Privacy Policy

2. Data Controller

The data controller for personal data collected through the tour booking form is the property management company or website operator that has installed and configured the Plugin on their website. Foreword Development acts as a data processor on behalf of the data controller.

If you have questions about how your data is handled, please contact the property website operator directly. For questions about the Plugin itself, contact:

Foreword Development
Email: privacy@foreword.dev

3. Personal Data We Collect

When you use the “Schedule a Tour” form, the following personal data is collected:

• Full name — to identify you for the scheduled tour visit. Legal basis: Performance of a contract (Art. 6(1)(b)).
• Adresse mail — to send tour confirmation and allow cancellation. Legal basis: Performance of a contract (Art. 6(1)(b)).
• Phone number — to send SMS (text message) reminders and notifications about your tour, and to allow the property to contact you about your visit. Legal basis: Consent (Art. 6(1)(a)) for SMS; Legitimate interest (Art. 6(1)(f)) for property contact.

We also record the following booking metadata: date, time, duration, tour type (guided or virtual), unit or floor plan of interest, and a confirmation code.

4. How We Use Your Data

Your personal data is used exclusively for the following purposes:

• Tour booking management — scheduling, confirming and cancelling property tour visits.
• Confirmation email — sending you an email with your booking details and confirmation code.
• SMS notifications — sending you text message reminders and notifications about your scheduled tour. You may opt out at any time by replying STOP to any SMS.
• Calendar synchronisation — creating a calendar event in the property manager’s Google Calendar or Outlook Calendar so they can prepare for your visit.

Your personal information is used for no other purpose than sending correspondence concerning the single apartment tour you have scheduled. We do not use your data for marketing, profiling, automated decision-making or any purpose beyond those listed above.

5. Third-Party Services

To provide the tour booking functionality, your personal data may be shared with the following third-party sub-processors:

• SendGrid (Twilio Inc., USA) — Name and email, to deliver the confirmation email.
• Twilio SMS (Twilio Inc., USA) — Phone number and booking details, to deliver SMS reminders and notifications about your tour. You may opt out by replying STOP.
• Google Calendar API (Google LLC, USA) — Name, email, phone and booking details, to create a calendar event for the property manager.
• Microsoft Graph API (Microsoft Corp., USA) — Name, email, phone and booking details, to create an Outlook calendar event for the property manager.
• SightMap (Engrain Inc., USA) — No visitor data is sent. Used for interactive property map display.

Only one calendar provider (Google or Outlook) is active per property at any time. Your data is shared only with the provider the property manager has connected.

International transfers: The third-party services listed above are based in the United States. Data transfers to the USA are protected by Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework, as applicable to each provider.

6. ICS Calendar Feed

The Plugin offers an ICS calendar feed that property managers can subscribe to from external calendar applications. This feed may contain booking details including visitor names. The feed URL is protected by a unique secret token and is accessible only to the property manager.

7. Data Storage and Security

• Personal data is stored in an encrypted database on servers managed by Foreword Development.
• All communications between the Plugin, the API server and third-party services are encrypted using TLS/HTTPS.
• Access to the database is restricted to authorised personnel and authenticated API requests only.
• OAuth tokens for calendar integrations are stored securely and refreshed automatically; they do not contain visitor personal data.

8. Data Retention

Your personal data is retained for the duration necessary to fulfil the purposes described in this policy:

• Active bookings: retained for the duration of the booking and a reasonable period afterward for record-keeping.
• Cancelled bookings: retained for up to 12 months after cancellation, then permanently deleted.
• You may request earlier deletion at any time (see Section 9).

9. Your Rights

Under the GDPR/RGPD, you have the following rights regarding your personal data:

• Right of access (Art. 15) — obtain a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion of your data (“right to be forgotten”).
• Right to restriction (Art. 18) — limit how we process your data.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.

To exercise any of these rights, contact the property website operator or email us at privacy@foreword.dev. We will respond within 30 days of receiving your request.

10. Cookies and Local Storage

The Plugin itself does not set any cookies. It uses browser localStorage to save your favourited units (unit IDs only, no personal data). This data stays on your device and is never transmitted to our servers.

The SightMap interactive map (a third-party embed) may set its own cookies. Please refer to Engrain’s Privacy Policy for details.

11. Children’s Privacy

The tour booking service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted data through the form, please contact us so we can delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect the most recent revision. We encourage you to review this page periodically.

13. Contact & Complaints

If you have questions or concerns about this Privacy Policy or wish to exercise your rights, contact:

Foreword Development
Email: privacy@foreword.dev

You also have the right to lodge a complaint with your local data protection supervisory authority.