1. GENERAL INFORMATION AND REGULATORY FRAMEWORK

This Privacy Policy regulates the processing of personal data provided by users (hereinafter, the “User” or “Users”) through this website owned by the commercial entity RIVER PLATE PROPERTIES, S.L. (hereinafter, “the Agency”).

The Agency declares its unyielding commitment to strict compliance with the current regulations on data protection, primarily governed by:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter “GDPR”).
• Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter “LOPDGDD”).
• Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (hereinafter “LSSI-CE”).
• Decree 218/2005 of 11 October of the Regional Government of Andalusia (Junta de Andalucía), approving the Regulations on consumer information in the purchase, sale, and lease of housing in Andalusia.

Accessing and using this website attributes the status of User and implies full acceptance of the conditions gathered in this Privacy Policy. The User is advised to read it carefully on a regular basis, as the text may be modified to adapt to new legislative amendments, case law, or changes in the operational activities of the Agency.

2. IDENTIFICATION OF THE DATA CONTROLLER

In accordance with the provisions of Article 13 of the GDPR, Users are informed that the Data Controller of the collected data is:

• Corporate Name: RIVER PLATE PROPERTIES, S.L. (The Agency)
• Registered and Operational Address: Avenida de la Paz, Nº 1, Postal Code 29631, Benalmádena (Málaga), Spain.
• General E-mail Address: [email protected]
• Contact Telephone: (+34) 952 93 00 33
• Data Protection Officer (DPO): For any specific queries, clarifications, or complaints regarding the processing of your data, the User may directly contact our Data Protection Officer via e-mail at: [email protected].

3. CATEGORIES OF DATA PROCESSED

The Agency collects and processes only the data that is strictly adequate, relevant, and limited to what is necessary for the purposes described in the following section. Depending on the User’s interaction on the web platform, the categories of data subject to processing are:

• Identification and Contact Data: Name, surname, national identity card or passport number (NIF/NIE), e-mail address, telephone number, and postal address.
• Real Estate Characteristics and Interests Data: Information regarding properties offered or demanded by the User, budgets, price ranges, housing typology, and geographic areas of interest (mainly the municipality of Benalmádena and the Costa del Sol).
• Economic, Financial, and Invoicing Data: In the event of formalizing a sale, purchase, or lease mandate, the Agency will process bank details (IBAN), payment history, and invoicing relative to the professional fees (fees) accrued from real estate brokerage services.
• Curricular and Professional Data: In the event that the User submits their curriculum vitae through the enabled channels to apply for employment positions or commercial collaborations.
• Navigation Data and Cookies: IP address, geolocation data, metadata, and browsing habits in accordance with the provisions of our Cookies Policy.

The User guarantees that the data provided is true, accurate, complete, and fully updated. In the event of providing data belonging to third parties, the User assumes exclusive liability for having previously informed them and for obtaining their express consent in accordance with the requirements of Article 14 of the GDPR.

4. PURPOSES OF PROCESSING AND LEGAL BASIS

The Agency will process the User’s personal data according to the following purposes and under the legal bases protected by Article 6 of the GDPR:

5. DATA RECIPIENTS AND TRANSFERS

Personal data processed by the Agency is strictly confidential. As a general rule, data will not be transferred to third parties external to the Agency, except under legally foreseen circumstances or when the User grants express authorization under the following parameters:

1. Public Bodies and Authorities: Mandatory transfer to Law Enforcement Agencies, Courts and Tribunals, the Spanish State Tax Administration Agency (AEAT), Notaries and Property Registrars, as well as the competent departments of the Junta de Andalucía, when legally required in compliance with tax, civil, or anti-money laundering regulations.
2. Data Processors (Service Providers): Access to data is foreseen for third-party providers with whom the Agency has signed strict data processing agreements under the guidelines of Article 28 of the GDPR. These providers encompass technical maintenance companies, CRM software developers (e.g., Clientify), hosting providers, legal and accounting consultancies, and private security companies. These third parties are prohibited from processing the data for their own purposes and are bound by professional secrecy and the implementation of rigorous technical security measures.
3. Specific Transfers due to the Use of Valuation Tools: In the explicit event that the User makes voluntary use of the online real estate valuation tool, they expressly accept and authorize that their contact and property data be communicated to specialized agencies and agents associated with the Agency’s collaborative network, for the sole purpose of providing them with direct, on-site advisory services regarding the real market value of their property.

The Agency does not perform international transfers of data to third countries or international organizations located outside the European Economic Area (EEA) that do not possess a level of protection comparable to that required by the GDPR. In the event of utilizing technological service providers whose servers are located outside the EEA, transfers will be formalized exclusively under the protection of Standard Contractual Clauses approved by the European Commission or under current adequacy decisions.

6. RETENTION AND DATA BLOCKING PERIODS

Personal data will be stored only for the period of time strictly essential for the fulfillment of the purposes for which it was collected, or until the User revokes their consent or exercises their right to erasure.

Once the underlying relationship has ended or the User’s request has been fulfilled, the data will be subjected to a strict technical blocking process (bloqueo de datos), in accordance with Article 32 of the LOPDGDD and Article 16 of the GDPR. Blocking means that the data will become unavailable for ordinary processing and will be kept exclusively at the disposal of Judges and Tribunals, the Public Prosecutor’s Office, the Spanish Data Protection Agency (AEPD), and competent Public Administrations, for the clearing of possible civil, contractual, tax, or criminal liabilities arising from the processing or the pre-existing real estate relationship.

The legal retention and blocking periods applicable in general terms are:

• Real Estate and Anti-Money Laundering Documentation: A minimum period of ten (10) years in accordance with the provisions of Article 25 of Spanish Law 10/2010 of 28 April.
• Tax and Accounting Documentation: A period of four (4) years under the Spanish General Tax Law (statute of limitations for tax obligations).
• Contractual and Civil Actions: A general period of five (5) years for the exercise of personal actions without a special limitation period, pursuant to Article 1964 of the Spanish Civil Code.
• Candidate Data (CVs): A maximum period of one (1) year from the receipt of the curriculum vitae, after which it will be confidentially and securely destroyed.

7. RIGHTS OF THE DATA SUBJECTS AND EXERCISE PROCEDURE

The GDPR and the LOPDGDD grant the User a series of unrenounceable rights regarding the control of their personal data. The User may exercise them completely free of charge by submitting a written communication to the Agency through the enabled channels.

7.1. List of Available Rights:

• Right of Access: The right to obtain confirmation as to whether the Agency is processing their personal data and, if so, to know what specific data is being processed, the purpose of the processing, its origin, and its recipients.
• Right to Rectification: The right to urge the immediate modification and correction of data that is inaccurate, outdated, or incomplete.
• Right to Erasure (Right to be Forgotten): The right to request the definitive deletion of their personal data when, among other reasons, it is no longer necessary for the purposes that motivated its collection, or when the User revokes the consent on which the processing was based.
• Right to Restriction of Processing: The right to request that the ordinary processing of their data be temporarily halted in specific cases, such as when the User contests the accuracy of the data (while it is being verified) or when the Agency no longer needs it but the User requires it for the exercise or defense of legal claims.
• Right to Data Portability: The right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit it directly to another data controller designated by them, provided that the processing is based on consent or the performance of a contract and is carried out by automated means.
• Right to Object: The right to object at any time, on grounds relating to their particular situation, to their data being processed based on the legitimate interest of the Agency, including the sending of commercial communications and the drafting of marketing profiles.
• Right not to be Subject to Automated Individual Decision-Making: The right not to be subject to a decision based solely on the automated processing of their data, including profiling, which produces legal effects concerning them or significantly affects them, guaranteeing their right to obtain human intervention from the Agency, to express their point of view, and to contest such decision.
• Right to Withdraw Consent: The User has the unconditional right to revoke at any time the authorizations previously granted (e.g., for advertising purposes), without this affecting in any way the lawfulness of the processing carried out prior to said withdrawal.

7.2. Channels and Requirements for Exercise:

To assert any of these rights, the User must submit a formal written request to the Agency indicating clearly the right they wish to exercise. The request must be processed through one of the following two channels:

1. Via E-mail: Sending their request to the specific privacy address: [email protected].
2. Via Postal Mail: Addressing a physical letter to the central offices of the Agency: Agencia Hernán Bustos – RIVER PLATE PROPERTIES, S.L., Avenida de la Paz, Nº 1, C.P. 29631, Benalmádena, Málaga, Spain.

Identity Guarantee Notice: In accordance with the provisions established by the AEPD, in order to prevent identity theft and guarantee absolute data security, the Agency may require the applicant to provide a copy of their National Identity Card (DNI), NIE, or valid Passport in the event that there are reasonable doubts regarding the true identity of the physical person making the request.

The Agency will resolve and respond to any request within a maximum period of one (1) month from its effective receipt. This period may be extended for a maximum of two (2) additional months in cases of extreme complexity or due to a high volume of requests, notifying the User of such a reasoned extension within the first month.

7.3. Right to Lodge a Complaint with the Supervisory Authority:

If the User considers that their rights have been violated, neglected, or that the processing of their personal data infringes the regulatory provisions of the GDPR or the LOPDGDD, they possess the legitimate right to file a formal complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD). However, and prior to doing so, we strongly urge you to contact our Data Protection Officer directly ([email protected]) to resolve the dispute in an agile and concerted manner.

• Postal Address of the AEPD: Calle Jorge Juan, Nº 6, Postal Code 28001, Madrid, Spain.
• Electronic Headquarters / Website: https://www.aepd.es

8. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

The Agency adopts and permanently executes necessary technical, organizational, and legal security measures to guarantee the integrity, confidentiality, availability, and resilience of the personal data collected. These measures are designed to prevent the alteration, loss, destruction, accidental or unauthorized access, or unlawful processing of information, in accordance with the requirements of Article 32 of the GDPR.

Among the implemented measures, the following are highlighted: data encryption in transit using secure transfer protocols (HTTPS and SSL certificates), physical and computer-based access restrictions limited exclusively to authorized personnel of the Agency, automated periodic backup copies on secure servers, and regular security audits of data storage systems.

9. AMENDMENTS TO THIS PRIVACY POLICY

The Agency expressly reserves the right to modify this Privacy Policy structurally or formally in order to adapt it to new guidelines from the AEPD, legislative amendments enacted at the state or regional level, or internal operational decisions of the firm. In the event of structural changes of major importance (such as the inclusion of new commercial purposes or variations in data transfers to third parties), Users will be notified in advance and explicitly through prominent notices on the website or via direct communications sent by e-mail, guaranteeing their right to revoke their consent if they deem it appropriate.