At AssetRent Capital we take the protection of your personal data very seriously. This policy explains clearly what information we collect, why we use it, and what rights you have, in compliance with the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection (LOPD-GDD).
We only collect the data we need to provide our service. Depending on how you use the platform:
Name, email, and password. We need these to create and maintain your account.
Name, email, and message. We use these to respond to your enquiry.
Data about your assets, contracts, simulations, and documents that you voluntarily enter. These are necessary for the tools to work.
Pages visited, browser type, and the cookie’s random identifier. Google uses your IP only to work out the country, region or city you are in, and discards it before storing anything. Only if you have accepted analytics.
Separately, as on any website, our server notes each request (your IP address, the page requested, the page you came from, the browser and the time) in a technical log that is deleted after 14 days. We use it to keep the platform secure and to fix faults. Requests to verify a document are logged without your IP address, the page you came from or the browser.
If you open a demo valuation someone has shared with you, we store with that link the date and a fingerprint of your device: a code we calculate with a key of ours from your IP address, browser, language, screen size and time zone, which does not contain those details. It stops any link being used more times than it allows, and it is deleted when the link expires or is withdrawn, at the latest the following day.
To stop bursts on our public forms we keep a count of attempts against your IP address (on IPv6, your /64 and /48 blocks), deleted after one day or when the block ends, if that is later. And if you have accepted analytics, the A/B tests in the portal keep your browser’s random identifier and, if you are signed in, your user, with no IP address or browser details.
In the portal’s sign-up assistant: name, email, phone, budget, cities, experience, rental type and any notes you write. We keep this as an enquiry so the team can look after you, before recording the permissions you choose there and even if you decline commercial emails. It does not put you on any mailing: commercial emails only go out with your consent. On the booking page: your name, email, phone and the appointment you book, move or cancel; the audit log of those actions does not keep your IP address.
From the city quiz: the city, the profile and your answers, with nothing about you. You see the result without giving an email, and if you ask to receive it, we use your address for that one sending. Results from before this version carried an email, name and IP address, and are deleted after 30 days. From the guide assistant: the questions and answers, with no email or IP address. From votes, shares and alerts: IP address, browser and, if you give them, email and name. From comments, local spots, ratings and ambassador applications: what you write, with your name and email, and your first name in the activity log, which we clear if you erase your account. The verdict in the city comparison is written by our own AI model from the figures in the articles, is labelled as AI-generated and uses no data about whoever reads it.
You write from your account email with a photo of your ID (you can cover the support number and the address), we hold a short video call that is not recorded, and on it you tell us a code we send to that email. The image is deleted when the check is finished and all that stays on record is what was checked. Legal basis: art. 6(1)(b) GDPR (giving you back access to your account) and 6(1)(f) (our legitimate interest in nobody else taking it over). If you change your account email, we send one code to the new address and another to the current one if it is verified; the new one counts as verified once you confirm it.
A client on a plan can give us your email to invite you to their team: we keep that address, the proposed role, the date and who invited you, whose verified email appears in the invitation as the source of the data. If you tell us you do not want any more invitations, we keep an HMAC fingerprint of your mailbox, without the address. If you open a secure link someone sent you to see a document, we keep your IP address and the time of each opening, your email if you type it and, in the single-use download token (120 seconds), your IP address. If the person sharing it gives them, also your name and email as the recipient. If you open a link to a property, your IP address (on IPv6, your /64 block) and your browser, to apply the view limit.
If your profile has those details (available capital or maximum budget, your investment horizon, the minimum return you are after and whether you already have pre-approved financing), whether you filled them in or your account manager noted them from what you told them, the financing area uses them to sort the products in the catalogue: some criteria compare each product with what your profile says (capital, term, return and whether you have pre-approved financing) and others look only at the product's own terms (interest rate, how much of the value it lends and who the lender aims it at). That is profiling within the meaning of Article 4(4) GDPR, and we would rather say so plainly. What it is not: an automated decision under Article 22, because the whole catalogue stays visible, the order neither grants nor refuses you anything, and the decision on each product is yours and the lender's. Nor is it advice.
It is part of the service you sign up for (Article 6(1)(b)), and you can change those details yourself in your profile or ask us to correct them (Article 16). And no lender sees your profile. What a lender receives is the pre-qualification you request: your name and email together with what you enter on that form, which every lender with an account on the platform can see while it is pending, until one takes it on; from then on, only that one. Today it does not expire on its own: if you want to withdraw it, write to [email protected] and we will cancel it. Section 5 sets out who receives what.
We process your data based on:
For analytics and A/B tests, for loading Google’s map on a public property page, its shared link or a shared valuation when you press "Cargar el mapa" (load the map) or "Cargar Street View", and for the commercial emails you ask for by ticking the box on a form and then confirm from your inbox.
To manage your account, provide the contracted service and deal with what you ask us through a contact or download form, the booking page or the sign-up assistant. Also to give you your Vivir & Invertir quiz result, show you your team and check it is you when restoring your access.
To improve platform security (including the server’s technical log), prevent fraud, limit the uses of a shared demo valuation, stop bursts on public forms, record openings of secure links and views of property links, invite you to a team if someone wants you on it (whoever invites you has a verified email; a team cannot leave more than 2 unaccepted invitations to the same mailbox in 30 days, or reach it if 3 other teams have already invited it; there is a limit of 10 a day per team, 5 if the account is on a trial and 100 across all accounts on a trial, and the email carries no advertising), keep the fingerprint of your email after an erasure, show you on a portal map where a property is (Google’s map on a public property page, its shared link or a shared valuation only loads with your permission), and answer you on WhatsApp or Telegram when you are the one writing to us (article 6(1)(f) GDPR: our legitimate interest is replying to the request you yourself make through the channel you chose). The record that you asked not to be contacted also rests here, as it is the only way to honour it. You can object at any time.
When the law requires us to retain certain data (e.g. invoices).
We do not sell or share your data with third parties for commercial purposes. We only share it when necessary to provide the service:
And we tell you so in the first message, before anything else, as article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence requires. It is our own AI, hosted on our servers in the EU (Germany and Finland): what you write does not leave them to be processed. If we give you figures, they come from our calculation engines, not from the model, and they are indicative. No reply from the channel grants, refuses or changes anything, so there are no automated decisions of the kind covered by article 22 GDPR. If you would rather speak to a person, write PERSON and we will tell you how: depending on the channel, someone from the team replies in that same chat or we ask you to email [email protected].
Everyone who processes data on our behalf has a signed data processing agreement. Telegram, the lenders and Google (for Google Maps) are not our processors: the lenders because they decide for themselves how to answer your request; Google because it processes what it receives from the map under its own terms; Telegram for the reasons we give below. With each one we share the minimum they need to do their job, and nothing more.
Five of these providers are US companies: Cloudflare, which the website passes through before it reaches your browser; Google, for analytics; Stripe, for payments; Mapbox, for maps; and Resend, which sends our email only when our own mail server fails. What reaches them leaves the European Economic Area, and for that the regulation requires one transfer mechanism. We have two: all five are certified under the EU–US Data Privacy Framework, which the European Commission declared adequate on 10 July 2023 (art. 45 GDPR), and their data processing agreements also include, as a fallback, the standard contractual clauses the Commission approved in 2021 (art. 46 GDPR); if that certification ever failed, those would remain available, with whatever transfer assessment is then required. Each time we review this policy we check that all five are still on the official list of the US Department of Commerce, and you can ask us for a copy of the clauses at [email protected].
Google Maps is a separate case. There Google does not work on our behalf, so there is no processing agreement or clauses of ours involved: what your browser sends when it loads a map goes to Google LLC, in the United States, which is certified under that same Data Privacy Framework, and Google processes it under its own terms.
What we share with the five US providers in the previous section leaves with the safeguards described there. What you write to us on WhatsApp or Telegram stays on our servers in the EU (Germany and Finland), where the AI that handles the channel also runs, with two caveats you have every right to know by name.
Delivered by Meta Platforms Ireland, established in the European Union, with signed data processing terms and standard contractual clauses for its own providers outside the European Economic Area.
Telegram FZ-LLC is based in the United Arab Emirates, a country the European Commission has not found adequate, and it offers no data processing agreement for the API that bots run on. We therefore cannot offer you the article 46 GDPR safeguards we do have with everyone else.
What that means in practice. There is no independent data protection authority equivalent to the Spanish AEPD there, nor comparable judicial redress; local authorities could access the data without the safeguards the GDPR requires; and you might not be able to enforce your rights against Telegram as effectively as against us. Messages to a bot are also not end-to-end encrypted.
What we do. When you write on Telegram, it is you who hands your data to Telegram, within your own relationship with them and before we are involved. What is a transfer by us is our reply, which has no choice but to travel back through the same channel: we rely on article 49(1)(b) GDPR, as it is indispensable to answer the request you yourself made through that medium. The channel is only used if you are the one who writes — we never start — we tell you this in the first message, and our reply adds no personal data about you that is not already in that conversation. And we review this exception if Telegram use stops being occasional: article 49 does not allow an exception to become the ordinary route.
If you would rather not use a channel outside Europe: write to [email protected], use WhatsApp, or your private area. You can request a copy of the contractual clauses for any other provider at [email protected].
We retain your data while your account is active or as long as necessary to provide the service. If you close your account, what we erase and what we keep is set out below, under "What happens when you ask us to erase your data". What the law requires us to keep includes invoices and tax records, for 6 years from the last invoice (article 30 of the Spanish Commercial Code). AI tax adviser ratings and their excerpts are deleted automatically after 12 months.
Your property figures last longer, and here is why. If you bought through us, we keep what we estimated before the purchase — what we thought it would cost and what it could rent for — alongside what it actually cost and actually rented for. We keep this for 6 years from the end of the engagement, and for as long as the property remains under our management. The part that evidences what the property cost you and what you spent improving it, we keep until 4 years after you sell it, because that is the day the tax authority will ask you to evidence exactly that in order to calculate your gain (article 35 of the Spanish Personal Income Tax Act). Once every period has elapsed, we can no longer link those figures to you.
If you ask us to delete your data, those figures disappear from your portal and from any document we generate from then on. They remain blocked in our records, consulted by no one, for the only two reasons the law allows us to retain them: meeting our accounting and tax obligations, and being able to defend ourselves if a claim about this transaction ever arises (article 17.3 GDPR). This is not a “cannot be deleted”: it is a “stops being used and is kept under lock”.
If you write to us on WhatsApp or Telegram, that conversation has its own periods:
And one exception we want to state explicitly. If you ask us to stop writing to you, we keep that “no” on an exclusion list with no deletion period, and we keep it even if you later ask us to erase all your data. In that case we do not keep your number or your email: we keep a fingerprint made with a key only our server holds, which cannot be read and only serves to recognise your number or address should they ever appear again. It is pseudonymised data, not anonymous. The one for your email does not stop every message: if you write to us again, we will answer. What it does is stop copies of our automatic emails being archived again and a commercial sequence restarting without a new act of yours. Without it, erasing your data would also erase the proof that you do not want to hear from us, and we would write to you again — the exact opposite of what you asked for. This rests on our legitimate interest in honouring your own objection (art. 21 GDPR and, for the commercial exclusion, art. 23(1) of the Spanish data protection act, LOPDGDD), and it is the minimum needed to honour it. We review it every three years and, if you ask us to delete it, we will, knowing that we will then stop recognising you.
If you told us you want no team invitations, that fingerprint stays too. It is a separate one, used only for this, and it survives erasure so that nobody can invite you again. It rests on our legitimate interest in honouring your objection (art. 21 GDPR). We review it every three years and, if you ask us to delete it or write to us from that address to withdraw it, we will, knowing that you can then be invited again.
Other periods worth knowing:
There is data we no longer collect. Since this version we do not keep the IP address of API access requests, the IP fingerprint of clicks on referral links and of satisfaction survey answers, the IP address or email of conversations with the Vivir & Invertir assistant, or the IP address or browser of subscriptions to its alerts. Anything older is cleared in the nightly purge.
What we erase. We anonymise your account, empty your investor profile and notifications, remove your data from the leads ledger, the newsletter and bookings, let the pending invitations you sent expire, and delete the ones you received, the PDFs of your "Ficha de inversor" (investor sheet) and the automatic copies our system sent you, along with the internal lead notices naming you and their attachments. The originals of those copies sit on our mail server, which this process does not reach: the erasure report tells us how many remain so we can remove them by hand. A nightly clean-up also removes, after 7 days, inbox attachments left without a message.
What we keep, and we will tell you. Invoices, transactions, contracts and rentals, for commercial and tax reasons; the audit log, without your email and without your name in what your account recorded (the name of a client may remain on the record of an invoice or a periodic report); the ID number on your client file, which may have to be kept for 10 years under Spanish anti-money-laundering law (Law 10/2010); the documents in your vault and correspondence with people on our team. Vault documents are not removed by the automatic erasure: we review them by hand within the month under art. 12(3) and keep only what a contract, tax rules or anti-money-laundering rules require. The automatic process does not decide on correspondence either: it leaves it in place and alerts us to how many messages remain; we review it within the month we have to reply to you and delete whatever is not contractual or tax-related.
Companies. If your file is that of a legal entity whose name does not include yours, we keep the company’s file (name, tax ID and its investor profile) without contact details, residence or notes. If the name includes yours, or the tax ID belongs to an individual (including K, L and M), it is erased like a person’s.
Unverified addresses and shared files. Anything linked to an email we have not verified is not erased this way, because it could belong to someone else: write to us from that address and we will check. A client file shared with another active account is left alone until someone decides by hand whose it is. A PDF of your "Ficha de inversor" that is in a workflow is not erased automatically either: it stays pending and we resolve it by hand before closing your request.
As a user, you have the following rights over your personal data:
Write BAJA or STOP in the WhatsApp or Telegram conversation itself and we stop writing to you immediately: you get an acknowledgement and nothing after that. You do not have to word it exactly like that — we read the sentence as you say it, and if there is any doubt a person looks at it. An email to [email protected] works too.
That refusal is final: it does not come back to life because you later agree to something else, and it survives even if you ask us to erase all your data. If what you want is for us to delete that record too, tell us and we will: just bear in mind that we will then stop knowing that you said no.
To exercise any of these rights, write to us at [email protected]. Only if we have reasonable doubts about your identity will we ask for something more to confirm it, such as a copy of your ID (art. 12(6) GDPR). If you work with a PSI associate, you can also ask them: they pass it to us within two working days and we reply, within the same month from the day you asked them. What the law requires us to keep in a sale (Law 10/2010) is not deleted: it is kept only for as long as the law requires, and we explain why (art. 17(3)(b) GDPR). We will respond within 30 days. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
We apply appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS/TLS), securely hashed passwords, regular backups, and access restricted to authorised personnel only. Photos you upload to your vault and works photos are stored without GPS or other metadata; for JPEG photos we only keep the date and time recorded by the phone or camera, which we do not check. Images inside a PDF, Word or Excel file are stored as they arrive, so remove the location before you upload the document. Turning on, removing or changing two-step verification requires a code, and we email you about every change.
Part of our work is analysing property information that has been officially published. We look at the auctions in Spain’s Official State Gazette (BOE), the company filings in the Official Gazette of the Companies Register (BORME), Cadastre data and the price statistics of the Ministry of Transport and the National Statistics Institute (INE). With that we prepare reports on properties for our clients: which charges or proceedings affect a property and how much risk the company registered as its owner carries.
We process very little about the people who appear in those sources. For company directors, our analysis system reads the name in the BORME and stores it pseudonymised: a code (a cryptographic hash) without the name in clear. It is still personal data, and we only use it to count how many different people stand behind the companies linked to a property. We extract and show nothing about auction debtors. The rest is data about properties (address, cadastral reference, starting price) and about companies (company name, tax ID and the filings published in the BORME).
The report is not stored on the platform: it is put together and delivered on the spot. We keep a note of who asked for it, about which property and when, and, if it is delivered with a seal, the document’s fingerprint for six years (article 30 of the Spanish Commercial Code). Each director’s hash stays in our map of company relationships for 4 years from their departure as published in the BORME, or 6 if no departure is recorded; on those periods there is nothing to delete before 2030. We do not write to each person named in a gazette: we do not have their contact details, and finding them would mean processing more of their data (Article 14(5)(b) GDPR). That is why we publish this here.
That analysis rests on our legitimate interest (Article 6(1)(f) GDPR), and we have chosen to keep it narrow: our reports do not include the names of individuals. When a company’s directors appear, we only say how many there are, and not even that if the figure could point to a specific person. In that analysis we do not profile people or make automated decisions about anyone: we analyse properties.
The documents we deliver carry a verification seal that lets a third party check that the file is genuine. To make that possible we keep the document’s cryptographic fingerprint, its date and how many times it has been checked. Our servers do not record the IP address or any other data about the person doing the check: the IP address is only used in memory, without being stored, to stop abuse. The file being checked is never sent to our servers, because the calculation happens in that person’s browser. Our server logs those requests without the IP address, the page they came from or the browser (only the time, the address requested and the result) and deletes that log after 14 days; only a serious failure of the server itself, such as running out of resources, could leave the IP address in its error log, which is also deleted after 14 days. As on the rest of the site, the connection goes through Cloudflare, which provides the network as our processor: it sees the IP address of every connection, which it needs to route the request and stop attacks, and may record it in its security logs.
If you appear in any of those sources and do not want us to process your information, you can object by writing to [email protected]. We act on the request even when the data comes from an official gazette.
In version 1.4.2. For JPEG photos in your vault and works photos we keep the date and time recorded by the phone or camera; GPS, phone details, the thumbnail and everything else are still removed. We also explain that images inside a PDF, Word or Excel file are not cleaned.
In version 1.4.1. You can turn down a team invitation using the link in the email, and the unsubscribe button in your mailbox means you get no more of them. If you tell us you want no more, we remove your address from the pending ones and keep a fingerprint of your mailbox, without the address, until you withdraw it. Whoever invites you does not know why they cannot. Turning down just that invitation stops that team inviting you again for 30 days. Accounts on a trial have their own invitation limit.
PSI associates become processors, and we spell out what they see and what they do not. Team invitations, secure links, the Vivir & Invertir quiz and assistant now appear with their periods, as does the ID photo used to restore access without your phone. We explain what is erased and what is kept when you ask for erasure, and that after erasing your email we keep a fingerprint that stops automatic copies being archived again and commercial sequences restarting. The application log goes from 30 to 14 days. Google’s map on a shared valuation now only loads if you ask for it. Company directors in the BORME now have a period: 4 years from departure, or 6 with none recorded. And we only ask for your ID to exercise your rights if we have reasonable doubts about who you are.
Related documents: