1. Controller
| Item | Value |
|---|---|
| Controller | SHA3DEV S.L. |
| Tax identification number | B44577427 (NIF-IVA ESB44577427) |
| Address | Carrer Jeroni Anyé i Casanovas, 57, 08340 Vilassar de Mar (Barcelona), España |
| Data protection email | inmoblia@sha3.dev |
The controller is not required to appoint a data protection officer under article 37 GDPR or article 34 LOPDGDD, so requests in this area are handled at the address above.
2. Starting point
Inmoblia is a consultation service that works without registration. Under normal browsing no identifying data is requested, and processing is limited to what is strictly needed to serve the pages and, where consented to, to audience measurement.
- Personal data is never sold, rented or disclosed to third parties for commercial purposes.
- No profiling with legal effects is carried out and no automated decisions about people are taken.
- No advertising or commercial communications are sent without prior consent.
- Home valuation queries are resolved transiently and are not retained against a user.
3. Processing operations, purposes and legal bases
The following processing operations are carried out:
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Providing the service and site security | IP address, date and time, page requested, response code, user agent and referring page, recorded in server logs | Legitimate interest of the controller in delivering the service requested and protecting the infrastructure against abuse and attack (art. 6(1)(f) GDPR) | 30 days, unless a security incident requires a specific record to be kept while it is investigated |
| Remembering the chosen language | Technical cookie holding the selected language code | Provision of a service expressly requested by the user (art. 22.2 LSSI, exempt from consent) and legitimate interest (art. 6(1)(f) GDPR) | 12 months from the choice |
| Remembering the cookie decision | Technical cookie holding the acceptance or rejection and its date | Compliance with a legal obligation: demonstrating consent or its absence (art. 6(1)(c) GDPR and art. 22.2 LSSI) | 12 months, after which the question is asked again |
| Audience measurement with Google Analytics 4 | Cookie identifier, IP address (truncated by Google before storage), page views, navigation events, device type, browser, language and approximate city-level location | User consent, given in the cookie notice (art. 6(1)(a) GDPR and art. 22.2 LSSI). Without consent the tool is not loaded | 14 months from the last activity, or until consent is withdrawn |
| Home valuation in “Value your home” | Postal address entered, cadastral reference selected and, if expressly authorised in the browser, approximate device coordinates | Consent and performance of the query requested by the user (art. 6(1)(a) and 6(1)(b) GDPR) | Not retained: the query is resolved in real time and the result is not stored against the user |
| Handling enquiries, rights requests and content removal notices | Name, email address and whatever the person includes in the message; for rights requests, a copy of an identity document where strictly necessary | Compliance with legal obligations (art. 6(1)(c) GDPR) and legitimate interest in handling and evidencing the reply (art. 6(1)(f) GDPR) | While the matter is handled and thereafter for the applicable limitation periods |
| User account (planned functionality, not yet active) | Email address, hashed password and saved preferences; technical session cookie | Performance of the contract for the service requested (art. 6(1)(b) GDPR) | While the account is active and, after closure, until liabilities lapse |
4. Geolocation
The Site may offer results near the device's location. This feature is only activated if the user expressly allows it in the browser, and permission can be withdrawn at any time from the browser's own permission settings.
The coordinates obtained are sent to Inmoblia's server for the sole purpose of identifying the corresponding municipality, and are not stored. Converting coordinates into a municipality name is done through the OpenStreetMap Foundation's Nominatim service; the request is made by Inmoblia's server, so the user's IP address is not disclosed to that service.
5. Personal data contained in third-party adverts
Property records come from adverts their authors have published in a publicly accessible manner on their own websites. Those adverts may contain personal data, usually of industry professionals (agency trading name, name of the agent in charge, contact telephone or email) and occasionally of private individuals advertising their own home.
In accordance with article 14 GDPR, the following is stated in respect of that data:
- Source. Websites of estate agencies, developers and private individuals, publicly accessible without registration or any technical access restriction.
- Purpose. Identifying where each advert comes from, allowing the user to reach the original source, and keeping published information traceable.
- Legal basis. Legitimate interest (art. 6(1)(f) GDPR) in reporting on the public supply side of the residential market and in correctly attributing each advert to whoever publishes it, balanced against the data subject's rights. Only the minimum data needed for attribution is published and the original advert is always linked.
- Retention. For as long as the advert remains referenced on the Site; once the advert or the property is withdrawn, the associated data ceases to be published.
- Rights. Anyone identified or identifiable in a record may request erasure, rectification or object by writing to inmoblia@sha3.dev, or through the procedure on the Content removal page.
6. Recipients
Personal data is not disclosed to third parties except where required by law or by a competent authority. The following act as processors or service providers:
| Provider | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the site and the database, and server logging | Germany (European Union) |
| Google Ireland Limited / Google LLC | Audience measurement (Google Analytics 4), only where consented to | European Union and United States |
| OpenStreetMap Foundation | Converting coordinates into a municipality name (Nominatim), called from the server | United Kingdom |
| Directorate-General for Cadastre | Cadastral data lookup, called from the server | Spain |
Contracts required by article 28 GDPR have been entered into with processors that handle personal data on Inmoblia's behalf.
7. International transfers
Use of Google Analytics may involve access to data from the United States by Google LLC. That transfer relies on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of the EU-US Data Privacy Framework, to which Google LLC is certified, and, in addition, on the standard contractual clauses approved by the European Commission.
Querying the Nominatim service involves a communication with the OpenStreetMap Foundation in the United Kingdom, relying on the European Commission's adequacy decision applicable to that country or, failing that, on standard contractual clauses. That query is made from the server and contains no data identifying the user.
If consent to analytics cookies is not given, no international transfer arises from audience measurement.
8. Data subject rights
Anyone may exercise the following rights by writing to inmoblia@sha3.dev, stating the right being exercised and enclosing, where strictly necessary to establish identity, a copy of an identity document:
- Access: to know what data is processed and obtain a copy of it.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to request deletion where the data is no longer necessary or the processing is unlawful.
- Objection: to object to processing based on legitimate interest, on grounds relating to your particular situation.
- Restriction: to request that processing be suspended while a challenge is verified.
- Portability: to receive the data you provided in a structured format, where processing is based on consent or a contract.
- Withdrawal of consent: to revoke consent at any time, without affecting the lawfulness of processing carried out beforehand. Cookie consent is withdrawn from the settings panel linked in the footer and described in the Cookie policy.
Requests are answered within one month, extendable by two further months where complexity warrants it, with prior notice of the extension. Exercising these rights is free of charge.
If you believe your data is not being handled properly, you may lodge a complaint with the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, or through its electronic office at www.aepd.es. We would be grateful for the chance to resolve the matter directly first.
9. Security measures
Appropriate technical and organisational measures are applied under article 32 GDPR, having regard to the state of the art and the risk of the processing: TLS encryption of traffic, access control to the infrastructure, minimisation of the data collected, separation of environments and backups. No system is entirely invulnerable; in the event of a security breach posing a risk to the rights of those affected, the supervisory authority and, where appropriate, the individuals concerned will be notified under articles 33 and 34 GDPR.
10. Minors
The Site is not directed at children under fourteen and does not knowingly collect their data. Under article 7 LOPDGDD, processing based on the consent of a child under fourteen requires the consent of the holders of parental responsibility or guardianship. If such processing is detected without that authorisation, the data will be erased.
11. Automated calculations
The published indicators — score, estimated yield, confidence and indicative valuation — are computed automatically, but they concern properties and territories, not people. There is no profiling and no automated decision-making producing legal effects concerning a person or similarly significantly affecting them within the meaning of article 22 GDPR.
12. Changes to this policy
This policy may be amended to reflect legal, technical or service changes. The version in force is always the one published on this page, bearing the date shown at its foot. Substantial changes will be announced prominently on the Site before they take effect.