Information on the processing of personal data, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018.
| Registered name | [Company name, S.L.] |
|---|---|
| Tax ID (NIF) | [B-00000000] |
| Registered office | [Street, number, postcode, municipality, Canary Islands, Spain] |
| Contact email | [contacto@dominio] |
| Commercial registry | [Registro Mercantil of ___, volume ___, sheet ___, page ___] |
[DPO email, where one is appointed]. Appointment is mandatory where any of the cases in Article 37(1) GDPR applies; otherwise it is voluntary and is notified to the Spanish Data Protection Agency.
| Processing | Legal basis | Retention |
|---|---|---|
| Professional account and publication of listings | Performance of the contract · Art. 6(1)(b) GDPR | For the duration of the relationship and 6 years after, under Art. 30 of the Spanish Commercial Code |
| Document verification of identity and title | Legal obligation and legitimate interest in preventing fraud · Arts. 6(1)(c) and 6(1)(f) | 6 years from the advertiser’s termination |
| Adviser’s image and voice in their introduction video | Consent of the data subject themselves · Art. 6(1)(a). Given by the adviser with their own credentials; nobody consents on behalf of anyone else. Withdrawable at any time, without affecting prior processing | Until the adviser withdraws it or leaves |
| Languages each adviser speaks and their profile data | Performance of the contract with the agency · Art. 6(1)(b) | While the profile is published |
| Enquiry from an interested party to an advertiser | Pre-contractual steps at the data subject’s request · Art. 6(1)(b) | 2 years from the last contact |
| Reports of illegal content (DSA) | Compliance with a legal obligation · Art. 6(1)(c), in relation to Art. 16 of Regulation (EU) 2022/2065 | 5 years from the decision, to evidence the required diligence |
| Favourites, comparison, saved searches, language and theme | No processing by the portal: these are stored in the user’s own browser local storage and are not transmitted to any server | Until the user clears their browser data |
| Aggregate usage measurement | Legitimate interest in understanding use of the service, without individual profiling · Art. 6(1)(f) | 14 months |
Data comes from the data subject. For advisers, the agency creates the professional profile and the adviser completes their personal data and uploads their video using their own credentials. The cadastral reference is checked against the Spanish Cadastre’s electronic office, which is a publicly accessible source.
The advertiser’s data and profile are public on the portal, because that is the purpose of the service.
Processors also act under contracts compliant with Article 28 GDPR: hosting, transactional email, payment gateway and support tools. The current list of processors is available on request.
Data is not sold to third parties and is not shared for advertising purposes.
Providers are chosen so that data is processed within the European Economic Area wherever possible. Where a processor handles data outside the EEA, the transfer relies on a European Commission adequacy decision or on standard contractual clauses, with a transfer impact assessment and any supplementary measures required.
The portal’s value estimate is an automated calculation, but it produces no legal effects on anyone and does not similarly significantly affect them: it is an indicative figure that does not condition access to any service or to any financing. It therefore does not constitute a decision within the meaning of Article 22 GDPR.
No individual profiles of visitors are built and no behavioural advertising is used.
Anyone may request access to their data, rectification or erasure, restriction of or objection to processing, and portability, by writing to the contact address and identifying themselves sufficiently.
Where processing is based on consent — the adviser’s video — consent may be withdrawn at any time from the profile itself, without affecting the lawfulness of prior processing.
Requests are resolved within one month, extendable by two further months in complex cases, with notice to the data subject.
Anyone may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid · www.aepd.es), in particular if they consider that their rights request has not been satisfactorily resolved.
Technical and organisational measures appropriate to the risk are applied, under Article 32 GDPR: encryption in transit, role-based access control, access logging and backups. Professional access requires two-factor authentication on every account, with passkeys or an authenticator app as the primary methods; SMS is accepted only as a fallback. Uploading an adviser’s video, changing payout details and bulk-deleting listings all require re-verifying the second factor.
Any security breach posing a risk to people’s rights is notified to the supervisory authority within 72 hours of becoming aware of it, and to those affected without undue delay where the risk is high.
These texts are published in Spanish and English. In case of discrepancy the Spanish version prevails. The portal’s other language versions link to the English one.
PROTOTYPE. There is no company behind this site and the identity fields appear in brackets, unfilled: a legal notice with an invented tax ID would be a document that appears to identify a real party. Before going live these must be completed and all four texts reviewed by a qualified lawyer.
Last updated: August 2026