Privacy policy for Referrers
This policy explains how we process your personal data as a Referrer registered in the ONLY Apartments Referrers App.
1. Data controller
ONLY APARTMENTS REAL ESTATE S.L. Spanish tax ID B26926378 Carrer de Monsenyor Palmer 1, 07014 Palma de Mallorca, Spain Email: info@onlyapartmentsre.com
2. What data do we process?
- Identifying data: first name, surname, tax ID, trade name (if any).
- Contact data: postal address, email, phone number.
- Tax data: IAE category, IAE section, tax regime (self-employed, S.L., etc.).
- Bank data: IBAN for commission payments.
- App activity data: leads submitted, leads activated, accrued commissions, date and version of the accepted contract, IP address at the moment of acceptance.
- Data derived from use: registration date, frequency of use, lead conversion.
3. What do we process your data for?
| Purpose | Legal basis |
|---|---|
| Performance of the Referrer Agreement | Art. 6.1.b GDPR (contract performance) |
| Issuing and receiving invoices, payment processing | Art. 6.1.b GDPR (contract performance) |
| Compliance with tax obligations (IVA, IRPF, forms 111, 190, 347) | Art. 6.1.c GDPR (legal obligation) |
| Compliance with anti-money laundering obligations (Law 10/2010) | Art. 6.1.c GDPR (legal obligation) |
| Communication about leads, commissions, contract changes | Art. 6.1.b GDPR |
| Improving App functionality (aggregated analytics) | Art. 6.1.f GDPR (legitimate interest) |
4. How long do we store your data?
- Contractual and tax data: 6 years from the end of the relationship, per article 30 of the Spanish Commercial Code and tax law.
- Anti-money laundering data: 10 years from the end of the relationship, per article 25 of Law 10/2010.
- App activity data not required for legal obligations: 2 years from last activity.
- Audit log of contract acceptance: throughout the life of the contract and 6 years after.
5. Who do we share your data with?
- Tax advisor Emprendix, for accounting and tax management (processor, processor agreement under Art. 28 GDPR).
- Spanish Tax Agency (AEAT), in compliance with tax obligations (forms 111, 190, 347, 303, 200).
- SEPBLAC, in case of mandatory anti-money laundering reporting.
- Bank, to make commission transfers.
- App technical providers: Supabase (database hosting, EU servers), Vercel (web hosting, EU servers), Twilio (WhatsApp/SMS delivery, data in EU/US under standard contractual clauses).
We do not sell your data. We do not share it for third-party marketing.
6. International transfers
Some technical providers may have part of their infrastructure outside the European Economic Area (e.g. Twilio in the US). In those cases, transfers rely on standard contractual clauses approved by the European Commission (Art. 46.2.c GDPR).
7. Your rights
You may at any time exercise:
- Access to your data,
- Rectification if it is wrong,
- Erasure ("right to be forgotten"), with the legal limits applicable to tax and AML data,
- Restriction of processing,
- Portability of data,
- Objection to processing based on legitimate interest,
- Withdrawal of consent (where applicable),
- Complaint to the Spanish Data Protection Agency (www.aepd.es).
To exercise them, write to info@onlyapartmentsre.com indicating your name, tax ID and the right exercised. We will reply within the legal period of one month.
8. Automated decisions
The automatic activation or rejection of a lead based on the owner's YES/NO reply does not constitute an automated decision about you within the meaning of Art. 22 GDPR, as the decision is made by the owner, not by an algorithm. Commission calculation is automatic but follows fixed contractual formulas, not profiling.
9. Origin of your data
All your personal data is provided directly by you when registering and using the App.
10. Changes to this policy
If we modify this policy, we will notify you via the App and by email at least 15 days in advance, indicating the changes.
Version: 1.0 Last updated: June 2026