Privacy Policy

1. Controller and contact

We have not appointed a data protection officer, because we are not required to do so under Article 37 GDPR. All requests concerning personal data can be sent to the e-mail address above.

2. What personal data we process, why, and on what legal basis

We obtain personal data only directly from you (when you fill in a form, write to us, use the chatbot or browse the website). We do not buy data or obtain it from other sources.

2.1 Contact and property inquiries

When you submit the contact form, a property inquiry, an inquiry to an agent, or a form on one of our project pages (Dříteč, Jiříkovice, Vlašim), we process your name, e-mail address, phone number (optional) and the text of your message. We also record the language of the site, the page from which the form was sent and, where relevant, the property or agent concerned. For protection against spam and misuse we also store your IP address and browser identification (user agent).

• Purpose: responding to your inquiry, arranging a viewing and negotiating about a property.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); IP address and user agent: our legitimate interest in protecting the website against spam and abuse (Art. 6(1)(f) GDPR).
• Where it goes: our database, an e-mail notification to the responsible agent, and a confirmation e-mail to you.
• Retention: 3 years from the last communication with you, then deleted.
• Provision of data: voluntary; without a name and e-mail address we cannot answer your inquiry.

2.2 Sending a project presentation (PDF)

On selected project pages you can request a PDF presentation by e-mail. We process your name, e-mail address, phone number (optional), IP address and user agent, we record the request as an inquiry, and we send you an e-mail with a link to the PDF. On the Dříteč project page the request is linked to a subscription to our newsletter (see 2.3); you can unsubscribe at any time using the link in every e-mail.

• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); newsletter subscription: your consent (Art. 6(1)(a) GDPR).
• Retention: 3 years from the last communication; newsletter data until you withdraw consent.

2.3 Newsletter

If you subscribe to our newsletter (in the website footer or when requesting a project presentation), we process your e-mail address and the date and fact of your consent so that we can send you news about our properties and services. Mailings are sent through Brevo.

• Legal basis: your consent (Art. 6(1)(a) GDPR and Section 7 of Act No. 480/2004 Coll. on certain information society services).
• Withdrawal: at any time via the “unsubscribe” link in every e-mail or by writing to it@realblue.cz. After unsubscribing we stop sending; we keep your address only with an “unsubscribed” flag so that we can honour your choice.

2.4 AI chatbot Sisi

The chatbot Sisi uses the Groq API to generate replies. The content of your conversation (your messages and the assistant's replies) is sent to the servers of Groq, Inc. in the USA for processing. We do not store conversations in our database: the session ends when you close the chat window. Please do not enter sensitive information in the chat.

If you leave your contact details in the chat (name, phone number, e-mail address, type of request and an optional note), we store them as an inquiry and send them by e-mail to our agents so that they can contact you. Only conversation metadata (number of messages, response time) is sent to our analytics tool PostHog, never the text of messages, and only with your consent to analytics.

• Legal basis: our legitimate interest in providing an interactive information service (Art. 6(1)(f) GDPR); contact details left in the chat: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Retention: conversations are not stored on our side (Groq's retention rules apply to its infrastructure); contact details from the chat 3 years from the last communication.

2.5 Website analytics

We use three analytics tools. Plausible Analytics works without cookies and without identifying you, so it runs without consent. PostHog and Microsoft Clarity are loaded only after you grant consent for the “Analytics” category in the cookie banner; without consent they collect nothing and set no cookies. Details are in section 3.

• Legal basis: Plausible: legitimate interest in measuring website traffic (Art. 6(1)(f) GDPR); PostHog and Microsoft Clarity: your consent (Art. 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll. on electronic communications).

2.6 Bot protection and maps

Our forms and the administration login are protected by Cloudflare Turnstile, which evaluates technical signals from your browser (including IP address) to tell humans from robots. The interactive maps on project pages are provided by Mapbox; when a map is displayed, your IP address is transmitted to Mapbox in order to load the map tiles. Mapbox telemetry is disabled.

• Legal basis: our legitimate interest in the security of the website and in displaying property locations (Art. 6(1)(f) GDPR).

2.7 Administration accounts

Our agents and staff log in to the website administration. Their login data (name, e-mail address, hashed password) is processed on the basis of our contract with them and for the duration of their cooperation with us.

3. Cookies and similar technologies

Besides technically necessary and functional cookies, this website uses analytics tools only with your consent. We do not use any marketing or advertising cookies. You can change your choice at any time via the “Cookie settings” link in the footer.

Plausible Analytics

Aggregated visitor statistics (page views, referrers, country, device type). Self-hosted on a server in the EU, no cookies, no cross-site tracking, IP addresses are not stored.

PostHog

Product analytics and session replay used to improve the website. We collect page views, clicks, scrolling and website events (viewing properties, using filters and galleries, clicking contact links, using the chatbot, and form submissions recorded as an event without their content), technical data about your device and browser, an approximate location derived from your IP address, an anonymous cookie identifier, masked session replays and error reports. In replays all input fields are masked and the chatbot window, the cookie banner and forms containing personal data are excluded from recording. We do not send names, e-mail addresses, phone numbers or message texts to PostHog. PostHog requests pass through the website's domain and are forwarded to PostHog's EU cloud (Frankfurt). PostHog is never active in the administration area. Retention at PostHog: events 1 year, session replays 30 days.

Microsoft Clarity

Session replay and heat maps used to understand how visitors use the website. Clarity records page views, clicks, scrolling, mouse movement, device and browser information and an approximate location derived from your IP address, and sets Microsoft cookies (see the table). Input fields are masked. Clarity is loaded only after consent and never in the administration area; if you withdraw consent, we stop Clarity and delete its cookies on our domain. Data is processed by Microsoft, which may transfer it to the USA (see section 5). Retention at Microsoft: session recordings 30 days, aggregated heat-map data 13 months.

On the live site, browsers show the login cookies with the __Secure- or __Host- prefix. Cookies of Microsoft services on third-party domains cannot be deleted by us; you can remove them in your browser settings.

4. Recipients and processors

Within our company, personal data is accessed only by the agents and staff who need it to handle your inquiry. We share data only with the following processors and recipients, strictly to the extent necessary. We do not sell personal data and do not pass it to third parties for their own marketing.

• Brevo (Sendinblue SAS), Paris, France — delivery of inquiry notifications, confirmation e-mails, project presentations and the newsletter. Data is stored in the EU.
• Cloudflare, Inc., USA — bot protection via Turnstile on forms and the login page.
• Groq, Inc., USA — AI processing of chatbot Sisi conversations.
• Mapbox, Inc., USA — interactive property maps; telemetry disabled.
• Microsoft Ireland Operations Ltd., Dublin, Ireland (Microsoft Corporation group) — Microsoft Clarity analytics, only with your consent.
• Netcup GmbH, Karlsruhe, Germany — hosting of the server on which the website, database and property photo storage (MinIO) run. All data is stored in the EU.
• Plausible Analytics — anonymous visitor statistics, self-hosted on a server in the EU; no data is shared with third parties.
• PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA, privacy@posthog.com— product analytics and session replay, only with your consent. PostHog acts as a processor under a data processing agreement (DPA) concluded in October 2026: it processes data only on our instructions and may not sell, share or use it for its own purposes. Data is stored in PostHog's EU cloud (Frankfurt). PostHog uses sub-processors listed at posthog.com/subprocessors and gives 14 days' notice of changes. Security overview: posthog.com/handbook/company/security.

Where the law requires it, we may also disclose data to public authorities (e.g. courts or the police).

5. Transfers outside the EU/EEA

Most data is stored in the EU. The following providers may process data in the USA: Cloudflare, Mapbox, Microsoft (Clarity) and PostHog's sub-processors are certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); Groq processes chatbot conversations under the standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR). In all cases the standard contractual clauses also form part of the contracts with these providers. You can request a copy of the relevant safeguards at it@realblue.cz.

6. Retention periods

• Contact and property inquiries, presentation requests and contact details from the chatbot: 3 years from the last communication.
• Newsletter: until you withdraw consent; afterwards only an “unsubscribed” record of your address.
• Chatbot conversations: not stored on our side.
• PostHog: events 1 year, session replays 30 days.
• Microsoft Clarity: session recordings 30 days, aggregated data 13 months.
• Administration accounts: for the duration of cooperation with the agent or staff member.

After the applicable period, data is deleted or anonymised. We may keep data longer where necessary to establish, exercise or defend legal claims, or where the law requires it.

7. Your rights

Under Articles 15 to 22 GDPR you have the right to:

• access your personal data and obtain a copy of it;
• rectification of inaccurate or incomplete data;
• erasure (“right to be forgotten”) where the conditions of Art. 17 GDPR are met;
• restriction of processing in the cases set out in Art. 18 GDPR;
• data portability for data processed on the basis of consent or a contract by automated means;
• withdraw consent at any time where processing is based on consent (newsletter, analytics cookies), without affecting the lawfulness of processing before withdrawal.

Right to object: where we process your data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

To exercise your rights, write to it@realblue.cz. We may ask you to verify your identity. We will respond without undue delay and at the latest within one month; in complex cases this period may be extended by two further months, of which we will inform you. Exercising your rights is free of charge.

You also have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, e-mail posta@uoou.gov.cz, uoou.gov.cz.

8. Security

We protect your data with HTTPS encryption, bcrypt password hashing, bot protection on forms, access restricted to authorised personnel only, and regular server backups.

9. Automated decision-making

We do not make decisions based solely on automated processing that would have legal or similarly significant effects on you (Art. 22 GDPR). Analytics data is used only in aggregate to improve the website.

10. Changes to this document

We update this document whenever we change the way we process personal data or the tools we use. The current version is always published at this address with the date of the last update.