YPI.BG Privacy Policy
Effective Date: 22/05/2026 | Version: Final Public Legal Draft
1. Scope of this Privacy Policy
This Privacy Policy explains how YPI LLC, a company incorporated in Sharjah Media City Free Zone, United Arab Emirates, trading as “YPI.BG” (“YPI.BG”, “we”, “us”, “our”), Licence No. 2428370.01, collects, uses, stores, discloses and protects Personal Data when you access or use www.ypi.bg, our mobile applications, account dashboards, CRM tools, advertising products, AI tools, messaging tools, live chat and any related services (together, the “Platform”).
This Privacy Policy applies to property seekers, buyers, tenants, landlords, owners, agencies, developers, agents, brokers, advertisers, business users, visitors and any other person who uses the Platform.
This Privacy Policy should be read together with our Terms of Use, Cookie Policy, Payments and Refund Policy, Listing Rules and any applicable subscription, advertising, agency or developer agreement.
2. Controller and contact details
For the purposes of applicable data protection laws, YPI.BG acts as controller of Personal Data where we determine the purposes and means of processing. In limited circumstances, we may act as processor or service provider for a business client where a separate written agreement expressly states this.
Contact email for privacy matters and the designated privacy lead: [email protected] or [email protected]. General contact email: [email protected]. YPI LLC, Sharjah Media City, Sharjah, UAE, Trade Licence No. 2428370.01.
2A. Bulgaria / European Union Data Protection Safeguard
Where and to the extent the General Data Protection Regulation (GDPR), the Bulgarian Personal Data Protection Act or other mandatory EU/Bulgarian data protection rules apply to the processing of Personal Data of individuals located in Bulgaria or the EU, YPI.BG will respect those mandatory requirements.
This safeguard is included out of an abundance of caution and does not constitute an admission or acknowledgement that:
- YPI LLC has an establishment in the EU/Bulgaria;
- YPI LLC is required to appoint a GDPR representative (Art. 27);
- YPI LLC is fully subject to extraterritorial application of GDPR.
Users in Bulgaria or the EU may contact [email protected] with any data protection requests. Complaints may also be lodged with the Bulgarian Commission for Personal Data Protection (CPDP) or another competent supervisory authority where permitted by law.
3. Important roles: Platform, agencies and other users
YPI.BG operates an online property portal. We do not act as a property broker, landlord, developer, mortgage provider, legal adviser or tax adviser unless expressly stated in a separate written agreement.
When an agency, developer, agent, owner or landlord receives leads, enquiries, messages, appointments or contact details through the Platform, that user may also become an independent controller of the Personal Data it receives. Such user is responsible for complying with applicable privacy, marketing, telecommunications and property laws when using that data.
Live chat and in-platform messages may be stored, reviewed, monitored and retained for customer support, quality assurance, fraud prevention, scam detection, security, dispute resolution, legal compliance and enforcement of Platform rules. We may use automated or manual review to detect fake listings, suspicious behaviour, spam, misuse, harassment or fraud.
Business users must not sell, transfer, scrape, export, spam, misuse or contact leads for unrelated purposes unless they have a lawful basis and all required consents.
4. Personal Data we collect
“Personal Data” means information relating to an identified or identifiable individual. It does not include data that has been irreversibly anonymised. We may collect the following categories of Personal Data depending on how you use the Platform:
| Category | Examples |
|---|---|
| Identity Data | Full name, username, profile photo, nationality where provided, proof of identity where required for verification, and age/confirmation that the user is at least 18. |
| Contact Data | Email address, telephone number, WhatsApp number, postal address, company contact details and communication preferences. |
| Account and Profile Data | Login username, password hash, account type, role, saved searches, preferences, dashboard settings, agency/agent profile data and subscription status. |
| Agency, Agent and Regulatory Data | Company legal name, trade licence number and expiry, broker registration number, licence/registration details, linked agency/office, official broker/company email and phone, jurisdiction, website/profile URL and review notes. |
| Listing and Property Data | Property details, descriptions, photos, videos, floor plans, 3D tours, price, location, availability, permit/QR information, listing history, views, reports and moderation records. |
| Lead and CRM Data | Enquiries, leads, appointments, viewing requests, live chat lead conversations, notes, lead status, agent assignment, communications and activity recorded in the dashboard, chat or CRM tools. |
| Communications Data | Emails, support messages, internal messages, live chat messages, chat content, WhatsApp link/form interactions, call metadata and call recordings where enabled or legally permitted. |
| Location Data | Approximate location from device, browser, IP address, property search location, map/radius search inputs and saved preferred areas. |
| AI Tools Data | Inputs submitted to “Upload Property with AI” or similar AI tools, generated outputs, edits, prompts, feedback, quality metrics and safety logs. |
| Payment and Billing Data | Billing name, billing address, invoices, receipts, payment status, transaction references, refund records, masked card data and fraud/risk indicators. Full card details are processed by payment providers and are not stored by YPI.BG unless legally required. |
| Technical and Device Data | IP address, browser, operating system, device identifiers, app identifiers, log files, time zone, language, crash logs, security logs and similar technical information. |
| Cookie, Analytics and Behavioural Data | Pages viewed, searches, filters, clicks, listing interactions, campaign attribution, cookie identifiers, ad identifiers, analytics events and preference signals. |
| Marketing Data | Marketing consents, opt-in and opt-out records, preferred communication channels, campaign interactions and unsubscribe records. |
| Verification, Compliance and Dispute Data | Documents and records used for verification, fraud prevention, complaint handling, legal claims, regulatory requests, suspected misuse, account suspensions and reporting records. |
| Aggregated and Anonymised Data | Statistical or aggregated information such as market trends, search volumes and average prices that does not identify an individual. If combined with identifiable data, it will be treated as Personal Data. |
We do not intentionally collect sensitive categories of Personal Data such as health data, religion, political opinions, criminal records or similar sensitive information unless required by law or voluntarily provided by you in a context where processing is necessary. You should not upload or send sensitive information through free-text fields, AI tools, chats, documents or listing descriptions unless strictly necessary.
Where you provide Personal Data about another person, you represent that you have the authority and lawful basis to do so and that you have provided all required notices and obtained all required consents.
Live chat and messaging records, including message content, timestamps, user identifiers, IP/device data and related metadata, may be processed for customer support, fraud prevention, scam detection, dispute resolution, safety, security, quality monitoring and legal compliance. Users should not share sensitive personal, financial, card, password or payment information through live chat.
5. Personal Data we collect from other sources
| Source | Examples of data |
|---|---|
| Public and regulatory sources | Verification of agency, agent, broker, licence, permit, property advertisement or company information. |
| Affiliates and related portals | Account, contact, usage, support and marketing data for shared systems and group operations. |
| Payment providers | Payment status, transaction references, chargeback/refund information and fraud indicators. |
| Analytics, advertising and technology partners | Cookie identifiers, device data, campaign attribution, analytics events and performance data. |
| Social media platforms | Profile/contact information and interaction data if you engage with YPI.BG social pages or use social sign-in. |
| Other users | Reports, complaints, messages, lead records, viewing requests and feedback involving your account or listings. |
6. How and why we use Personal Data
We only process Personal Data where we have a lawful basis under applicable data protection laws. Depending on the circumstances, we may rely on contractual necessity, compliance with law, legitimate interests, consent, protection of rights or other lawful bases available under applicable law.
| Purpose | Data used | Why we use it | Legal basis |
|---|---|---|---|
| Account creation and authentication | Identity, Contact, Account and Technical Data | Create accounts, authenticate users, manage dashboards and prevent unauthorised access. | Contractual necessity; legitimate interests |
| Agency, agent and owner verification | Agency, Agent and Regulatory Data; Identity; Compliance Data | Review licences, trade licences, licence/registration/broker information, jurisdiction details and other verification evidence. | Contractual necessity; compliance with law; legitimate interests |
| Publishing and managing listings | Listing and Property Data; Account Data; Agency/Agent Data | Display listings, manage listing quality, operate search tools, map view, smart match and listing moderation. | Contractual necessity; legitimate interests |
| Real estate advertising compliance | Regulatory Data; Listing Data; Compliance Data | Support internal checks, respond to reports and preserve evidence relating to advertising permits, QR codes, property, land registry and advertising authorities, ADREC or other competent authorities. | Compliance with law; legitimate interests |
| CRM, leads, messaging and appointments | Lead and CRM Data; Contact Data; Communications Data | Enable enquiries, viewing requests, lead management, internal messages and communications between users. | Contractual necessity; legitimate interests |
| Paid services, subscriptions and refunds | Payment and Billing Data; Account Data; Contact Data | Process payments, invoices, subscription packages, refunds, accounting records and payment disputes. | Contractual necessity; compliance with law |
| AI-assisted features | AI Tools Data; Listing Data; Behavioural Data | Generate suggested listing descriptions, titles, translations, improvements or recommendations and improve service quality. | Contractual necessity for the feature; legitimate interests; consent where required |
| Analytics and product improvement | Technical, Behavioural, Cookie and Aggregated Data | Understand usage, fix issues, measure performance, improve search, build market insights and improve user experience. | Legitimate interests; consent where required for cookies |
| Marketing communications | Contact Data; Marketing Data; Behavioural Data | Send newsletters, offers, product updates, partner offers and campaign communications where permitted. | Consent where required; legitimate interests where permitted |
| Security, fraud and abuse prevention | Technical Data; Communications Data; Compliance Data | Detect fake listings, spam, scraping, fraud, account misuse, unauthorised access and other harmful activity. | Legitimate interests; compliance with law |
| Legal, regulatory and enforcement | Any relevant category | Respond to courts, regulators, law enforcement, payment providers and legal advisers; enforce agreements and defend claims. | Compliance with law; legitimate interests |
| Corporate transactions | Limited relevant data | Support an actual or proposed merger, acquisition, financing, investment, restructuring or sale of assets. | Legitimate interests; legal obligations |
7. Marketing, SMS, WhatsApp and direct communications
We may send service messages, account messages, security notices, legal notices and transactional communications even if you opt out of marketing.
We will send direct marketing by email, SMS, WhatsApp, phone or similar channels only where permitted by applicable law and, where required, after obtaining consent. Marketing messages will include or make available a clear method to opt out, unsubscribe or withdraw consent.
Business users must not use leads or contact details received through the Platform for unsolicited SMS, WhatsApp campaigns, cold calls, bulk messages or unrelated marketing unless they have all required consents and comply with applicable telecommunications, anti-spam, privacy and property advertising rules.
8. Cookies, pixels and similar technologies
We use cookies, pixels, SDKs, local storage, device identifiers and similar technologies for essential functions, analytics, security, preferences, advertising and performance measurement. Non-essential cookies will be used in accordance with applicable law and our Cookie Policy. You can manage cookie choices through the cookie banner/preference centre where available, and through browser or device settings.
9. AI tools, recommendations and automated processing
The Platform may include AI-assisted tools, smart matching, ranking, listing suggestions, text generation, translations, recommendations and automated moderation or fraud-detection signals.
AI outputs may be inaccurate, incomplete or inappropriate. Users are responsible for reviewing and approving any AI-generated listing content before publication. YPI.BG may retain AI inputs and outputs for security, quality, abuse prevention, product improvement and dispute-resolution purposes, subject to this Privacy Policy.
We do not intend to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals unless permitted by law and appropriate safeguards are applied.
10. Who we share Personal Data with
We do not sell Personal Data. We may share Personal Data where reasonably necessary for the purposes described in this Privacy Policy:
| Recipient | Reason for sharing |
|---|---|
| Other users of the Platform | Where needed for enquiries, listings, messages, appointment requests, agency/agent profiles or property transactions initiated by users. |
| Agencies, developers, agents, owners and landlords | When a user submits an enquiry, viewing request, message or lead relating to a listing or account. |
| Affiliates and group companies | For shared technology, administration, support, analytics, reporting, legal compliance and business operations. |
| Service providers and processors | Hosting, cloud storage, CRM systems, email, SMS, call routing, WhatsApp integrations, analytics, security, moderation, AI infrastructure, payment processing, accounting and support tools. |
| Analytics, advertising and social media partners | For analytics, attribution, campaign measurement, remarketing and performance advertising where permitted and subject to cookie/marketing choices. |
| Payment providers and financial institutions | To process payments, prevent fraud, handle refunds, resolve chargebacks and comply with payment rules. |
| Professional advisers | Lawyers, auditors, accountants, insurers, consultants and other advisers where reasonably necessary. |
| Authorities, regulators, courts and law enforcement | Where required by law or where reasonably necessary to comply with legal obligations, investigate misuse, respond to complaints, prevent fraud or protect rights and safety. |
| Potential investors, buyers or successors | In connection with an investment, merger, acquisition, financing, restructuring or sale, subject to appropriate confidentiality protections. |
11. International data transfers
Our operations, servers, service providers, affiliates and technology partners may be located in the UAE or other countries. Your Personal Data may therefore be transferred to and processed outside your country of residence.
Where required by applicable law, we will use appropriate safeguards such as contractual protections, due diligence, security measures and other recognised transfer mechanisms to protect Personal Data transferred internationally.
12. Security measures
We apply reasonable technical and organisational measures appropriate to the nature of the data and risks involved, which may include access controls, authentication, encryption in transit and/or at rest, backups, logging, monitoring, secure development practices, staff confidentiality obligations, vendor controls and incident-response procedures.
No internet or digital system is completely secure. Users are responsible for maintaining the confidentiality of their passwords, devices and account access.
13. Data breach and incident handling
If we become aware of a Personal Data breach or security incident, we will assess the incident and take appropriate steps to contain, investigate and remediate it. Where required by law, we will notify affected individuals, competent authorities or relevant business users in accordance with applicable timelines and requirements.
14. Retention of Personal Data
We retain Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Retention periods vary depending on the nature of the data, legal requirements, risk, accounting rules and dispute needs.
| Data type | Typical retention approach |
|---|---|
| Account data | For the life of the account and a reasonable period afterwards for security, audit, dispute and legal purposes. |
| Listing and regulatory data | For as long as listings are active and afterwards for audit, fraud prevention, property advertising compliance, dispute resolution and legal claims. |
| Lead, CRM and communications data | For as long as necessary to provide CRM tools, support, dispute resolution, safety, fraud prevention and legal compliance. |
| Payment, tax and invoice records | For the period required by accounting, tax, payment and legal rules. |
| Marketing consent and opt-out logs | For as long as needed to demonstrate consent, opt-out and compliance. |
| Security logs | For a reasonable period required for cyber security, fraud prevention and platform protection. |
| Anonymised data | May be kept indefinitely where it no longer identifies an individual. |
15. Your rights
Depending on applicable law and subject to legal exceptions, you may have the right to:
request access to Personal Data held about you;
request correction of inaccurate or incomplete data;
request erasure where there is no lawful reason for continued processing;
request restriction of processing;
object to processing, including direct marketing and profiling related to direct marketing;
request portability of certain data in a structured, commonly used and machine-readable format;
withdraw consent where processing is based on consent;
request information about automated processing and safeguards where applicable;
submit a complaint to the competent data protection authority where available under applicable law.
To exercise rights, contact [email protected] or [email protected]. We may request information to verify your identity and authority. We may reject or limit requests where permitted by law, including where requests are excessive, conflict with legal obligations, affect third-party rights, impair security or prejudice legal claims.
16. Children and minors
The Platform is not intended for persons under 18. We do not knowingly collect Personal Data from minors. If you believe a minor has provided Personal Data to us, contact us so that we can take appropriate steps.
17. Third-party websites and integrations
The Platform may contain links or integrations with third-party websites, apps, maps, social media services, payment gateways, analytics providers, advertising networks, WhatsApp, call tracking or other tools. We do not control third-party privacy practices and are not responsible for their processing. You should review their privacy notices before using them.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be posted on the Platform with a new effective date. Where required by law or where changes are material, we may also notify users by email, account notice, cookie banner, platform notice or another appropriate method. Continued use of the Platform after the updated Privacy Policy is posted means that you acknowledge the updated Privacy Policy.
19. Contact us
For privacy requests or questions, contact:
Privacy email: [email protected]
General email: [email protected]
Additional contact: [email protected]
Company: YPI LLC, Sharjah Media City Free Zone, United Arab Emirates
Formation number: 2428370
Licence number: 2428370.01