This policy explains what ZVV records about you, why, and what you can ask us to do about it. It covers this website and everything you can reach with a ZVV account — listings, bookings, messages, the wallet and the journal.
What we collect
What you give us
- Your account — name, username, email address, phone number and password. Signing in with Google or Apple sends us your name and email address from that account instead of a password.
- Your profile — title, bio, website, photo, country and address, and any social links you add.
- What you publish — property listings, booking listings, posts, comments, ratings and the photos and files attached to them.
- What you send — messages to other members, enquiries and offers on a listing, and anything you write to us.
- Identity documents — only if you verify your identity, and only for as long as the check requires.
- Payment and wallet details — the wallet address and payment details needed to fund an account, settle a booking or raise an invoice.
- Your email address alone, if you subscribe to the newsletter without an account.
What we record as you use the site
- The IP address you registered from, and sign-in activity on your account.
- Which listings and pages you open, so we can show what is popular and give you your own view history.
- Your browser and device, from the request itself.
- Your language, currency, theme and cookie choice, so the site opens the way you left it.
Cookies and local storage
We set as little as the site can work with.
- zvvsid — the session cookie that keeps you signed in for one visit. Without it you cannot sign in at all.
- A sign-in token, if you ask to be remembered, so the session can be rebuilt on your next visit.
- Your cookie choice, so the banner stops asking.
- Language, currency and theme — kept in your browser, not read by anyone else.
- Analytics — page and listing views, which only run once you accept.
Declining non-essential cookies leaves the first three; everything else stops.
Why we use it
- To run your account and keep you signed in.
- To publish your listings and posts and to show them to the right audience.
- To carry a booking, an offer or a payment through to settlement, and to issue the invoice for it.
- To pass an enquiry to the agency or host it is addressed to.
- To send the emails the service depends on — verification, password resets, booking and payment notices — and the newsletter if you asked for it.
- To keep the platform safe: spam and bot checks, fraud checks, and identity verification where it is required.
- To understand what is read and searched for, so the site gets better at showing it.
Who we share it with
We do not sell your personal information. It reaches other hands only where the service cannot work otherwise:
- The agency, host or member on the other side of a listing, enquiry, offer or booking — they see what you send them and the contact details a booking needs.
- Payment and identity-verification providers, to take a payment or complete a check.
- Mapbox, which draws the maps and receives the area being looked at.
- Google reCAPTCHA, which checks that a form was filled in by a person.
- Google or Apple, if you choose to sign in with them.
- Authorities, where the law requires it or where we must act on fraud or abuse.
How long we keep it
Your account and what you published stay while the account is open. Close it and we remove or anonymise what we are not required to keep — records tied to a payment, an invoice or an identity check are held for as long as tax and anti-money-laundering rules require. Analytics are kept in aggregate and are not tied back to you.
Your choices
- See and correct — your profile and settings pages hold most of what we have; write to us for the rest.
- Export — ask and we will send you a copy of your data.
- Delete — ask us to close your account and remove it, subject to the records above.
- Stop the newsletter — the unsubscribe link is in every one, and it takes effect immediately.
- Change your cookie choice — clear this site's cookies and the banner will ask again.
- Object or complain — write to us first, and to your local data protection authority if we have not put it right.
Security
The site is served over HTTPS, passwords are stored hashed and never in the clear, and sign-in can be protected with two-factor authentication from your security settings. No system is perfect: if a breach ever affects your data, we will tell you and the relevant authority.
Children
ZVV is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us information, write to us and we will remove it.
Changes to this policy
When this policy changes, the date at the top of this page changes with it. Material changes are announced on the site before they take effect.
Who to contact
Questions about this policy, or a request about your data, go to our contact page.
Controller: [legal entity name and registered address]. Data protection contact: [email address]. Governing law: [jurisdiction].