Privacy Policy

This Privacy Policy describes how S2A Prime Lands Advisors S.R.L. processes the personal data of website visitors, clients, partners, and other data subjects, in accordance with Regulation (EU) 2016/679 (the GDPR).

1. Identity of the Controller

S2A Prime Lands Advisors S.R.L.
Registered in Romania
Trade Register No.: J23/4619/2020
Fiscal Registration Code (CUI): RO43146892
Email: contact@primelands.ro

S2A Prime Lands Advisors S.R.L. acts as the data controller within the meaning of Regulation (EU) 2016/679 (the GDPR).

2. Scope of this Privacy Policy

This Privacy Policy explains how we collect, use, and protect personal data when you:

Visit our website
Contact us via forms, email, or phone
Interact with our services or communications
Use website features that involve personal data processing

This policy applies together with our Cookie Policy, which provides detailed information on cookies and similar technologies.

3. Categories of personal data we process

Depending on how you interact with the website, we may process the following categories of personal data:

Identification data (e.g. name, company, role)
Contact data (e.g. email address, phone number)
Technical data (e.g. IP address, browser type, device information)
Usage data (e.g., pages viewed, actions taken on the website; processed where necessary for the website’s operation and security, and for analytics/marketing only where you have given consent, where applicable)
Log and security data (e.g., timestamps, IP address, device/browser identifiers, error logs; processed to ensure security, prevent fraud/abuse, and maintain the website)
Any other information voluntarily provided via contact forms or further communications.

We do not intentionally collect special categories of personal data.

The website is not intended for minors, and we do not knowingly process their personal data.

4. Whether providing personal data is required

When you contact us or submit a request, providing certain identification and contact details is necessary for us to respond and/or take steps at your request. If you do not provide the requested information, we may be unable to respond or provide the requested details.

Where processing is necessary to enter into or perform a contract, providing certain data is required for contractual purposes; if you do not provide it, we may be unable to conclude or perform the contract.

Providing consent-based data (such as analytics and marketing preferences) is optional and refusal will not affect access to the website’s core functionality.

5. Purposes and Legal Bases of Processing

We process personal data only where permitted by applicable law and only for specific, explicit purposes. Depending on the context (e.g., whether you are a client, a prospective client, a representative of a company, or a website visitor), we rely on one or more of the legal bases below:
A. Processing necessary for providing our services, managing relationships, and operating the website (no marketing consent required)
• Providing real estate consultancy and brokerage services (including preliminary discussions and steps prior to entering into a contract) — performance of a contract / steps taken at your request before entering into a contract
• Managing and performing contractual relationships with clients and partners (e.g., mandates, engagement administration, relationship management, invoicing-related operational flows) — performance of a contract
• Handling requests submitted through website forms and responding to inquiries (including: general enquiries, enquire about a property, requesting additional property information, requesting a brochure, or submitting requirements when you did not find what you are looking for) — steps taken at your request before entering into a contract / performance of a contract, as applicable
• Service and relationship communications related to your request (e.g., replying to inquiries, providing the property details you requested, meeting scheduling, viewing coordination, and operational notices such as updates to our Terms or this Privacy Policy) — steps taken at your request before entering into a contract / performance of a contract, and where appropriate, our legitimate interests (ensuring efficient communication and relationship management)
• Secure operation of the website and IT systems (including ensuring security, preventing fraud/abuse, maintaining system integrity, troubleshooting, and logging) — our legitimate interests (ensuring website and IT security, preventing abuse, and maintaining service quality). This may include processing technical data such as logs, IP address, device and browser information
• Compliance with legal and regulatory obligations applicable to the controller — compliance with a legal obligation
Service and relationship communications are sent only in connection with your request or our relationship with you and are not direct marketing.
B. Processing based on consent (enabled only if you opt in, where applicable)
• Direct marketing communications (where enabled and only if you opt in via a dedicated checkbox, e.g., newsletters, new listings alerts, Investor Circle newsletters/updates, and promotional campaigns) — your consent, in line with applicable privacy rules (including Romania’s Law 506/2004). You may withdraw consent at any time (e.g., via the unsubscribe option in our messages or by contacting us).
• Website analytics (where enabled) — your consent. Analytics tools are activated only where you have provided consent via cookie settings, where applicable.
Where processing is based on legitimate interests, we assess that our interests (e.g., operating our business and ensuring website security) do not override your rights and freedoms. Where processing is based on consent, you may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Direct marketing note: you have the right to object to direct marketing at any time; if you object, we will stop processing your personal data for direct marketing purposes.

6. Legal Basis of Processing

We process personal data only where permitted by applicable law, based on one or more of the following legal grounds:

your explicit consent, where required;
the performance of a contract or steps taken at your request prior to entering into a contract;
compliance with legal obligations applicable to the controller;
the legitimate interests of the company, such as ensuring website security, preventing fraud, and improving our services, where such interests do not override your fundamental rights and freedoms.

7. Data Retention

We keep personal data only for as long as necessary to achieve the purposes described in this Privacy Policy, and then delete or anonymize it, unless a longer retention period is required by law.

Retention criteria (how we decide how long to keep data):

Enquiries and requests (website forms, email, phone): we retain data for the time needed to handle your request and any follow-up correspondence.
Client/partner relationship and contractual data: we retain data for the duration of the contractual relationship and afterwards as required by applicable legal, accounting, and tax obligations, and where necessary to establish, exercise, or defend legal claims.
Marketing data (where enabled and only if you opt in): we retain your contact details and preferences until you withdraw consent/unsubscribe.
Website security and technical data (logs): we retain logs for as long as needed to ensure website and IT security, prevent abuse, troubleshoot issues, and to comply with legal requirements.

Where you withdraw consent or object to direct marketing, we may retain a minimal record of your request (e.g., your email address and opt-out status) in order to ensure we respect your choice and do not send you further marketing communications.

8. Recipients of Personal Data

Personal data may be disclosed to:

IT, hosting, and website maintenance providers
Platform providers used to operate our communications and workflows (e.g., email services, CRM/contact management tools, form-processing tools), as applicable
Analytics, functional, and marketing service providers (only where consent is given, where applicable)
Professional advisers (e.g., legal and accounting advisers), where necessary
Public authorities and courts, where required by law or to protect our rights

All service providers act under contractual obligations consistent with Article 28 GDPR, where applicable.

9. Data Security

The controller implements appropriate technical and organizational measures, in accordance with Article 32 of the GDPR, to protect personal data against unauthorized access, loss, destruction, alteration, or unauthorized disclosure.

These measures are adapted to the nature of the data, the purposes of processing, and the associated risks. However, the transmission of data over the internet cannot be guaranteed to be completely secure.

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access — to obtain confirmation of whether we process your data and access to that data
Right to rectification — to have inaccurate or incomplete data corrected
Right to erasure (“right to be forgotten”) — where applicable
Right to restriction of processing — in certain situations
Right to data portability — to receive certain data you provided to us in a structured, commonly used format and to transmit it to another controller, where applicable
Right to object — to processing based on our legitimate interests
Right to object to direct marketing at any time — if you object, we will stop processing your personal data for direct marketing purposes
Right to withdraw consent at any time — where processing is based on your consent (withdrawal does not affect processing carried out before withdrawal)
Right to lodge a complaint — with a competent supervisory authority

You may exercise these rights by sending a request to contact@primelands.ro. We may ask for information necessary to confirm your identity before responding. We will respond within the time limits set by applicable data protection law.

11. Contact

For any requests regarding the processing of personal data, please contact us using the contact details available on the website.

12. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The current version will always be available on this website.