On this page
Courtesy translation. The binding text is the Spanish original, which prevails in the event of any discrepancy. Read the original in Spanish
This is an extract from the record of processing activities under art. 30 GDPR, not the complete record: the full version, with the security measures and the technical detail, is made available to the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Authority) upon request.
It is not one of the four policies of the site and no consent is given to it: it is published for the sake of transparency, and it accompanies the privacy policy, which is the document that informs data subjects.
Controller
Dalyko Partners, S.L. — NIF B21833264 (Spanish tax ID) · Calle Navel 10 · 03189 Orihuela (Alicante) · daly@icam.es
No Data Protection Officer: none of the cases in art. 37.1 GDPR applies.
Cross-cutting processor
Google Ireland Ltd. provides the infrastructure for all the digital processing activities listed below (servers, database, document storage, authentication for the private area and email delivery), as processor and under a contract pursuant to art. 28 GDPR. To avoid repeating this in every row, the recipients column lists only the additional recipients.
Twilio Ireland Ltd. (SendGrid) is a processor solely as an alternative email delivery route.
Processing activities
| Processing activity | Purpose | Categories of data | Legal basis | Data subjects | Recipients in addition to Google |
|---|---|---|---|---|---|
| Web analytics | Measuring use of the site | Random identifier, IP, browser, operating system, device, language, referrer, pages and interaction | Consent — art. 6.1.a GDPR and 22.2 LSSI (Spanish Information Society Services Act) | Visitors | No one |
| Quote request | Calculating and recording a simulation | Service, property value, amount | Pre-contractual steps — 6.1.b | Requesters | No one |
| Opening a file from the website | Receiving the engagement and opening the file | Name, email, telephone, transaction, quote | Pre-contractual steps — 6.1.b | Anyone who confirms an engagement | No one |
| Protection against automated submissions | Preventing a program from filling in the forms | Result of the calculation, trap field, IP | Legitimate interest — 6.1.f | Anyone who fills in a form | No one |
| Email confirmation | Verifying that the address belongs to the person who declares it | Email, single-use token, date | Pre-contractual steps — 6.1.b · Legitimate interest — 6.1.f | Requesters | No one |
| Client private area | Giving access to the file and its documents | Email, session identifier, access date | Contract — 6.1.b · Legitimate interest — 6.1.f | Clients | No one |
| WhatsApp contact | Answering enquiries, outside the engagement process | Number, message content, metadata | Pre-contractual steps — 6.1.b · Legitimate interest — 6.1.f | Anyone who writes to us | Meta Platforms Ireland, as independent controller |
| Client file | Providing the legal service | Identification data, contact details, property, transaction, documents | Contract — 6.1.b · Legal obligation — 6.1.c | Clients and other parties to the transaction | AEAT (Spanish State Tax Administration Agency), Registro de la Propiedad (Spanish Land Registry), notary's office, regional administration |
| Prevention of money laundering | Complying with Ley 10/2010 (Spanish Act on the prevention of money laundering and terrorist financing) | Identity document, beneficial ownership, source of funds | Legal obligation — 6.1.c | Clients within its scope | SEPBLAC (Spanish anti-money laundering financial intelligence unit), where applicable |
| Document signing | Proving who signed and when | Name, email, date and time, IP, browser, document hash, signature stroke | Contract — 6.1.b · Legitimate interest — 6.1.f | Signatories | No one |
| Mobile and email verification | Checking that the channel belongs to the data subject | Telephone, email, single-use code | Contract or prior steps — 6.1.b · Legitimate interest — 6.1.f | Clients and requesters | Meta Platforms Ireland, if the check is done via WhatsApp |
| Document custody | Keeping the file | Documents of the matter | Contract — 6.1.b · Legal obligation — 6.1.c | Clients | No one |
| Invoicing and taxation | Complying with tax and accounting obligations | Identification data, NIF, amounts, invoices | Legal obligation — 6.1.c | Clients | AEAT |
| Payment handling with money on account | Paying on the client's behalf what they instruct us to pay, and accounting to them for it | Identification data, source account, amounts, receipts | Contract — 6.1.b · Legal obligation — 6.1.c | Clients who ask for it | Bank, AEAT, town hall or SUMA, seller; water and electricity companies if the change of holder is instructed |
| Outgoing email | Sending confirmations, quotes and notifications about the file | Email, name, message content | Contract or prior steps — 6.1.b | Requesters and clients | Twilio Ireland (SendGrid), only as an alternative route |
| Commercial communications | Sending news, guides and offers from QuickConvey by email to those who ask for them and verify their address, and choosing who each mailing is of interest to | Email, name, language, country, nationality, type and relationship with us, activity with us, data from their files with QuickConvey; sign-ups and unsubscriptions with the version and hash of the policy; copy and outcome of each mailing | Consent — art. 6.1.a GDPR and 21 LSSI | Those who ask for them | Twilio Ireland (SendGrid), only if used as a sending route |
| Advertising suppression list | Not writing again to anyone who has unsubscribed or whose address bounces | Email, reason, date | Art. 23.1 LOPDGDD (Spanish Data Protection and Digital Rights Act) · Legitimate interest — 6.1.f | Those who unsubscribe and holders of addresses that bounce | No one |
| Security of the service | Maintaining the service, detecting abuse and limiting submissions | IP, address requested, browser, date and result | Legitimate interest — 6.1.f and recital 49 | Any visitor | No one |
Retention periods
As set out in the table in the privacy policy: 10 years for anti-money laundering documentation (with blocking from the fifth year, art. 25.1 Ley 10/2010), 6 for accounting records, 4 for tax records, 5 for the file, 1 year for enquiries that do not lead to an engagement, 6 months for requests submitted and not confirmed, 14 months for web analytics, 90 days for technical security logs and 3 years after unsubscribing, blocked, for the proof of consent to commercial communications; the suppression list, for as long as needed to respect the unsubscription.
International transfers
Our systems and their database are in the European Union (Belgium and Madrid). The processors are Irish companies belonging to groups whose parent company is in the United States, which may involve transfers to that country, covered by the EU-US adequacy framework and, in the alternative, by the European Commission's standard contractual clauses.
If a data subject chooses to write to us on WhatsApp, Meta Platforms Ireland Ltd. processes their data on its own account and under its own terms.
Security measures
Encryption in transit and at rest, access control per person and per project, access logging, backups, separation of environments and periodic review. The technical detail is not published, for the same reason that the configuration of a lock is not published; it is made available to the supervisory authority when it so requires.
Special categories of data
We do not currently process data in the categories of art. 9 GDPR in our property purchase and sale services.
When we provide family law services we will process data that do fall into those categories (family situation, health and psychosocial reports, including those concerning minors), on the basis of art. 9.2.f GDPR: the establishment, exercise or defence of legal claims. This extract will be updated before that happens, not after.
Automated decision-making
We do not take automated decisions producing legal effects concerning any person, or similarly affecting them. The price calculator works out a price from the data you enter and decides nothing about you.
The only profiling we carry out is for commercial communications, and only of those who ask for them: rules written by us choose who each mailing is of interest to, without artificial intelligence and with no effect whatsoever on the file, the price or the service. It is described in the privacy policy.
Nor do we use artificial intelligence on the files. If it were ever activated, that would be a new purpose: the version of the policies would change and information would be provided beforehand, not afterwards.
The four policies on this site share the same version, and this extract accompanies them with the same date. The version changes only when the substance changes (a new purpose, a new recipient, a different retention period or a different legal basis); correcting a typo does not create a new version.