Privacy Policy

The data controller is the Operator of the "La Llave" platform, identified in the Legal Notice.

Contact point for any matter relating to privacy or the exercise of rights: [email protected].

User identification and contact data: full name, email address and, optionally, telephone number.

Referral network data: slug chosen by the User, slug of the referrer who invited them and network of direct invitees.

Data on referred properties: address or reference of the property, and contact details provided voluntarily by the User or by the owner of the property.

Financial data: amounts of commissions generated and, where applicable, the bank or payment details needed to pay them.

Technical data: IP address, session identifiers and authentication events, needed for the security of the service.

Managing the User's registration and authentication via magic link.

Building and maintaining the three-level referral network, calculating commissions and paying them.

Communicating with the User regarding their account, validations, leads and transactions.

Complying with the applicable legal, tax and accounting obligations.

Preventing fraud, abuse and uses contrary to the Terms and Conditions.

Performance of the contract entered into between the Operator and the User upon acceptance of the Terms and Conditions (Art. 6(1)(b) GDPR), for the purposes of registration, network management and payment of commissions.

Compliance with legal obligations applicable to the Operator (Art. 6(1)(c) GDPR), particularly in tax matters and the prevention of money laundering where applicable.

Legitimate interest of the Operator (Art. 6(1)(f) GDPR) in validating duplicate referrals, preventing fraud and maintaining the security of the platform.

While your account is active, we keep your data in order to provide you with the service.

If you request the closure of your account from /dashboard/datos and you have no closed transactions, we delete everything immediately and irreversibly.

If you have closed transactions, we delete your personal data (name, telephone number, IBAN, email, etc.) but retain the anonymised accounting record for 4 years, the minimum period required by the Spanish General Tax Act (Ley General Tributaria, Ley 58/2003). After that period, it is deleted automatically.

Technical security logs are kept for a maximum of 12 months, unless they are needed to investigate an incident.

The data may be processed by technology providers acting as data processors, solely in order to provide the service: Supabase (database and authentication, hosted in the European Union), Vercel (hosting and delivery of the application), Brevo (sending of transactional emails), Stripe (processing of commission payments), Microsoft Clarity (aggregated usage analytics, without collecting identifiable personal data) and Cloudflare (DNS and anti-bot protection).

Where any of these providers operates outside the European Economic Area, transfers will be covered by the Standard Contractual Clauses approved by the European Commission or by another equivalent safeguard mechanism.

The data are not disclosed to third parties for their own commercial purposes. They may only be disclosed to the competent authorities where there is a legal obligation to do so.

When the User refers a property or a potential buyer, the User warrants that they have the informed consent of that third party to share their data with the Platform.

The User shall be solely liable towards the referred third party if they provide data without the appropriate legal basis, and shall hold the Operator harmless against any resulting claim.

The User may at any time exercise the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17, "right to be forgotten"), objection (Art. 21), restriction of processing (Art. 18) and portability (Art. 20).

For access, erasure and portability, the User may exercise these rights directly from their dashboard: /dashboard/datos. For the other rights, by writing to [email protected] from the address associated with their data or by proving their identity by another reasonable means.

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if they consider that the processing does not comply with the legislation in force.

The Platform uses only technical cookies that are strictly necessary for the operation of the service (session maintenance and fraud prevention). No profiling or advertising cookies are used.

The Operator applies reasonable technical and organisational measures to protect the data: encryption in transit, role-based access control, passwordless authentication and periodic reviews of database permissions.