Privacy Policy - Vern Properties

1. BASIC INFORMATION

Controller	VERN PROPERTIES, S.L. (GRUPO ONDARA) — Tax ID: B02980639
Address	C/ Muntaner 354, 4º, 2ª — 08021 Barcelona
Phone	+34 932 20 22 63
Contact email	contacto@vern.properties
DPO / Data Protection Officer	dpo@vern.properties
Main purpose	Commercial management, provision of real estate and financial services, compliance with legal obligations
Legal basis	Performance of a contract · Legal obligation · Legitimate interest · Consent
Recipients	Data is not disclosed to third parties except where legally required or with express consent
International transfers	Only with appropriate safeguards (EU Standard Contractual Clauses) where applicable
Rights	Access, rectification, erasure, objection, restriction, portability, automated decisions
Complaints	Spanish Data Protection Agency — www.aepd.es

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we provide you with the following information on the processing of your personal data.

2. DATA CONTROLLER

VERN PROPERTIES, S.L. (hereinafter, “VERN PROPERTIES” or the “Company”), with Tax ID B02980639 and registered office at C/ Muntaner 354, 4º, 2ª, 08021 Barcelona, is the Data Controller of the personal data collected through its channels (website, telephone, email, physical and digital forms).

VERN PROPERTIES operates under the corporate umbrella of GRUPO ONDARA, made up of Ondara Capital, S.L., Vern Properties, S.L. and Angelum Legal, S.L. Where there is joint controllership or shared access between group entities for any processing, you will be specifically informed.

3. DATA PROTECTION OFFICER (DPO)

VERN PROPERTIES has appointed a Data Protection Officer (DPO) in accordance with Art. 37 GDPR and Art. 34 LOPDGDD, whose appointment has been notified to the Spanish Data Protection Agency (AEPD).

For any matter relating to the processing of your personal data or the exercise of your rights, you can contact the DPO at:

Email: dpo@vern.properties
Postal address: DPO — Vern Properties, S.L., C/ Muntaner 354, 4º, 2ª, 08021 Barcelona

4. PURPOSES OF PROCESSING AND LEGAL BASES

VERN PROPERTIES processes your personal data for the following purposes, indicating the legal basis for each processing activity:

4.1 Management of requests, enquiries and pre-contractual relationship

To handle and manage the requests for information, quotes, valuations or feasibility studies you send us via the website, by phone or through any contact channel.
Legal basis: Taking pre-contractual steps at the request of the data subject (Art. 6.1.b GDPR).

4.2 Formalisation and performance of real estate contracts

To manage the contractual relationship arising from the purchase, sale or lease of properties, including documentary, notarial and land registry processing.
Legal basis: Performance of a contract (Art. 6.1.b GDPR).

4.3 Real estate credit intermediation and management (Law 5/2019 — LCCI)

Within the framework of mortgage and financed real estate intermediation activities, we process your data to prepare the European Standardised Information Sheet (ESIS/FEIN), the Standardised Warnings Sheet (FiAE), the creditworthiness assessment and credit risk analysis, as provided for in Law 5/2019, of 15 March, regulating real estate credit agreements (LCCI) and its implementing regulations.
Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR) and performance of a contract (Art. 6.1.b GDPR).

4.4 Consultation of the Bank of Spain’s Central Credit Register (CIRBE/CIR)

Under Bank of Spain Circular 1/2013, of 24 May, and in order to assess the risk of the transaction, GRUPO ONDARA (Bank of Spain Financial Entity Registration Code: D552) may request the CIR report on the borrower from the Bank of Spain, with their prior express consent. CIR data may only be used to assess the risk of the specific transaction justifying the request, and for no other purpose. The data subject may exercise their right of access directly before the Bank of Spain (www.bde.es).
Legal basis: Consent of the data subject (Art. 6.1.a GDPR) and compliance with a legal obligation (Art. 6.1.c GDPR).

4.5 Prevention of money laundering and terrorist financing (AML/KYC)

As an obliged entity under Law 10/2010, of 28 April, on the prevention of money laundering and terrorist financing, VERN PROPERTIES processes your identification data, source of funds, economic activity and transactions to comply with due diligence obligations, identify the beneficial owner and report to SEPBLAC where legally required.
Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).
Retention period: 10 years from the end of the business relationship (Art. 25 Law 10/2010).

4.6 Access to electronic government portals for solvency analysis

In order to carry out a responsible solvency analysis, the lender may request authorisation to access certain electronic government portals (Tax Agency, Social Security, etc.) through a qualified service provider, in accordance with the LCCI and Bank of Spain regulations. This authorisation shall be prior, specific and informed, and may be revoked at any time in writing without affecting the validity of any transaction already formalised.
Legal basis: Express consent of the data subject (Art. 6.1.a GDPR).

4.7 Commercial communications

Sending information about properties, offers and news from VERN PROPERTIES, provided you have given your express consent. For existing clients, about products or services similar to those contracted, in accordance with Art. 21.2 of Law 34/2002 (LSSI-CE).
Legal basis: Consent (Art. 6.1.a GDPR) and legitimate interest.
You may object at any time by writing to dpo@vern.properties or using the unsubscribe link in each communication.

4.8 Compliance with tax, accounting and legal obligations

Processing for issuing invoices, tax returns and compliance with accounting and commercial regulations.
Legal basis: Compliance with legal obligations (Art. 6.1.c GDPR): General Tax Law, Law 37/1992 (VAT), Commercial Code.

4.9 Management of claims and judicial or administrative proceedings

Retention and processing of data necessary for the legal defence of VERN PROPERTIES and the handling of user claims.
Legal basis: Legitimate interest (Art. 6.1.f GDPR) and compliance with legal obligations.

5. CATEGORIES OF PERSONAL DATA PROCESSED

Depending on the relationship with you, VERN PROPERTIES processes the following categories of data:

Identification data: first name and surnames, DNI/NIE/passport, date of birth, nationality, marital status.
Contact data: address, email, telephone.
Economic and financial data: income, assets, CIRBE, credit history, ownership of assets, source of funds (for AML/KYC purposes).
Real estate transaction data: cadastral reference, land registry data, price, loan conditions, valuation, encumbrances.
Web browsing data: IP address, browser type, operating system, pages visited (see Cookie Policy).
Communications data: content of emails, phone calls, messages through forms.

We do not process special categories of data (Art. 9 GDPR: health, racial origin, religious beliefs, etc.) unless you voluntarily provide them in the context of a specific transaction, in which case we will obtain your explicit consent.

6. DATA RETENTION PERIOD

Purpose / Data type	Period	Legal basis
Client data and contractual relationship	Term of the contract + 5 years	Art. 1964 Civil Code
Billing and accounting data	6 years	Art. 30 Commercial Code
Tax data	4 years	General Tax Law
AML data (Law 10/2010)	10 years	Art. 25 Law 10/2010
CIRBE consultation data	As per Bank of Spain Circular 1/2013	Bank of Spain Circular 1/2013
Commercial communications (with consent)	Until consent is withdrawn	Art. 6.1.a GDPR
Requests/enquiries not formalised	1 year	General limitation period
Web browsing data (analytics cookies)	Max. 13 months	AEPD Cookie Guide
Judicial or administrative proceedings	Until final judgment + appeal periods	Procedural regulations

Once these periods have elapsed, the data will be erased or irreversibly anonymised. During the limitation period for any liabilities and where there are ongoing disputes, the data will be kept blocked and not actively used.

7. RECIPIENTS AND DISCLOSURES OF DATA

As a general rule, VERN PROPERTIES does not disclose or communicate your personal data to third parties, except in the following cases:

7.1 Ondara Group entities

Your data may be accessed by the Ondara Group entities (Ondara Capital, S.L. and Angelum Legal, S.L.) when necessary to provide the requested service or where there is joint controllership of the processing, after informing the data subject and, where applicable, with their consent.

7.2 Data Processors (Art. 28 GDPR)

VERN PROPERTIES works with service providers acting as Data Processors under our instructions, who have signed the corresponding Data Processing Agreement in accordance with Art. 28 GDPR. These include: technology and information systems providers (hosting, CRM, email), property valuation providers, administrative agencies and tax advisors, providers of access to electronic government portals for solvency analysis, law firms and notaries when acting on our behalf.

7.3 Disclosures required by law

We will disclose your data to the competent authorities when legally required: Tax Agency (AEAT), Land Registrars and Notaries, SEPBLAC (Law 10/2010), Bank of Spain (CIRBE), Courts and Tribunals, and Law Enforcement in response to legally supported requests.

8. INTERNATIONAL DATA TRANSFERS

Some technology service providers used by VERN PROPERTIES may be located outside the European Economic Area (EEA). In these cases, we ensure that such transfers have the appropriate safeguards required by Art. 46 GDPR, mainly through Adequacy decisions of the European Commission and Standard Contractual Clauses (SCCs). You can request detailed information on international transfers by contacting the DPO at dpo@vern.properties.

9. DATA SUBJECTS’ RIGHTS

Under the GDPR and the LOPDGDD, you have the following rights:

Access (Art. 15 GDPR): Obtain confirmation as to whether we process your data and access it.
Rectification (Art. 16 GDPR): Request the correction of inaccurate or incomplete data.
Erasure or “right to be forgotten” (Art. 17 GDPR): Request the deletion of your data when it is no longer necessary, you have withdrawn your consent or it has been unlawfully processed. This right may be limited by legal retention obligations.
Restriction of processing (Art. 18 GDPR): Request the temporary suspension of processing while a dispute is resolved.
Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format and transmit it to another controller.
Objection (Art. 21 GDPR): Object to processing on grounds relating to your particular situation. For commercial communications, the objection is unconditional.
Automated decisions and profiling (Art. 22 GDPR): Not to be subject to decisions based solely on automated processing producing significant legal effects, request human intervention, express your point of view and contest the decision.
Withdrawal of consent: At any time and without justification, without affecting the lawfulness of prior processing.

10. HOW TO EXERCISE YOUR RIGHTS

To exercise any of the rights indicated, you may contact VERN PROPERTIES through:

Email: dpo@vern.properties (from the same email address you provided to us)
Post: Vern Properties, S.L. — Attn: Data Protection Officer — C/ Muntaner 354, 4º, 2ª, 08021 Barcelona

You must attach a copy of your valid DNI, NIE or passport . The response period is one month from receipt (Art. 12.3 GDPR), extendable to three months in particularly complex cases, with prior notice.

11. COMPLAINT TO THE AEPD

If you consider that your data has not been processed in accordance with current regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD):

Website: www.aepd.es
Electronic office: sedeagpd.gob.es
Address: C/ Jorge Juan, 6 — 28001 Madrid

We recommend that, before contacting the AEPD, you contact our DPO to try to resolve any issue directly.

12. PROFILING AND AUTOMATED DECISIONS IN REAL ESTATE CREDIT

VERN PROPERTIES and the Ondara Group entities may use automated solvency and credit risk analysis systems within the framework of real estate credit processing regulated by Law 5/2019 (LCCI). In compliance with Art. 22 GDPR, we inform you that:

The use of these systems is legitimised by the need to enter into a contract (Art. 22.2.a GDPR) and by legal obligations arising from solvency analysis.
There will always be the possibility of human review of any decision taken.
You have the right to contest the decision, express your point of view and interact with the person responsible for the analysis.
You can request information on the logic of the automated analysis systems by contacting our DPO.

13. INFORMATION CLAUSE — CIRBE CONSULTATION WITH THE BANK OF SPAIN

The CIR, or Bank of Spain Central Credit Register (CIRBE), is a public service that manages a database of the loans, credits, guarantees and risks that financial institutions assume with their clients, whether individuals or legal entities.

Pursuant to Law 5/2019 (LCCI) and Rule Sixteen of Bank of Spain Circular 1/2013, GRUPO ONDARA (Bank of Spain Financial Entity Registration Code: D552) informs you of its right to request data from the CIR report in order to assess the risk of the transaction. The data may only be used for this specific purpose. The borrower may exercise their right of access directly before the Bank of Spain (www.bde.es).

14. PREVENTION OF MONEY LAUNDERING (Law 10/2010)

In compliance with Law 10/2010, of 28 April, on the prevention of money laundering and terrorist financing, VERN PROPERTIES, as an obliged entity, will carry out the following due diligence measures:

Identification and verification of the client’s identity using reliable documentation.
Identification of the beneficial owner of the transaction.
Analysis of the purpose and nature of the business relationship and the source of funds.
Retention of the documentation obtained for a minimum period of 10 years from the end of the business relationship (Art. 25 Law 10/2010).
Reporting of suspicious transactions to SEPBLAC where legally required.

15. COOKIES AND TRACKING TECHNOLOGIES

This website uses first-party and third-party cookies for technical, analytical and, where applicable, advertising purposes. For detailed information on the types of cookies used, their purpose, duration and how to manage them, see our Cookie Policy. The use of non-essential cookies requires your prior consent, which you can give, refuse or withdraw at any time through the cookie settings panel accessible from any page of the website.

In any case, the use of this website is governed by the provisions of Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE) and the AEPD guidelines on the use of cookies.

16. DATA SECURITY AND BREACH NOTIFICATION

VERN PROPERTIES applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing carried out, in accordance with Art. 32 GDPR. These measures include, among others: encryption of communications, role-based access control, strong authentication, regular backups and ongoing staff training in data protection.

In the unlikely event of a security breach affecting your personal data and posing a risk to your rights and freedoms, VERN PROPERTIES will notify the AEPD within a maximum of 72 hours of its detection (Art. 33 GDPR) and, where appropriate, will notify you directly without undue delay (Art. 34 GDPR).

If you detect any security incident related to your data, please report it to: dpo@vern.properties

17. SOURCE OF PERSONAL DATA

VERN PROPERTIES collects your data from the following sources:

Directly from the data subject: web forms, email, telephone, in person or through documentation provided.
Publicly accessible sources: Land Registry, Cadastre, Official Gazettes, when necessary to provide the service.
Bank of Spain Central Credit Register (CIR/CIRBE): with the prior express authorisation of the data subject.
Electronic portals of public bodies: Tax Agency, Social Security, etc., with the prior authorisation of the data subject for solvency analysis.

18. MINORS

VERN PROPERTIES’ services are aimed exclusively at persons over 18 years of age. We do not knowingly collect data from minors. If you become aware that a minor has provided us with data without parental consent, please notify dpo@vern.properties for its immediate deletion.

19. SOCIAL NETWORKS

VERN PROPERTIES has profiles on various social networks. Interacting with these profiles implies acceptance of each platform’s privacy policies. We recommend reviewing the privacy policies of each social network before interacting with our profiles. VERN PROPERTIES is not responsible for the processing of your data carried out by the platforms.

20. CHANGES TO THIS POLICY

VERN PROPERTIES reserves the right to amend this Privacy Policy to adapt it to legislative or case-law developments or industry practices. Any substantial change will be communicated to you through the website and, where we have your email address, by email. The “last updated” date indicates the version in force at any given time.

21. APPLICABLE LAW AND JURISDICTION

This Privacy Policy is governed by Spanish and European Union data protection legislation. For the resolution of any dispute, the parties submit to the jurisdiction of the Courts and Tribunals of the city of Barcelona.

VERN PROPERTIES, S.L. — Tax ID B02980639 — C/ Muntaner 354, 4º, 2ª, 08021 Barcelona
Bank of Spain Financial Entity Registration Code: D552
DPO: dpo@vern.properties