Your data, explained clearly

1. Data we process

We process information that you provide through the mortgage review form or during subsequent communications.

• Identity and contact details: name, email address, telephone number, WhatsApp or Telegram contact.
• Personal and location details: tax residence, preferred language and the Spanish province relevant to your property search.
• Financial and professional details: employment situation, tenure with the current income source, probation status, income, savings, existing commitments and, where relevant, company revenue, age and available funds.
• Property and mortgage details: financing purpose, purchase stage, expected property price and information included in optional comments.
• Communication and case records: messages, documents and actions needed to assess or manage your request.
• Technical and security data: submission time, IP address and basic security logs where these are generated by the website or its service providers.

2. Why we use it and our legal bases

• To review your situation, respond to your request and contact you through your selected channel. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• To identify potentially suitable financing options for our internal review. The initial form is not sent to banks or other mortgage lenders.
• At a later stage, after you enter into the applicable service agreement and instruct us to proceed, to present the necessary parts of your case to selected lenders. Legal basis: performance of the contracted service and steps taken on your instruction (Article 6(1)(b) GDPR), together with any additional confirmation required for the specific process.
• To comply with mortgage-credit, accounting, tax, anti-money-laundering, supervisory and other legal requirements. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
• To keep the service secure, prevent misuse, maintain necessary internal records and establish or defend legal claims. Legal basis: our legitimate interests (Article 6(1)(f) GDPR), limited by your rights and reasonable expectations.

We do not currently use mortgage-review data for advertising. If this changes, we will request separate, optional consent before sending marketing communications.

3. Which information is required?

Fields marked as required are needed to understand and respond to your request. You are not legally obliged to submit the form, but without these details we may be unable to assess your case or contact you. Optional comments are not required.

Please do not include health information, biometric data, political or religious views, or other special-category data in the comments field unless we specifically request it and explain why it is necessary.

4. Who may receive your data?

• Banks, credit institutions and other mortgage lenders only after the relevant service is contracted and you instruct us to present your case. Submitting the initial review form does not disclose your data to them.
• Technology providers needed to operate the service, such as website hosting, secure storage, email, CRM, communications, support and cybersecurity providers. They act under data-processing agreements where required.
• Professional advisers where their involvement is necessary for your request and you have been appropriately informed.
• Courts, regulators, the Banco de España, tax authorities, law-enforcement bodies or other public authorities when disclosure is legally required.

We do not sell personal data. If you later instruct us to approach lenders, we share only the information reasonably necessary for that purpose and do not send every case indiscriminately to every lender.

5. International transfers

Some technology providers may process data outside the European Economic Area. Where this occurs, we use a valid GDPR mechanism: an adequacy decision, the EU–US Data Privacy Framework for certified US organisations, or the European Commission’s Standard Contractual Clauses together with supplementary safeguards where needed.

You may contact us to request information about the applicable safeguard or a copy of the relevant terms, subject to protection of confidential information.

6. How long we keep it

• Requests that do not become an active case: up to 12 months from the last meaningful interaction, unless you request earlier deletion or a legal claim requires limited retention.
• Active cases: for as long as needed to provide the requested service and manage the relationship.
• Contractual, pre-contractual and compliance records: for the periods required by applicable law. This may include six years for documents supporting certain Banco de España risk-information requests and ten years for anti-money-laundering records where those obligations apply.
• Evidence needed to answer rights requests or defend claims: only for the applicable limitation period.

When a retention period ends, data is deleted or irreversibly anonymised. Residual backup copies remain protected and are removed under the relevant backup cycle.

7. Case ranking and automated tools

We may use rules or assisted tools to organise requests, estimate preliminary compatibility and help prioritise human review. Typical factors may include residence, income, available funds, property price, existing commitments and purchase stage.

These tools do not make a final lending decision and we do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects. If you later contract the relevant service and instruct us to approach lenders, a person reviews the case before any presentation. Each lender then performs its own assessment under its own responsibility and privacy information.

You may ask for information about this processing, object where the legal requirements are met, and request human review.

8. Your data-protection rights

You may request access to your data, correction of inaccurate data, deletion, restriction of processing, objection to processing based on legitimate interests and portability where applicable. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Send your request to rgpd@harborone.es and identify the right you wish to exercise. We may request proportionate information to verify your identity. There is normally no charge, and we will respond within the period required by the GDPR.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es

9. Security and confidentiality

We apply organisational and technical measures appropriate to the risk, including access controls, minimisation, confidentiality duties, secure transmission and service-provider oversight. No internet service can guarantee absolute security, but suspected incidents are assessed and notified where the GDPR requires it.

10. Changes to this policy

We may update this policy when the service, providers or legal requirements change. The current version and its update date will remain available on this page. If a change materially affects how an existing case is processed, we will provide additional notice where required.