{"id":3454,"date":"2022-01-29T11:38:01","date_gmt":"2022-01-29T10:38:01","guid":{"rendered":"https:\/\/www.ondara.group\/privacy\/"},"modified":"2026-09-29T10:03:02","modified_gmt":"2026-09-29T09:03:02","slug":"privacy","status":"publish","type":"page","link":"https:\/\/www.lp.ondara.group\/en\/privacy\/","title":{"rendered":"Privacy"},"content":{"rendered":"<p><div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-1 fusion-flex-container has-pattern-background has-mask-background fusion-parallax-none nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"background-color: rgba(255,255,255,0);background-image: url(&quot;http:\/\/www.ondara.group\/wp-content\/uploads\/2025\/01\/logan-armstrong-hVhfqhDYciU-unsplash-scaled.jpg&quot;);background-position: center bottom;background-repeat: no-repeat;border-width: 0px 0px 0px 0px;border-color:var(--awb-color3);border-style:solid;-webkit-background-size:cover;-moz-background-size:cover;-o-background-size:cover;background-size:cover;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start\" style=\"max-width:1248px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-0 fusion_builder_column_1_1 1_1 fusion-flex-column\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\" style=\"background-position:left top;background-repeat:no-repeat;-webkit-background-size:cover;-moz-background-size:cover;-o-background-size:cover;background-size:cover;padding: 0px 0px 0px 0px;\"><\/div><style type=\"text\/css\">.fusion-body .fusion-builder-column-0{width:100% !important;margin-top : 0px;margin-bottom : 20px;}.fusion-builder-column-0 > .fusion-column-wrapper {padding-top : 0px !important;padding-right : 0px !important;margin-right : 1.92%;padding-bottom : 0px !important;padding-left : 0px !important;margin-left : 1.92%;}@media only screen and (max-width:1024px) {.fusion-body .fusion-builder-column-0{width:100% !important;order : 0;}.fusion-builder-column-0 > .fusion-column-wrapper {margin-right : 1.92%;margin-left : 1.92%;}}@media only screen and (max-width:640px) {.fusion-body .fusion-builder-column-0{width:100% !important;order : 0;}.fusion-builder-column-0 > .fusion-column-wrapper {margin-right : 1.92%;margin-left : 1.92%;}}<\/style><\/div><\/div><style type=\"text\/css\">.fusion-body .fusion-flex-container.fusion-builder-row-1{ padding-top : 0px;margin-top : 0px;padding-right : 0px;padding-bottom : 420px;margin-bottom : 0px;padding-left : 0px;}<\/style><\/div><div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-2 fusion-flex-container has-pattern-background has-mask-background nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"background-color: rgba(255,255,255,0);background-position: center center;background-repeat: no-repeat;border-width: 0px 0px 0px 0px;border-color:var(--awb-color3);border-style:solid;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-justify-content-center\" style=\"max-width:1248px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-1 fusion_builder_column_2_3 2_3 fusion-flex-column\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\" style=\"background-position:left top;background-blend-mode: overlay;background-repeat:no-repeat;-webkit-background-size:cover;-moz-background-size:cover;-o-background-size:cover;background-size:cover;padding: 0px 0px 0px 0px;\"><style type=\"text\/css\">@media only screen and (max-width:1024px) {.fusion-title.fusion-title-1{margin-top:10px!important; margin-right:0px!important;margin-bottom:15px!important;margin-left:0px!important;}}@media only screen and (max-width:640px) {.fusion-title.fusion-title-1{margin-top:10px!important; margin-right:0px!important;margin-bottom:10px!important; margin-left:0px!important;}}<\/style><div class=\"fusion-title title fusion-title-1 fusion-sep-none fusion-title-text fusion-title-size-one\" style=\"margin-top:10px;margin-right:0px;margin-bottom:15px;margin-left:0px;\"><h1 class=\"title-heading-left fusion-responsive-typography-calculated\" style=\"margin:0;color:var(--awb-color8);--fontSize:77;line-height:var(--awb-typography1-line-height);\">Privacy<\/h1><\/div><div class=\"fusion-text fusion-text-1\"><p><em>Ondara Group \u00b7 Last updated: 29 September 2026<\/em><\/p>\n<p>At Ondara Group we process personal data with the confidentiality, security and transparency that our business requires: property-backed lending, real estate brokerage and transactions, and legal services. This policy explains who processes your data, for what purposes, on what legal basis, for how long, who it is shared with and how you can exercise your rights. It applies to all websites, forms, telephone, messaging and email channels of the group&#8217;s companies and brands.<\/p>\n<h2>1. Data controllers<\/h2>\n<p>Ondara Group is not a legal entity but the trading name of the following companies, all registered at C\/ Muntaner 354, 4\u00ba 2\u00aa, 08021 Barcelona (Spain). Each company is the controller of the data it processes in connection with its own services. Where two or more companies jointly determine the purposes and means of a processing activity (for example, the shared management of the CRM or of enquiries received through ondara.group), they act as <strong>joint controllers<\/strong> under Article 26 GDPR, having agreed an allocation of responsibilities whose essence is available to data subjects.<\/p>\n<div style=\"overflow-x:auto\">\n<table style=\"width:100%;border-collapse:collapse\" border=\"1\" cellpadding=\"8\">\n<tr>\n<th>Company<\/th>\n<th>Identification details<\/th>\n<th>Activity and brands<\/th>\n<\/tr>\n<tr>\n<td><strong>Ondara Capital, S.L.<\/strong><\/td>\n<td>Tax ID (NIF) B-67229757<br \/>Barcelona Commercial Registry, Volume 46,475, Folio 91, Section 8, Sheet B-521,200, Entry 1<br \/>Registered with the Bank of Spain under code <strong>D552<\/strong><br \/>contacto@prestamo.capital \u00b7 contacto@hipoteca.capital<\/td>\n<td>Real estate lender and property-backed financing; investor relations (<em>cuentas en participaci\u00f3n<\/em> \/ joint-account agreements).<br \/>Brands: <em>Pr\u00e9stamo Capital<\/em>, <em>Hipoteca Capital<\/em>, <em>Now.Credit<\/em><\/td>\n<\/tr>\n<tr>\n<td><strong>Vern Properties, S.L.<\/strong><\/td>\n<td>Tax ID (NIF) B-02980639<br \/>Barcelona Commercial Registry, Volume 47,622, Folio 148, Sheet B-557,390, Entry 1<br \/>contacto@vern.properties<\/td>\n<td>Acquisition, sale, letting and brokerage of real estate; liquidity solutions (sale &amp; leaseback, purchase with repurchase agreement).<br \/>Brand: <em>Vern Properties<\/em><\/td>\n<\/tr>\n<tr>\n<td><strong>Angelum Legal, S.L.<\/strong><\/td>\n<td>Tax ID (NIF) B-75379289<br \/>Barcelona Commercial Registry, Volume 100436487483, Folio 1, Sheet B-625275, Entry 1<br \/>Services provided by a lawyer registered with the Barcelona Bar Association (Il\u00b7lustre Col\u00b7legi de l&#8217;Advocacia de Barcelona, ICAB), membership no. 27445<br \/>Freephone (Spain): 900 86 11 85<\/td>\n<td>Legal services: Spanish Second Chance Law and personal insolvency proceedings, debt restructuring and negotiation, claims against banks and real estate legal advice.<br \/>Brand: <em>Resuelve mi Deuda<\/em><\/td>\n<\/tr>\n<\/table>\n<\/div>\n<p><strong>Group general contact:<\/strong> +34 932 20 22 63 \u00b7 hello@ondara.group<\/p>\n<h3>Data Protection Officer (DPO)<\/h3>\n<p>The group companies have appointed a common Data Protection Officer (Articles 37\u201339 GDPR and 34\u201337 LOPDGDD), whom you may contact on any matter relating to the processing of your data at <strong>dpo@ondara.group<\/strong> or by post to &#8220;Data Protection Officer \u2013 Ondara Group&#8221;, C\/ Muntaner 354, 4\u00ba 2\u00aa, 08021 Barcelona (Spain).<\/p>\n<h2>2. Applicable legal framework<\/h2>\n<p>The processing of personal data is governed by the following legislation, as amended from time to time.<\/p>\n<h3>2.1. European Union law<\/h3>\n<ul>\n<li><strong>Regulation (EU) 2016\/679<\/strong>, General Data Protection Regulation (GDPR).<\/li>\n<li><strong>Directive 2002\/58\/EC<\/strong> on privacy and electronic communications (ePrivacy Directive), as amended by Directive 2009\/136\/EC (cookies and commercial communications).<\/li>\n<li><strong>Directive 2014\/17\/EU<\/strong> on credit agreements for consumers relating to residential immovable property (Mortgage Credit Directive).<\/li>\n<li><strong>Directive (EU) 2023\/2225<\/strong> on credit agreements for consumers (creditworthiness assessment, use of data and right to human intervention), as transposed into Spanish law.<\/li>\n<li><strong>Directive (EU) 2015\/849<\/strong> on the prevention of the use of the financial system for money laundering or terrorist financing, and <strong>Regulation (EU) 2024\/1624<\/strong> (AMLR), in accordance with its application timetable.<\/li>\n<li><strong>Regulation (EU) 2024\/1689<\/strong> (Artificial Intelligence Act), in particular its transparency obligations for systems interacting with individuals and the rules on creditworthiness assessment systems, according to its application dates.<\/li>\n<li><strong>Regulation (EU) 910\/2014<\/strong> (eIDAS), as amended by Regulation (EU) 2024\/1183, on electronic identification and trust services.<\/li>\n<li><strong>Commission Implementing Decision (EU) 2021\/914<\/strong> (standard contractual clauses) and <strong>Commission Implementing Decision (EU) 2023\/1795<\/strong> (EU-US Data Privacy Framework) for international transfers.<\/li>\n<li>Guidelines and recommendations of the <strong>European Data Protection Board (EDPB)<\/strong>.<\/li>\n<\/ul>\n<h3>2.2. Spanish general legislation<\/h3>\n<ul>\n<li><strong>Organic Law 3\/2018<\/strong> of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).<\/li>\n<li><strong>Law 34\/2002<\/strong> of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).<\/li>\n<li><strong>Law 11\/2022<\/strong> of 28 June, General Telecommunications Law (Art. 66: right not to receive unsolicited commercial calls).<\/li>\n<li><strong>Royal Legislative Decree 1\/2007<\/strong>, Consolidated Text of the General Law for the Protection of Consumers and Users.<\/li>\n<li><strong>Law 10\/2025<\/strong> of 26 December regulating customer service.<\/li>\n<li><strong>Law 7\/1998<\/strong> of 13 April on General Contracting Conditions.<\/li>\n<li><strong>Law 22\/2007<\/strong> of 11 July on the distance marketing of consumer financial services.<\/li>\n<li><strong>Law 6\/2020<\/strong> of 11 November on electronic trust services.<\/li>\n<li><strong>Law 2\/2023<\/strong> of 20 February on the protection of persons who report regulatory breaches (internal whistleblowing channel).<\/li>\n<li><strong>Royal Legislative Decree 1\/1996<\/strong>, Consolidated Text of the Intellectual Property Law.<\/li>\n<li>Guidelines of the <strong>Spanish Data Protection Agency (AEPD)<\/strong>, in particular its Guide on the use of cookies.<\/li>\n<\/ul>\n<h3>2.3. Real estate credit, lenders and credit intermediaries<\/h3>\n<ul>\n<li><strong>Law 5\/2019<\/strong> of 15 March on real estate credit agreements (LCCI): creditworthiness assessment (Arts. 11 and 12), valuation (Art. 13), pre-contractual information and European Standardised Information Sheet \u2013 ESIS\/FEIN (Art. 14), and rules governing real estate lenders and credit intermediaries (Arts. 26 et seq.).<\/li>\n<li><strong>Royal Decree 309\/2019<\/strong> of 26 April, partially implementing Law 5\/2019 (registration, knowledge and competence requirements, professional liability insurance).<\/li>\n<li><strong>Order ECE\/482\/2019<\/strong> of 26 April and <strong>Order EHA\/2899\/2011<\/strong> of 28 October on transparency and customer protection in banking services.<\/li>\n<li><strong>Law 2\/2009<\/strong> of 31 March on consumer mortgage loans and intermediation services provided by companies other than credit institutions, where applicable.<\/li>\n<li><strong>Law 16\/2011<\/strong> of 24 June on consumer credit agreements.<\/li>\n<li><strong>Law 44\/2002<\/strong> of 22 November on Financial System Reform Measures (Bank of Spain Central Credit Register \u2013 CIRBE), where applicable.<\/li>\n<li><strong>Article 20 LOPDGDD<\/strong>: credit information systems.<\/li>\n<li><strong>Law 1\/2013<\/strong> of 14 May on the protection of mortgage debtors and <strong>Royal Decree-Law 6\/2012<\/strong> (Code of Good Practice), where applicable.<\/li>\n<li><strong>Catalan Law 20\/2014<\/strong> of 29 December amending Law 22\/2010 of the Consumer Code of Catalonia to improve consumer protection in credit and mortgage loans.<\/li>\n<li><strong>Catalan Law 22\/2010<\/strong> of 20 July, Consumer Code of Catalonia.<\/li>\n<\/ul>\n<h3>2.4. Real estate activity<\/h3>\n<ul>\n<li><strong>Law 12\/2023<\/strong> of 24 May on the right to housing and <strong>Law 29\/1994<\/strong> of 24 November on Urban Leases.<\/li>\n<li><strong>Catalan Law 18\/2007<\/strong> of 28 December on the right to housing and <strong>Catalan Decree 12\/2010<\/strong> of 2 February on the requirements for carrying on business as a real estate agent.<\/li>\n<li><strong>Catalan Decree-Law 1\/2024<\/strong> and other Catalan housing legislation, where applicable.<\/li>\n<li>Mortgage and notarial legislation (Mortgage Law, Notarial Regulations) regarding the disclosure of data to notaries and land registries.<\/li>\n<\/ul>\n<h3>2.5. Legal services<\/h3>\n<ul>\n<li><strong>Organic Law 6\/1985<\/strong> on the Judiciary (Art. 542.3: lawyers&#8217; professional secrecy).<\/li>\n<li><strong>Royal Decree 135\/2021<\/strong> of 2 March approving the General Statute of the Spanish Legal Profession, and the Spanish Legal Profession Code of Ethics.<\/li>\n<li><strong>Organic Law 1\/2025<\/strong> of 2 January on efficiency measures for the Public Justice Service (appropriate dispute resolution methods).<\/li>\n<li><strong>Royal Legislative Decree 1\/2020<\/strong>, Consolidated Text of the Insolvency Law, as amended by <strong>Law 16\/2022<\/strong> (discharge of unpaid debts \/ Second Chance).<\/li>\n<li><strong>Article 10 GDPR and Article 10 LOPDGDD<\/strong>: processing of data relating to criminal convictions and offences in the practice of law.<\/li>\n<\/ul>\n<h3>2.6. Anti-money laundering<\/h3>\n<ul>\n<li><strong>Law 10\/2010<\/strong> of 28 April on the prevention of money laundering and terrorist financing (obliged entities: Art. 2.1, including lenders, real estate developers and agents, and lawyers in certain transactions), and its Regulation approved by <strong>Royal Decree 304\/2014<\/strong> of 5 May.<\/li>\n<\/ul>\n<h2>3. Personal data we process<\/h2>\n<p>We only process data that is adequate, relevant and limited to what is necessary for each purpose (Art. 5.1.c GDPR). Depending on the service, this may include:<\/p>\n<ul>\n<li><strong>Identification and contact data:<\/strong> name and surname, ID card\/NIE\/passport, signature, address, telephone, email, voice (in recorded calls).<\/li>\n<li><strong>Economic, financial and creditworthiness data:<\/strong> income, payslips, tax returns, bank statements, existing debts and loans, information from credit information systems and, where applicable, from CIRBE.<\/li>\n<li><strong>Property and real estate data:<\/strong> ownership of properties, land registry extracts and certificates, cadastral references, valuations, encumbrances, lease agreements and occupants&#8217; details.<\/li>\n<li><strong>Personal and family circumstances:<\/strong> marital status, matrimonial property regime, dependants, employment status, where necessary to assess creditworthiness, vulnerability or for legal proceedings.<\/li>\n<li><strong>Procedural and legal data:<\/strong> court, insolvency, mortgage enforcement or eviction proceedings, attachments and case documentation.<\/li>\n<li><strong>Due diligence data (AML\/CFT):<\/strong> professional activity, source of funds, beneficial ownership, politically exposed person status.<\/li>\n<li><strong>Investor data:<\/strong> identification, bank account, investor profile and experience, contributions and settlements.<\/li>\n<li><strong>Browsing data:<\/strong> IP address, device identifiers, cookies and website interaction data (see our Cookie Policy).<\/li>\n<\/ul>\n<p><strong>Special categories of data:<\/strong> we do not request health data, beliefs or other categories under Art. 9 GDPR. If exceptionally essential \u2014 for example, to evidence a situation of particular vulnerability in Second Chance or mortgage-debtor protection proceedings \u2014 they will only be processed with your explicit consent or where necessary for the establishment, exercise or defence of legal claims (Art. 9.2.a and f GDPR).<\/p>\n<p><strong>Third-party data:<\/strong> if you provide us with data of other persons (co-owners, guarantors, spouse, occupants, heirs), you warrant that you have informed them and are entitled to do so, in accordance with Art. 14 GDPR.<\/p>\n<h3>Source of the data<\/h3>\n<p>Data is obtained from the data subject and, where necessary for the service, from: public registries (Land Registry, Cadastre, Commercial Registry, Public Insolvency Registry, Official State Gazette\/Single Edictal Board), notaries, approved valuation companies, credit information systems, CIRBE where legally permitted, partners and intermediaries who referred you to us with your authorisation, and judicial or administrative bodies in the course of proceedings.<\/p>\n<h2>4. Purposes and legal bases<\/h2>\n<div style=\"overflow-x:auto\">\n<table style=\"width:100%;border-collapse:collapse\" border=\"1\" cellpadding=\"8\">\n<tr>\n<th>Purpose<\/th>\n<th>Controller<\/th>\n<th>Legal basis (Art. 6 GDPR)<\/th>\n<\/tr>\n<tr>\n<td>Handling enquiries and requests received via forms, telephone, WhatsApp, chat or email.<\/td>\n<td>The company providing the requested service<\/td>\n<td>Pre-contractual steps at the data subject&#8217;s request (6.1.b) and legitimate interest in responding (6.1.f).<\/td>\n<\/tr>\n<tr>\n<td>Assessing the applicant&#8217;s creditworthiness, issuing the Non-Binding Offer and the ESIS (FEIN), and executing property-backed loans.<\/td>\n<td>Ondara Capital<\/td>\n<td>Pre-contractual steps and performance of the contract (6.1.b); legal obligation to assess creditworthiness (6.1.c; Arts. 11 and 12 LCCI).<\/td>\n<\/tr>\n<tr>\n<td>Management, monitoring and collection of loans granted; consultation of and, where applicable, reporting to credit information systems.<\/td>\n<td>Ondara Capital<\/td>\n<td>Performance of the contract (6.1.b); presumed legitimate interest under Art. 20 LOPDGDD (6.1.f).<\/td>\n<\/tr>\n<tr>\n<td>Intermediation in obtaining financing from third-party institutions.<\/td>\n<td>Ondara Capital<\/td>\n<td>Performance of the intermediation contract (6.1.b) and consent for disclosure to specific institutions (6.1.a).<\/td>\n<\/tr>\n<tr>\n<td>Sale and purchase, sale &amp; leaseback, purchase with repurchase agreement, letting and real estate brokerage; viewings, valuations and property due diligence.<\/td>\n<td>Vern Properties<\/td>\n<td>Pre-contractual steps and performance of the contract (6.1.b); legal obligations under housing and consumer law (6.1.c).<\/td>\n<\/tr>\n<tr>\n<td>Provision of legal services: case assessment, engagement letter, Second Chance proceedings, negotiation with creditors, claims against banks and representation in proceedings.<\/td>\n<td>Angelum Legal<\/td>\n<td>Performance of the professional services contract (6.1.b); legal obligation (6.1.c); establishment, exercise or defence of legal claims (Art. 9.2.f GDPR and Art. 10 LOPDGDD).<\/td>\n<\/tr>\n<tr>\n<td>Investor management and joint-account agreements: onboarding, contracts, settlements and periodic reporting.<\/td>\n<td>Ondara Capital<\/td>\n<td>Performance of the contract (6.1.b) and tax and corporate legal obligations (6.1.c).<\/td>\n<\/tr>\n<tr>\n<td>Customer due diligence, identification, record keeping and reporting of transactions to SEPBLAC.<\/td>\n<td>All, as obliged entities<\/td>\n<td>Legal obligation (6.1.c; Law 10\/2010 and RD 304\/2014). Public interest (Art. 32 Law 10\/2010).<\/td>\n<\/tr>\n<tr>\n<td>Call recording to evidence contracting, pre-contractual information and service quality.<\/td>\n<td>The company handling the call<\/td>\n<td>Performance of the contract and legal obligation to provide evidence (6.1.b and c) and legitimate interest in service quality (6.1.f). You will be informed at the start of the call.<\/td>\n<\/tr>\n<tr>\n<td>Initial assistance and qualification through virtual assistants and AI-based voice agents.<\/td>\n<td>The company providing the service<\/td>\n<td>Pre-contractual steps (6.1.b) and legitimate interest (6.1.f). You will always be informed that you are interacting with an AI system and may request human assistance.<\/td>\n<\/tr>\n<tr>\n<td>Electronic commercial communications about group services.<\/td>\n<td>The sending company<\/td>\n<td>Consent (6.1.a; Art. 21 LSSI-CE) or, for customers, legitimate interest regarding similar products (Art. 21.2 LSSI-CE), with an opt-out in every message.<\/td>\n<\/tr>\n<tr>\n<td>Commercial calls.<\/td>\n<td>The calling company<\/td>\n<td>Prior consent or request by the data subject (Art. 66.1.b Law 11\/2022). Prior check of the Robinson List (Art. 23 LOPDGDD).<\/td>\n<\/tr>\n<tr>\n<td>Social media advertising and campaign measurement (custom audiences, pixels).<\/td>\n<td>The advertising company, jointly with the platform where applicable<\/td>\n<td>Consent (6.1.a; Art. 22.2 LSSI-CE).<\/td>\n<\/tr>\n<tr>\n<td>Compliance with tax, accounting and corporate obligations and handling of customer complaints.<\/td>\n<td>All<\/td>\n<td>Legal obligation (6.1.c).<\/td>\n<\/tr>\n<tr>\n<td>Management of the internal whistleblowing channel.<\/td>\n<td>All<\/td>\n<td>Legal obligation (6.1.c; Law 2\/2023) where mandatory, or public interest (6.1.e).<\/td>\n<\/tr>\n<tr>\n<td>Recruitment processes.<\/td>\n<td>The company offering the position<\/td>\n<td>Consent (6.1.a) and pre-contractual steps (6.1.b).<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<p>Where the legal basis is legitimate interest, we have carried out the relevant balancing test and you may object at any time. Where it is consent, you may withdraw it at any time without affecting the lawfulness of prior processing. If you do not provide the data marked as mandatory, we will not be able to provide the requested service or comply with the associated legal obligations.<\/p>\n<h2>5. Automated decision-making, profiling and artificial intelligence<\/h2>\n<p>For creditworthiness assessment we may use analytical tools that support our analysts, but <strong>no loan application is approved or rejected solely by automated means<\/strong>: the final decision is always taken by a person. Should any decision based solely on automated processing with legal or similarly significant effects be taken, you will be informed in advance and will have the right to obtain human intervention, to express your point of view, to receive an explanation of the logic involved and to contest the decision (Art. 22 GDPR and Art. 18 Directive (EU) 2023\/2225).<\/p>\n<p>We use artificial intelligence systems (conversational and voice assistants, content drafting, request classification). In accordance with Regulation (EU) 2024\/1689, we will inform you when you interact with an AI system, we apply human oversight to its outputs and we do not use your data to train third-party models without your consent.<\/p>\n<p>We may create basic commercial profiles (for example, type of service of interest or geographical area) in order to offer you relevant information, on the basis of legitimate interest or consent; you may object at any time.<\/p>\n<h2>6. Retention periods<\/h2>\n<p>Data is kept for as long as necessary for the purpose for which it was collected. It is then <strong>blocked<\/strong> (Art. 32 LOPDGDD), available only to courts, the Public Prosecutor and competent authorities, for the limitation periods of any liabilities that may arise, and finally erased.<\/p>\n<div style=\"overflow-x:auto\">\n<table style=\"width:100%;border-collapse:collapse\" border=\"1\" cellpadding=\"8\">\n<tr>\n<th>Information<\/th>\n<th>Indicative period<\/th>\n<\/tr>\n<tr>\n<td>Enquiries and requests that do not lead to a contract<\/td>\n<td>1 year from the last contact<\/td>\n<\/tr>\n<tr>\n<td>Loan, real estate and investment contract documentation<\/td>\n<td>Duration of the relationship and thereafter 6 years (Art. 30 Commercial Code) and up to 5 years for personal actions (Art. 1964 Civil Code), whichever is longer<\/td>\n<\/tr>\n<tr>\n<td>AML\/CFT due diligence documentation<\/td>\n<td>10 years from the end of the business relationship or the execution of the transaction (Art. 25 Law 10\/2010)<\/td>\n<\/tr>\n<tr>\n<td>Tax-relevant data<\/td>\n<td>4 years (Arts. 66 and 70 General Tax Law)<\/td>\n<\/tr>\n<tr>\n<td>Legal case files (Angelum Legal)<\/td>\n<td>For the duration of the engagement and thereafter the limitation period for professional liability<\/td>\n<\/tr>\n<tr>\n<td>Call recordings<\/td>\n<td>As long as necessary to evidence the contract or information provided, and at most the applicable limitation period<\/td>\n<\/tr>\n<tr>\n<td>Commercial communications<\/td>\n<td>Until consent is withdrawn or you object<\/td>\n<\/tr>\n<tr>\n<td>Internal whistleblowing channel<\/td>\n<td>3 months in the system from receipt, unless an investigation is opened (Art. 32 Law 2\/2023)<\/td>\n<\/tr>\n<tr>\n<td>CVs<\/td>\n<td>1 year, unless consent is given for a longer period<\/td>\n<\/tr>\n<tr>\n<td>Cookies<\/td>\n<td>As set out in the Cookie Policy<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<h2>7. Recipients of the data<\/h2>\n<p>We do not sell your data. It will only be disclosed to third parties where there is a legal basis to do so:<\/p>\n<ul>\n<li><strong>Between group companies<\/strong>, where necessary to provide the service you have requested (for example, where a loan request is best resolved through a Vern Properties solution or requires advice from Angelum Legal), with your prior knowledge.<\/li>\n<li><strong>Notaries and Land and Commercial Registries<\/strong>, for the execution and registration of transactions.<\/li>\n<li><strong>Valuation companies approved<\/strong> by the Bank of Spain (Art. 13 LCCI).<\/li>\n<li><strong>Financial institutions, lenders and investors<\/strong> with whom the transaction is intermediated, subject to prior information or consent.<\/li>\n<li><strong>Credit information systems<\/strong>, in the cases set out in Art. 20 LOPDGDD, after a prior demand for payment and prior notice.<\/li>\n<li><strong>Bank of Spain<\/strong> (supervision, CIRBE where applicable and complaints service), <strong>SEPBLAC<\/strong>, <strong>Spanish Tax Agency<\/strong>, <strong>Catalan Consumer Agency<\/strong> and other authorities, where required by law.<\/li>\n<li><strong>Courts, insolvency administrators, insolvency mediators and court representatives (procuradores)<\/strong>, in the course of proceedings.<\/li>\n<li><strong>Creditors<\/strong> of Angelum Legal&#8217;s clients, only to the extent necessary for the negotiation or proceedings entrusted.<\/li>\n<li><strong>Insurers<\/strong>, where the transaction includes associated insurance or as required for professional liability cover.<\/li>\n<li><strong>Processors<\/strong> providing services to us under a contract compliant with Art. 28 GDPR: web hosting and cloud services, CRM, telephony, electronic signature, email and office tools, AI and voice tools, digital advertising, accounting and advisory services, audit and IT maintenance.<\/li>\n<\/ul>\n<h3>International transfers<\/h3>\n<p>Some technology providers may process data outside the European Economic Area. In such cases, the transfer is based on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on standard contractual clauses approved by the Commission (Decision 2021\/914) with the necessary supplementary measures (Arts. 45 and 46 GDPR). You may request information on the safeguards applied by writing to the DPO.<\/p>\n<h2>8. Professional secrecy and confidentiality<\/h2>\n<p>All group staff and partners are subject to a duty of confidentiality that continues after their relationship ends (Art. 5 LOPDGDD). In addition, data and information you disclose to the lawyers of <strong>Angelum Legal<\/strong> are protected by <strong>legal professional privilege<\/strong> (Art. 542.3 Organic Law on the Judiciary, General Statute of the Spanish Legal Profession and Code of Ethics), and will not be disclosed to other group companies or third parties without your express authorisation, unless required by law.<\/p>\n<h2>9. Your rights<\/h2>\n<p>You may exercise the following rights at any time, free of charge (Arts. 15\u201322 GDPR and 12\u201318 LOPDGDD):<\/p>\n<ul>\n<li><strong>Access<\/strong> to your data and to information about its processing.<\/li>\n<li><strong>Rectification<\/strong> of inaccurate or incomplete data.<\/li>\n<li><strong>Erasure<\/strong> where the data is no longer necessary, among other cases.<\/li>\n<li><strong>Objection<\/strong> to processing based on legitimate interest and, in any event, to receiving commercial communications.<\/li>\n<li><strong>Restriction<\/strong> of processing.<\/li>\n<li><strong>Portability<\/strong> of the data you have provided to us.<\/li>\n<li><strong>Not to be subject to automated individual decisions<\/strong>, including profiling.<\/li>\n<li><strong>Withdrawal of consent<\/strong>, without retroactive effect.<\/li>\n<li>Digital rights recognised in Title X LOPDGDD, including the <strong>right to be forgotten<\/strong> in internet searches and social networks.<\/li>\n<\/ul>\n<p><strong>How to exercise them:<\/strong> by writing to <strong>dpo@ondara.group<\/strong> or by post to the relevant controller (C\/ Muntaner 354, 4\u00ba 2\u00aa, 08021 Barcelona, Spain), stating the right you wish to exercise and proving your identity. We will respond within <strong>one month<\/strong>, extendable by two further months for complex requests, in which case we will inform you of the extension (Art. 12.3 GDPR).<\/p>\n<p>Exercising these rights does not affect the retention obligations imposed by anti-money laundering legislation or professional secrecy, which may limit, for example, the right to erasure or the right of access with respect to reports made to SEPBLAC (Art. 32 Law 10\/2010).<\/p>\n<h3>Complaints<\/h3>\n<ul>\n<li><strong>Data protection:<\/strong> you may lodge a complaint with the <strong>Spanish Data Protection Agency (AEPD)<\/strong> (C\/ Jorge Juan 6, 28001 Madrid \u00b7 www.aepd.es), the competent authority for private entities based in Catalonia. We recommend contacting our DPO first.<\/li>\n<li><strong>Financial services:<\/strong> Ondara Capital&#8217;s customer service department and, at second instance, the <strong>Bank of Spain Complaints Service<\/strong>.<\/li>\n<li><strong>Consumer matters:<\/strong> <strong>Catalan Consumer Agency<\/strong> (Ag\u00e8ncia Catalana del Consum), official complaint forms, and the dispute resolution system of <strong>Confianza Online<\/strong>, to which we adhere.<\/li>\n<li><strong>Legal services:<\/strong> Barcelona Bar Association (Il\u00b7lustre Col\u00b7legi de l&#8217;Advocacia de Barcelona, ICAB), c\/ Mallorca 283, 08037 Barcelona \u00b7 www.icab.cat.<\/li>\n<\/ul>\n<h2>10. Information security<\/h2>\n<p>We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR): access control with individual credentials and two-factor authentication, encrypted communications, backups, access logging, staff confidentiality duties, regular training, supplier assessment and, where appropriate, data protection impact assessments (Art. 35 GDPR). We maintain a record of processing activities (Art. 30 GDPR) and a personal data breach procedure, including notification to the AEPD within 72 hours and, where appropriate, to the data subjects (Arts. 33 and 34 GDPR).<\/p>\n<p>Nevertheless, no transmission over the internet is completely secure; we recommend that you do not send sensitive documents through unsecured channels and that you use the means of transmission we indicate.<\/p>\n<h2>11. Minors<\/h2>\n<p>Our services are intended exclusively for adults. We do not knowingly collect data from children under 14 (Art. 7 LOPDGDD). Data of minors will only be processed where they form part of the client&#8217;s household and it is necessary for the service (for example, to evidence dependants), provided by their legal representatives.<\/p>\n<h2>12. Commercial communications and calls<\/h2>\n<p>We will only send you electronic commercial communications if you have given your consent or if you are a customer and they relate to products or services similar to those contracted (Art. 21 LSSI-CE). You may unsubscribe at any time using the link included in each communication or by writing to dpo@ondara.group. We do not make commercial calls without your prior consent or request (Art. 66.1.b Law 11\/2022), and we check advertising exclusion systems (Robinson List) in accordance with Art. 23 LOPDGDD. All our calls are made from identified numbers.<\/p>\n<h2>13. Cookies<\/h2>\n<p>This website uses technical cookies, necessary for its operation, and, only with your consent, analytics and advertising cookies. You can accept, reject or configure cookies at any time from the settings panel, as easily as you accepted them, in accordance with Art. 22.2 LSSI-CE and the AEPD Guide on the use of cookies. Please see our <a href=\"https:\/\/www.ondara.group\/en\/cookies\/\">Cookie Policy<\/a> for more information.<\/p>\n<h2>14. Social media and third-party links<\/h2>\n<p>We have profiles on social networks (LinkedIn, Instagram, Facebook, among others). When you interact with them, your data will be processed in accordance with this policy and that of the relevant platform; with regard to page statistics, we may be joint controllers with the platform (CJEU judgment of 5 June 2018, C-210\/16). This website may contain links to third-party websites; we are not responsible for their policies or content (Art. 17 LSSI-CE).<\/p>\n<h2>15. Intellectual and industrial property<\/h2>\n<p>The contents of this website \u2014 texts, design, logos, trademarks, images and source code \u2014 are owned by the Ondara Group companies or by third parties who have authorised their use, and are protected by Royal Legislative Decree 1\/1996 (Intellectual Property Law) and Law 17\/2001 on Trademarks. Their reproduction, distribution, public communication or transformation without the express authorisation of their owners is prohibited.<\/p>\n<h2>16. Updates to this policy<\/h2>\n<p>We may amend this policy to reflect legislative changes, AEPD guidance or new services. The current version will be published on this page with its update date and, if the changes are significant, we will notify you through the contact details we hold.<\/p>\n<p><em>This English version is provided for information purposes. In the event of any discrepancy, the Spanish version shall prevail.<\/em><\/p>\n<\/div><\/div><style type=\"text\/css\">.fusion-body .fusion-builder-column-1{width:66.666666666667% !important;margin-top : 0px;margin-bottom : 0px;}.fusion-builder-column-1 > .fusion-column-wrapper {padding-top : 0px !important;padding-right : 0px !important;margin-right : 2.88%;padding-bottom : 0px !important;padding-left : 0px !important;margin-left : 2.88%;}@media only screen and (max-width:1024px) {.fusion-body .fusion-builder-column-1{width:66.666666666667% !important;}.fusion-builder-column-1 > .fusion-column-wrapper {margin-right : 2.88%;margin-left : 2.88%;}}@media only screen and (max-width:640px) {.fusion-body .fusion-builder-column-1{width:100% !important;}.fusion-builder-column-1 > .fusion-column-wrapper {margin-right : 1.92%;margin-left : 1.92%;}}<\/style><\/div><\/div><style type=\"text\/css\">.fusion-body .fusion-flex-container.fusion-builder-row-2{ padding-top : 0px;margin-top : 60px;padding-right : 0px;padding-bottom : 0px;margin-bottom : 0px;padding-left : 0px;}<\/style><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"100-width.php","meta":{"footnotes":""},"class_list":["post-3454","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.lp.ondara.group\/en\/wp-json\/wp\/v2\/pages\/3454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lp.ondara.group\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.lp.ondara.group\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.lp.ondara.group\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lp.ondara.group\/en\/wp-json\/wp\/v2\/comments?post=3454"}],"version-history":[{"count":6,"href":"https:\/\/www.lp.ondara.group\/en\/wp-json\/wp\/v2\/pages\/3454\/revisions"}],"predecessor-version":[{"id":4240,"href":"https:\/\/www.lp.ondara.group\/en\/wp-json\/wp\/v2\/pages\/3454\/revisions\/4240"}],"wp:attachment":[{"href":"https:\/\/www.lp.ondara.group\/en\/wp-json\/wp\/v2\/media?parent=3454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}