Privacy Policy

https://www.acginmobiliaria.com

I. PRIVACY AND DATA PROTECTION POLICY

This Privacy Policy explains clearly who processes your personal data, for what purposes, on what legal basis, for how long, to whom it is disclosed and how you can exercise your rights. It applies to people who browse https://www.acginmobiliaria.com (the Website), to those who request a valuation or contact us, and to the clients of our real estate agency services. This English version is provided for information purposes only. In the event of any discrepancy, the Spanish version shall prevail.

Applicable legislation

The processing of your personal data is governed, among others, by the following legislation:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR).
  • Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights (LOPDGDD).
  • Spanish Law 34/2002 of 11 July on information society services and electronic commerce (LSSI-CE), in particular articles 21 (commercial communications) and 22.2 (cookies).
  • Spanish Law 10/2010 of 28 April on the prevention of money laundering and terrorist financing, which imposes identification and record-keeping obligations on real estate agents.
  • Spanish Law 58/2003 of 17 December, General Tax Law, and the Spanish Commercial Code, regarding the retention of tax and accounting records.

Data controller

The data controller for the personal data collected through this Website is Andrés Cambon Gómez, a sole trader operating under the trade name ACG Inmobiliaria, tax ID (NIF) 73429392Y (the Data Controller or ACG Inmobiliaria). No data protection officer has been appointed, as none of the cases in article 37 GDPR or article 34 LOPDGDD applies; any privacy question may be sent to the following contact details:

Postal address: Pl. de España, Casco Antiguo, 50002 Zaragoza, Spain

Phone: +34 604 92 21 34

Email: [email protected]

Processing activities and source of the data

ACG Inmobiliaria keeps a record of processing activities under article 30 GDPR. The activities that affect Website users are: (1) handling valuation and contact requests; (2) client management and the provision of real estate agency services (sales and lettings), valuation and home staging; (3) commercial communications; (4) first-party audience measurement of the Website; (5) handling complaints and requests to exercise rights; and (6) compliance with anti-money laundering obligations.

The data is obtained directly from you through the forms, email, phone or WhatsApp. If you provide data relating to other people (for example, co-owners of the property), you undertake to have informed them beforehand of the content of this Policy and, where necessary, to have obtained their consent.

Principles applicable to processing

In accordance with article 5 GDPR, ACG Inmobiliaria processes your personal data in line with the following principles:

  • Lawfulness, fairness and transparency: we only process your data on a valid legal basis and inform you clearly before collecting it.
  • Purpose limitation: data is collected for specified, explicit and legitimate purposes and is not processed in a manner incompatible with them.
  • Data minimisation: we only ask for data that is adequate, relevant and strictly necessary for each purpose.
  • Accuracy: data is kept accurate and up to date; please tell us about any changes.
  • Storage limitation: data is kept only for the periods set out in this Policy.
  • Integrity and confidentiality: we apply technical and organisational measures that protect the data against unauthorised access, loss or destruction.
  • Accountability: ACG Inmobiliaria is responsible for, and able to demonstrate, compliance with these principles.

Categories of personal data

We process the following categories of data: (a) identification and contact data (first name, last name, email and phone number); (b) property data (address, location coordinates and the features you tell us about); (c) transaction data (price, financial terms and property documentation) if you hire our services; (d) the identification and documentary data required by Law 10/2010 in the transactions in which we take part; and (e) technical browsing data (page visited, source of the visit and browser type), only if you accept audience measurement. We do not process special categories of data within the meaning of article 9 GDPR; please do not send them to us.

Legal basis for processing

Consent (article 6(1)(a) GDPR): handling the valuation and contact requests you send through the form, sending commercial communications where you authorise it, audience measurement and loading third-party content that uses cookies (article 22.2 LSSI-CE). Consent is given by a clear affirmative action (an unticked box) and you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal (article 7(3) GDPR).

Performance of a contract or steps taken prior to entering into a contract (article 6(1)(b) GDPR): providing the real estate agency, valuation and home staging services you hire. Compliance with legal obligations (article 6(1)(c) GDPR): tax and accounting obligations, anti-money laundering obligations (Law 10/2010), consumer protection obligations and handling requests to exercise rights.

Legitimate interest (article 6(1)(f) GDPR): ensuring the security of the Website and preventing fraud and abuse (for example, limiting repeated form submissions); sending existing clients communications about our own services similar to those they hired, in accordance with article 21.2 LSSI-CE, with a simple, free opt-out in every message; and keeping the contact details of professionals and representatives of legal entities in accordance with article 19 LOPDGDD. We have assessed that these interests do not override your rights; you may request information on that balancing test and object at any time.

Purposes of processing

We process your data to: (a) handle your valuation or information request and contact you to answer it; (b) prepare and provide real estate agency, valuation and home staging services, including drawing up the listing agreement, publishing the property where you authorise it and managing viewings and negotiations; and (c) handle your enquiries, complaints and claims.

We also process your data to: (d) send you commercial communications about our services only if you have consented or, as a client, in accordance with article 21.2 LSSI-CE; (e) measure Website usage on a first-party and aggregated basis, only if you accept it in the cookie panel; (f) comply with the legal obligations that apply to us; and (g) ensure the security of the Website. We do not share or sell your data to third parties for advertising purposes.

We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (article 22 GDPR). Property valuations are prepared and reviewed by a person.

Retention periods

We keep data for the following periods: (a) valuation requests and contacts that do not become a listing agreement: up to twelve (12) months from the last contact, unless you request erasure earlier; (b) data processed for marketing purposes on the basis of consent: until you withdraw it; (c) client data: for the duration of the contractual relationship and, once it ends, blocked for the statutory limitation periods: four (4) years for tax obligations (articles 66 to 70 of the General Tax Law), six (6) years for commercial and accounting records (article 30 of the Commercial Code), five (5) years for personal actions without a specific period (article 1964 of the Civil Code) and ten (10) years for the due diligence records required by article 25 of Law 10/2010; (d) audience measurement data: a maximum of twenty-four (24) months; (e) requests to exercise rights and complaints: for the time needed to prove they were handled, up to a maximum of three (3) years.

Once the periods of use have expired, the data is blocked in accordance with article 32 LOPDGDD: it is identified and set aside, with technical and organisational measures that prevent its processing, including viewing, except to make it available to judges and courts, the Public Prosecutor or the competent public authorities (in particular, the Spanish Data Protection Agency and the Spanish Tax Agency) for possible liabilities. When the blocking period ends, the data is securely erased.

Recipients and international transfers

We do not disclose your data to third parties, except where required by law (the Spanish Tax Agency, the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences, courts or other competent authorities) or where necessary to carry out the transaction you entrust to us (for example, to the other party to the sale or lease, the notary or the institution formalising the transaction), and always only to the extent strictly necessary.

The following have access to the data as processors, under a contract in accordance with article 28 GDPR: (a) Render Services, Inc., which hosts the application server and the database in Frankfurt (Germany, European Union); (b) Cloudflare, Inc., which provides hosting and delivery of the Website through a global network, so international transfers are based on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914; (c) Resend, the transactional email delivery provider, whose servers are located in the United States (us-east-1 region), with the transfer based on the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023); (d) Google, the corporate email provider, also certified under that Framework; and (e) the OpenStreetMap Foundation, which provides the address geocoding service from the United Kingdom, a country with a European Commission adequacy decision renewed on 19 December 2025. You can request a copy of the applicable safeguards by writing to [email protected].

Data of minors

ACG Inmobiliaria's services are intended for adults with legal capacity to enter into contracts. Under article 7 LOPDGDD, only people over fourteen (14) may consent to the processing of their data; for younger children, the consent of the holder of parental authority or guardianship is required. If we find that we have received data from a minor without such authorisation, we will erase it without delay.

Security measures

In accordance with article 32 GDPR, we apply technical and organisational measures appropriate to the risk, including: HTTPS/TLS encryption of communications, encryption of the information the Website stores in your browser, access control to the management panel with personal credentials and authorisation profiles, automatic limits on repeated attempts and submissions, and regular backups.

People authorised to access the data are bound by the duty of confidentiality laid down in article 5 LOPDGDD, which continues even after their relationship with ACG Inmobiliaria ends.

In the event of a personal data breach, we will notify the Spanish Data Protection Agency without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of individuals (article 33 GDPR). Where it is likely to result in a high risk, we will also inform you without undue delay (article 34 GDPR).

No system connected to the internet is completely invulnerable. We recommend that you do not send sensitive information through insecure channels and that you report any incident you detect to us immediately. You are responsible for the accuracy of the data you provide.

Your rights and how to exercise them

You may exercise the following rights, free of charge and at any time, as recognised in articles 15 to 22 GDPR and 12 to 18 LOPDGDD:

  • Access (article 15 GDPR): to know whether we process your data and, if so, to obtain a copy of it and information about the purposes, recipients, retention period and source of the data.
  • Rectification (article 16 GDPR): to correct inaccurate data or complete incomplete data.
  • Erasure or "right to be forgotten" (article 17 GDPR): to have your data deleted when it is no longer necessary, you withdraw consent, you object to the processing or the processing is unlawful, unless we are required by law to keep it blocked.
  • Objection (article 21 GDPR): to object to processing based on legitimate interest on grounds relating to your particular situation and, in any case, to processing for direct marketing purposes.
  • Restriction of processing (article 18 GDPR): to ask us to suspend processing while the accuracy of the data or the grounds for your objection are verified, or to keep the data when you need it to establish, exercise or defend legal claims.
  • Portability (article 20 GDPR): to receive the data you have provided to us, processed by automated means on the basis of your consent or a contract, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
  • Not to be subject to individual automated decision-making, including profiling (article 22 GDPR), and to withdraw your consent at any time.

Procedure for exercising your rights:

  • Send your request by email or by post to the addresses below, stating the right you wish to exercise and, if possible, the reference "Data protection".
  • Identification: we will use the contact details already in our records to verify your identity. We will only ask for additional, proportionate information if we have reasonable doubts. If you act through a representative, the representation must be proven.
  • Response time: we will reply within one (1) month of receiving the request. That period may be extended by two (2) further months where necessary, taking into account the complexity and number of requests, in which case we will tell you about the extension and the reasons within the first month (article 12(3) GDPR).
  • Free of charge: exercising your rights is free. Only where requests are manifestly unfounded or excessive, in particular because of their repetitive character, may we charge a reasonable fee based on administrative costs or refuse to act, giving reasons (article 12(5) GDPR).
  • If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency, as explained below.

You can send your requests to:

Post: ACG Inmobiliaria (Data protection), Pl. de España, Casco Antiguo, 50002 Zaragoza, Spain

Email: [email protected]

Third-party links and services

The Website contains links to third-party sites and services (such as Google Maps, WhatsApp, Instagram, TikTok or Facebook) that are not operated by ACG Inmobiliaria. When you access them, their owners process your data as independent controllers under their own privacy and cookie policies, which we recommend you review. ACG Inmobiliaria is not responsible for that processing.

Complaints to the supervisory authority

If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, Spain; https://www.aepd.es; e-office: https://sedeagpd.gob.es) or with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement. We encourage you to contact us first so that we can try to resolve any issue quickly.

II. UPDATES AND VALIDITY OF THIS POLICY

Browsing the Website does not mean that you consent to the processing of your data. We only process it on the legal bases described in this Policy; where the basis is consent, we will ask for it expressly, separately and before the processing.

ACG Inmobiliaria may update this Policy to reflect changes in the law, guidance from the Spanish Data Protection Agency or new processing operations. We will always publish the current version on this page with its update date and, if the changes are substantial or require your consent, we will inform you by appropriate means before applying them.

Commercial communications: in accordance with article 21 LSSI-CE, every commercial communication we send you by electronic means will include a simple, free procedure to unsubscribe. You can also object at any time by writing to [email protected].

Last updated: 14 October 2026.