DreamEstate is committed to protecting your privacy. This policy explains which personal data we process when you use our real estate platform, the agency panel, “Moj dom” and the building management tools: for what purposes, who can see it, how long it is kept and whom to contact to exercise your rights. We process data in accordance with the personal data protection regulations in force in Montenegro. Some features described here are being switched on gradually; the section on a feature applies from the day that feature becomes available.
1Data Collection
We collect data that you provide directly to us, including: • Full name • Email address • Phone number • Property data you publish • Search preferences and favorite properties • Messages exchanged through our platform • Data you enter in the agency panel, in “Moj dom” or when managing a building Others may also enter data about you: an agency you sent an inquiry to or viewed a property with, a landlord who rents you a flat or accommodation, and the manager of your building. These processing activities are described in the sections below.
2Data Usage
We use your data to: • Provide and improve our services • Connect buyers and sellers of real estate • Send notifications about properties you're interested in • Analyze and improve user experience • Prevent fraud and abuse • Provide tools that agencies, landlords and building managers use to meet their contractual and legal obligations (described in the sections below)
3Who Is Responsible for Your Data
We are responsible for some of your data, and the person or company you deal with is responsible for the rest. The controller decides the purpose and means of processing. The processor processes data on behalf of the controller and on its instructions. DreamEstate is the controller for: • your account, listings, messages, favorite properties and searches • data you enter in “Moj dom” for your own flat The real estate agency is the controller, and DreamEstate the processor, for: • contacts and inquiries in the agency's contact records • viewing reminders • brokerage agreements, the brokerage register and commissions • invitations and data about members of the agency team The flat owner (landlord or accommodation provider) is the controller, and DreamEstate the processor, for: • leases, handover records and deposit settlements • short-term rental bookings and guest data An agency that manages the flat under an agreement with the owner processes this data on the owner's behalf. The building manager is the controller, and DreamEstate the processor, for data about unit owners, charges, payments, bank statements and voting in that building. As a processor, we process data only to provide the service to the controller. We do not use it for our own purposes and we do not sell it. Platform administrators have no access through the application to agency contacts or brokerage agreements.
4Inquiries to Agencies and Contact Records
When you send a message about an agency listing or a viewing request, your inquiry is added to the contact records of the agency the listing belongs to. What data: • from a conversation: full name, email and phone from your account, and the account identifier • from a viewing request: name, email and phone from the form and the requested time • the listing you were interested in, the status of the inquiry and the agent's notes • the criteria you are searching by (e.g. city, price, area), if the agent enters them The text of your messages and of the form message is not copied into the contact records. Purpose and legal basis: so the agency can answer your inquiry, arrange a viewing and offer you suitable properties. The basis is taking steps at your request before entering into a contract and the agency's legitimate interest in keeping records of its inquiries. Who can see it: the agency administrator and the agent the contact is assigned to. While a contact is unassigned, all agents of that agency can see it. A contact never passes to another agency. Retention and deletion: a contact is kept until the agency deletes it. Deletion immediately removes the name, email, phone and note text. Only data that does not identify you remains: status, inquiry source, dates and the link to the listing. To request deletion, contact the agency. If the inquiry leads to a brokerage agreement, its data is kept under the rules in the section on brokerage agreements.
5Viewings and Reminders
For a viewing of a property advertised by an agency, the agency may send you a reminder by email. The reminder arrives automatically the day before the confirmed appointment, or the agent sends it manually. DreamEstate sends the message on behalf of the agency, and the agent receives a copy. What data: your name and email address, the viewing time, the property title and address, the agent's name and the agency's contact details. The message includes a calendar file (ICS) with the appointment that you can add to your calendar. Purpose and legal basis: organising a viewing you requested or arranged with the agency, i.e. steps taken at your request before entering into a contract. Limits: reminders exist only for agency listings, not for listings by private individuals. One address receives no more than three reminders in 24 hours. To enforce this limit, the sending log stores only a one-way fingerprint (hash) of the address, and the address is masked in technical logs. Record of visits: when the agent marks a viewing as completed, the agency records the visit (date, listing and your name) as proof of visits in the brokerage register, which it keeps under the Law on Brokerage in Real Estate Sales and Leases. This record is kept as part of the brokerage register. If you do not want reminders, let the agency know.
6Brokerage Agreement and Brokerage Register
In the panel, an agency can keep brokerage agreements with its principals (sellers, buyers, landlords and tenants) and the brokerage register. What data: • full name or business name, address, and the attorney or legal representative of the principal • the principal's personal identification number (JMBG), tax number (PIB) or passport number • property details (municipality, location, cadastral parcel, area), price, commission and duration of the agreement • a scan of the signed agreement • a concluded deal: date, amount, commission and fiscal invoice number • the agent handling the case and completed property viewings (dates and the visitor's name) Purpose and legal basis: concluding and performing the brokerage agreement, and the agency's legal obligation under the Law on Brokerage in Real Estate Sales and Leases (Official Gazette of Montenegro, Nos. 89/2025 and 114/2026) and the Rulebook on the detailed content, manner of keeping and retention period of the brokerage register (Official Gazette of Montenegro, No. 45/2026). Who can see it: the agency administrator and the agent responsible for the agreement. Only they can see the full JMBG, PIB or passport number, in the agreement details and in the print document. It is hidden in lists, and the brokerage register does not contain it. The expiry reminder the agent receives contains neither the identification number nor the address. Security: JMBG, PIB and passport numbers are stored encrypted (AES-256-GCM) with a dedicated key, separate from the platform's other keys. Retention: the brokerage register is kept permanently, and the agreement and supporting documents for 10 years, as the rulebook requires. The right to erasure of this data may therefore be restricted while that period runs.
7Agency Members and Invitations
An agency owner can invite an agent to the team by email. • We store the invited person's address, who sent the invitation, when it was sent and its status. • The invitation link is valid for 7 days. The link exists only in the email; we store only a one-way fingerprint of it. • A person becomes a member only after signing in and accepting the invitation themselves, with an account on the address they were invited to. • The agency owner can revoke an invitation, and an invitation that is not accepted expires. For the Register of Brokers, the agency may enter data about a member's professional exam: whether it was passed, the certificate number and date, and a scan of the certificate. This is visible to the agency owner, the member and platform administrators. When an agent leaves the agency, their name remains in the brokerage register as the agent who handled the case, because the register is kept permanently. The agency is the controller for this data. The legal basis is the agency's legitimate interest in organising its team and its legal obligation related to the Register of Brokers.
8Leases: Flat Handover and Deposit
When the owner, or an agency managing the flat, keeps a lease on the platform, handover records (move-in and move-out) and a deposit settlement can be kept with it. What data: • the tenant's name and email from the lease • the handover date, number of keys and meter readings (electricity, water and others) with meter numbers • an inventory of items and their condition, notes and photos of the flat • who signed the record and when, and the tenant's confirmation and comment • the deposit settlement: amount, deductions and their description, refund, any amount owed, payment date and reference Photos: before a photo is stored, its metadata (EXIF and similar) is removed, including GPS location and capture time. We accept only JPEG, PNG and WebP up to 10 MB. Purpose and legal basis: performance of the lease and proof of the flat's condition at move-in and move-out, as the basis for settling the deposit. Who can see it: the flat owner, people the owner has given access to the flat, and an agency with an active management agreement. The tenant sees a record once it is signed and the deposit settlement once it has been sent, and receives an email about it. Retention: for the duration of the lease and afterwards for as long as needed to settle the deposit and prove the flat's condition. A record confirmed by the tenant cannot be changed or deleted in the application. Send requests about this data to the flat owner or the agency managing the flat.
9Short-Term Rentals and Guest Registration
The flat owner, or an agency managing the flat, can keep short-term rental bookings on the platform, together with the guest data needed to register their stay. What data: • the lead guest of a booking: full name, phone, email and a note • the booking: arrival and departure dates, number of adults and children, children's ages, channel (e.g. Airbnb, Booking), price and tourist tax • each guest for stay registration: full name, citizenship, type and number of identity document (passport, ID card or other document), date of birth and a mark that the guest has been registered Purpose and legal basis: compliance with the accommodation provider's legal obligation to register guests' stays and calculate tourist tax, and performance of the accommodation contract. DreamEstate does not send guest data to the authorities; stay registrations and tax returns are filed by the accommodation provider. Who can see it: only the flat owner, a person the owner has given management rights, and an agency with an active management agreement, on a separate guest screen. People with view-only access cannot see guest data or the lead guest's contact details. The tourist tax overview and export do not contain guest names. Security: document numbers are stored encrypted (AES-256-GCM). Retention: 90 days after the departure date, the data is automatically anonymised. The full name, citizenship, identity document and date of birth of each guest are erased, as are the lead guest's phone, email and note. The same applies to cancelled and deleted bookings. Exception: the full name of the lead guest of a booking is not erased after 90 days. It stays with the booking as an accounting record, linking it to the payout from the sales channel (e.g. Airbnb, Booking) and to the statement for the owner, and is kept for as long as accounting documentation under the accounting regulations. Send requests about this data to the flat owner or the agency managing the flat.
10“Moj dom” and Building Management
“Moj dom” (bills and utilities): • We store data about your flat, subscriber and meter numbers with utility providers, bill amounts and due dates, and the bills you upload. • When a provider's portal requires a password, we store it encrypted, use it only to fetch bills and never display it. • If you choose to have a bill read by artificial intelligence, the image or PDF of the bill is sent to that service provider (OpenAI) to extract the amount, due date and provider. • You can give others access to your flat (e.g. a tenant, a family member or an agency). They see data within the role you give them, until you revoke access. For data about your own flat, DreamEstate is the controller, and the legal basis is providing the service you requested. Building management: • The manager keeps records of unit owners and building members (name, email, unit and area), charges, payments and debts. • Electronic voting at the owners' meeting: the vote per unit, voting method, who voted and when, and a note about a proxy are recorded. • Bank statement import (CSV or XLSX) to match payments: the date, amount, payer's name and account, payment reference and description are stored, together with the remembered link between a payer and a unit. The statement file itself is not stored, only its fingerprint to detect duplicates. • Fault reports and the notice board; metadata (EXIF) is removed from fault report photos. A unit owner sees the balance of their own unit and the total balance of the fund, not other owners' debts. The building manager is the controller, and DreamEstate the processor. The legal basis is the manager's obligations under the regulations on the management and maintenance of residential buildings and the decisions of the owners' meeting. Send requests about this data to the building manager.
11Data Security
We apply modern technical and organizational measures to protect your data from unauthorized access, loss, or misuse: • All data is transferred via encrypted connection (SSL/TLS). • Access is role-based: everyone sees only the data of their own agency, flat or building, and only to the extent of their role. • Guests' document numbers, principals' JMBG, PIB and passport numbers, and utility portal passwords are stored encrypted with AES-256-GCM. The keys are not stored in the database, and a dedicated key is used for principals' data. • Metadata (EXIF and similar), including GPS location, is removed from handover and fault report photos before they are stored. • Handover and fault report photos and agency PDF documents open through temporary links that expire after 15 minutes. • Invitation links are stored only as a one-way fingerprint. • In technical logs about sending reminders, email addresses are masked.
12Payment processing
Payments for subscriptions and points are processed by Paddle.com Market Limited, as the seller towards you and as an independent controller of the payment data. We never see or store your card details — you enter them on Paddle's page. From Paddle we receive only what we need to keep a record of your subscription and invoices: the purchase and invoice reference, which plan or points pack was paid for, the amount and currency, the subscription status and billing date, and the email address the payment was made from. The invoice is issued and sent by Paddle. Paddle's own terms and privacy policy are available at paddle.com. When and how money is returned is described in our Refund Policy.
13Retention Periods
Overview of retention periods for the features described in this policy: • Contacts in an agency's records: until the agency deletes them; deletion immediately removes personal data • Brokerage register, including completed visits: permanently • Brokerage agreement and supporting documents: 10 years • Guest data for stay registration and the lead guest's contact details: 90 days after departure, then anonymised • Full name of the lead guest of a booking: as long as accounting documentation • Handover records and deposit settlements: as long as needed to settle the deposit and prove the flat's condition • Agency invitation link: valid for 7 days Where regulations require data to be kept, it is not erased before the prescribed period ends.
14Cookies
We use cookies to improve your experience on our platform. More information about cookies can be found on our cookies page.
15Third Parties
We do not sell your personal data to third parties. Data may only be shared with: • Real estate agencies you send an inquiry to or work with • The flat owner, the agency managing the flat or the building manager, to the extent described in this policy • People you yourself give access to your flat in “Moj dom” • Service providers who help us run the platform (e.g. email delivery, reading bills with artificial intelligence), only to provide that service • Authorities when legally required Guest stay registrations and tourist tax returns are filed with the authorities by the accommodation provider, not by DreamEstate.
16Your Rights
In accordance with the personal data protection regulations in force, you have the right to: • Access your data • Correct inaccurate data • Request deletion of your data • Object to processing based on legitimate interest • Withdraw consent for data processing, where processing is based on consent • File a complaint with the competent personal data protection authority Whom to contact: • for your account, listings, messages and “Moj dom” for your own flat: us • for contacts, viewings and reminders, brokerage agreements and the register: the agency • for leases, handovers, deposits and guest data: the flat owner or the agency managing the flat • for data in a building: the building manager If you send us a request and the controller is an agency, a flat owner or a building manager, we will forward it to the controller without delay. The right to erasure may be restricted where regulations require data to be kept, for example for the brokerage register, brokerage agreements and accounting documentation.
17Changes to This Policy
We update this policy from time to time. The date of the last update is shown at the top of the page. The update of September 14, 2026 added these sections: who is responsible for your data; inquiries to agencies and contact records; viewing reminders; signed viewing confirmation; brokerage agreement and register; agency members and invitations; flat handover and deposit; short-term rentals and guest registration; “Moj dom” and building management; retention periods. The update of September 15, 2026 removed the section on signed viewing confirmations, because the feature is not in use and no confirmation was ever created, and added to the section on viewings that the agency records completed visits in the brokerage register. The update of September 24, 2026 added the section on payment processing, because payments for subscriptions and points are processed by Paddle as the seller. Features are being switched on gradually. The section on a feature applies from the day it becomes available on the platform.
18Contact
For all privacy-related questions, you can contact us at: Email: [email protected] Address: Podgorica, Montenegro