Bopperty Privacy Policy.

This summary is for convenience. The full Privacy Policy below provides the complete transparency information required by GDPR Articles 13 and 14.

What Bopperty does. Bopperty (bopperty.ie) provides free area reports, sold-prices pages derived from the Property Price Register, an area comparison tool, content hubs for buying, renting, and selling, free consumer accounts, the Head Start watch programme, an affordability guide, a service to request contact from a PSRA-licensed property services provider (/local-experts), a registration service for those providers (/for-agents), and a portal for publishing agents.

What we collect. If you submit information through Bopperty (email, account sign-up, location selections, GPS coordinates with your permission, Head Start watches, /local-experts requests, /for-agents registrations, correction requests, or sold-prices position suggestions), we process it to deliver the service you have requested. We also process limited technical information (IP address, request logs) to operate the service securely, prevent abuse, and enforce the free usage allowances.

What we do with it. We use your information to generate reports and comparisons, show sold-prices pages, operate your account and sign you in with one-time codes, run your Head Start watches, route /local-experts requests to PSRA-licensed providers in your area, manage /for-agents registrations and the agent portal, prevent abuse of the free service, and communicate with you where appropriate.

Who we share it with. Where you request a provider contact through /local-experts, your details are passed to that provider, who then handles your data as an independent controller. We use third-party processors to host the service, store data, send email, and prevent bot abuse. Categories and locations are listed in Section 10. A current list of key processors is available on request.

How long we keep it. Identifying details are removed from most operational records after 24 months; account records, agent registrations, and the acceptance log have their own periods, set out in Section 14. Where continued identifiable or pseudonymised retention is necessary for legal-claims defence, the relevant record is moved to restricted-access storage and deleted no later than 72 months from the relevant event. Account records are erased within 30 days of a deletion request, as described in Section 3.5.

Your rights. You can access, correct, restrict, object to processing of, or delete the personal data we hold about you, and request a copy of your data. You can withdraw marketing consent at any time; each Head Start watch has its own consent. You can complain to the Irish Data Protection Commission. Use /contact (privacy category) or legal@bopperty.ie.

Cookies. Bopperty sets only essential cookies under the acceptance step. Non-essential cookies are not set without your separate consent through the cookie settings page.

Automated controls. Bopperty protects the free service using rate limiting, signed cookies, hashed IP records, a bot-signal challenge on forms and sign-in flows, and a network-edge security provider. These controls are used only for security, abuse prevention, and fair-usage enforcement, never for advertising or behavioural profiling. Bopperty does not deploy device-identification or browser-fingerprinting technology, and does not use any such techniques for tracking, advertising, behavioural profiling, or cross-site identification; Bopperty's network-edge security provider analyses technical request signals (such as IP address and request characteristics) to detect and block malicious traffic. You can object under GDPR Article 21; where an access restriction of genuine significance has affected you, you can ask for human review of it.

This Privacy Policy explains how Bopperty Ltd ("Bopperty", "we", "us", "our") collects, uses, stores, shares, and protects personal data when you use bopperty.ie and related services.

Bopperty is the controller of the personal data described in this Privacy Policy.

This Privacy Policy covers Bopperty's information services, including processing connected to property listings where Bopperty publishes them. It does not cover regulated property services (valuations, estate agency, letting agency, auctioneering, property management, brokerage), which Bopperty does not provide. The role Bopperty performs in routing /local-experts requests to PSRA-licensed property services providers is described in Section 3.2 and Section 7.

This Privacy Policy should be read with the Terms of Use, the Cookie Notice, and the Digital Services Act notice.

Bopperty Ltd is registered in Ireland. CRO number: 822120. Registered office: 77 Camden Street Lower, Dublin 2, D02 XE80.

Bopperty provides area reports generated from public, licensed, third-party, and derived data sources, together with content hubs covering buying, renting, and selling residential property in Ireland.

Bopperty is independent. It is not affiliated with, endorsed by, sponsored by, authorised by, or acting for any government body, regulator, local authority, property services provider, estate agent, letting agent, auctioneer, valuer, lender, insurer, data provider, public registry, public body, or professional adviser unless expressly stated in writing.

2.1 Data Protection Contact

Bopperty's data protection contact is legal@bopperty.ie. You can raise any question about this Privacy Policy, or exercise any of your rights under data protection law, through the contact form at /contact (selecting the privacy category) or by writing to legal@bopperty.ie. The same address is Bopperty's single point of contact under Articles 11 and 12 of the Digital Services Act; the Digital Services Act Notice at https://bopperty.ie/dsa provides detail.

Bopperty generates area reports using public, licensed, third-party, and derived information, and publishes content hubs at /buying-a-home-in-ireland, /renting-in-ireland, and /selling-in-ireland. Bopperty also publishes sold-prices pages at national, county, and area level with a methodology page, and an area comparison tool presenting the same area-level figures side by side.

Reports may include information about local amenities, transport context, education and registered centre-based childcare availability indicators, demographics, public-service context, neighbourhood and built-environment context, market-context indicators including indicative price and rental information (these are general guidance only and are not valuations, advised market values, or rent assessments within the meaning of the Property Services (Regulation) Act 2011), and other area-level information.

Reports and content hubs are for general guidance only. Bopperty does not provide property valuations, property advice, financial advice, legal advice, planning advice, investment advice, insurance advice, surveying advice, or regulated property services.

Reports and content hubs are intended to describe area-level context, market context, and process context, not to assess or profile any specific person or household. Bopperty does not produce content that makes decisions about individuals or assesses individual suitability.

Where a user selects a pin or location, Bopperty uses that input to generate area-level context around the selected location. Bopperty does not produce a valuation, condition assessment, suitability assessment, or professional opinion about any specific property or transaction.

3.1 Content Hubs and Readiness Check Tools

Bopperty operates three content hubs supporting users buying, renting, or selling residential property in Ireland. Each hub provides a comprehensive guide and a personalised readiness check tool. Readiness check tools ask the user a series of multiple-choice questions about their current situation and produce a personalised checklist of items to consider. Readiness check answers are processed in your browser. Unless you choose to save a result, they are not transmitted to or stored by Bopperty. Readiness check tools are educational; they do not provide regulated advice and do not assess individual suitability.

3.2 Local Agent Introduction Service

Bopperty operates a service at /local-experts where users can request that a PSRA-licensed property services provider in their area contacts them about selling or letting their property.

Bopperty's role is limited to capturing the user's request and transmitting it to a PSRA-licensed property services provider operating in the relevant area. Bopperty does not negotiate, advise on, value, market, manage, let, sell, or otherwise provide regulated property services. The receiving property services provider determines its subsequent professional processing as an independent controller.

Bopperty tells you which provider received your details: the provider's name and PSRA licence details are provided to you at or before transmission, together with a link or contact route to the provider's privacy information where available.

Bopperty does not request special-category information through its general contact routes. Where a person makes an equality complaint or an accessibility request and special-category information is necessary to establish, exercise or defend their legal rights, Bopperty processes only the information necessary to receive, investigate and respond to that matter, relying on GDPR Article 6(1)(c) or 6(1)(f), as applicable, and Article 9(2)(f). Please do not include health or other sensitive information unless it is necessary for that purpose.

The lawful basis for this transmission is performance of a service the user has requested (GDPR Article 6(1)(b)).

3.3 Agent Registration

Bopperty operates an agent registration service at /for-agents where PSRA-licensed property services providers (and individuals authorised to act for them) can register interest in receiving local agent introductions. Registrations capture identifying details of the registrant and, where relevant, the PSRA licence details of their agency.

3.4 Head Start Watches

Head Start is Bopperty's programme for publishing agent-provided property listings ahead of wider marketing. Signed-in users can create Head Start watches from their account. A watch records your intent (buy or rent), the watch area, and optional refinements such as property type and budget or rent band. Each watch carries its own consent to receive Head Start alert emails for that watch; stopping the watch stops its emails, and deleting your account stops all of them. Bopperty will use watch details to send alert emails when the programme begins sending them; watches created before sending begins are held under the same consent until then. Watches created during Bopperty's earlier preview period are retained with the same rights and controls. The lawful basis is your consent, withdrawable at any time per watch, through your account, or via /contact. Retention is set out in Section 14.

3.5 Consumer Accounts

Bopperty offers free consumer accounts. An account increases your free usage allowances (Section 4.12 and Section 10 of the Terms of Use) and lets you create Head Start watches. Bopperty signs you in with one-time codes sent to your email address; there are no passwords and no password is ever stored. Signed-in sessions expire after 30 days of inactivity and in any event 90 days after sign-in; re-signing in is by email code.

You can delete your account at any time from your account settings. When you do: your account is deactivated immediately and you are signed out; and within 30 days your sign-in identity and account record are erased. Head Start watches created from your account are anonymised at that point: the email address is removed and the watch stops, while the watch's consent and audit records are retained. Your saved checklists and signed-in usage read records are deleted together with your account. Records Bopperty is required or entitled to keep are retained as described in Section 14, including the acceptance log and a minimal record that your deletion request was received and completed.

Watches created during Bopperty's earlier preview period that carry the same email address as your account are stopped and anonymised as part of account deletion. Pseudonymised usage records (measured with a signed browser cookie and a hashed IP address) are not linked to your account and are unaffected by account deletion; they expire under their own retention periods described in Section 14 and the Cookie Notice.

3.6 Agent Portal and Agent Accounts

Bopperty operates a portal for PSRA-licensed publishing agents. Agent accounts are created by Bopperty on invitation; there is no self-service agent sign-up. Agents sign in with one-time codes sent to their registered email address. Bopperty processes agent account details (name, work email address, agency and PSRA licence details), sign-in and portal activity records, and the listing and related records agents submit. The Bopperty Agent Listing Terms govern portal use.

Listings may incidentally contain personal data: a property address may relate to an occupier; a listing carries the agent's own contact details; a sole trader's agency identity may be the individual's own. Bopperty processes this data to operate the portal and to moderate listings before publication, under GDPR Article 6(1)(f) legitimate interests and, in respect of the agent relationship, Article 6(1)(b) performance of a contract, as applicable. The Agent Listing Terms restrict the inclusion of unnecessary third-party personal data in listings, and Bopperty's pre-publication moderation includes review of listing images. Retention is set out in Section 14. Agents are independent controllers of the personal data they process in their own dealings with clients and enquirers.

We may collect and process the following categories of personal data.

4.1 Information You Provide

This may include:

• email address (provided at marketing-opt-in points on the homepage and report-access flows);
• account sign-up and sign-in email address;
• location selections from the curated taxonomy autocomplete;
• pin coordinates from the homepage map;
• GPS coordinates if you grant your browser or device permission;
• stated intent (such as Buy, Rent, Sell, or Let) and optional refinements (property type, budget band, timeline);
• Head Start watch details (Section 3.4);
• affordability updates sign-up (email address and consent);
• readiness check answers, which are processed in your browser. Unless you choose to save a result, they are not transmitted to or stored by Bopperty (Section 4.3);
• /local-experts submissions (described in Section 4.4);
• /for-agents submissions (described in Section 4.5);
• correction requests and supporting materials submitted via /corrections;
• sold-prices position suggestions (a suggested map position, your explanation, and optional contact details);
• communications you send to us;
• your acceptance of the Terms of Use, and the record that the Privacy Policy and Cookie Notice were presented and acknowledged, together with your cookie preferences.

Where information is marked as required in a form or flow, we need it to provide the requested function. If you do not provide required information, we may not be able to generate a report, process a correction request, route a /local-experts request, or manage a /for-agents registration. Optional fields do not have to be provided.

4.2 Location Data

You may search Bopperty by selecting a location from the curated autocomplete, by dropping a pin on the homepage map, or by allowing your device or browser to share GPS coordinates.

Free-text street-address entry and free-text Eircode entry are not supported as search paths to a report.

If you choose GPS search, your browser or device asks you for permission first. If you grant permission, your device shares precise coordinates with Bopperty for the purpose of resolving your location to an area on the curated taxonomy.

If you drop a pin on the map, the pin coordinates are sent to Bopperty for the same purpose.

You do not have to use GPS or the pin-drop. You can use Bopperty by selecting an area from the autocomplete only.

GPS coordinates are used only for the session or request that generated them, unless you separately submit them through a form or they appear in logs retained for security purposes. Pin precision is not embedded in shareable report URLs. Where Bopperty needs to retain pin context for a session (for example, to support pin-radius sections of the report), it stores the pin in a short-lived signed session cookie. The Cookie Notice describes this further.

4.3 Readiness Check Tools

When you use a readiness check tool on one of Bopperty's content hubs, your answers are processed entirely in your browser. Unless you choose to save a result, your answers, and the checklist and preparation score computed from them, are not transmitted to or stored by Bopperty; closing the page discards them. Where you use a readiness check without saving the result, the only personal data Bopperty processes is the ordinary technical data involved in serving the pages, described in Section 4.8. If you save a result, Bopperty also processes the saved-checklist information described in Section 4.12.

4.4 /local-experts Submissions

When you submit a request through /local-experts asking for a property services provider to contact you, the following data is processed: name, contact details (email and optional phone), an Eircode or a free-text area, property type, your intended timeline, a hashed IP address, a hashed user agent string, the submission timestamp, and a unique ticket number prefixed SEL- (all /local-experts requests, whether about selling or letting, use this single submission route and prefix).

Bopperty transmits the request to a PSRA-licensed property services provider operating in the relevant area, as described in Section 3.2 and Section 7.

4.5 /for-agents Submissions

When a property services provider, or an individual authorised to act for one, registers interest in receiving local agent introductions through /for-agents, the following data is processed: name, contact details, PSRA licence number and licensee details (selected from a PSRA-Register-derived combobox, or supplied manually as free text where the user is a personal licence holder or their agency is not listed), agency or trading name, area coverage, optional message, a hashed IP address, a hashed user agent string, the submission timestamp, and a unique ticket number prefixed AGT-####.

4.6 Public PSRA Register Display

The PSRA licensee data displayed in the /for-agents combobox and used to validate licensee selections is sourced from the Property Services Regulatory Authority's published Register of Licensed Property Services Providers. This is public-sector information made available by the PSRA. Where this information includes personal data (for example, individual licence holders trading under their own name), Bopperty processes it under GDPR Article 6(1)(f) legitimate interest in supporting verification of regulated status, in line with the PSRA's publication of the Register.

Bopperty periodically refreshes PSRA-derived data and provides a correction route where a listed person believes the displayed information is inaccurate or outdated. Correction requests in respect of PSRA-derived data can be submitted via https://bopperty.ie/corrections or through the contact form at /contact (privacy category).

Where providing individual notice to each listed person would involve disproportionate effort, Bopperty provides this transparency information through this Privacy Policy and the correction route above, in reliance on the exemption in GDPR Article 14(5)(b).

4.7 Search, Report, and Allowance Usage Data

We may collect and store information about:

• locations searched;
• reports generated;
• report IDs;
• comparisons generated and the areas they display;
• sold-prices area pages viewed;
• timestamps of searches and report generation;
• report access history;
• correction status;
• records of the distinct areas you view, labelled by surface (area report, comparison, or sold-prices area page), supporting the separate free usage allowances within rolling 30-day windows;
• where listings are published, aggregate interaction counts for listings (such as views and phone-number reveals);

4.8 Technical, Device, and Abuse-Prevention Data

We may collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• referring URL;
• pages viewed;
• timestamps;
• server logs;
• diagnostic and security event data;
• cookie identifiers;
• session identifiers;
• request timing and metadata.

Bopperty's hosting provider also produces aggregate, cookieless measurements of site usage and performance from the requests it serves as host. Visitors are counted using a short-lived identifier derived from the request and discarded within 24 hours; no cookie or device storage is used, no cross-site tracking occurs, and only aggregated statistics are available to Bopperty.

4.9 Acceptance and Consent Records

We record: the Terms version accepted; the Privacy Policy and Cookie Notice versions presented and acknowledged; the timestamp; a hashed record of the IP address; a hashed record of the browser user-agent; and the acceptance reference and surface (such as the report or comparison generated immediately after acceptance, where applicable). The acceptance record stores the acceptance surface; it does not store a report identifier.

These records are retained for the period described in Section 14.

4.10 Publicly Available Information Used in Reports and Content Hubs

Bopperty uses public, licensed, third-party, official, open, and derived information to generate reports and to populate content hubs.

Bopperty seeks to minimise the display of personal names. For example, Bopperty surfaces registered centre-based childcare facilities (where the entity name is the trading name) and named public amenities. Bopperty does not surface registered private childminders by name and does not surface natural persons who provide a regulated service from a private home.

Where public data includes personal data, Bopperty aims to minimise its use and present information at an area or contextual level wherever the source licence and reader inference allows.

4.11 Special-Category Data and Profiling Limits

Bopperty does not use special-category personal data within the meaning of GDPR Article 9 for profiling, selection, routing, or decision-making about any person, and does not display or seek to infer it. Accessibility and equality requests raised through /contact are handled as described in Section 3.2.

Bopperty's data architecture excludes Census fields that disclose special-category attributes such as ethnicity, religion, nationality, disability, and education-level statistics. Demographic indicators surfaced in reports are presented at area level only and are derived from variables that do not disclose special-category attributes.

Readiness check tools ask about the user's situation (buyer type, arrangement type, ownership type, stage, property type interest, selling intent); answers are processed in your browser (Section 4.3), and the tools do not collect or seek to infer family status, age, race, national origin, disability, religion, sexual orientation, civil status, membership of the Traveller community, or any other protected ground under the Equal Status Acts 2000-2018 or the Employment Equality Acts 1998-2015.

Bopperty does not present any area as suitable or unsuitable for individuals on the basis of any protected ground under the Equal Status Acts 2000-2018.

4.12 Account Data and Usage Allowance Records

For consumer accounts, Bopperty processes your email address, account identifiers and status, sign-in events and one-time-code delivery records, account creation and activity timestamps, your Head Start watches, your saved checklists, and deletion request records where you request deletion.

To operate the free usage allowances, Bopperty keeps records of the distinct areas you view, labelled by surface. Signed in, these records are measured against your account. Without an account, allowances are measured using a signed browser cookie and a hashed record of your IP address, as described in the Cookie Notice.

Saved checklists. Readiness answers are processed in your browser. Unless you choose to save a result, they are not transmitted to or stored by Bopperty. If you save a result, Bopperty stores the result-page address, including the parameters needed to recreate the checklist and which reflect your answer choices, together with the checklist name and save and update timestamps. Bopperty does not create a separate answer record or use saved-checklist information for profiling, selection, routing or any other purpose.

4.13 Public-Source Property Data (Property Price Register and Other Sources)

Bopperty processes information from the Property Price Register and other public and licensed sources to produce its sold-prices statistics, area reports, and derived datasets. Some register information — property addresses and transaction details — may relate to identifiable individuals, such as a seller or buyer of a property.

The lawful basis for this processing is GDPR Article 6(1)(f) legitimate interests: providing a public property-information service, and publishing statistics derived from a statutory public register.

Bopperty distinguishes between register facts and its own derived figures: register facts (individual sale records) are rendered as filed with the register, and Bopperty never edits them; derived figures (medians, adjusted statistics, trends) are Bopperty's own computations under the published methodology at /sold-prices/methodology.

Providing individual notice to every person appearing in a large-scale public register would involve disproportionate effort. Bopperty relies on GDPR Article 14(5)(b) as the principal exemption, and takes these measures instead: this Privacy Policy, the published methodology page, the visible source statements on the pages that display register-derived information, and the correction route at /corrections.

Register-derived working data is retained while the service operates and is refreshed from the source register. You can object to this processing under GDPR Article 21 through /contact (privacy category) or legal@bopperty.ie; Bopperty will assess the objection against the grounds you provide.

Where more than one lawful basis is listed for a single purpose, this is because different elements of the same activity involve different processing. For example, we rely on contract to generate a report requested by you, and legitimate interests to retain limited logs needed to secure the service and evidence acceptance of our terms.

Where we rely on legitimate interests, our interests include operating Bopperty, generating reports requested by users, publishing statistics derived from public property data, protecting the service from abuse, enforcing fair usage, maintaining security and reliability, protecting intellectual property and database rights, investigating correction requests, supporting regulated property services providers in connecting with users who have requested introductions, and managing legal or regulatory risk. Bopperty has assessed and documented the basis for this processing; further information is available where required.

Bopperty distinguishes between transactional emails and marketing emails.

Transactional emails are necessary to provide a service you have requested. Bopperty's transactional emails are: sign-in one-time codes (consumer and agent accounts), agent portal invitation emails, correction-report acknowledgements, and, where listings are published, the relay of a listing enquiry to the publishing agent. These are sent without a separate marketing consent because they are part of the service.

Marketing emails include Head Start alert emails (per-watch consent), affordability updates, newsletters, content-hub updates, and product communications. These are sent only where you have given consent through an opt-in.

You can unsubscribe from marketing emails at any time using the unsubscribe link in our emails or through /contact (privacy category). After unsubscribe, your email address may be retained on a suppression list to prevent further marketing emails.

Where you submit a request through /local-experts, your contact details and request details are shared with a PSRA-licensed property services provider operating in your area for the purpose of fulfilling the introduction you have requested. Bopperty tells you which provider received your details: the provider's name and PSRA licence details are provided to you at or before transmission, together with a link or contact route to the provider's privacy information where available.

The receiving property services provider determines its subsequent professional processing as an independent controller. The property services provider is subject to the Property Services (Regulation) Act 2011 and to its own data protection obligations under GDPR.

Where Bopperty publishes property listings and you submit an enquiry about a listing, your enquiry details (name, email address, phone number, and your message) are transmitted to the publishing agent, who handles them as an independent controller for the purpose of responding to you. Bopperty retains a record of the enquiry as described in Section 14.

Bopperty uses cookies and, in one narrow case, session-scoped browser storage to operate the website, support location, report-generation, and content-hub functionality, manage the free usage allowances within rolling 30-day windows, prevent abuse, and maintain security. The single session-storage item holds the email address you entered so a sign-in can complete at the code-entry step; it is cleared when the sign-in completes or the session ends. Bopperty does not use persistent local storage.

The click-acceptance step on the homepage, presented before you first generate a report or compare areas, captures acceptance of the Terms of Use, acknowledgement of this Privacy Policy, and confirmation that you have read the Cookie Notice. Only essential cookies are loaded under this step. Non-essential cookies (such as analytics or marketing technologies) are not set unless and until you have given separate, specific, informed consent through the cookie settings page. You can review or change your cookie preferences at any time at https://bopperty.ie/cookies/settings.

The Cookie Notice identifies each cookie and session-storage item that is treated as strictly necessary, including the purpose and duration of each.

Cookie Notice: https://bopperty.ie/cookies Cookie settings: https://bopperty.ie/cookies/settings

Bopperty operates as a free service. To keep it free and to prevent abuse, Bopperty uses automated controls including rate limiting, IP-based throttling, signed-cookie session controls, hashed IP records, and a bot-signal challenge on forms and sign-in flows.

The bot-signal challenge is applied on the corrections form, the /local-experts and /for-agents forms, the contact form, account sign-up and sign-in, and the agent portal sign-in. The bot-signal provider processes IP address and request signals during submission to distinguish human users from automated bots, and is described in Section 10 under "Form bot-signal and spam-protection provider".

Bopperty's service is delivered through a network-edge security provider, which applies network-level protections (such as filtering malicious traffic and mitigating denial-of-service attacks) to requests before they reach Bopperty's servers.

These controls help Bopperty:

• enforce the free usage allowances within their rolling 30-day windows;
• detect and prevent scraping, automated extraction, bot abuse, and circumvention attempts;
• preserve service availability;
• secure forms and sign-in flows.

These controls are never used for advertising, behavioural profiling, or any purpose beyond security, abuse prevention, and fair-usage enforcement.

Bopperty does not deploy device-identification or browser-fingerprinting technology, and does not use any such techniques for tracking, advertising, behavioural profiling, or cross-site identification. Bopperty's network-edge security provider analyses technical request signals (such as IP address and request characteristics) to detect and block malicious traffic, as described in Section 10 and the Cookie Notice.

9.1 Lawful Basis

Bopperty's lawful basis for these abuse-prevention controls, including the bot-signal protection, is:

1. The strictly-necessary exemption under the Irish ePrivacy Regulations 2011 (SI 336/2011, Regulation 5(3)), on the basis that the technology is necessary to provide, secure, and preserve the integrity of the report-generation, form-submission, and sign-in services the user has requested.
2. GDPR Article 6(1)(f) legitimate interest. The legitimate interests pursued are fraud prevention and abuse prevention, as recognised in Recital 47 GDPR.

Bopperty has assessed and documented the basis for this processing and the transfer arrangements that support it; further information is available where required.

9.2 Right to Object and Human Review

You have the right to object to Bopperty's abuse-prevention processing on grounds relating to your particular situation, under GDPR Article 21(1). To object, use the contact form at /contact (privacy category) or legal@bopperty.ie.

Bopperty assesses objections case by case. Where Bopperty accepts an objection, it will cease the relevant processing in line with applicable law and will consider whether less intrusive controls are sufficient for the user's interactions. Where Bopperty cannot provide the relevant service securely without the relevant control, Bopperty may be unable to provide some functionality to that user.

You can object under GDPR Article 21; where an access restriction of genuine significance has affected you, you can ask for human review of it, through the contact form at /contact (privacy category) or legal@bopperty.ie.

Bopperty uses third-party service providers to operate, secure, and maintain the service. We disclose the categories of those recipients, their typical location, the data they process, and the cross-border transfer mechanism applied (where relevant). We do this in accordance with our obligation under GDPR Article 13(1)(e) to identify the recipients or categories of recipients of personal data.

A current list of key processors is available on request via /contact (privacy category) or legal@bopperty.ie. Changes to the categories above (such as adding a new category of recipient, materially changing the data processed by an existing category, or changing the location or transfer mechanism applied to a category) are notified where required by law or where a change materially affects you, in line with Section 19.

We may also disclose personal data where required by law, regulation, court order, public authority request, or to protect the rights, safety, security, or integrity of Bopperty, users, or others.

Bopperty does not sell personal data.

Bopperty uses automated systems to generate area reports and to produce personalised readiness check results in your browser.

Bopperty does not use automated processing to make decisions about users that produce legal effects or similarly significant effects on them within the meaning of GDPR Article 22.

Bopperty does not produce user credit scores, lending decisions, insurance decisions, eligibility decisions, legal determinations, valuation decisions, or suitability determinations.

Reports and readiness check results are informational only. They apply rules, thresholds, multiples, or parameters published by regulators, public bodies, or third parties as in effect at the time the report or result is generated. Those rules may have changed since. Authoritative current rules remain available from the relevant publishers.

/local-experts requests are not routed automatically: Bopperty selects one receiving provider, checked against the public PSRA register. No automated decision-making with legal or similarly significant effect occurs, and no scoring, ranking, profiling, or assessment of users takes place.

You can object under GDPR Article 21; where an access restriction of genuine significance has affected you, you can ask for human review of it, through the contact form at /contact (privacy category) or legal@bopperty.ie.

We may share personal data with the categories of recipients listed in Section 10 and with professional advisers (such as legal, accounting, compliance, and insurance advisers) where necessary and on a need-to-know basis.

Service providers and professional advisers process personal data only where necessary to provide services to us and, where required, under appropriate data processing agreements or professional confidentiality obligations.

Bopperty may also disclose personal data where required by law, regulation, court order, public authority request, or to protect the rights, safety, security, or integrity of Bopperty, users, or others.

Bopperty is based in Ireland. We aim to use service providers and configurations that process personal data in Ireland, the EEA, the UK, Switzerland, or other jurisdictions recognised as providing adequate protection.

Some service providers process personal data outside the EEA. Section 10 (Categories of Recipients) indicates the location of each category of recipient and the transfer mechanism applied.

Where personal data is transferred to the United States, we rely on the EU Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), in the appropriate module for the relationship, supplemented by technical and organisational measures such as encryption in transit, the use of hashed identifiers where feasible, and access controls. Bopperty has assessed these arrangements in line with the Schrems II judgment of the Court of Justice of the European Union.

Where personal data is processed in Switzerland, we rely on the European Commission's adequacy decision for Switzerland.

Where personal data is processed in the United Kingdom, we rely on the European Commission's adequacy decision for the United Kingdom.

Summaries of Bopperty's transfer assessments are available where legally required.

Bopperty retains personal data only as long as necessary for the purposes described in this Privacy Policy or as required by applicable law.

Identifying details are removed from most operational records after 24 months; account records, agent records, and the acceptance log have their own periods below. Where continued identifiable or pseudonymised retention is necessary for legal-claims defence or other documented legal, regulatory, dispute-resolution, or fraud-prevention purposes, the relevant record is moved to restricted-access storage and deleted no later than 72 months from the relevant event. De-identification, as used here, means the removal of direct identifiers and the reduction of re-identification risk; it is not a guarantee of full anonymisation under GDPR.

Where Bopperty receives a data subject request that requires earlier deletion, Bopperty will action that request in line with Section 16 unless an exemption or legal obligation applies.

Bopperty applies organisational and technical measures to protect personal data, including encryption in transit, access controls, IP and user-agent hashing, signed session cookies, rate limiting, bot-signal protection, and regular review of supplier security posture.

No system is perfectly secure. Where a personal data breach occurs that is likely to result in a risk to the rights and freedoms of natural persons, Bopperty notifies the Irish Data Protection Commission within the period required by GDPR Article 33 and notifies affected users where required by GDPR Article 34.

Subject to the conditions and exemptions under GDPR and Irish data protection law, you have the right to:

• access the personal data Bopperty holds about you;
• request rectification of inaccurate or incomplete personal data;
• request deletion of your data (the right to erasure) (account deletion is self-serve from your account settings; Section 3.5 describes what happens);
• restrict processing;
• object to processing based on legitimate interests, including the right to object to abuse-prevention processing under Section 9.2;
• withdraw consent where processing is based on consent;
• request data portability where the right applies;
• object to direct marketing at any time;
• lodge a complaint with the Data Protection Commission.

To exercise your rights, use the contact form at /contact (privacy category) or legal@bopperty.ie. Please describe the right you wish to exercise and provide enough information for us to identify the relevant records.

Statutory data-protection rights requests are handled under the timelines in this Section. Ordinary content feedback and correction suggestions submitted through /corrections are reviewed as part of operating the service and do not carry a service-standard commitment; where a /corrections submission is in substance a rights request, it is handled under this Section.

You can also request a copy of your data through /contact by selecting "Request a copy of my data". Export requests are fulfilled manually and the copy is sent only to the email address on the relevant records or account.

We aim to respond to data protection rights requests as soon as reasonably practicable and in any event within the period required by GDPR. We may respond sooner where possible. Where a request is complex or where we receive multiple requests, we may extend the response period as permitted by GDPR Article 12(3) and will tell you if we do so.

We may need to verify your identity before responding.

If you are unhappy with how we handle your personal data, please contact us first through the contact form at /contact (privacy category) or legal@bopperty.ie.

You also have the right to lodge a complaint with the Irish Data Protection Commission:

• Website: https://www.dataprotection.ie
• Online complaint form: https://www.dataprotection.ie/en/contact/how-make-complaint
• Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

If you live or work in another EEA Member State, you may also lodge a complaint with the supervisory authority of that Member State.

Ordinary browsing of Bopperty's informational pages is open to everyone. Creating an account and using Bopperty's record-creating or restricted services require the user to be 18 or older, as set out in the Terms of Use.

The Irish digital age of consent under the Data Protection Act 2018, Section 31, is 16. Bopperty applies a higher threshold: it does not knowingly collect personal data from anyone under 18 through its accounts, reports and comparisons, or commercial or record-creating services, and does not rely on a child's consent for any processing.

Statutory routes are open to everyone irrespective of age: anyone, including a person under 18, may make a data-protection rights request, submit a DSA notice, or raise an equality or accessibility complaint, and Bopperty facilitates such requests in line with GDPR Article 12.

If you are under 18, you must not create an account or use Bopperty's accounts, reports and comparisons, or commercial or record-creating services.

If a parent or guardian believes a person under 18 has created an account or provided personal data to Bopperty, use the contact form at /contact (privacy category) or legal@bopperty.ie and Bopperty will take reasonable steps to delete it.

We may update this Privacy Policy from time to time. The updated version will be published on bopperty.ie with a new effective date.

Where changes are material, we may take additional steps to notify users (such as posting a notice on bopperty.ie, requesting acknowledgement of the updated policy through the click-acceptance step on the homepage, or sending an email to email-subscribed users).

Changes to the categories of recipients in Section 10 (such as adding a new category of recipient, materially changing the data processed by an existing category, or changing the location or transfer mechanism applied to a category) are notified where required by law or where a change materially affects you.