Privacy Policy

Effective Date: 1 October 2026, Version: 2.0

This privacy notice (hereinafter referred to as “Privacy Notice” or “Notice”) describes the manner in which Realpad, s.r.o., with its registered office at Panská 854/2, Praha 1 – Nové Město, 110 00, Czech Republic, Company ID No. (IČO): 10756540, VAT ID: CZ10756540, registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 347  (hereinafter referred to as “Realpad” or “we”) collects, processes and safeguards your personal data. Your privacy is important to us, and we are committed to protecting your personal data.

This Notice applies to the processing of personal data within all services, applications and websites operated by Realpad in which the personal data are processed and that contain this Notice, reference to it or link thereto. It applies to the processing of personal data of visitors of our website, users of our services and also representatives of our business partners, applicants for employment and persons who contact us through our website or otherwise. It also applies to users of the Customer Portal, in respect of the limited processing described below.

For ease of reference, this Notice uses the following terms for our main services:

• “Website” our website at www.realpadsoftware.com;
• “Platform” the Realpad web application, comprising the CMS, CRM and financial modules, made available at cms.realpad.eu, including the Customer Portal made available through it;
• “Mobile Apps” the Realpad mobile applications for iOS and Android, including the sales tools and the Android Contacts application;
• “Services” or “Websites” the Website, the Platform and the Mobile Apps together.

These terms are used for clarity only and do not limit the scope of this Notice as described above. This Notice also applies to any other service, application or website we operate, including one we may launch in the future, which contains this Notice or a reference or link to it.

This Privacy Notice applies when Realpad processes personal data as a data controller. Realpad provides its Services to business clients (in particular real estate developers and sellers). A substantial part of the personal data held in the Platform, in particular data concerning our clients’ leads, prospective buyers, customers and deals, is entered into the Platform by our clients and is processed by Realpad solely as a data processor on the documented instructions of the relevant client, who acts as the data controller. If you are a lead, buyer or customer of one of our clients, please refer to the privacy notice of that client. Processing carried out by Realpad as a processor is governed by the data processing agreement concluded with the relevant client and is not described in this Notice.

There is one exception. If you use the Customer Portal, the optional measurement of how you use it, including any session recording, is carried out for our own purpose of improving our products. For that limited processing we act as a controller and this Notice applies to you: we rely on your consent, which we ask for in the Portal itself, and you may withdraw it at any time in the Cookie settings there. Everything else you see in the Portal as your unit, your documents, your payments and your account itself is processed by us as a processor on the instructions of your seller, and their privacy notice applies.

In the event of any conflict between this Privacy Notice and any specific privacy notice applicable to any Realpad product or service, the specific privacy notice shall prevail.

In this Notice whenever we refer to the GDPR this includes references to the UK Data Protection Act as well.

The provisions of this Privacy Notice are effective as of the above effective date.

The data we process, the purposes, and the legal basis for processing.

Account registration and its usage and management

When you, as a customer or an employee or another authorized user of Realpad services, create an account on the Platform, use it and manage it we process the following data: identification details (name, surname), log-in data (your e-mail address, password stored in hashed form), contact details (in particular business phone number), information about the company you work for and your work position, your salesperson details where the relevant module is used, your notification preferences and personalisation settings (for example which columns are displayed in tables and your saved filter settings), and technical details about your use of the Platform (logs of your actions, ID numbers assigned by the systems, timestamps and IP addresses, etc.). Your account is linked to the records assigned to you in the Platform, such as commission claims, defect-related conversations, on-duty data for CRM projects and tasks. In many cases your account is created by your employer or by us on behalf of your employer. As part of operating your account we also send you the service e-mails and notifications the Platform generates, such as notifications about changes to records assigned to you; these are dispatched through an external e-mail delivery provider, which means that your e-mail address and the full content of the notification pass through that provider’s systems. The legal basis for processing your personal data is contract performance between Realpad and you as a customer or business partner (if the customer or business partner is an individual) or legitimate interest (if the customer or business partner is a legal entity).

Management of our contractual relationships

When you or your organization engage with us as a customer, business partner, advisor, or in a similar capacity, we may process your personal data for the purpose of effectively managing and maintaining our contractual relationship. We process the following data: identification details (name, surname), contact details, such as address, phone number, e-mail address, information about the company you work for and your work position, and billing and payment details. The legal basis is contract performance between Realpad and you as a customer or business partner (if the customer or business partner is an individual) or legitimate interest (if the customer or business partner is a legal entity).

Provision of customer service and support

When you use our Services or contact our support team for assistance, we process your personal data necessary to provide you with service or handle your request. We process the following data: identification details (name, surname), contact details (e-mail address and, where you provide it, phone number), information about the company you work for, the content of your support conversation, and technical data about your use of the Platform. The legal basis is contract performance between Realpad and you as a customer or business partner (if the customer or business partner is an individual) or legitimate interest (if the customer or business partner is a legal entity).

Security of the Services, audit trail and prevention of misuse

In order to keep the Platform and the data stored in it secure, we log security-relevant events. Whenever you change CRM or financial data in the Platform we record the exact time, your IP address and the exact nature of the change. This creates an audit trail which is necessary to establish who is responsible for which change; parts of this audit trail are visible in the Platform itself, for example in the history of changes of a Unit or a Deal, or in the events shown in a Customer detail. Where incorrect log-in data is entered, we store the IP address from which the attempt was made for a limited period in order to protect the account against brute-force attacks. We also process technical logs for the purpose of detecting, investigating and preventing security incidents, fraud and misuse of the Services. The legal basis is our legitimate interest in the security and integrity of our Services and of the data entrusted to us, and, where applicable, the fulfilment of our legal obligations relating to information security.

Improvement of our services and products, product analytics and session replay

We process your data to improve our services and products and to provide you with the best possible user and customer experience. We process the following data: identification details (name, surname), contact details, such as address, phone number, e-mail address, content of your feedback and your ideas shared with us by various means, information about usage of our services and products, and additional communication between you and us about provided feedback or ideas. The legal basis is our legitimate interest to improve our products and services and to provide you with the best customer and user experience.

In addition, where you have given us your consent, we record how you move through the Website, the Platform and the Customer Portal. This includes the pages you visit, the IP address from which you visit them and how long you stay, your clicks, changes of form inputs and form submissions, web performance metrics and browser exceptions, together with a pseudonymous visitor, session and device identifier. It is carried out both by our own logging and by means of the third-party analytics tools; the tools we currently use and the entries each of them places on your device are identified in our Cookie List . Where session replay is enabled, this also includes a reconstruction of your interaction with the user interface, comprising clicks, mouse movements, scrolling and snapshots of the content displayed on the screen. Before session replay is enabled, we configure input and text masking so that sensitive information you type into forms and any personal data of third parties displayed on screen is masked. The legal basis for this processing is your consent. Aggregated and de-identified statistics derived from this data are further processed on the basis of our legitimate interest to improve our products and services.

Direct marketing and promotion

We use your data for our own marketing purposes, i.e., if you sign up for our newsletter or other marketing communication. We process the following data: identification details (name, surname), contact details, such as address, phone number, e-mail address, information about newsletters you signed up for and your preferences regarding marketing communication (if any), information about the company you work for and your work position. The legal basis for processing is your consent. You can withdraw your consent to receive marketing newsletters at any time by unsubscribing. In certain cases, we may use third parties or publicly accessible information to enhance our data for marketing purposes. In relation to use of third-party data and publicly available information, the legal basis for processing is your consent or our legitimate interest.

Recruitment process

If you apply for any open job positions at Realpad, we will process personal data you provide to us for the purposes of evaluating your suitability for any of our open positions. We will process the following data: identification details (name, surname), contact details, such as address, phone number, e-mail address, information from your CV, Cover Letter about your past positions, qualifications, etc., any further information you share with us during the recruitment process. Applications submitted through the external recruitment portal on which our open positions are published are received by us through that portal. If you are a successful candidate, you will receive a job offer from us. For this purpose, we will process the offered position and salary and other relevant job details. The legal basis is our legitimate interest to find the most suitable candidate for the position, or a pre-contractual relationship with you.

Defending our rights and claims

When you make a legal claim against us, or when we need to protect our rights through legal or other means, we process your data necessary to be able to effectively defend our rights and defend ourselves against a claim. The legal basis for processing your data is our legitimate interest in defending against claims or fulfilling legal obligations or our contractual commitments.

Fulfilment of legal obligation

In some instances, legal regulations impose obligations on us under which we are obliged to process personal data. Such cases are for instance tax and accounting laws, whistleblowing laws, anti-discrimination laws and the provision of some data to public authorities based on applicable legislation. If we receive a lawful request for a copy of data from a public authority, we will comply with it to the extent required. We process your data within the scope as required by applicable legislation. The legal basis for processing is fulfilment of legal obligations imposed upon us by the applicable legislation.

Contacting us

If you contact us via our Website or by different means we will process your data to reply and provide you with what you have requested. We process the following data: identification details (name, surname), contact details, such as address, phone number, e-mail address, information about the company you work for and your work position, any further information you share with us. The legal basis for processing is your consent or our legitimate interest.

Whenever we process your data on the legal basis of consent, you can withdraw your consent with the given processing at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

We do not intentionally collect or process any special categories of personal data (such as data revealing health, racial or ethnic origin, religious beliefs or biometric data) about users of our Services, and we ask you not to enter such data into free-text fields in the Platform.

Cookies and other tracking technologies.

Our Website use cookies, local storage, web beacons and other similar technologies to automatically collect information about individuals who visit and use our Websites. These are small files or storage entries that are stored on your device. They help us to operate our Websites, provide important features and functionalities and enable us to better understand how you use our Websites. A full and up-to-date list of the individual cookies and other storage entries we use, including their provider, purpose, storage type and duration, is set out in our Cookie List, which is available in the Cookie management section of our Website.

We use the following types of cookies and similar technologies:

(i) essential (strictly necessary) cookies that are necessary to provide access to our Websites and to provide the services you have specifically requested, to enable basic website functions such as maintaining your logged-in session in the Platform, protecting forms against cross-site request forgery, network management, load balancing, bot and attack mitigation, accessibility, and recording your cookie preferences. We process your personal data on contractual basis to provide you with the services requested by you on our Websites and on the basis of our legitimate interest to operate and secure the Websites. It is not possible to disable essential cookies through the Privacy settings as our Websites might not function properly when you disable this type of cookies.

(ii) functional cookies allow us to remember choices you have made in the past, such as what language you prefer, the number of rows shown in tables and your saved filter settings in the Platform, and allow for personalization. Some of these preferences are stored in the local storage of your browser rather than in a cookie. We process your personal data based on your consent.

(iii) analytical (performance) cookies help us analyse how you move around our Website and the Platform and what content is relevant to our users. They are used for performance measurement and improvement, and where enabled for heatmaps and session replay. We process your personal data based on your consent.

Through cookies and similar technologies we may collect your IP address, information about your device, browser and operating system, unique device and browser identifiers, screen size, time zone and language, the pages you visit on our Websites and how long you spend on them, the address you arrived from and any campaign parameters it contained, and information about how you interact with the Websites, such as scrolling, clicking, changes of form inputs and form submissions.

When you visit our Websites, you will be informed via the cookie banner located at the bottom of the website that we collect cookies. This banner allows you to manage what cookies Realpad can collect. Cookies and other tracking technologies which are not strictly necessary are only placed on your device after you have given your consent. You can change your settings and withdraw your consent at any time via the Cookie management section at the bottom of our Website.

Other tracking technologies

Apart from cookies, we also use other technologies that help us to operate our Websites and to analyse your behaviour. We currently use:

• client-side event capture by the analytics software development kits integrated into our Websites, including automatic capture of interactions with page elements;
• session replay of your interaction with the user interface, where enabled;
• local storage and session storage of your browser;
• URL and campaign parameter tracking, including UTM parameters and advertising click identifiers;
• pixels and web beacons in our e-mail communication, which allow us to establish whether a message has been opened;
• map components in the Mobile Apps, which transmit your IP address and technical data about your device to the relevant map provider; and
• embedded third-party video players on our Website.

The above technologies may have access to your device's IP address, device screen size, device type, unique device identifiers, operating system, browser information, approximate geographic location derived from the IP address, time stamp, time zone, preferred language used to display our Websites, activities and navigation on our Websites, and length of visit.

We also use so-called social plugins and links on our Website from linkedin.com (“plugins”), which are indicated by their logos on our Website. When you visit our Website, your browser establishes a direct connection with the servers on which these plugins run. The content of the plugins is transferred directly by the social network to your browser, which then integrates it into our Website.

Integration of the plugins causes the social network to receive the information that you have accessed the corresponding page of our Website, regardless of whether you interact with the plugin or not. If you are logged in with the social network, it will be able to assign your visit to your account on that social network. If you do not want the social network to gather data about you via our Website, you must log out of it before visiting our Website. If you wish to learn about how the social network processes your data, please visit the privacy policy of the respective social network.

Disabling cookies

If you do not wish cookies to be collected, you can restrict, block or delete them at any time by adjusting your browser configuration.

If you wish to prevent the installation of new cookies or if you wish to delete existing cookies, you can find instructions at the links below. The exact procedure depends on the browser you are using:

• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/kb/clear-cookies-and-site-data-firefox
• Microsoft Edge: https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
• Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471

For mobile devices, you can limit tracking through your device's privacy settings, for example by deleting or resetting the advertising identifier. Step-by-step instructions are published by the Network Advertising Initiative at https://thenai.org/how-to-opt-out/advertising-privacy-settings-on-mobile-devices/.

In addition, where interest-based advertising is used, you can opt out of it through the industry tools operated by the European Interactive Digital Advertising Alliance, available in Czech at https://youronlinechoices.eu/cz/, and, for advertising delivered by companies based in the United States, through the Digital Advertising Alliance and the Network Advertising Initiative.

How long will we process your data?

In general, personal data shall be retained for as long as necessary for the purpose for which they were processed. The period for which Realpad will retain your personal data also depends on the legal basis on which your data are processed. If the processing is based on a legitimate interest, your data will be processed for the duration of that legitimate interest of Realpad. In the case of data retained on the basis of legal obligations, the retention period is determined by applicable legal regulations. For data processed on the basis of the performance of a contract, the data are processed for the duration of the contractual relationship and for the relevant limitation period. If the processing is based on your consent, your personal data will be deleted after the withdrawal of consent. You can withdraw your consent to the processing of your personal data at any time by sending a message to privacy@realpadsoftware.com. Please note that the same data may also be processed on more than one legal basis, in which case your withdrawal of consent or request for erasure of personal data may not result in the complete erasure of your personal data. Withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal.

If you create an account on our Website or application, we will process your personal data for the duration of that registration. You can request deletion of your account at any time. Please note that we need to retain the audit-trail records relating to your account even after the account itself has been deleted, in order to preserve the integrity and evidential value of the record of changes made in the Platform.

Unless a longer period is required by law, we apply the following retention periods:

• account data and user profile: for the duration of the registration and for 3 years after the account is deleted;
• audit-trail records of changes made in the Platform: for the duration of the contract with the relevant client and for 3 years thereafter;
• IP addresses recorded following incorrect log-in attempts: 7 days;
• other security and technical logs: 12 months;
• support tickets and support conversations: 3 years from closure of the ticket;
• contractual documentation, invoices and accounting records: up to 10 years, as required by tax and accounting legislation;
• marketing contacts and newsletter subscriptions: until withdrawal of your consent, and in any event no longer than 3 years from your last interaction with our marketing communication;
• recruitment data: for the duration of the selection procedure and for 6 months thereafter, or longer where you have given us your consent;
• cookies and similar storage entries: for the duration stated in the Cookie List, or until you delete them or withdraw your consent; and
• analytics events and session recordings: 30 days

Where a particular processing operation is not listed above, we retain the personal data for as long as necessary for the purpose concerned, in accordance with the principles set out at the beginning of this section.

Data sharing, processors and transfers to third countries

Your personal data will not be shared with any third party except in the following situations:

• data are necessary for the provision of Realpad services,
• based on your consent,
• entrusting personal data to processors who process personal data on behalf of Realpad,
• Realpad is obliged to provide personal data based on the law or order of a public authority.

We do not sell your personal data and we do not forward it to any third party that does not result in a clear benefit for you or that is not necessary for the provision of our Services.

Categories of Processors

We may share your data with processors in the following categories, in particular:

• data centre and hosting providers,
• website and content delivery providers,
• e-mail delivery providers,
• analytics, product analytics and session recording providers,
• customer support and communication tool providers,
• map and crash reporting service providers used in our Mobile Apps,
• marketing providers,
• business management, task management, communication and other IT tools,
• our contractors and other partners who assist us in providing our services,
• legal services, tax, accounting, and audit services,
• recruitment and applicant verification providers,
• providers of artificial intelligence and machine-learning tools,
• information security providers.

If you would like to know which specific suppliers we use, you can request the current list at privacy@realpadsoftware.com and we will provide it.

Transfers to third countries

In some cases, Realpad may transfer your data to countries outside the EU/European Economic Area. Such a transfer can only take place if it complies with the GDPR. This means, for example, that the provider is based in a country for which the European Commission and/or UK Secretary of State has issued a decision that it provides an adequate level of protection for personal data, or that standard contractual clauses issued by the European Commission and/or other transfer mechanisms are in place that provide adequate safeguards with respect to the protection of your personal data. It may be necessary to apply certain additional measures in order to provide the data subject with a level of protection substantially equivalent to that guaranteed by the GDPR. You may request a copy of the relevant safeguards at privacy@realpadsoftware.com.

The personal data you enter into the Platform and the backups of that data are stored within the European Union, namely in a data centre in France and, in the case of backups, in the Czech Republic.

Data security

Realpad undertakes to ensure that your personal data is stored securely. All communication with our Services takes place over a secure HTTPS connection. Realpad has taken appropriate technical and organizational measures to secure the personal data processed by Realpad, including, for example:

• Encryption: All sensitive data is encrypted in transit; encryption of data at rest is being progressively implemented.
• Access Controls: Access to personal data is restricted to authorized personnel only, based on the principle of least privilege.
• Secure Hosting: We store data on secure servers with robust firewalls and intrusion detection systems, operated by an established data centre provider, and we maintain backups on a separate secured server.
• Password Protection: All systems and databases are protected by strong password policies and, where supported by the relevant system, multi-factor authentication.
• Audit Trail: Changes to CRM and financial data in the Platform are logged together with the identity of the acting user, the time and the originating IP address.
• Employee Training: Our team undergoes regular training to understand and comply with data security best practices.
• Regular Updates: Our software, systems, and hardware are regularly updated to address potential security vulnerabilities.

These measures do not relieve you of the obligation to take appropriate measures to secure your personal data. You should, among other things, change your passwords regularly. On the other hand, you should not, among other things, use predictable usernames and/or passwords, share your passwords with others or provide access to your administrator account and/or disclose your personal information to others. Realpad will never ask you for your password in any unsolicited communication. Immediately notify us of any unauthorized use of your administrator account or any other suspected breach of security.

Your rights

Under the GDPR, you are entitled to the following rights:

Right of access

You have the right to be informed about, among other things, what personal data Realpad processes about you, for what purposes and who the recipients of your personal data are. A significant part of the data we hold about you can be reviewed by you directly in the Platform.

Right to rectification

You have the right to have any of your incomplete, inaccurate or outdated personal data rectified. Much of this data can be corrected by you directly in the Platform.

Right to erasure

You are entitled to the erasure of certain personal data that we have collected and processed about you. You can request deletion of your account at any time. Please note that we will need to retain the audit-trail records relating to your account even after the account has been deleted.

Right to restriction of processing

In given cases such as when we process inaccurate personal data about you, or you deem the processing as no longer necessary, you may ask for a restriction of the processing.

Right to data portability

You have the right to obtain the personal data you provide to us in a structured, commonly used and machine-readable format and to request that it be transferred to another controller, if technically feasible. Please note that the right to data portability only applies to data that you have provided to us and that we process as controller on the basis of your consent or the performance of a contract. Some of the data held in the Platform was entered in the course of your work and belongs to your employer rather than to you; in that case the request must be addressed to your employer as the controller.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you that is carried out in the public interest or for the purposes of Realpad's legitimate interests, including profiling.

Right to withdraw consent

If your data is processed based on your consent, you are entitled to withdraw such consent at any time. Kindly note that the withdrawal of your consent will not affect the lawfulness of processing based on your consent before its withdrawal.

Right to opt-out from marketing communication

You are entitled to opt out from receiving marketing communication. You can exercise this right in accordance with the opt-out rules described in each marketing e-mail or other form of communication via the unsubscribe option in the footer of every e-mail or by directly contacting Realpad.

Right not to be subject to the automated individual decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision:

• is necessary for entering into, or performance of, a contract between you and Realpad;
• is authorised by the law and the law lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• is based on your explicit consent.

Realpad does not make decisions based solely on automated processing that would have significant effects on its users. For the sake of completeness, we note that Realpad uses cookies and similar technologies, the use of which may constitute profiling. Information on how to withdraw your consent to the use of cookies or disable cookies can be found in the chapter about cookies of this Privacy Notice.

Right to lodge a complaint

If you believe that your data has been processed unlawfully, please contact us and we will try to resolve the issue. Under the GDPR and UK GDPR, you have the right to file a complaint with your relevant EU Data Protection Authority (https://edpb.europa.eu/about-edpb/board/members_en) As Realpad is established in the Czech Republic, the competent supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz. Under the UK GDPR, you may also lodge a complaint with The Information Commissioner's Office (https://ico.org.uk/).

Your ability to exercise your rights may be restricted if Realpad is required to retain your personal data for legal obligations, legal claims, or other reasons as outlined in the relevant data protection law.

Contact details

If you wish to exercise any of your rights set out above, please contact us at privacy@realpadsoftware.com.

If you would like to learn more about Realpad, its privacy protection or this Privacy Notice, you may contact Realpad at privacy@realpadsoftware.com.

Please help Realpad to keep your information up to date. If you believe that any data processed by Realpad is incorrect, or if you believe that Realpad is not complying with this Privacy Notice, please contact Realpad at privacy@realpadsoftware.com.

Realpad has not appointed a Data Protection Officer, as it is not required to do so under Article 37 of the GDPR.

Final provisions

The English-language version of this Notice shall be controlling in all respects and shall prevail in case of any inconsistencies with translated versions Realpad may provide, if any.

This Privacy Notice may be amended by Realpad at any time. If we make any material/substantial changes to this Privacy Notice, we will post the updated version of the Privacy Notice to our Website and/or other places we deem appropriate. We may notify you of the change via sending you an email or providing other notice of the update, however you should check this Privacy Notice from time to time for any significant changes to its text.