Privacy policy

1. Data Controller

The controller for the processing carried out directly through RealtorList.Net is:

The NIF, business address and other identifying information required from the service provider are permanently available in the Legal notice. This policy avoids repeating personal information that is not necessary to explain the data processing activities.

2. When RealtorList acts as controller or processor

RealtorList as data controller

RealtorList acts as controller when it determines the purposes and essential means of the processing. This includes, among other things, managing:

• The website, accounts and authentication.
• Subscriptions, payments, invoices and customer support.
• Published professional profiles and contact cards.
• Verification, moderation, fraud prevention and security processes.
• Associated reviews, responses, complaints and audit logs.
• Service communications and, where applicable, marketing communications.
• Statistics, cookies and measurement tools configured by RealtorList.

RealtorList as data processor

When an agency or professional enters information into the contact database about its own clients, prospects, property owners or collaborators and decides how to use it, that agency or professional will normally be the controller and RealtorList will act as processor, processing the data in accordance with its documented instructions.

In such cases, the relevant data processing agreement will apply, in addition to the terms of service. The user, whether an individual or entity, must inform their contacts, have a valid legal basis and use the tools in accordance with applicable regulations.

The existence of a technical tool does not in itself authorise the import of contacts, sending communications or retaining third-party information without a valid legal basis.

3. What Personal Data We May Process

Depending on how you use RealtorList, we may process the following categories:

• Identification and contact details: first name, last name, email address, telephone number, company, agency and professional title.
• Account and authentication data: username, internal identifiers, cryptographic password verifier, preferences, account status and basic access logs.
• Professional data: service areas, languages, experience, specialities, services, property types, biography, photograph, logo, website, social media and affiliation with an agency.
• Profile and contact card data: fields that the account holder chooses to make public so they can be viewed or shared.
• Contracting and billing data: plan, applicable limits, orders, billing address, tax information, invoice number, payment status and reference provided by the payment processor.
• Verification data: documents or evidence reasonably necessary to verify identity, professional activity or affiliation with an agency.
• Reviews and moderation: ratings, comments, responses, evidence, review statuses, moderation decisions and audit logs.
• User-managed contact data: name, contact details, notes, tasks, calls, messages, sales status and interaction history entered by the agency or professional.
• Communications: support messages, internal chat, requests, complaints, responses and files sent.
• Use of artificial intelligence: instructions, questions, documents provided, generated results, assessments and technical data necessary to provide and protect the feature.
• Professional documents: data entered to prepare draft invoices, reservation agreements or other documents enabled under the plan.
• Usage and security data: IP address, browser, device, date and time, technical events, security logs, relevant activity and cookie preferences.
• Preferences and consents: privacy choices, marketing communications and cookie settings.

Do not enter specially protected categories of data, complete identity documents, bank details, medical information, passwords, unnecessary secrets or third-party information that is not essential for a legitimate professional purpose.

4. Where the data comes from

Data may come from:

• The data subject when registering, subscribing, completing a profile or making contact.
• An authorised agency, company or professional that creates or manages a profile.
• Clients, property owners, collaborators or users participating in communications or reviews.
• Publicly accessible professional sources, such as corporate websites or professional profiles.
• Payment, authentication, security or communications providers.
• The device and browser while using the service.

Where data is not obtained directly from the data subject, RealtorList will provide the required information about the processing within the applicable timeframe and, at the latest, in the first communication or when the data is first disclosed, unless a legal exception applies.

The use of professional information published online does not make all data freely reusable. RealtorList will apply criteria of necessity, proportionality, accuracy, reasonable expectations and the right to object.

5. Purposes and Legal Bases

Where processing is based on legitimate interest, its necessity, proportionality and impact on individuals' rights will be assessed. You may request additional information or object where applicable.

6. Public profiles, contact cards and reviews

Professional profiles and certain contact card fields are public. They may be viewed by visitors, shared via links and appear in search engines.

• Only professional data appropriate for that purpose should be published.
• Optional fields will be shown as public before the user completes or activates them.
• Verification documents are not published as part of the profile.
• Anyone providing another person's data declares that they have sufficient authorisation.
• RealtorList may request corrections, evidence or updates to the information.
• The data subject may request rectification, concealment or removal in accordance with applicable regulations and the contracted service.

Reviews

Public reviews may display the rating, approved comment, date, limited identification of the author and the professional's response. The reviewer's email address, telephone number, documents and other private data will not be published unless clear information and valid authorisation are provided.

Only approved reviews will be included in public aggregates. RealtorList may retain limited information and audit logs to prevent duplicates, investigate fraud, handle complaints and document moderation decisions.

Editorial distribution

Where a contracted plan includes the distribution of profiles or content through other media in the RealtorList network, only the professional data and materials specified in the approved order, proposal or brief will be published. Private account, billing, verification, CRM or internal communications data are not part of that publication.

7. Privacy in professional tools

Contact database

Users must record only the information necessary to manage a legitimate professional relationship. Purchased or unlawfully obtained databases must not be imported or used for unsolicited communications.

Internal chat

Messages are intended for professional communications between authorised users. RealtorList may process metadata and content where necessary to deliver messages, resolve incidents, protect security, handle complaints or comply with a legal obligation.

Artificial intelligence

Instructions and results may be processed by technology providers acting as sub-processors or independent providers, depending on the service used. Do not enter confidential or third-party data where it is not necessary or you do not have a valid legal basis.

RealtorList will not authorise the use of customer data for independent training of third-party models where such use is not necessary to provide the service, unless specific notice is given and a valid legal basis exists.

Invoices and contracts

The user is responsible for the accuracy of the personal data entered in drafts and for restricting its use to persons involved in the transaction or service. Documents must be reviewed before being issued, shared or signed.

Knowledge base

RealtorList may record enquiries, searches and valuations in order to provide responses, identify issues and improve content organisation, applying data minimisation and access controls.

8. Processing of the data you enter about your contacts

Where RealtorList acts as a data processor, it will process personal data in accordance with the documented instructions of the account holder and exclusively to provide, protect and maintain the contracted features.

The applicable data processing agreement must regulate, among other matters:

• The subject matter, duration, nature and purpose of the processing.
• The types of data and categories of data subjects.
• The confidentiality of those who access the information.
• Technical and organisational security measures.
• The engagement and oversight of sub-processors.
• Assistance with the exercise of rights and breach management.
• The return, export or deletion of data at the end of the service.
• The information required to demonstrate compliance.

The account holder will remain responsible for the lawfulness of the collection, the information provided to their contacts, the communications sent, the retention periods and the instructions provided to RealtorList.

Do not use RealtorList to store medical records, criminal information, biometric data, banking credentials or other particularly sensitive categories, unless the feature has been expressly designed, assessed and contracted for that purpose.

9. Recipients and service providers

RealtorList does not sell personal data. Data may be disclosed or made available to third parties only where there is a valid legal basis and it is necessary.

• Hosting, cloud infrastructure, security and backup providers.
• Email, SMTP, messaging and customer support providers.
• Payment processors and fraud prevention tools.
• Billing, accounting, legal advisory and administrative management providers.
• Artificial intelligence, search and knowledge base providers enabled within the service.
• Maintenance, development, monitoring and technical support providers.
• Analytics, advertising or measurement tools, where consent or another valid basis exists.
• Other users where a communication or collaboration feature requires their data to be displayed.
• Visitors, search engines and online media in relation to published professional information.
• Government bodies, judges, courts, law enforcement agencies and competent authorities where required.

Providers that process data on behalf of RealtorList will be subject to data protection agreements and may only access the information necessary for their function. Where a third party determines its own purposes, it will act as an independent controller and must provide its own privacy information.

10. International transfers

Some providers may process data from countries outside the European Economic Area. Before using these services, RealtorList will assess the applicable mechanism and the safeguards offered.

Depending on the circumstances, transfers may be based on:

• An adequacy decision by the European Commission.
• Standard contractual clauses approved by the European Commission.
• The EU-US Data Privacy Framework. where the recipient is certified and the processing is covered.
• Binding corporate rules or other legally recognised safeguards.
• A legal derogation applicable to a specific and occasional transfer.

Where necessary, additional contractual, technical or organisational measures will be applied. You may request information about the applicable safeguards by writing to partners@realtorlist.net.

11. How long we retain data

Where data must be retained to address liabilities, it will remain blocked or subject to restricted access and will not be used for incompatible purposes.

12. Your Rights

You may exercise the following rights where applicable:

• Access to your personal data and information about its processing.
• Correction of inaccurate or incomplete data.
• Deletion of data where applicable.
• Objection to processing based on legitimate interest or intended for direct marketing.
• Restriction of processing in cases provided for by law.
• Portability of the data provided where processing is automated and based on consent or a contract.
• Withdrawal of consent, without affecting the lawfulness of prior processing.
• Not being subject to decisions based solely on automated processing that produce legal or similarly significant effects.
• Request information about the safeguards for an international transfer.

RealtorList will generally respond within one month of receipt. This period may be extended by a further two months where the request is complex or there is a large number of requests, and you will be informed of the extension and the reasons for it.

Exercising your rights is free of charge. However, where a request is manifestly unfounded or excessive, particularly due to its repetitive nature, the measures permitted by the regulations may be applied.

You may also lodge a complaint with the Spanish Data Protection Agency if you believe that the processing does not comply with the applicable regulations.

Where RealtorList acts solely as a processor in relation to data entered by an agency or professional, it may forward the request to the relevant controller or assist them in accordance with the data processing agreement.

13. Automated decisions and artificial intelligence

RealtorList does not currently use decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect them.

Score calculations, technical checks, anti-spam filters and tools supporting moderation may automate certain operations, but relevant measures regarding verification, suspension, removal or complaints must be reviewable by a person.

Results generated by artificial intelligence tools are supporting content and do not in themselves constitute a legal, financial, tax or real-estate decision made by RealtorList.

If an automated decision with legal or similar effects is implemented in the future, the required information regarding its logic, significance, consequences and available rights will be provided in advance.

14. Cookies and similar technologies

RealtorList uses cookies necessary for the operation and security of the site. Analytical, advertising or third-party cookies requiring consent will remain blocked until the user accepts them.

You can view the categories, purposes, providers, duration and configuration options in the Cookie policy and change your choice using the permanent settings link.

15. Security and incident management

RealtorList applies technical and organisational measures proportionate to the risks, including access controls, authentication, backups, updates, activity logs, segregation of duties and confidentiality measures where appropriate.

No system connected to the Internet can guarantee absolute security. Users must protect their credentials, limit permissions on their devices, review granted access and report any suspicious activity.

When a personal data security breach occurs, RealtorList will document the incident and make notifications to the authority or affected individuals where legally required.

16. Minors

Professional profiles, subscriptions and RealtorList tools are intended for individuals with sufficient legal capacity to act professionally or on behalf of a company.

Professional accounts must not be created, nor minors' data entered, without a legitimate purpose, a valid legal basis and the necessary authorisations. If we detect data of a minor processed improperly, we may block it and request the information necessary to delete it or regularise the processing.

17. Changes, interpretation and contact

This policy may be updated to reflect legal, technical, security, provider or service changes. The current version will be the one published on this page and will show its last updated date.

Where a change materially affects a purpose, legal basis, recipient or use of data, additional information will be provided and new consent will be requested where necessary.

This policy must be read together with the Legal notice, the Cookie policy and the terms applicable to the contracted service.