Your data, explained clearly

1. Data we process

We process information that you provide through the mortgage review form or during subsequent communications.

• Identity and contact details: name, email address, telephone number, WhatsApp or Telegram contact.
• Personal and location details: tax residence, preferred language and the Spanish province relevant to your property search.
• Financial and professional details: employment situation, tenure with the current income source, probation status, income, savings, existing commitments and, where relevant, company revenue, age and available funds.
• Property and mortgage details: financing purpose, purchase stage, expected property price and information included in optional comments.
• Communication and case records: messages, documents and actions needed to assess or manage your request.
• Technical and security data: submission time, IP address and basic security logs where these are generated by the website or its service providers.

2. Why we use it and our legal bases

• To review your situation, respond to your request and contact you through your selected channel. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• To identify potentially suitable financing options for our internal review. HARBOR ONE receives the initial form. Before the service is arranged, we may discuss only a genuinely anonymised outline with lenders, without disclosing the form, your identity, contact details, documents or details that reasonably allow you to be identified.
• At a later stage, after you enter into the applicable service agreement and instruct us to proceed, to present the necessary parts of your case to selected lenders. Legal basis: performance of the contracted service and steps taken on your instruction (Article 6(1)(b) GDPR), together with any additional confirmation required for the specific process.
• To comply with mortgage-credit, accounting, tax, anti-money-laundering, supervisory and other legal requirements. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
• To keep the service secure, prevent misuse, maintain necessary internal records and establish or defend legal claims. Legal basis: our legitimate interests (Article 6(1)(f) GDPR), limited by your rights and reasonable expectations.

Submitting a review request or entering into the service agreement does not authorise advertising or publication of your case. Any such use requires separate, optional consent for the specific purpose.

3. Which information is required?

Fields marked as required are needed to understand and respond to your request. You are not legally obliged to submit the form, but without these details we may be unable to assess your case or contact you. Optional comments are not required.

Please do not include health information, biometric data, political or religious views, or other special-category data in the comments field unless we specifically request it and explain why it is necessary.

4. Who may receive your data?

• Banks, credit institutions and other mortgage lenders after the relevant service is arranged and you instruct us to present your identifiable case. Before that point, any preliminary discussion must use a genuinely anonymised outline that does not identify you; pseudonymised or indirectly identifying information remains personal data and is not covered by this exception.
• Technology providers for hosting, secure storage, email, CRM, communications, electronic signatures, document archiving, support and cybersecurity, under data-processing agreements where required.
• Appraisers, notaries, registries, administrative agents, professional advisers and insurers where necessary for the requested service or a legal obligation, with an appropriate legal basis and information to you. Only the necessary data is disclosed.
• Courts, regulators, the Banco de España, tax authorities, law-enforcement bodies or other public authorities when disclosure is legally required.

We do not sell personal data. If you later instruct us to approach lenders, we share only the information reasonably necessary for that purpose and do not send every case indiscriminately to every lender.

5. International transfers

Some technology providers may process data outside the European Economic Area. Where this occurs, we use a valid GDPR mechanism: an adequacy decision, the EU–US Data Privacy Framework for certified US organisations, or the European Commission’s Standard Contractual Clauses together with supplementary safeguards where needed.

You may contact us to request information about the applicable safeguard or a copy of the relevant terms, subject to protection of confidential information.

6. How long we keep it

Statutory retention duties below take precedence over the deletion periods for ordinary requests.

• Requests that do not become an active case: up to 12 months from the last meaningful interaction, unless you request earlier deletion or a legal claim requires limited retention.
• Active cases: for as long as needed to provide the requested service and manage the relationship.
• Contractual and pre-contractual documentation covered by the fourth additional provision of Law 5/2019: at least six years after the contractual relationship ceases to have effect. Statutory obligations to make documents available are respected before disposal.
• Anti-money-laundering documentation, where required: ten years from the end of the business relationship or execution of the occasional transaction. After five years, access is restricted to the internal control bodies, including technical prevention units, and, where applicable, the persons responsible for legal defence.
• Evidence needed to answer rights requests or defend claims: only for the applicable limitation period.

When a retention period ends, data is deleted or irreversibly anonymised. Residual backup copies remain protected and are removed under the relevant backup cycle.

7. Case ranking and automated tools

We may use rules or assisted tools to organise requests, estimate preliminary compatibility and help prioritise human review. Typical factors may include residence, income, available funds, property price, existing commitments and purchase stage.

These tools do not make a final lending decision and we do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects. If you later contract the relevant service and instruct us to approach lenders, a person reviews the case before any presentation. Each lender then performs its own assessment under its own responsibility and privacy information.

You may ask for information about this processing, object where the legal requirements are met, and request human review.

8. Your data-protection rights

You may request access to your data, correction of inaccurate data, deletion, restriction of processing, objection to processing based on legitimate interests and portability where applicable. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Send your request to rgpd@harborone.es and identify the right you wish to exercise. We may request proportionate information to verify your identity. There is normally no charge, and we will respond within the period required by the GDPR.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es

9. Security and confidentiality

We apply organisational and technical measures appropriate to the risk, including access controls, minimisation, confidentiality duties, secure transmission and service-provider oversight. No internet service can guarantee absolute security, but suspected incidents are assessed and notified where the GDPR requires it.

10. Changes to this policy

We may update this policy when the service, providers or legal requirements change. The current version and its update date will remain available on this page. If a change materially affects how an existing case is processed, we will provide additional notice where required.

11. Optional testimonials and case publications

Only if you separately authorise it may selected testimonials, images, voice or case information be published in the materials, channels and languages covered by your consent. Refusal does not affect the mortgage service. The legal basis is consent (Article 6(1)(a) GDPR). Public channels can make the authorised material accessible worldwide.

The authorisation lasts three years unless a shorter period is agreed. You may withdraw it at rgpd@harborone.es; future use stops and material on channels controlled by HARBOR ONE is removed within ten business days. Withdrawal does not affect earlier lawful processing, and we cannot directly control independent copies made by third parties.

This authorisation does not cover disclosure of your full mortgage file, creation of advertising audiences from your personal data, or synthetic recreation of your image or voice. Only the specifically authorised material is used.