Privacy policy

Controller

The controller is Alejandro Juan Torres, Spanish tax ID 47409442W, with an address at Calle Sur 14, Puig d’en Valls. No data protection officer has been appointed.

You can write to [email protected], use the contact form, or send a letter to the operator at the address shown (Calle Sur 14, Puig d’en Valls).

User account

• Data. Your email and name (provided at registration or by Google or Facebook when you sign in); a password if you create one (we store only a scrypt hash, never the password itself); your Google or Facebook account identifier if you use that service; auctions you save as favourites; your alert searches; and, if you subscribe, subscription status and your Stripe customer identifier. We do not receive your Google or Facebook password, contacts or posts, and never publish anything on your behalf.
• Purpose and legal basis. To identify you, save favourites across devices and provide the alert subscription if you purchase it. The legal basis is the service you request by creating an account (Article 6(1)(b) GDPR).
• Email alerts. If you subscribe, we email new auctions matching your searches. We store which auctions we have sent so they are not repeated and keep each email result for 90 days. If your email provider rejects alerts, we pause them until you resume them. You can pause alerts using the link in each email or from “Alerts”.
• Account emails. We email you to confirm your address after registration and when you request a password reset. Links expire after 7 days and 1 hour respectively, and each link can be used once.
• Google or Facebook sign-in. When you choose one of these services, you authenticate with Google Ireland Limited or Meta Platforms Ireland Limited. They learn that you are accessing this website and handle data under their own privacy policies.
• Retention and deletion. We keep account data while your account remains open. You can delete it from “My account”; your account, favourites, alerts and sign-in methods are deleted immediately and removed from backups within 7 days. Removing this website’s access in Google or Facebook settings does not delete your account. Billing data is kept for the legally required periods.

Auction alert waitlist

• Data. Your email, request date and version of the information text you accepted, as evidence of consent.
• Purpose. To tell you when alerts launch. We do not send newsletters or other messages.
• Legal basis. Your consent (Article 6(1)(a) GDPR), which you can withdraw at any time without affecting earlier processing.
• Confirmation. At launch, we will send one email asking you to confirm that the address is yours and that you want the notice. We will delete your request if you do not confirm within 30 days. Until then, you will not receive email.
• Retention. Until launch and the confirmation process, until you unsubscribe, or until the launch is cancelled, whichever happens first.

Contact form

• Data. Your email address and message.
• Purpose. To reply, correct published information and handle requests about your personal data.
• Legal basis. Your consent when you send the message and, for rights requests, compliance with a legal obligation (Article 6(1)(c) GDPR).
• Retention. For as long as needed to handle the request, then restricted for the applicable limitation periods for potential claims.

Published property information

Listings reproduce details from BOE and TGSS auction notices. Although they relate to properties, some details may be linked to people involved in a case, so this processing is described under Article 14 GDPR.

• Data. The street name and municipality only (no building number, floor or unit), postcode, cadastral reference when available, and case details such as the auction reference, issuing authority and amounts. Debtors’ and registered owners’ names are not published; if they appear in a notice description, they are replaced before storage.
• Case documents. We archive documents that the BOE Auction Portal publishes with each auction, such as notices, land charge certificates, valuations and occupancy reports. They may contain names and identity document numbers of people involved, but are not published. When a report is requested, documents are sent to Anthropic as a processor and processed in the United States with GDPR transfer safeguards. We retain them while an auction may be eligible for a report and for the period needed to handle claims about reports issued.
• Source and purpose. Public BOE and TGSS auction notices. We make public auctions easier to search and follow on the basis of our legitimate interest (Article 6(1)(f) GDPR) in making available information that the law requires to be published.
• Retention. 90 days after an auction ends, its listing is removed from search engines and the site map.
• Objection. If a listing concerns your home or data, you may object or request a correction using the contact form. Include the listing link.

Security and backups

To limit abusive submissions, forms use your IP address in server memory for a few minutes; it is not stored in the database. This is based on our legitimate interest in service security. Cloudflare serves the website and protects it from attacks; it receives your IP address and technical request data. The contact form uses Cloudflare Turnstile, which receives your IP address and browser technical data to check that the request is not automated. Sign-in, registration and password recovery forms also use Cloudflare Turnstile for this check. Database backups are deleted after 7 days.

Advertising

The website currently shows no advertising and shares no data with advertising services.

Payments

If you buy the alert subscription, Stripe handles payment on its own page. Your card details do not reach this website. Billing data is kept for the periods required by tax and commercial law.

If you buy an auction case report, Stripe handles payment on its own page and your card details do not reach this website. No account is required. Stripe shares the email address you enter at checkout so we can send the report link, handle issues or refunds, and keep the email with the report and purchase data for the periods required by tax and commercial law. The report link is personal: anyone who has it can read the report.

Report packs require an account. We store Stripe-confirmed purchases, your balance and reports requested using that balance to provide the service and handle issues. Reports are delivered to your account and its email address; anyone with a report link can read it.

Recipients and processors

We do not disclose data to third parties unless required by law. The following providers process data on the operator’s behalf:

• The server hosting provider.
• Cloudflare, which serves the website, protects it from attacks, counts visits in aggregate (Web Analytics) and verifies sign-in forms with Turnstile. Turnstile also verifies the contact form and may process data outside the EEA using the EU–US Data Privacy Framework safeguards.
• The service that delivers contact form messages to the operator’s email.
• The email provider, for account confirmation and password recovery messages, alerts and report delivery.
• Stripe, to handle payments.
• Anthropic, whose AI system reads case documents to prepare reports. It does not receive your email or purchase data.

When the map is displayed, your browser downloads OpenStreetMap images and sends your IP address as it would when visiting any website.

Your rights

You may request access, correction or deletion; object to processing; request restriction or portability; and withdraw consent. Write using any contact channel above. If there are reasonable doubts about your identity, we may ask for additional information to verify it. We will reply within one month.

If you believe your rights have not been respected, you may complain to the Spanish Data Protection Agency at www.aepd.es.

No automated decisions are made and no profiles are created from your data. An email address is needed to join the waitlist or receive a reply to your message.

Aggregated usage statistics

We count visits and actions by day and page type to improve search, listings and tools. These counters use no cookies or visitor identifiers and do not store email addresses, searches, notes, full page addresses or IP addresses. They do not reconstruct individual browsing histories.

As with any web request, the technical request reaches our server. The connection address is held temporarily in memory to limit abuse and is not included in the counters. Account, favourites, comparison and alert management pages are excluded from this measurement.