Privacy policy

• Who is the controller
• What data we process
• Purposes, legal basis and retention
• Marketing communications
• WhatsApp
• Who we share data with
• International transfers
• When we process data on behalf of others
• Your rights
• Security
• Changes to this policy

This document is a translation of the original Spanish version. In the event of any discrepancy in interpretation, the original Spanish text shall be used as a reference, without prejudice to the rights granted to users and consumers under applicable law. Versión en castellano.

Who is the controller

For any question about your data, write to info@habitaretail.com. We have not appointed a data protection officer.

This policy applies to the data we process as controller: data of people who write to us or call us, visit the website, instruct us or take part in a transaction we are involved in. It complies with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on data protection and digital rights (LOPDGDD) and the LSSI.

What data we process

Data you give us

• Identification and contact details: name, phone number and email address.
• What you tell us about your property or what you are looking for: address, type, floor area, condition, price, timing and any other information you include in your message.
• If we end up working together, the documents the instruction requires: identity document, title deeds, Land Registry extracts, contracts, bank details for payments, and any financial information required by the transaction or by anti-money-laundering rules.

We do not need health data or other special categories of data. Please do not include them in forms or messages.

Fields marked with an asterisk are required to deal with your request; without them we cannot reply. If you give us another person's data (a co-owner, your tenant, a relative), you must have informed them beforehand and have their permission.

Data generated when you use the website

The date and IP address from which you submit a form, and the browsing data collected by cookies if you accept them. This is explained in the cookie policy.

Data we receive from others

We may receive your data from the property portals where we advertise, when you contact us about a listing; from the other party to a transaction we are involved in (for example, an owner who gives us their tenant's details, or a buyer who tells us their notary); or from a client or professional partner who refers you. In those cases we process identification and contact details and data related to the transaction, and we inform you at our first contact with you.

What we use it for, on what legal basis and for how long

When these periods end, we delete or anonymise the data. While liability arising from the processing may still be claimed, we keep it blocked and use it only to deal with such potential liability (art. 32 LOPDGDD).

To send you only what interests you, we take into account what you have told us you are looking for: area, property type, budget. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Marketing communications

We only send you marketing by email or WhatsApp if you have agreed to it or, if you are already a client, about services similar to those you engaged. Replying to your enquiry or sending you properties you asked us to look for is not marketing: it is dealing with your request.

You can unsubscribe at any time, free of charge and without giving reasons: using the link or instructions in each email, replying «BAJA» (or «STOP») to a WhatsApp message, or writing to info@habitaretail.com. Unsubscribing does not affect anything already sent or our replies to your enquiries.

WhatsApp

If you write to us on WhatsApp, or agree that we may contact you that way, the conversation goes through WhatsApp's services, owned by Meta, which processes the data under its own terms and privacy policy. We use WhatsApp Business. If you prefer not to use it, you can call us or email us.

Who we share your data with

We do not sell your data or pass it to third parties for their own benefit. We only share it when necessary:

• With the other party to the transaction and those involved in it (notary, Land Registry, administrative agency and, if you ask us to present financing options, lenders or valuation firms), to the extent necessary to complete it.
• With registered technicians who issue occupancy certificates, energy certificates or building inspection reports, when you ask us to arrange them.
• With public authorities, courts, the Spanish Tax Agency, the Catalan Tax Agency, INCASÒL (rental deposits) and the Spanish Financial Intelligence Unit (SEPBLAC), where required by law.

Our service providers also have access to the data, solely to provide their services to us and following our instructions:

• Website hosting and form delivery.
• Email and document storage.
• Messaging, with people who write to us on WhatsApp or have agreed that we may write to them.
• Web analytics and maps, only if you accept the relevant cookies.
• The cloud-based property management and community management software we use.
• Other technology and cloud software providers, including productivity, analysis and document-drafting tools, which we use in their professional versions and which may not use your data for their own purposes.
• External advisers and professionals who provide services to us, bound by confidentiality.

Some of these tools include automated analysis and drafting features. We use them to support our work, with review by a member of our team, and never to take decisions that affect you.

On request, we will give you the up-to-date list of providers.

When we publish a property on the website or a portal, we do not publish the owner's personal data.

International transfers

Some of these providers may process data outside the European Economic Area. When this happens, they do so with the safeguards required by the GDPR: a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses. You can ask us for more information at info@habitaretail.com.

When we process data on behalf of others

When we manage an owners' association or an owner's property, we process the data of owners, tenants, occupants and suppliers on behalf of the association or owner, who is the controller. We do so under the service agreement and their instructions. To exercise your rights over that data you can contact the association or the owner, or us, and we will pass it on.

Your rights

You can exercise these rights at any time:

• Access: to know whether we process your data and obtain a copy.
• Rectification of inaccurate or incomplete data.
• Erasure of your data when it is no longer needed or you withdraw consent.
• Objection to processing based on our legitimate interest and, at any time, to receiving marketing.
• Restriction of processing, for example while we check a complaint of yours.
• Portability of the data you gave us, in a commonly used format.
• Withdrawal of consent, without affecting processing carried out before withdrawal.

To exercise them, write to info@habitaretail.com with the subject «Data protection», or by post to Via Augusta 135, local 3, 08021 Barcelona, stating which right you wish to exercise. We will only ask you to prove your identity if we have reasonable doubts about it. We will reply within one month, which may be extended by two further months for complex requests; if so, we will tell you within the first month.

If you believe we have not properly dealt with your rights, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, aepd.es). We would appreciate it if you wrote to us first so we can try to resolve it.

Minors

The website is not aimed at children under 14 and we do not knowingly process their data. If we learn that a child under that age has sent us data without the authorisation of their parents or guardians, we will delete it.

Security

We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS) across the website, access limited to those who need the data for their work, personal passwords, records closed to the public and a duty of confidentiality for everyone who works with us, which continues after the relationship ends.

Changes to this policy

We may update this policy when our processing or the law changes. The version in force is always the one published on this page, with its date. If the change affects something we asked for your consent to, we will ask for it again.