Privacy Policy

1. DATA CONTROLLER

2. PURPOSES OF DATA PROCESSING

Website users / visitors

• Manage your navigation on the website (analytics and functionality).
• Respond to inquiries, contact requests, and information requests.
• Send commercial communications about our services (only with explicit consent).

Clients (paid services: mortgage brokerage, consulting, valuation)

• Provide the contracted services (advisory, intermediation, property valuation).
• Manage the mortgage intermediation mandate and search for financing offers.
• Present your credit application to partner financial institutions.
• Perform solvency analysis and debt capacity assessments (compliance with Spanish mortgage regulations).
• Legal compliance with Law 5/2019 on real estate credit contracts.

3. INFORMATION ON REQUESTED DATA

The personal data we request in our forms are adequate, relevant and strictly necessary to manage and process your request and to send you information about our services. You are not obliged to provide them. Mandatory fields are marked in the forms; refusal to provide them will make it impossible to process your request. You guarantee that all data provided are true, accurate and relevant for the purpose for which we request them.

Personal data will be kept as long as the commercial relationship remains active. Once terminated, data will be kept blocked for the legally established periods before being deleted.

By submitting your data, you expressly authorise us to incorporate them into our files for the management of your request. Your data will not be transferred to third parties without your explicit consent, except where necessary to comply with a legal obligation.

Ticking the acceptance box on any form constitutes your consent to receive information about our services that may interest you.

4. CONSULTATION OF SOLVENCY FILES

In accordance with Article 11 of Law 5/2019 (Spanish Real Estate Credit Contracts Law), as a Mortgage Credit Intermediary we are authorised to consult solvency and credit files from the following databases:

• ASNEF / ASNEF-Equifax – Spanish solvency file
• CIRBE – Central Risk Information System of the Bank of Spain
• RAI – Register of Unpaid Acceptances
• Experian, TransUnion, and other official credit bureaus

5. DATA TRANSFERS AND RECIPIENTS

We may transfer your personal data to the following categories of recipients:

• Partner financial institutions (banks) – for the purpose of submitting your mortgage application.
• Service providers (IT hosting, CRM, email marketing) under data processing agreements (processors) that guarantee GDPR compliance.
• Public authorities and courts – when required by law (anti-money laundering, tax obligations, etc.).

No international data transfers outside the European Economic Area (EEA) are performed unless appropriate safeguards (Standard Contractual Clauses) are in place. You may request information about such transfers by contacting privacy@casarates.com.

6. YOUR DATA PROTECTION RIGHTS

To exercise your rights, please send a written request to privacy@casarates.com or to our postal address: Casarates Advisory S.L., C. de Ricardo Villa, 9, P.9 PTA.2, 08017 Barcelona, Spain. You must attach a copy of your ID or equivalent identification document. For opting out of commercial communications, you may also use the unsubscribe link in any email or write to unsubscribe@casarates.com.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with your local supervisory authority if you believe your data protection rights have been violated.

7. DATA RETENTION PERIOD

We retain your personal data as follows:

• Client data (contractual relationship): For the duration of the contractual relationship and, after termination, for the legally required periods (e.g., 6 years for tax and accounting purposes, 10 years for anti-money laundering regulations under Spanish Law 10/2010).
• Prospect data (consent-based): Until you withdraw your consent or request erasure.
• Website usage analytics: According to our cookie policy (max 26 months for analytics).

8. LEGAL BASIS FOR PROCESSING

• Performance of a contract: Provision of mortgage intermediation, advisory and valuation services.
• Legal obligation: Anti-money laundering regulations, compliance with Law 5/2019, Bank of Spain record-keeping.
• Legitimate interest: Direct marketing of similar services (when consent is not strictly required under Spanish LSSI) and security monitoring.
• User consent: For cookies (except strictly necessary), sending newsletters, and transfers to third parties not covered by legal obligations.