Privacy Policy

1. Who is responsible for your data

The data controller responsible for the processing described in this Policy is:

2. What personal data we collect

We only collect personal data that you actively provide to us, plus a small amount of technical data needed to keep the site secure and to understand how it is used.

• Contact and quote request forms: your name, email address, and the content of your message. If you request a quote through the Zome Lounge form, we also collect the property type, quantity, and budget details you enter, along with the checkbox confirming you agree to be contacted.
• Waitlist sign-up: your email address and the checkbox confirming you agree to be contacted about updates and exclusive offers.
• Automatically collected technical data: your browser and connection data processed by Cloudflare Turnstile solely to confirm you are not a bot, and aggregated, anonymised page-visit statistics collected via Vercel Web Analytics, which does not identify you personally.
• The language (locale) of the page you used, so we can reply to you in the right language.

3. Why we process your data, and our legal basis

• To respond to your inquiry or quote request — based on your consent (Art. 6(1)(a) GDPR) and, where applicable, to take steps prior to entering into a contract with you (Art. 6(1)(b) GDPR).
• To add you to our waitlist and notify you about launches or offers — based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
• To protect the website against spam, bots, and abuse (Cloudflare Turnstile) — based on our legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR).
• To understand aggregate site usage and improve the website (Vercel Web Analytics) — based on our legitimate interest in operating and improving the site (Art. 6(1)(f) GDPR). This analytics data is aggregated and does not identify you.

4. Who we share your data with

We use the following service providers to operate this website. They process personal data on our behalf, under data-processing agreements, and are not permitted to use it for their own purposes:

• Supabase Inc. — stores the messages and sign-ups you submit through our forms.
• Resend — delivers your inquiry by email to our team.
• Cloudflare, Inc. — provides the Turnstile bot-verification check on our forms.
• Vercel Inc. — hosts the website and provides cookieless, aggregated analytics.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

International transfers

Some of these providers may process data on servers located outside the European Economic Area (for example, in the United States). Where this occurs, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.

5. How long we keep your data

• Contact and quote form submissions are kept for as long as needed to handle your request and a reasonable follow-up period, and are deleted no later than 24 months after our last contact with you.
• Waitlist entries are kept until we launch and contact you, or until you withdraw your consent, whichever happens first.
• Analytics data is aggregated and does not identify you. Turnstile verification results are not stored by us beyond the verification check itself.

6. Cookies

This website does not use advertising or tracking cookies. Vercel Web Analytics operates without cookies. A functional session cookie is only set for authorised staff who log in to our internal administration area; it is not set for regular visitors browsing the public site.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data ("right to be forgotten").
• Request restriction of processing.
• Receive your data in a portable format.
• Object to processing based on our legitimate interest.
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, contact us at office@refarmo.com. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria (dsb@dsb.gv.at), or with the supervisory authority in your own EU country of residence.

8. Data security

We use appropriate technical and organisational measures, such as encrypted connections (HTTPS) and access controls, to protect your data, and we work only with reputable service providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

This website is not directed at children under 16, and we do not knowingly collect personal data from children.

10. Our right to change the content of this website

REFARMO GmbH reserves the right to change, update, add to, remove, or discontinue any content, feature, description, image, pricing, availability, or functionality of this website at any time and without prior notice, including in relation to the Zome Lounge product and any retreat or property offerings described here. Such changes to the website's content do not, by themselves, change the data-protection commitments described in this Policy — those only change if we update this Policy itself, as described below.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The "last updated" date at the top of this page shows when it was last revised. Where required by law, we will notify affected individuals of material changes that affect how we use personal data we already hold.

12. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at office@refarmo.com or at the postal address above.