Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Property Shell is a real estate sales and CRM platform headquartered in Sydney with operations in the United Kingdom. It is specialised in new build and off plan developments: contact management, reservation forms, sales contracts, payment plans, agent commissions and buyer portals. The platform installs tracking pixels and transfers personal data to Australia and the United States, which requires consent and a documented transfer chain for European deployments.
Property Shell is a real estate sales platform born in Australia and now active in the United Kingdom, Ireland and other European markets. Unlike traditional residential CRMs, it focuses on new build and off plan developments: it manages display suites, reservation flows, exchange of contracts, payment milestones, agent commissions, and buyer portals for progress updates. Real estate developers use it to coordinate sales agents, conveyancers and lenders inside a single workflow.
Property Shell collects buyer contact details, financial qualification data, identity documents (passport, driving licence, proof of funds), reservation deposits, behavioural data on listings, signed sales contracts and stage payment instructions. The web tracker captures IP, user agents, UTM parameters and an anonymous identifier used to link a visitor to a CRM contact.
Property Shell is a processor for the developer while CRM features may make it a joint controller. Marketing tracking cookies are not strictly necessary and require consent under Art. 5(3) ePrivacy. Identity documents and financial data trigger heightened security obligations under Art. 32 GDPR and, in some EU member states, sectoral rules for real estate transactions.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Configure your CMP to block Property Shell marketing tags until consent is granted. Reservation and contract flows do not need a tracking consent (they rely on Art. 6(1)(b) contract execution) but they still require a clear privacy notice and an audit log of every staff interaction with the buyer file.
Property Shell processes data on AWS regions including Sydney and possibly US regions for analytics. EU data should be stored in eu-west-2 (London) where possible. Operators must sign Standard Contractual Clauses, document a Transfer Impact Assessment for Australia and the US, and apply supplementary measures such as encryption at rest and segregated access roles.
Sign the Property Shell DPA and SCCs, configure data residency in London where available, restrict admin and agent access with MFA and IP allow lists, retain identity documents only for the period required by anti money laundering law, integrate a CMP for the marketing tag, and document Property Shell in your Article 30 register.
Websites using Property Shell must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended when Property Shell is used at scale to score new build prospects, manage AML and KYC documents, or integrate with mortgage providers. The processing of identity documents and proof of funds often crosses the Art. 35 GDPR threshold.
Sample consent text
We use Property Shell, a sales CRM headquartered in Australia, to manage your real estate enquiries, reservation forms and sales contracts. This involves transferring your personal data outside the European Union under Standard Contractual Clauses.
Third-party domains contacted
propertyshell.comapp.propertyshell.comcdn.propertyshell.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ps_uid | Marketing | 1 year | Unique Property Shell visitor identifier used to link a buyer enquiry to its journey across listings. |
| ps_session | Strictly Necessary | Session | Maintains the buyer portal session and the agent dashboard session in the Property Shell back office. |
| ps_marketing | Marketing | 6 months | Stores marketing attribution parameters (UTM, source) for new build campaigns and agent attribution. |
Property Shell places tracking cookies for advertising — comply with GDPR using FlowConsent.
Property Shell sets a marketing visitor identifier for attribution, a strictly necessary session cookie for the buyer portal and agent dashboard, and a marketing cookie that captures UTM parameters. Marketing cookies require prior consent; session cookies are exempt.
Yes for marketing tags and behavioural analytics. Strictly necessary cookies for the portal and the reservation flow are exempt. Identity documents and financial data must be collected with full transparency and adequate security.
Performance of a contract (Art. 6(1)(b) GDPR) for reservation, sale and payment. Legitimate interest (Art. 6(1)(f)) for fraud prevention and KYC, subject to a balancing test. Consent (Art. 6(1)(a)) for marketing communications. Legal obligation (Art. 6(1)(c)) for anti money laundering checks.
Yes. Property Shell uses AWS Sydney as its primary region and may replicate analytics to US regions. Operators should configure data residency in London where possible and document Standard Contractual Clauses and a Transfer Impact Assessment for both Australia and the United States.
Yes, particularly when Property Shell processes identity documents, proof of funds and financial data, or when buyer scoring is automated. A DPIA aligned with Art. 35 GDPR documents risks and mitigation.
Sign the Property Shell DPA and SCCs, configure London data residency where available, enforce MFA and role based access for agents, retain identity documents only for the legal AML retention period, integrate a CMP for the marketing tag, and document Property Shell in your Article 30 register.
Yes. Reapit (UK), Apimo (France), PropertyEngine (Netherlands) and Salesforce Real Estate Cloud configured in EU regions provide comparable functionality with EU data residency by default. They reduce exposure to international transfers.
List ps_uid, ps_marketing as marketing cookies and ps_session as a strictly necessary cookie. Disclose Property Shell as a sub processor with operations in Australia and the United Kingdom. Mention the Sydney and possibly US data flows and re trigger the consent banner.