Privacy Notice – AVITAS Online Services
Last updated: 2026-10-14
This notice explains what personal data the AVITAS Online Services application collects, why, who receives it, how long we keep it, and your choices.
What we collect
| Data | Why |
|---|---|
| Account details: name, username, company, postal address, email, phone, fax | To create and run your account and contact you about it |
| Password (stored only as a one-way hash, never in readable form) | To sign you in |
| Subscription and purchase records | To provide the plans you buy and keep accounting records |
| Content you create: appraisals, portfolios, criteria, files you upload or export | To provide the service |
| Security records: sign-ins and sign-outs, failed attempts, password and account changes, with the time, your IP address and your browser/device description (user-agent) | To protect accounts, detect and investigate misuse, and meet audit obligations |
Emails we send
Only service emails: verifying your address, password-reset links, notices when an administrator changes your password settings, and replies to your support requests. No marketing emails are sent from this application.
Cookies
We use only cookies the service needs to work:
- Session cookie – keeps you signed in; ends when you sign out or after a period of inactivity.
- Security token – protects forms against cross-site request forgery.
- “Remember me” – only if you tick it; keeps you signed in for up to 7 days. Not available for administrator accounts.
We do not use advertising, analytics or tracking cookies.
Services from other companies
| Service | When | What they receive |
|---|---|---|
| Google reCAPTCHA Enterprise | Sign-in page | Information about your browser and how you interact with the page, to tell people from automated attacks |
| Google Maps (address suggestions) | Registration form | What you type in the address field, to suggest matching addresses |
| PayPal | Buying a subscription | Your payment details, entered directly on PayPal's pages |
| Content delivery networks (e.g. Cloudflare cdnjs, jsDelivr, jQuery, Google Hosted Libraries) | Every page load | Your IP address and browser information, as with any website request, to deliver page scripts and styles |
Each provider handles this data under its own privacy terms. Some of them process data outside your country, including in the United States.
Legal basis
We process account, purchase and content data to perform our contract with you; purchase records also to meet tax and accounting law; and security records, bot protection and address suggestions on the basis of our legitimate interest in a secure, easy-to-use service.
Who receives your data
We do not sell or rent your data. Besides the services above, it is handled only by providers that host the service and deliver its emails, by AVITAS staff who need it to support you, and by authorities when the law requires it.
How we protect it
Passwords are stored as one-way hashes; repeated failed sign-ins lock the account temporarily; administrator actions and security events are recorded in an audit log; and access to personal data is limited to staff who need it.
How long we keep it
- Account and content data: while your account exists.
- Security records: 400 days, then deleted automatically.
- Purchase records: as long as tax and accounting law requires.
Your rights
Depending on where you live, you can ask for a copy of your data, its correction or deletion, restriction of or objection to processing, and data portability, and you can complain to your data protection authority. You can update most account details yourself on the Account page; for anything else, contact us below.
Children
The service is for business users and is not intended for children.
Changes to this notice
When we change this notice we update the date at the top. Significant changes will be announced in the application.
Contact
Questions or requests: avitas-support@avitas.com.