
• Consent: For optional communications and marketing (which you may withdraw at any time).
• Legal obligation: When required by Finnish or EU law.

5. Data Sharing

Your data may be shared with:

• Cloud infrastructure providers (e.g. hosting and database services) under data processing agreements.
• Payment and billing providers (when enabled) to process plan charges and subscription status.
• Email service providers used to deliver transactional emails.
• Image hosting services for property photos you upload.
• Law enforcement or authorities if required by law.

All third-party providers are required to handle your data in compliance with GDPR.

6. Cookies

Kotira uses cookies and similar technologies to maintain your login session and improve the platform experience. A session cookie is stored when you sign in.

You can disable cookies in your browser settings, but this may affect platform functionality such as staying logged in.

7. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide our services. You may request deletion of your account and associated data at any time by contacting us at support@kotira.fi.

Some data may be retained for longer periods if required by law or for legitimate business purposes such as resolving disputes.

Compliance verification records (including onboarding decisions and review logs) may be retained for an extended period where needed for fraud prevention, dispute handling, legal claims, or regulatory accountability.

8. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Right of access: Request a copy of the data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your data ("right to be forgotten").
• Right to restriction: Request that we limit processing of your data.
• Right to data portability: Request your data in a machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: At any time for consent-based processing.

To exercise any of these rights, contact us at support@kotira.fi. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, or loss. These include encrypted storage of passwords, HTTPS transmission, and access controls.

No system is completely secure. If you suspect a security incident involving your data, please contact us immediately.

10. Children's Privacy

Kotira is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us for removal.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this policy periodically.

12. Contact and Complaints

For any privacy-related questions or to exercise your rights, contact us at support@kotira.fi.

If you are not satisfied with our response, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).