Privacy Policy

Data controller

The controller of the personal data collected through the InversionNPL platform (inversionnpl.com) is:

• Owner: ORENES & ASOCIADOS ABOGADOS-CONSULTORÍA LEGAL, S.L.P.
• Tax ID (CIF): B05560313
• Registered office: Avenida de la Libertad 5, 1.º A, 30009 Murcia (Spain)
• Data protection email: [email protected]
• Telephone: +34 606 31 13 56

We have not appointed a Data Protection Officer as the cases in Article 37 GDPR and Article 34 LOPDGDD do not apply. Any privacy question may be sent to the email above.

What data we process and where it comes from

Data you provide to us:

• Identification and contact: name, email, telephone and, if you provide it, referral code.
• Investor profile: provinces of interest, approximate available capital, whether you have investors or a team, experience in buying mortgage loans and your answers to the profile questionnaire (type of investor, horizon, ticket size, profession, signing availability).
• Interest in specific deals: declared capital, offer amount, expected term and source of funds (required by anti-money-laundering rules for deals that are ultimately formalised).
• Communications: messages to the team, to the virtual assistant and to support channels, including any files you attach.
• Payment data: handled by Stripe; we only receive the payment confirmation, the customer identifier and the last digits of the card. We do not store full card data.

Data generated when you use the Platform:

• Evidence of contractual acceptance: date and time, IP address, user agent and digital fingerprint of the text accepted, together with the boxes you ticked.
• Browsing data: IP address, pages visited, device and browser, screen resolution and referring page, only if you accept analytics cookies (see Cookie Policy).
• Activity log: searches, favourites, requests, files and communications, necessary to provide the service and to evidence compliance with confidentiality obligations.
• Email metrics: whether you open or click links in our commercial emails (opening pixel). You can avoid this by unsubscribing from commercial communications.

Third-party data you may provide to us: if, as a manager, you register your investors, or if, as a field-report collaborator, you collect data from residents, neighbours or property administrators, you warrant that you are entitled to pass it on to us and that you have informed those persons. That data is processed solely for the purpose for which you provide it.

Purposes and legal bases

We process your data for the following purposes, each with its legal basis:

• Registration, account management, catalogue, tools, support and provision of the services contracted — performance of the contract (Art. 6.1.b GDPR).
• Payment, invoicing, accounting and tax obligations — legal obligation (Art. 6.1.c GDPR).
• Prevention of money laundering and terrorist financing in deals that are formalised (identification, source of funds, 10-year retention) — legal obligation (Law 10/2010).
• Fraud prevention, Platform security, access control and retention of evidence of acceptance and of compliance with confidentiality — legitimate interest (Art. 6.1.f GDPR).
• Commercial emails about services similar to those you have already purchased — legitimate interest (Art. 6.1.f GDPR and Art. 21.2 LSSI), with a right to object in every mailing.
• Commercial communications about news and promotions if you are not a paying customer — consent (Art. 6.1.a GDPR), through the specific sign-up checkbox, revocable at any time.
• Disclosure of your identification data to collaborators (managers, law firms, agents) when you request it — consent (Art. 6.1.a GDPR), through a specific checkbox.
• Virtual assistant "Marta" and automated document analysis using artificial intelligence — performance of the contract; AI providers act as processors and do not use your data to train their models.
• Usage statistics and Platform improvement through our own analytics — consent (Art. 6.1.a GDPR and Art. 22.2 LSSI) via the cookie banner.
• Handling complaints and defending our rights — legitimate interest and legal obligation.

Investor profile and automated decisions

Using your sign-up answers and the profile questionnaire we calculate an internal score (capacity, intent and knowledge) that we use to prioritise which deals we show you and how often we contact you. This classification does not produce legal effects or similarly significantly affect you: it does not condition access to the Platform, to the plans or to deals, and a person always intervenes before any decision on a specific deal.

You may object to this profiling, ask for it to be reviewed or request the information held about you by writing to [email protected].

Recipients and processors

We do not sell or rent your data. We disclose it only to:

• Asset owners/assignors (financial institutions, funds and their servicers), to the extent necessary to formalise a deal in which you participate.
• Notaries, property registries, courts and public authorities where there is a legal obligation or it is necessary for the deal.
• SEPBLAC and financial authorities, in compliance with anti-money-laundering rules.
• Collaborators (managers, law firms, agents) to whom you have expressly consented to be put in contact.

We use the following providers as processors, under a contract in accordance with Article 28 GDPR:

• Stripe Payments Europe, Ltd. — payment gateway and subscriptions.
• Resend, Inc. and Hostinger International Ltd. — sending and receiving email.
• Backblaze, Inc. — storage of files and documents.
• Cloudflare, Inc. — content delivery network and protection against attacks.
• Anthropic, PBC and Google Ireland Ltd. (Gemini) — processing of text and images using artificial intelligence for the virtual assistant, document analysis and report generation.
• Retell AI, Inc. — telephony for the voice assistant.
• Hosting providers in the European Union for the Platform's database and servers.

International transfers

Some of the providers above process data in the United States. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework (Commission Decision of 10 July 2023) where the provider is certified and, failing that, on the standard contractual clauses approved by the European Commission, with supplementary measures where appropriate. You may request a copy of the applicable safeguards.

Retention periods

• Account and profile data: while the account is active. After closure, blocked for the limitation periods for liabilities (generally five years for contractual claims, six for commercial records and four for tax records).
• Evidence of contractual acceptance and confidentiality: for the term of the contract and the five years after.
• Anti-money-laundering documentation: ten years (Art. 25 Law 10/2010).
• Identifiable browsing data: less than 48 hours; afterwards we keep only aggregates without identifiers.
• Voice assistant transcripts: 365 days; audio is not recorded unless prior notice is given.
• Commercial communications: until you object or withdraw consent; the record of your opt-out is kept in order to respect it.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw at any time any consent given and object to profiling, by writing to [email protected] stating the right you are exercising and a detail that allows us to identify you (writing from your account email is normally enough). We will only ask for additional documentation if we have reasonable doubts about your identity.

You can delete your account and all your data from My account → Delete account, and unsubscribe from commercial communications with the link included in every email.

If you consider that we have not honoured your rights, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Data of debtors, occupants and owners of the assets

The Platform processes data relating to the published loans and properties (cadastral reference, address, debt amount, status of proceedings and associated documentation) that may refer to persons other than our users. This processing is carried out in our own legitimate interest and that of the assignors for the management, valuation and marketing of loans and assets, with access limited to registered users under a duty of confidentiality, without publishing the identity of the persons and with partial data on the public pages.

Full information addressed to those persons, including their rights and the source of the data, is on the page "Information for debtors and owners".

Minors, security and changes

The Platform is intended exclusively for persons over 18. We apply appropriate technical and organisational measures (encryption in transit, role-based access control, access logging, encrypted backups and providers with contractual guarantees). We will publish any change to this policy on this page and, if substantial, notify you by email.