At AssetRent Capital we take the protection of your personal data very seriously. This policy explains clearly what information we collect, why we use it, and what rights you have, in compliance with the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection (LOPD-GDD).
We only collect the data we need to provide our service. Depending on how you use the platform:
Name, email, and password. We need these to create and maintain your account.
Name, email, and message. We use these to respond to your enquiry.
Data about your assets, contracts, simulations, and documents that you voluntarily enter. These are necessary for the tools to work.
IP address (anonymised), browser type, and pages visited. Only if you have accepted analytics cookies.
We process your data based on:
For analytics cookies, contact forms, and optional communications.
To manage your account and provide the contracted service.
To improve platform security, prevent fraud and answer you on WhatsApp or Telegram when you are the one writing to us (article 6(1)(f) GDPR: our legitimate interest is replying to the request you yourself make through the channel you chose). The record that you asked not to be contacted also rests here, as it is the only way to honour it. You can object at any time.
When the law requires us to retain certain data (e.g. invoices).
We do not sell or share your data with third parties for commercial purposes. We only share it when necessary to provide the service:
And we tell you so in the first message, before anything else, as article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence requires. It is our own AI, hosted on our servers in Germany: what you write does not leave them to be processed. The figures come from our calculation engines, not from the model, and they are indicative. No reply from the channel grants, refuses or changes anything, so there are no automated decisions of the kind covered by article 22 GDPR. If you would rather speak to a person, just ask and we will hand you over.
All our providers comply with the GDPR and have signed data processing agreements. With each one we share the minimum they need to do their job, and nothing more.
Mapbox is a US company, so that part leaves the European Economic Area. It does so with the two safeguards the regulation requires: it is certified under the EU–US Data Privacy Framework, and its data processing agreement incorporates the standard contractual clauses approved by the European Commission in 2021 (art. 46 GDPR).
Our servers are in Germany and the AI that handles the channel runs inside them: the content of what you write does not leave. There are two exceptions you have every right to know by name.
Delivered by Meta Platforms Ireland, established in the European Union, with signed data processing terms and standard contractual clauses for its own providers outside the European Economic Area.
Telegram FZ-LLC is based in the United Arab Emirates, a country the European Commission has not found adequate, and it offers no data processing agreement for the API that bots run on. We therefore cannot offer you the article 46 GDPR safeguards we do have with everyone else.
What that means in practice. There is no independent data protection authority equivalent to the Spanish AEPD there, nor comparable judicial redress; local authorities could access the data without the safeguards the GDPR requires; and you might not be able to enforce your rights against Telegram as effectively as against us. Messages to a bot are also not end-to-end encrypted.
What we do. When you write on Telegram, it is you who hands your data to Telegram, within your own relationship with them and before we are involved. What is a transfer by us is our reply, which has no choice but to travel back through the same channel: we rely on article 49(1)(b) GDPR, as it is indispensable to answer the request you yourself made through that medium. The channel is only used if you are the one who writes — we never start — we tell you this in the first message, and our reply adds no personal data about you that is not already in that conversation. And we review this exception if Telegram use stops being occasional: article 49 does not allow an exception to become the ordinary route.
If you would rather not use a channel outside Europe: write to [email protected], use WhatsApp, or your private area. You can request a copy of the contractual clauses for any other provider at [email protected].
We retain your data while your account is active or as long as necessary to provide the service. If you close your account, we will delete your data within a maximum of 30 days, except for what the law requires us to keep: invoices and tax records, for 6 years from the last invoice (article 30 of the Spanish Commercial Code). AI tax advisor valuations and their excerpts are deleted automatically after 12 months.
If you write to us on WhatsApp or Telegram, that conversation has its own periods:
And one exception we want to state explicitly. If you ask us to stop writing to you, we keep that “no” on an exclusion list with no deletion period, and we keep it even if you later ask us to erase all your data. In that case we do not keep your number: we replace it with a one-way cryptographic code whose only purpose is to recognise that this number said “no”, should it ever appear again. Without it, erasing your data would also erase the proof that you do not want to hear from us, and we would write to you again — the exact opposite of what you asked for. This rests on our legitimate interest in honouring your own objection (art. 21 GDPR), and it is the minimum needed to honour it.
As a user, you have the following rights over your personal data:
Write BAJA or STOP in the WhatsApp or Telegram conversation itself and we stop writing to you immediately: you get an acknowledgement and nothing after that. You do not have to word it exactly like that — we read the sentence as you say it, and if there is any doubt a person looks at it. An email to [email protected] works too.
That refusal is final: it does not come back to life because you later agree to something else, and it survives even if you ask us to erase all your data. If what you want is for us to delete that record too, tell us and we will: just bear in mind that we will then stop knowing that you said no.
To exercise any of these rights, write to us at [email protected]. We will respond within 30 days. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
We apply appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS/TLS), securely hashed passwords, regular backups, and access restricted to authorised personnel only.
Related documents: