Provider and data controller
Limani Holding GmbHAuf der Reihe 2
45884 Gelsenkirchen, Germany
info@spitivista.gr
+49 176 83244788
Data, purposes and legal bases
We process email, display name and language for accounts and sign-in; property details, photos and translations for listings; messages for communication between enquirers and advertisers; and saved searches for optional alerts. Published listings are public and can be indexed by search engines, including the AMA/MHTE number of holiday rentals and the company name and GEMI number of professional advertisers. The legal basis for service features is Art. 6(1)(b) GDPR; for security, abuse prevention, review and listing statistics Art. 6(1)(f) (legitimate interest in a safe and reliable platform); for search alerts consent under Art. 6(1)(a); for legal obligations Art. 6(1)(c). Required fields are necessary for the respective feature.
Device storage and security
We only use the strictly necessary cookie spitivista_session, which keeps you signed in for up to 14 days, and browser storage for favourites, drafts and comparisons you request (§ 25(2) no. 2 TDDDG). We use no advertising or analytics cookies, so there is no cookie banner. Sign-in codes are valid for 10 minutes and stored only as hashes. To prevent abuse we temporarily store request counters with hashed keys derived from email or IP address. The hosting provider logs technical data such as IP address, request and time for operation and security. Listing views by signed-in users are counted with a pseudonymous identifier.
Automatic review and translation
Before publication, listing details, translations written by the advertiser and reduced-size versions of all photos are sent to Google Gemini for a risk check. Listings with no risk flags are published automatically; all others are reviewed by a person. No adverse decision is made solely by automated means (Art. 22 GDPR). For automatic translations, the listing title and description or the text of a message are sent to Google Gemini or, alternatively, DeepL; never sign-in credentials.
Professional advertisers and CSV import
Agencies store their company name and GEMI number, which are shown on their listings. A CSV import stores the row contents, the agency’s own listing reference and the photo addresses. We fetch photos only from the https addresses the agency provides; the source server then sees our server’s IP address. Photos are processed like regular uploads and EXIF metadata is removed. The agency confirms that it has the owners’ mandate and the rights to texts and photos.
Visitor reports
Reports store the listing, reason, optional description and handling status. A pseudonymous identifier derived from the IP address limits repeated reports for the same listing. Reporting does not automatically remove a listing; an administrator reviews it.
Contact research and invitations
Public email addresses, name, language and source URL may be collected from permitted listing sources for contact research. These contacts are not published or verified as owners. Invitations via Resend require documented consent. We store the consent record, delivery status and hashed email addresses to avoid further invitations after an objection. Contact us for correction, deletion or objection.
Service providers and transfers
We use the following processors: Vercel (hosting), Neon (PostgreSQL database in Frankfurt), Hetzner (image storage in Nuremberg), Resend (email delivery), Google Gemini and DeepL (review and translation). Kapaweb manages the domain and DNS. Some providers are based in the USA; transfers there rely, as applicable, on the EU-US Data Privacy Framework or standard contractual clauses (Arts. 45, 46 GDPR). Please do not publish sensitive or unnecessary personal data in listings.
Retention
Sign-in codes are deleted after they expire, sessions after 14 days and abuse-protection counters after 15 minutes to 24 hours. Listings are shown publicly for up to 90 days from first approval; expiry ends public display but does not automatically delete accounts, photos or messages. We keep data as long as needed for the service, open requests or statutory retention. You can request deletion of your account via the contact details above.
Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction, portability and withdrawal of consent with effect for the future. You can turn off search alerts in your account or with the link in the email. You can request a human review of a moderation decision. You can lodge a complaint with a data protection authority, in particular the LDI NRW responsible for us or, in Greece, the Hellenic Data Protection Authority.
Right to object (Art. 21 GDPR)
Where we process data on the basis of legitimate interests (Art. 6(1)(f)), you may object at any time on grounds relating to your particular situation. We then stop processing unless we demonstrate compelling legitimate grounds or the processing is needed to establish, exercise or defend legal claims. You may object at any time and without giving reasons to processing for direct marketing, including invitations. A short message to info@spitivista.gr is enough.