Privacy

Ondara Group · Last updated: 29 September 2026

At Ondara Group we process personal data with the confidentiality, security and transparency that our business requires: property-backed lending, real estate brokerage and transactions, and legal services. This policy explains who processes your data, for what purposes, on what legal basis, for how long, who it is shared with and how you can exercise your rights. It applies to all websites, forms, telephone, messaging and email channels of the group’s companies and brands.

1. Data controllers

Ondara Group is not a legal entity but the trading name of the following companies, all registered at C/ Muntaner 354, 4º 2ª, 08021 Barcelona (Spain). Each company is the controller of the data it processes in connection with its own services. Where two or more companies jointly determine the purposes and means of a processing activity (for example, the shared management of the CRM or of enquiries received through ondara.group), they act as joint controllers under Article 26 GDPR, having agreed an allocation of responsibilities whose essence is available to data subjects.

Group general contact: +34 932 20 22 63 · hello@ondara.group

Data Protection Officer (DPO)

The group companies have appointed a common Data Protection Officer (Articles 37–39 GDPR and 34–37 LOPDGDD), whom you may contact on any matter relating to the processing of your data at dpo@ondara.group or by post to “Data Protection Officer – Ondara Group”, C/ Muntaner 354, 4º 2ª, 08021 Barcelona (Spain).

2. Applicable legal framework

The processing of personal data is governed by the following legislation, as amended from time to time.

2.1. European Union law

• Regulation (EU) 2016/679, General Data Protection Regulation (GDPR).
• Directive 2002/58/EC on privacy and electronic communications (ePrivacy Directive), as amended by Directive 2009/136/EC (cookies and commercial communications).
• Directive 2014/17/EU on credit agreements for consumers relating to residential immovable property (Mortgage Credit Directive).
• Directive (EU) 2023/2225 on credit agreements for consumers (creditworthiness assessment, use of data and right to human intervention), as transposed into Spanish law.
• Directive (EU) 2015/849 on the prevention of the use of the financial system for money laundering or terrorist financing, and Regulation (EU) 2024/1624 (AMLR), in accordance with its application timetable.
• Regulation (EU) 2024/1689 (Artificial Intelligence Act), in particular its transparency obligations for systems interacting with individuals and the rules on creditworthiness assessment systems, according to its application dates.
• Regulation (EU) 910/2014 (eIDAS), as amended by Regulation (EU) 2024/1183, on electronic identification and trust services.
• Commission Implementing Decision (EU) 2021/914 (standard contractual clauses) and Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework) for international transfers.
• Guidelines and recommendations of the European Data Protection Board (EDPB).

2.2. Spanish general legislation

• Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
• Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).
• Law 11/2022 of 28 June, General Telecommunications Law (Art. 66: right not to receive unsolicited commercial calls).
• Royal Legislative Decree 1/2007, Consolidated Text of the General Law for the Protection of Consumers and Users.
• Law 10/2025 of 26 December regulating customer service.
• Law 7/1998 of 13 April on General Contracting Conditions.
• Law 22/2007 of 11 July on the distance marketing of consumer financial services.
• Law 6/2020 of 11 November on electronic trust services.
• Law 2/2023 of 20 February on the protection of persons who report regulatory breaches (internal whistleblowing channel).
• Royal Legislative Decree 1/1996, Consolidated Text of the Intellectual Property Law.
• Guidelines of the Spanish Data Protection Agency (AEPD), in particular its Guide on the use of cookies.

2.3. Real estate credit, lenders and credit intermediaries

• Law 5/2019 of 15 March on real estate credit agreements (LCCI): creditworthiness assessment (Arts. 11 and 12), valuation (Art. 13), pre-contractual information and European Standardised Information Sheet – ESIS/FEIN (Art. 14), and rules governing real estate lenders and credit intermediaries (Arts. 26 et seq.).
• Royal Decree 309/2019 of 26 April, partially implementing Law 5/2019 (registration, knowledge and competence requirements, professional liability insurance).
• Order ECE/482/2019 of 26 April and Order EHA/2899/2011 of 28 October on transparency and customer protection in banking services.
• Law 2/2009 of 31 March on consumer mortgage loans and intermediation services provided by companies other than credit institutions, where applicable.
• Law 16/2011 of 24 June on consumer credit agreements.
• Law 44/2002 of 22 November on Financial System Reform Measures (Bank of Spain Central Credit Register – CIRBE), where applicable.
• Article 20 LOPDGDD: credit information systems.
• Law 1/2013 of 14 May on the protection of mortgage debtors and Royal Decree-Law 6/2012 (Code of Good Practice), where applicable.
• Catalan Law 20/2014 of 29 December amending Law 22/2010 of the Consumer Code of Catalonia to improve consumer protection in credit and mortgage loans.
• Catalan Law 22/2010 of 20 July, Consumer Code of Catalonia.

2.4. Real estate activity

• Law 12/2023 of 24 May on the right to housing and Law 29/1994 of 24 November on Urban Leases.
• Catalan Law 18/2007 of 28 December on the right to housing and Catalan Decree 12/2010 of 2 February on the requirements for carrying on business as a real estate agent.
• Catalan Decree-Law 1/2024 and other Catalan housing legislation, where applicable.
• Mortgage and notarial legislation (Mortgage Law, Notarial Regulations) regarding the disclosure of data to notaries and land registries.

2.5. Legal services

• Organic Law 6/1985 on the Judiciary (Art. 542.3: lawyers’ professional secrecy).
• Royal Decree 135/2021 of 2 March approving the General Statute of the Spanish Legal Profession, and the Spanish Legal Profession Code of Ethics.
• Organic Law 1/2025 of 2 January on efficiency measures for the Public Justice Service (appropriate dispute resolution methods).
• Royal Legislative Decree 1/2020, Consolidated Text of the Insolvency Law, as amended by Law 16/2022 (discharge of unpaid debts / Second Chance).
• Article 10 GDPR and Article 10 LOPDGDD: processing of data relating to criminal convictions and offences in the practice of law.

2.6. Anti-money laundering

• Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing (obliged entities: Art. 2.1, including lenders, real estate developers and agents, and lawyers in certain transactions), and its Regulation approved by Royal Decree 304/2014 of 5 May.

3. Personal data we process

We only process data that is adequate, relevant and limited to what is necessary for each purpose (Art. 5.1.c GDPR). Depending on the service, this may include:

• Identification and contact data: name and surname, ID card/NIE/passport, signature, address, telephone, email, voice (in recorded calls).
• Economic, financial and creditworthiness data: income, payslips, tax returns, bank statements, existing debts and loans, information from credit information systems and, where applicable, from CIRBE.
• Property and real estate data: ownership of properties, land registry extracts and certificates, cadastral references, valuations, encumbrances, lease agreements and occupants’ details.
• Personal and family circumstances: marital status, matrimonial property regime, dependants, employment status, where necessary to assess creditworthiness, vulnerability or for legal proceedings.
• Procedural and legal data: court, insolvency, mortgage enforcement or eviction proceedings, attachments and case documentation.
• Due diligence data (AML/CFT): professional activity, source of funds, beneficial ownership, politically exposed person status.
• Investor data: identification, bank account, investor profile and experience, contributions and settlements.
• Browsing data: IP address, device identifiers, cookies and website interaction data (see our Cookie Policy).

Special categories of data: we do not request health data, beliefs or other categories under Art. 9 GDPR. If exceptionally essential — for example, to evidence a situation of particular vulnerability in Second Chance or mortgage-debtor protection proceedings — they will only be processed with your explicit consent or where necessary for the establishment, exercise or defence of legal claims (Art. 9.2.a and f GDPR).

Third-party data: if you provide us with data of other persons (co-owners, guarantors, spouse, occupants, heirs), you warrant that you have informed them and are entitled to do so, in accordance with Art. 14 GDPR.

Source of the data

Data is obtained from the data subject and, where necessary for the service, from: public registries (Land Registry, Cadastre, Commercial Registry, Public Insolvency Registry, Official State Gazette/Single Edictal Board), notaries, approved valuation companies, credit information systems, CIRBE where legally permitted, partners and intermediaries who referred you to us with your authorisation, and judicial or administrative bodies in the course of proceedings.

4. Purposes and legal bases

Where the legal basis is legitimate interest, we have carried out the relevant balancing test and you may object at any time. Where it is consent, you may withdraw it at any time without affecting the lawfulness of prior processing. If you do not provide the data marked as mandatory, we will not be able to provide the requested service or comply with the associated legal obligations.

5. Automated decision-making, profiling and artificial intelligence

For creditworthiness assessment we may use analytical tools that support our analysts, but no loan application is approved or rejected solely by automated means: the final decision is always taken by a person. Should any decision based solely on automated processing with legal or similarly significant effects be taken, you will be informed in advance and will have the right to obtain human intervention, to express your point of view, to receive an explanation of the logic involved and to contest the decision (Art. 22 GDPR and Art. 18 Directive (EU) 2023/2225).

We use artificial intelligence systems (conversational and voice assistants, content drafting, request classification). In accordance with Regulation (EU) 2024/1689, we will inform you when you interact with an AI system, we apply human oversight to its outputs and we do not use your data to train third-party models without your consent.

We may create basic commercial profiles (for example, type of service of interest or geographical area) in order to offer you relevant information, on the basis of legitimate interest or consent; you may object at any time.

6. Retention periods

Data is kept for as long as necessary for the purpose for which it was collected. It is then blocked (Art. 32 LOPDGDD), available only to courts, the Public Prosecutor and competent authorities, for the limitation periods of any liabilities that may arise, and finally erased.

7. Recipients of the data

We do not sell your data. It will only be disclosed to third parties where there is a legal basis to do so:

• Between group companies, where necessary to provide the service you have requested (for example, where a loan request is best resolved through a Vern Properties solution or requires advice from Angelum Legal), with your prior knowledge.
• Notaries and Land and Commercial Registries, for the execution and registration of transactions.
• Valuation companies approved by the Bank of Spain (Art. 13 LCCI).
• Financial institutions, lenders and investors with whom the transaction is intermediated, subject to prior information or consent.
• Credit information systems, in the cases set out in Art. 20 LOPDGDD, after a prior demand for payment and prior notice.
• Bank of Spain (supervision, CIRBE where applicable and complaints service), SEPBLAC, Spanish Tax Agency, Catalan Consumer Agency and other authorities, where required by law.
• Courts, insolvency administrators, insolvency mediators and court representatives (procuradores), in the course of proceedings.
• Creditors of Angelum Legal’s clients, only to the extent necessary for the negotiation or proceedings entrusted.
• Insurers, where the transaction includes associated insurance or as required for professional liability cover.
• Processors providing services to us under a contract compliant with Art. 28 GDPR: web hosting and cloud services, CRM, telephony, electronic signature, email and office tools, AI and voice tools, digital advertising, accounting and advisory services, audit and IT maintenance.

International transfers

Some technology providers may process data outside the European Economic Area. In such cases, the transfer is based on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on standard contractual clauses approved by the Commission (Decision 2021/914) with the necessary supplementary measures (Arts. 45 and 46 GDPR). You may request information on the safeguards applied by writing to the DPO.

8. Professional secrecy and confidentiality

All group staff and partners are subject to a duty of confidentiality that continues after their relationship ends (Art. 5 LOPDGDD). In addition, data and information you disclose to the lawyers of Angelum Legal are protected by legal professional privilege (Art. 542.3 Organic Law on the Judiciary, General Statute of the Spanish Legal Profession and Code of Ethics), and will not be disclosed to other group companies or third parties without your express authorisation, unless required by law.

9. Your rights

You may exercise the following rights at any time, free of charge (Arts. 15–22 GDPR and 12–18 LOPDGDD):

• Access to your data and to information about its processing.
• Rectification of inaccurate or incomplete data.
• Erasure where the data is no longer necessary, among other cases.
• Objection to processing based on legitimate interest and, in any event, to receiving commercial communications.
• Restriction of processing.
• Portability of the data you have provided to us.
• Not to be subject to automated individual decisions, including profiling.
• Withdrawal of consent, without retroactive effect.
• Digital rights recognised in Title X LOPDGDD, including the right to be forgotten in internet searches and social networks.

How to exercise them: by writing to dpo@ondara.group or by post to the relevant controller (C/ Muntaner 354, 4º 2ª, 08021 Barcelona, Spain), stating the right you wish to exercise and proving your identity. We will respond within one month, extendable by two further months for complex requests, in which case we will inform you of the extension (Art. 12.3 GDPR).

Exercising these rights does not affect the retention obligations imposed by anti-money laundering legislation or professional secrecy, which may limit, for example, the right to erasure or the right of access with respect to reports made to SEPBLAC (Art. 32 Law 10/2010).

Complaints

• Data protection: you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid · www.aepd.es), the competent authority for private entities based in Catalonia. We recommend contacting our DPO first.
• Financial services: Ondara Capital’s customer service department and, at second instance, the Bank of Spain Complaints Service.
• Consumer matters: Catalan Consumer Agency (Agència Catalana del Consum), official complaint forms, and the dispute resolution system of Confianza Online, to which we adhere.
• Legal services: Barcelona Bar Association (Il·lustre Col·legi de l’Advocacia de Barcelona, ICAB), c/ Mallorca 283, 08037 Barcelona · www.icab.cat.

10. Information security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR): access control with individual credentials and two-factor authentication, encrypted communications, backups, access logging, staff confidentiality duties, regular training, supplier assessment and, where appropriate, data protection impact assessments (Art. 35 GDPR). We maintain a record of processing activities (Art. 30 GDPR) and a personal data breach procedure, including notification to the AEPD within 72 hours and, where appropriate, to the data subjects (Arts. 33 and 34 GDPR).

Nevertheless, no transmission over the internet is completely secure; we recommend that you do not send sensitive documents through unsecured channels and that you use the means of transmission we indicate.

11. Minors

Our services are intended exclusively for adults. We do not knowingly collect data from children under 14 (Art. 7 LOPDGDD). Data of minors will only be processed where they form part of the client’s household and it is necessary for the service (for example, to evidence dependants), provided by their legal representatives.

12. Commercial communications and calls

We will only send you electronic commercial communications if you have given your consent or if you are a customer and they relate to products or services similar to those contracted (Art. 21 LSSI-CE). You may unsubscribe at any time using the link included in each communication or by writing to dpo@ondara.group. We do not make commercial calls without your prior consent or request (Art. 66.1.b Law 11/2022), and we check advertising exclusion systems (Robinson List) in accordance with Art. 23 LOPDGDD. All our calls are made from identified numbers.

13. Cookies

This website uses technical cookies, necessary for its operation, and, only with your consent, analytics and advertising cookies. You can accept, reject or configure cookies at any time from the settings panel, as easily as you accepted them, in accordance with Art. 22.2 LSSI-CE and the AEPD Guide on the use of cookies. Please see our Cookie Policy for more information.

14. Social media and third-party links

We have profiles on social networks (LinkedIn, Instagram, Facebook, among others). When you interact with them, your data will be processed in accordance with this policy and that of the relevant platform; with regard to page statistics, we may be joint controllers with the platform (CJEU judgment of 5 June 2018, C-210/16). This website may contain links to third-party websites; we are not responsible for their policies or content (Art. 17 LSSI-CE).

15. Intellectual and industrial property

The contents of this website — texts, design, logos, trademarks, images and source code — are owned by the Ondara Group companies or by third parties who have authorised their use, and are protected by Royal Legislative Decree 1/1996 (Intellectual Property Law) and Law 17/2001 on Trademarks. Their reproduction, distribution, public communication or transformation without the express authorisation of their owners is prohibited.

16. Updates to this policy

We may amend this policy to reflect legislative changes, AEPD guidance or new services. The current version will be published on this page with its update date and, if the changes are significant, we will notify you through the contact details we hold.

This English version is provided for information purposes. In the event of any discrepancy, the Spanish version shall prevail.