Legal
Last updated: 1 August 2026
This policy explains which personal data Noventis d.o.o. processes when operating the nreport.ai website and providing the nReport service, why it does so, on what legal basis, who it is shared with, how long it is kept, and what rights you have. It is prepared in accordance with Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
The controller of personal data is:
For all data protection questions and to exercise your rights, write to privacy@nreport.ai or to the company's registered address.
Given the nature, scope and purposes of the processing, the controller is not required to appoint a data protection officer (Article 37 GDPR). Should that change, we will publish the contact details here.
| Category | Specific data | Source |
|---|---|---|
| Account data | email address, name (if provided), hashed password, sign-in provider identifier (Google, Facebook), registration date, language | from you or your sign-in provider |
| Order data | address and identification of the property queried, apartment number, property type, reports produced, credit balance, usage history, the time a report was first opened, its PDF downloaded and its negotiating brief viewed | from you and from operation of the service |
| Payment data | amount, currency, time, payment status, payment provider session identifier, invoice details. We neither receive nor store payment card data. | from the payment service provider Stripe |
| Technical data | IP address, browser and device information, access time, requested URLs, error traces | automatically during use |
| Consent records | your cookie choice and its timestamp, newsletter consent, consent to immediate performance at purchase | from you |
| Communications | the content of messages you send us and our replies | from you |
| Usage and marketing data | in-app events, traffic sources, conversions — only to the extent you have permitted through your cookie consent | automatically, upon consent |
We do not collect special categories of personal data under Article 9 GDPR (such as health, religious or political data) and ask that you do not send them to us.
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing the user account and sign-in | performance of a contract — Art. 6(1)(b) GDPR | until the account is deleted; then up to 30 days in backups |
| Producing and delivering the ordered report | performance of a contract — Art. 6(1)(b) GDPR | for the lifetime of the account, so reports remain accessible |
| Processing payments and preventing fraud | performance of a contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c); legitimate interest — Art. 6(1)(f) | per accounting record retention rules |
| Issuing and keeping invoices, tax obligations | legal obligation — Art. 6(1)(c) GDPR (ZDDV-1, ZGD-1) | 10 years from the end of the year the invoice relates to |
| Transactional notifications (order confirmation, report ready, password reset) | performance of a contract — Art. 6(1)(b) GDPR | until the account is deleted |
| User support and complaint handling | performance of a contract — Art. 6(1)(b); legitimate interest — Art. 6(1)(f) | 3 years after the matter is closed |
| System security, logs, abuse prevention | legitimate interest — Art. 6(1)(f) GDPR | normally 90 days; longer only while investigating a specific incident |
| Measuring traffic and improving the service (analytics) | consent — Art. 6(1)(a) GDPR and Art. 225 ZEKom-2 | until consent is withdrawn; cookies per the Cookie Policy |
| Advertising and measuring advertising performance | consent — Art. 6(1)(a) GDPR and Art. 225 ZEKom-2 | until consent is withdrawn |
| Sending the newsletter | consent — Art. 6(1)(a) GDPR | until you unsubscribe or withdraw consent |
| Establishing or defending legal claims | legitimate interest — Art. 6(1)(f) GDPR | until the limitation periods expire |
Where we rely on legitimate interest, we have carried out a balancing test between that interest and your rights. We will provide a summary on request at privacy@nreport.ai.
The address of the property you query is order data for us. Where the property relates to you (for example your home), it is also your personal data and we treat it like any other order data.
A report may contain public-register data relating to third parties — in particular where a land registry excerpt showing ownership or encumbrances is available for the property. We process that data solely to produce the report you ordered, on the basis of legitimate interest under Article 6(1)(f) GDPR, and only to the extent it is already publicly accessible in the register.
We do not build profiles of individuals from that data, do not maintain a separate database of owners, and do not use it for marketing. As the data is not obtained directly from the individual and informing each individual would involve disproportionate effort, we rely on the exemption in Article 14(5)(b) GDPR and publish this policy instead of giving individual notice.
As the customer, you are responsible for having a legitimate interest in querying a particular property (for example an intended purchase, lease, financing, valuation or ownership). The service must not be used to track, harass or profile individuals.
To produce reports we use publicly accessible sources: the registers of the Surveying and Mapping Authority of the Republic of Slovenia (real estate cadastre, real estate register, Real Estate Market Register), the land registry, the register of energy performance certificates, mapping sources, and publicly published property listings. These sources are outside our control and are subject to the terms of their operators.
Some processors are established or have support operations in the United States. In those cases the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework (where the recipient is certified) or on the Commission's standard contractual clauses, supplemented by a transfer impact assessment and additional technical measures such as encryption in transit and at rest and access restrictions.
You may request a copy of the safeguards used at privacy@nreport.ai.
A report, including the indicative property value estimate, is produced automatically without human review. This processing concerns the property and does not produce legal effects concerning an individual or similarly significantly affect them, so it is not automated decision-making within the meaning of Article 22(1) GDPR.
We do not use your personal data for automated creditworthiness or risk scoring or similar ranking of individuals.
In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you without undue delay and notify the Information Commissioner within 72 hours.
In relation to your personal data you have the right to:
Send requests to privacy@nreport.ai. We respond within one month of receipt at the latest; for complex requests we may extend this by two months and will tell you if we do. Exercising your rights is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse the request. For security reasons we may ask for additional information to verify your identity.
You can also request deletion of your account and data through the dedicated form on the website. We must retain some data despite a deletion request where the law requires it — in particular issued invoices for the tax retention period.
If you believe the processing of your personal data infringes the law, you have the right to lodge a complaint with the supervisory authority:
You may also lodge a complaint with the supervisory authority in the country of your habitual residence or of the alleged infringement.
Providing your email address and the property details is a condition for concluding and performing the contract — without them we cannot produce and deliver a report. Providing data for the newsletter and consenting to non-essential cookies are entirely voluntary; refusing them does not affect your use of the service.
The service is not intended for persons under 18 and we do not knowingly collect their data. If we find that we have processed a minor's data without an appropriate basis, we delete it. If you believe this has happened, tell us at privacy@nreport.ai.
The website contains links to third-party sites (for example official registers or listing portals). We are not responsible for their content or their handling of personal data; we recommend reading their privacy policies.
We may update this policy when the service, our processors or the law change. Every version carries the date of the last update. We notify registered users of material changes by email or by a notice on the website; where a change requires your consent, we will obtain it separately.