Privacy and data protection policy

1. Controller identity

The controller undertakes to apply the technical and organisational measures needed to protect the personal data processed by the application, according to the risk level of each processing activity.

2. Applicable regulations

This policy is adapted to current Spanish and European legislation on personal data protection and information society services, in particular:

• Regulation (EU) 2016/679, General Data Protection Regulation (GDPR).
• Spanish Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights (LOPDGDD).
• Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

3. Categories of data processed

The application processes data needed to identify users, manage communities and provide support. Depending on the profile and features used, the following categories may be processed:

• Identification data: name, surnames, DNI/CIF, email, phone and access credentials.
• Community, home or management company data: code, address, door, coefficients, relationship with homes or communities and user role.
• Financial or administrative data linked to community management: fees, charges, unpaid amounts, transactions, concepts, documents, minutes and reports.
• Technical data: IP address, access date and time, device, activity records, error logs and data needed for security and support.

No special categories of personal data within the meaning of Article 9 GDPR are expected to be processed.

4. Purposes of processing

• Manage access to the application and verify user identity.
• Administer communities, homes, residents, management companies, employees and permissions.
• Record and consult financial and document information, incidents, tasks, insurance, maintenance, minutes, voting and reports.
• Handle support requests, technical queries and incidents reported by users.
• Maintain application security, prevent unauthorised access and keep reasonable technical evidence through activity records.
• Comply with legal or contractual obligations arising from community management.

The data will not be used for commercial communications unrelated to the purpose of the application.

5. Legal basis for processing

The legal basis may vary depending on the feature used:

• User consent when using contact, support or registration forms.
• Performance of a contractual or pre-contractual relationship when processing is necessary to provide the service.
• Legitimate interest in maintaining security, traceability and proper operation of the application.
• Compliance with legal obligations applicable to administrative, accounting or document management.

When information is mandatory to complete an operation, it will be indicated in the form or will be necessary to perform the requested feature.

6. Retention periods

Personal data will be kept for the time necessary to fulfil the purposes for which it was collected, while there is a relationship with the community, management company or user, and during the periods required by applicable law.

Technical records and logs will be kept for the time reasonably necessary for security, audit, incident resolution and support, unless they must be kept longer due to a legal obligation or claim.

7. Recipients and processors

The data may be processed by the management company, authorised administrators, employees with permissions, users linked to the community and technical support, always within the purposes of the application.

Data will not be transferred to third parties except due to a legal obligation, operational need of the service or intervention of technical providers acting as processors under the safeguards required by the GDPR.

8. Minors

The application is not intended for minors. It is intended for management companies, technical professionals, administrators, presidents, owners or authorised residents.

9. User rights

Users may exercise, where applicable, the following rights recognised by the GDPR and LOPDGDD:

• Right of access.
• Right to rectification.
• Right to erasure.
• Right to restriction of processing.
• Right to data portability.
• Right to object.
• Right not to be subject to decisions based solely on automated processing.

To exercise these rights, a request may be sent to jose.rodriguez.an@gmail.com, indicating the reference “GDPR”, the right to be exercised and the information needed to verify the applicant’s identity.

10. Security and confidentiality

The controller will apply appropriate technical and organisational measures to prevent destruction, loss, accidental or unlawful alteration, disclosure of or unauthorised access to the personal data processed.

Data will be treated confidentially. Persons or providers accessing personal information must do so only for the authorised purpose.

In the event of a security breach that may pose a high risk to people’s rights and freedoms, the communication obligations provided for in the GDPR will be followed.

11. Links to third parties

The application may contain links to third-party websites. Those sites have their own privacy policies and are responsible for their own processing activities.

12. Complaints to the supervisory authority

If a person considers that the processing of their data does not comply with the regulations, they may file a complaint with the Spanish Data Protection Agency: https://www.aepd.es/.

13. Acceptance and changes to this policy

Use of the application implies acceptance of this privacy policy where applicable. The controller may modify this policy due to legal, technical, organisational or application operation changes.

Users are advised to consult this page periodically to know the current version.