Skip to content
NewBuildTracker

Privacy policy

Last updated: 29 September 2026

This policy explains which personal data NewBuildTracker (newbuildtracker.com) processes, for what purpose, on which legal basis, who receives it, how long we keep it, and which rights you have (Art. 13 GDPR).

1. Controller

Alexander Seipel
Jeseniova 2829/20
130 00 Praha 3
Czech Republic
Email: hello@newbuildtracker.com

NewBuildTracker is run by one person. We have not appointed a data protection officer, because the conditions for one (Art. 37(1) GDPR) are not met.

2. The key points

  • You can use NewBuildTracker without an account and without telling us who you are.
  • We only receive your email address, name or phone number when you sign up for an email alert, send an “I'm interested” request, join the Plus waitlist or write to us.
  • The website and its database run on servers of Hetzner in Germany. Our emails are sent through Brevo, whose servers are in the EU.
  • The flat prices we publish come from developers' public price lists. To read those lists we use an AI service from OpenAI; it receives only the public content of those pages, never data about you.
  • We use no advertising or tracking cookies, which is why there is no cookie banner.
  • We don't sell data. An “I'm interested” request goes only to the developer you name in it.

3. Visiting the website

3.1 Hosting

NewBuildTracker runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. Hetzner processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

3.2 Server logs

When you open a page, our web server processes technically necessary data: your IP address, the date and time, the page requested, the status code and your browser's identification (user agent). The access log stores the IP address only in shortened form and is deleted after 7 days at the latest. The application itself logs technical errors; email addresses, phone numbers, names and link tokens are removed from these logs. The purpose is the secure and stable operation of the website (legitimate interest, Art. 6(1)(f) GDPR).

3.3 Protection against abuse

To stop automated abuse of our forms, we count requests per IP address in the server's memory. These counters are never written to disk and disappear after one hour at the latest (legitimate interest, Art. 6(1)(f) GDPR).

4. Cookies and storage in your browser

The public website sets no cookies and reads nothing from your device for statistics or advertising. We don't use tracking or advertising cookies, which is why there is no cookie banner. (The operator's admin area uses a sign-in cookie; it is only set for the operator.)

5. Statistics

5.1 Usage events in our database

We record a few events in our own database, for example that a project or flat page was viewed, a search was made, an alert was confirmed, an “I'm interested” request was sent or someone clicked through to a developer's price list. An event contains its name, the page path, the time and, where relevant, the project or flat concerned and which filters were used (not their values). Events contain no names, email addresses, phone numbers, IP addresses or identifiers of your device or browser, and they are not linked to a person. They show us which parts of the site are used and let us tell developers how many people looked at their projects. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We delete events after 24 months.

5.2 Page statistics (Umami)

To see which pages are used, we run Umami, a statistics tool, on our own server at Hetzner in Germany. Our pages don't load Umami's script. Instead, each page view sends Umami only the address of the page (without search terms and without other parameters, except campaign tags such as “utm_source”), its title and our domain. With that request Umami also receives your IP address and user agent. From them it derives country, region and city, browser, operating system and device type, and it forms a visit identifier from IP address, user agent and a secret value that changes every month, so no long-term profile can be built. Umami does not store the IP address, sets no cookies and reads nothing from your device. The data is pseudonymous. The legal basis is our legitimate interest in knowing which pages are useful (Art. 6(1)(f) GDPR). We delete Umami data after 24 months.

6. Email alerts

If you ask us to email you about new flats matching a search, or about changes to a flat or a project, we process your email address, the language of the site you used, the alert itself (the search filters, flat or project) and the time you signed up, confirmed and last received an email. Every alert must be confirmed through a link in a confirmation email (double opt-in); until then we send you nothing else.

  • Purpose: sending the daily email about the changes you asked for.
  • Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
  • Emails: sent through Brevo (see 10). They contain no tracking pixels and no tracked links. Every email has a link to manage your alerts and to unsubscribe with one click.
  • Deletion: unconfirmed alerts after 7 days. When you unsubscribe, we delete your email address and all your alerts immediately.

7. “I'm interested” requests to a developer

If you send an “I'm interested” request for a flat or a project, we process your name, email address, phone number, when you plan to buy, how you plan to pay (if given), your message (if given), your preferred language, the flat or project, the site language, and the time and version of your consent.

  • Purpose: passing your request to the developer you named, so that they can contact you about the flat or project. We send you a confirmation email with a copy of your request.
  • Legal basis: your consent (Art. 6(1)(a) GDPR), given with the checkbox that names the developer.
  • How it is passed on: we receive a notification by email, check the request and forward it to the developer's sales contact by email, usually within 2 working days. The developer then processes your data as an independent controller under its own privacy policy. We don't charge you or the developer for this.
  • Deletion: 12 months after the request, earlier if you ask. If you withdraw your consent before we have forwarded the request, we don't forward it. Data the developer has already received is subject to the developer's privacy policy; please contact the developer directly.

8. Plus waitlist

If you are interested in “NewBuildTracker Plus” and leave your email address, we store it with the site language, where you saw the offer and the time of your consent, so that we can tell you when Plus is available (consent, Art. 6(1)(a) GDPR). The email address is optional; without it we only count the click. We don't send a confirmation email. We delete your entry once we have informed you, at the latest 12 months after you signed up, or earlier if you ask.

9. Contact by email

If you write to us at hello@newbuildtracker.com, we process your email address, your name if you give it, and the content of your message in order to reply (legitimate interest in answering enquiries, Art. 6(1)(f) GDPR; for requests about your rights, Art. 6(1)(c) GDPR). The notifications about new “I'm interested” requests arrive in the same mailbox.

Messages to this address are currently forwarded by the forwarding service of our domain registrar, Porkbun LLC (USA), to a Gmail mailbox. For users in the European Economic Area, Gmail is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your message is transferred to the USA in the process: Porkbun is based in the USA, and Google may also process Gmail data there. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). To our knowledge Porkbun is not certified, and we have not agreed any other safeguards under Art. 46 GDPR with Porkbun or a data processing agreement for this mailbox. If you don't want your message to be transferred to the USA, please write to us by post at the address in section 1.

We delete emails once your enquiry has been dealt with, at the latest at the end of the third year after the last message, unless we must keep them longer by law.

10. Recipients

  • Processors (under a data processing agreement, Art. 28 GDPR): Hetzner Online GmbH (hosting, see 3.1) and Sendinblue SAS (Brevo), Paris, France (sending our emails). Brevo stores the data in the EU. Where Brevo's group companies or sub-processors outside the EU can access it, for example for support, Brevo relies on the EU standard contractual clauses or the EU-US Data Privacy Framework (Art. 45, Art. 46(2)(c) GDPR).
  • Developers: only the developer you name in an “I'm interested” request (see 7).
  • Email: Porkbun and Google for messages to our address (see 9).
  • OpenAI: to read developers' price lists we send the public content of those pages to OpenAI (OpenAI Ireland Limited, Dublin, Ireland). This never includes data about our visitors, subscribers or buyers.

We don't sell or rent personal data and don't pass it to anyone else, unless we are legally obliged to.

11. How long we keep data

  • Unconfirmed alerts: 7 days.
  • Confirmed alerts and your email address: until you unsubscribe; we then delete them immediately.
  • “I'm interested” requests: 12 months, earlier on request.
  • Plus waitlist: until Plus launches, at most 12 months, earlier on request.
  • Usage events: 24 months. Umami data: 24 months.
  • Server logs: 7 days at the latest. Abuse counters: one hour at the latest, in memory only.
  • Emails to us: until your enquiry is dealt with, at the latest the end of the third year after the last message.
  • Backups: we currently make no backup copies of the database, so deleted data is gone at once.

Flat prices, statuses and their history are not personal data; we keep them as long as the service exists.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interests (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)); the easiest way for alerts is the unsubscribe link in every email. For everything else, write to hello@newbuildtracker.com.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work. The authority responsible for us is the Czech Office for Personal Data Protection: Úřad pro ochranu osobních údajů, Pplk. Sochora 727/27, 170 00 Praha 7, Czech Republic, uoou.gov.cz.

13. Do you have to provide your data?

No. You can use NewBuildTracker without giving us any personal data. Without an email address we cannot send you alerts, and without your name, email address and phone number we cannot pass an “I'm interested” request to a developer.

14. No automated decisions

We don't make decisions based solely on automated processing that have legal effects on you or affect you similarly (Art. 22 GDPR).

15. Changes

We update this policy when NewBuildTracker or the law changes. The version published here applies. The English and Czech versions have the same content.