Privacy Policy of the Vertuom Platform

Last Updated: July 31, 2025

Preamble

This Privacy Policy describes in a detailed and exhaustive manner how VERTUOM S.L. (hereinafter "we", "our" or "the Operator"), a limited liability company under Spanish law, registered with the Commercial and Companies Registry of Malaga under the number NIF: B70963830, with its registered office located at Centro Comercial Valdepinos 4b, Calypso, Calahonda, 29649, Marbella, Spain, collects, uses, protects, stores, shares and processes your personal data when you access or use our platform (hereinafter "the Platform"), accessible via the website https://www.vertuom.com and associated mobile applications.

The Platform is dedicated to the purchase and sale of exceptional real estate properties in Marbella and its surroundings. It offers innovative services such as connecting buyers and sellers, exclusive and off-market investment opportunities, immersive virtual tours, an intuitive application ensuring full transaction transparency, and flexible payment options including cryptocurrencies (such as Bitcoin, USDC, etc.). We are firmly committed to protecting your privacy and processing your personal data with the highest level of security and transparency, in strict compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679, Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD) in Spain, as well as any other applicable data protection legislation.

By using the Platform, you explicitly consent to the processing of your personal data as described in this Policy. This consent is free, informed, specific and unambiguous. If you do not accept these terms, please do not use the Platform or provide any personal data. We apply the principle of data minimization, collecting only the information strictly necessary for the purposes described below, and we ensure that all processing is proportionate and justified.

We reserve the right to modify this Policy at any time to reflect changes in our practices, technologies or legal requirements. Modifications will be published on the Platform and will take effect immediately. We will notify you of significant changes by email (if you have provided an address) or via a visible notification on the Platform. Your continued use of the Platform after any modification constitutes acceptance of the new terms. It is your responsibility to regularly review this Policy to stay informed.

Article 1: Data Controller

VERTUOM S.L. is the data controller of your personal data within the meaning of the GDPR. This means that we determine the purposes and means of the processing. We have appointed a data protection officer (DPO) to oversee compliance. For any questions, requests or concerns regarding this Policy, your personal data or our processing practices, please contact us at:

Postal Address: Centro Comercial Valdepinos 4b, Calypso, Calahonda, 29649, Marbella, Spain
Email: contact@vertuom.com (preferred for GDPR requests)
Phone: +34 722 16 30 80

We will respond to your requests within the timeframes provided by the GDPR (generally one month, extendable to two months for complex cases).

Article 2: Data Collected

We collect only the data necessary and proportionate to the stated purposes. The categories of personal data processed include:

2.1. Identification and Contact Data : Name, first name, email address, phone number, postal address, date of birth (if necessary to verify age), and any other information you voluntarily provide when creating an account, subscribing to a newsletter, or during a real estate transaction.

2.2. Financial and Transactional Data : Payment details such as credit card numbers (processed securely via PCI-DSS certified third-party providers), banking information for transfers, or cryptocurrency wallet details (such as Bitcoin or USDC addresses). This data is pseudonymized or encrypted as soon as possible.

2.3. Usage and Technical Data : Automated information about your interaction with the Platform, including IP addresses, device identifiers (such as UUID), browser and operating system type, pages visited, time spent on each page, clicks, scrolls, and navigation data. This data is collected via cookies, pixels, web beacons and similar technologies to analyze behaviors and improve the user experience.

2.4. Location Data : Approximate location derived from the IP address or provided voluntarily (for example, for localized real estate searches in Marbella or surrounding areas like Elviria, Nueva Andalucia). We do not collect precise location data without explicit consent.

2.5. Marketing and Preference Data : Communication preferences (e.g., types of properties of interest), browsing history for personalized recommendations, and specific consents to receive promotional offers or newsletters.

2.6. Sensitive Data : We do not intentionally collect sensitive data (such as racial origins, political opinions, health data) unless strictly necessary for a transaction (e.g., accessibility for disabilities) and with your explicit consent.

This data is collected directly from you (via forms, registrations, interactions), automatically when using the Platform, or via authorized third parties (e.g., real estate partners with your agreement). We apply the minimization principle: only essential data is collected, and we anonymize or pseudonymize as soon as possible to reduce risks.

Article 3: Purposes of Processing

Your personal data is processed for legitimate, explicit and limited purposes, in compliance with the GDPR's purpose limitation principle. The main purposes include:

Providing, operating and maintaining the Platform's Services, including connecting buyers and sellers, managing user accounts, organizing virtual or physical tours, and facilitating secure real estate transactions.
Improving the quality and performance of the Platform, analyzing usage trends, detecting fraud or abuse, and personalizing the user experience (e.g., property suggestions based on your past searches).
Managing targeted advertising and measuring its effectiveness via Google Ads and Meta Ads, using pseudonymized data to display relevant ads on exceptional real estate properties.
Analyzing traffic and user behaviors via Google Analytics GA4 to optimize the site, identify areas for improvement, and generate aggregated reports (without individual identification).
Managing cookie consents and tracking technologies via Cookiesyes, ensuring dynamic and documented compliance.
Complying with legal and regulatory obligations, such as retention for accounting purposes, anti-money laundering prevention, or tax declarations related to real estate transactions in Spain.
Sending direct marketing communications (newsletters, exclusive offers) only with your prior consent, and allowing you to unsubscribe easily at any time.
Hosting and securing data via Scalahosting, ensuring high availability and protection against threats.
Performing anonymized statistical analyses for internal research or reports on the real estate market in Marbella.

We do not process your data for incompatible purposes without obtaining new consent. Any automated processing (e.g., profiling for recommendations) is transparent and subject to your objection.

Article 4: Legal Bases for Processing

Each processing is based on a solid legal basis in accordance with Article 6 of the GDPR:

Consent** (Art. 6(1)(a)): For non-essential cookies, direct marketing, personalized advertising via Google Ads/Meta Ads, and any optional processing. Consent is granular, revocable at any time without retroactive effect, and documented via Cookiesyes.
Performance of a Contract (Art. 6(1)(b)): To manage real estate transactions, create accounts, and provide requested Services (e.g., virtual tours).
Legitimate Interests (Art. 6(1)(f)): To improve the Platform, prevent fraud, analyze usage via GA4 (with balancing of interests: your rights take precedence), and secure data. We have conducted a legitimate interests assessment (LIA) available upon request.
Legal Obligations** (Art. 6(1)(c)): To comply with Spanish and European laws (e.g., tax retention for 6 years).
Vital Interests (Art. 6(1)(d)): Rarely, to protect your interests in emergencies (e.g., security alert).

For sensitive data (if applicable), we rely on explicit consent (Art. 9(2)(a)). We do not use automated decisions producing legal effects without human intervention.

Article 5: Recipients and Data Sharing

Your data is shared in a limited and secure manner with:

5.1. Internal : Our employees, agents and subcontractors (e.g., marketing team, IT), strictly within the scope of their duties and under confidentiality agreements.

5.2. Third-Party Processors :

Scalahosting : For site and data hosting, with servers potentially in Europe or the United States. We select European data centers where possible to minimize transfers, and apply standard contractual clauses (SCC) for any transferred data.
Analytics Services : Google Analytics GA4 (Google Ireland Limited) for traffic analysis. Shared data: pseudonymized usage data (e.g., anonymized IP). We use GA4's EU-focused features to process data in the EU before any sending, and implement Consent Mode v2 to respect your choices.
Advertising Services : Google Ads (Google Ireland Limited) and Meta Ads (Meta Platforms Ireland Limited) for targeted ads. Shared data: pseudonymized identifiers, browsing behaviors. We require explicit consent via Cookiesyes before any tracking, and comply with Google/Meta guidelines (e.g., no personalization without agreement, use of pixels with consent).
Consent Management : Cookiesyes to store and manage your cookie preferences, collecting technical data (e.g., consent timestamp) to ensure traceability and compliance.
Other Third Parties : Payment processors (e.g., Stripe for cards, or crypto platforms), notaries for real estate transactions, or marketing partners, all under data processing agreements (DPA) compliant with the GDPR. A complete list is available upon request.

We do not sell, rent or transfer your data to third parties for their own purposes without consent. All recipients are bound by strict obligations of confidentiality, security and GDPR compliance, with regular audits. In the event of a merger or acquisition, we will inform you in advance.

Article 6: Cookies and Tracking Technologies

We use cookies, pixels, beacons and similar technologies to enhance the experience, analyze usage and deliver targeted advertising, in full compliance with the ePrivacy Directive and the GDPR.

Essential Cookies : Necessary for basic operation (e.g., session maintenance, security). Legal basis: legitimate interest; no consent required.
Analytics Cookies : Google Analytics GA4 to measure audience, traffic and conversions. Collected data: aggregated and pseudonymized. We anonymize IPs and limit retention to a maximum of 14 months.
Advertising Cookies : Google Ads and Meta Ads for personalized ads (e.g., remarketing on viewed properties). Data: pseudonymized behaviors; implementation via pixels with Consent Mode v2 to block tracking without agreement.
Functional Cookies : To personalize the interface (e.g., language preferences).
Consent Management : Via Cookiesyes, a banner appears on your first visit to obtain granular and informed consent (e.g., "Accept All", "Reject", "Customize" buttons). You can revoke or modify your choices at any time via the "Cookie Management" link in the footer. We respect "Do Not Track" signals and do not use cookies without valid consent. For more details, consult our dedicated Cookie Policy, integrated into this Policy. In accordance with Google and Meta guidelines, we do not share personal data without consent and use tools like Consent Mode to adjust tag behavior.

Article 7: Retention Period

We retain your data for the time strictly necessary for the purposes, applying the storage limitation principle:

Account and transactional data: As long as your account is active, plus 5 years for legal obligations (e.g., tax proofs) or until the end of real estate warranties.
Usage and analytics data: Maximum 26 months for Google Analytics GA4; then anonymized.
Marketing data: Until consent withdrawal or 3 years of inactivity.
Security logs: 1 year to detect threats.
Consents: Retained as proof for 5 years.

Upon expiration, data is deleted or irreversibly anonymized. We conduct periodic reviews to purge obsolete data.

Article 8: Your Rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights, exercised free of charge and without excessive justification:

Access : Obtain confirmation of processing and a copy of your data (in a structured format if possible).
Rectification : Correct inaccurate or incomplete data.
Erasure ("right to be forgotten"): Request deletion if the data is no longer necessary, if you withdraw consent, or in case of valid objection.
Objection : Object to processing based on legitimate interests (e.g., marketing) for reasons related to your situation; we will stop unless compelling reasons apply.
Restriction : Restrict processing during verification of a challenge.
Portability : Receive your data in a machine-readable format and transfer it to another controller.
Consent Withdrawal : At any time, without affecting the lawfulness of prior processing (e.g., via Cookiesyes for cookies).
Post-Mortem Directives : Define the fate of your data after death.

To exercise these rights, contact us at contact@vertuom.com with proof of identity. We will respond within one month (extendable). If dissatisfied, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es, or the authority in your country of residence.

Article 9: Data Security

The security of your data is paramount. We implement appropriate technical and organizational measures, adapted to the risks, to protect against loss, alteration, disclosure or unauthorized access:

Encryption of data in transit (HTTPS/TLS) and at rest (AES-256).
Restricted access via multi-factor authentication (MFA) and "need-to-know" principle.
Regular audits, penetration testing, and staff training on cybersecurity.
Secure backups and business continuity plans.
Compliance with standards such as ISO 27001 (certification in progress).

Despite these measures, no internet transmission is infallible. In the event of a data breach with high risk to your rights, we will notify the AEPD within 72 hours and inform you without undue delay, with details on the incident, consequences and corrective measures.

Article 10: International Transfers

Your data is primarily processed in Spain and the EU/EEA. However, certain third parties (e.g., Google, Meta, Scalahosting if US data centers) involve transfers outside the EEA to countries without an adequacy decision (e.g., United States). We ensure an equivalent level of protection via:

Standard contractual clauses (SCC) approved by the European Commission.
Transfer impact assessments (TIA) to identify and mitigate risks.
Additional measures such as encryption and pseudonymization.

For example, for Google and Meta, we use their DPAs including SCC, and select EU-based configurations where available. No data is transferred without these safeguards. A copy of the SCC is available upon request.

Article 11: Children

The Platform is not intended for minors under 18 years of age. We do not knowingly collect their personal data. If we discover such collection, we delete the data immediately. Parents or guardians may contact us with any concerns.

Article 12: Third-Party Links

The Platform may contain links to third-party sites or services (e.g., partner real estate portals). We do not control their practices and are not responsible for their privacy. Review their policies before interacting. Any integration (e.g., social buttons) is subject to your consent via Cookiesyes.

Article 13: Complaints and Supervisory Authority

If you believe we are not respecting your rights or the GDPR, you may file a complaint with us first for an amicable resolution. If not satisfactory, contact the Spanish Data Protection Agency (AEPD) at www.aepd.es, or the data protection authority in your country of residence. We cooperate fully with authorities and document all complaints for continuous improvement.

Article 14: Modifications and Acceptance

This Policy may be modified to adapt to legal, technological or operational developments. We will notify substantial changes (e.g., new purposes) by email or notification on the Platform at least 30 days in advance, allowing you to exercise your rights (e.g., objection). Minor modifications take effect immediately.

By continuing to use the Platform after publication, you confirm that you have read, understood and accepted this Policy in its entirety. If you have any questions, contact us at the provided details.

By using the Platform, you confirm that you have read and accepted this Privacy Policy.

Last Updated: July 31, 2025