On this page
Courtesy translation. The binding text is the Spanish original, which prevails in the event of any discrepancy. Read the original in Spanish
In brief
First layer · the details, further below- Controller
- Dalyko Partners, S.L. — daly@icam.es
- What for
- To deal with your enquiry, open and handle your file, comply with tax, land registration and anti-money laundering obligations and, only if you agree, measure use of the site and send you commercial communications from QuickConvey, which begin once you confirm your email address.
- On what basis
- Your consent (for analytics and for commercial communications, which you can withdraw with one click); pre-contractual steps and performance of the contract; legal obligations; and legitimate interest.
- Who receives your data
- Where the service so requires, the AEAT (Spanish State Tax Administration Agency), the regional administration, the Registro de la Propiedad (Spanish Land Registry), the notary's office and, where applicable, the SEPBLAC (Spanish anti-money laundering financial intelligence unit). Your data are not sold or disclosed for advertising purposes. If you choose to use WhatsApp or to sign in with Google, those services process your identification data on their own account.
- Where your data are stored
- Our systems are in the European Union (Belgium and Madrid). There may be transfers to the United States through our providers' groups, with the safeguards explained below.
- Your rights
- Access, rectification, erasure, restriction, objection and portability, by writing to daly@icam.es, and lodging a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Authority).
Who processes your data
Dalyko Partners, S.L., NIF B21833264 (Spanish tax ID), Calle Navel 10, 03189 Orihuela (Alicante). Contact for data protection matters: daly@icam.es.
We have not appointed a Data Protection Officer because none of the cases set out in art. 37.1 GDPR applies. You may write to the address above with any question about your data.
What we process, for what purpose, and on what legal basis
Expand the situation that applies to you
If you only browse the site
If you accept analytics, we store a random identifier in your browser and record the pages you visit, together with your IP address (from which an approximate location can be inferred), the full identification of your browser (the string it sends with every request), your operating system, device type, language, the page you came from and the campaign parameters.
We also record how you interact with the page: which links and buttons you click, how far you scroll down each page, how long you stay on it, which forms you submit and which outbound links you open.
Legal basis: your consent (art. 6.1.a GDPR and art. 22.2 LSSI, the Spanish Information Society Services Act). You may withdraw it whenever you wish, and withdrawing it is as easy as giving it.
And this needs to be said plainly, because it is not obvious: that identifier is called anonymous but ceases to be so if you later identify yourself (through a form, by accessing the portal or through an access link). At that point your earlier browsing becomes linked to your name, retroactively as well. If you would rather this did not happen, do not accept analytics.
We do not use Google Analytics or any third-party analytics tool. The data are stored in our own database, hosted in the European Union, and are not disclosed to anyone.
If you calculate a price
The calculation is carried out in your own browser. As long as you only move the figure and choose a service, you send us nothing: not the amount, not your name, not your email address, not your telephone number. As with any visit, our server logs your IP address and your browser, for the security and traceability of the service (art. 6.1.f).
If you confirm the engagement
When you click “Hire us” you go to a page on this same site where you give us your first name and surname, your email address and your telephone number, together with the service and the property value you used in the calculation. With that we open your file and give you a reference number.
All four items are required: your name and telephone number, so that we can assist you; your email address, because that is the channel through which it is verified and through which you access your file. Not providing them has no consequence except one: we cannot open the file or send you the quote.
Before the form is sent, your browser solves a small calculation to curb the automated submission of forms. It does not use cookies, does not read anything from your device and cannot be used to identify or track you (art. 6.1.f). The form also contains a hidden field that a person neither sees nor fills in, and which only arrives with content when whoever submits the form is not a person.
Your email address is not verified merely by typing it in. If this is the first time you have written to us from that telephone number, or if that email address is the one we already had on record with it, we send you a message at that address with a link that expires after 24 hours and can be used only once. If not (we already had that telephone number on record with a different email address or with none, or we already had that address on record with a different telephone number), we do not write to the address you have just given us: we check the request ourselves before treating it as yours.
Until that address has been verified, what you have sent is an unverified request: we do not treat it as yours and we do not open access to your private area. It is verified in two ways, and both prove the same thing (that you receive the email sent to that address):
- by opening the link we send you, if we send you one, or
- by signing in with the Google account for that same address when you enter your private area.
In either case, from that point on we send you the details of your quote and you can access your file. What never happens is the reverse: without verification, nothing is opened.
That first email contains no figures and no property details, deliberately: if the address were not yours, whoever receives it learns nothing more than that someone used it.
Legal basis: pre-contractual steps taken at your request (art. 6.1.b), and our legitimate interest in checking that the address belongs to the person who claims it, so that we do not write to third parties or give access to anyone who should not have it (art. 6.1.f).
If you write to us on WhatsApp
WhatsApp is not part of the engagement process: it is a channel for enquiries, and whether or not you use it is your decision. The button opens a conversation in an app operated by Meta Platforms Ireland Ltd.
Meta does not process your data on our behalf: it processes them on its own account, under its own terms and its own policy, which we do not control. The content of your message and its metadata —your number, the time, the device— enter Meta's systems, which may involve transfers outside the European Economic Area with the safeguards that Meta states.
If you prefer to avoid this, write to us at daly@icam.es or use the engagement page: neither of them goes through Meta.
For our part, we process the content of what you write to us and your number in order to deal with your enquiry. Legal basis: pre-contractual steps taken at your request (art. 6.1.b) and, where the enquiry does not reach the pre-contractual stage, our legitimate interest in responding to those who write to us (art. 6.1.f).
If you access your private area
You sign in with the same email address you have just confirmed, and you choose how: with an access link that we send to that mailbox, or by signing in with your Google account. In neither case is there a password to remember, and neither of them creates a file: signing in only opens the one that is already yours.
If you sign in with Google, it is you who identify yourself to Google, not us. From Google we receive your email address (already verified by them, which is what saves us from asking you to confirm your mailbox again), your first name and your surname, and with that we fill in the gaps in your record: we never replace what you have already told us. Google processes that identification as an independent controller, not as our processor, and whatever happens within your account is governed by Google's policy. If you would rather not go that way, the email link remains an equivalent route.
We store the date of your last access and your session identifier in order to maintain the service and to be able to account for who saw what (art. 6.1.b and 6.1.f).
If you engage us
We process the data needed to provide the service: identification data, contact details, details of the property and of the transaction, the documents you provide to us and those we produce.
Legal basis: performance of the contract (art. 6.1.b) and our legal obligations (art. 6.1.c) in tax, land registration and anti-money laundering matters.
Where the service so requires, we disclose your data to: the Agencia Estatal de Administración Tributaria (AEAT, the Spanish State Tax Administration Agency), the regional administration competent for ITP (the Spanish property transfer tax), the Registro de la Propiedad (the Spanish Land Registry), the notary's office involved and, where applicable, the SEPBLAC (the Spanish anti-money laundering financial intelligence unit).
If you instruct us to make payments on your behalf or to change the holder of the utility contracts, we also disclose the necessary data to the bank holding the client account, to the administrations we pay on your behalf (the town hall, SUMA or another collection body) and, for the change of holder, to the water and electricity companies. We also process the number of the account you transfer from, in order to return the balance to you.
Identity verification and prevention of money laundering
Where the transaction is subject to Ley 10/2010 (the Spanish Act on the prevention of money laundering and terrorist financing), we are required to identify you and to retain the documentation. This is a legal obligation: we cannot provide the service without complying with it, and it does not depend on your consent (art. 6.1.c). Advice on the purchase and sale of real estate is expressly covered (art. 2.1.ñ of that Act).
What the law exempts, and it is worth stating precisely, because it is often summarised incorrectly: art. 22 of Ley 10/2010 releases us from three specific obligations —special examination, reporting on the basis of indications and refraining from carrying out the transaction— in respect of the information we receive from you when ascertaining your legal position or defending you in, or in relation to, judicial proceedings, including advice on instituting or avoiding them.
What that exception does not do is take us outside the law. Identification and the retention of documentation remain mandatory in those cases too.
Signing documents
To prove who signed and when, we store your email address, your name, the date and time, your IP address, your browser and a cryptographic hash of the document you signed.
If you sign with your finger or a stylus on the screen, we also store the path of your signature: its coordinates and the time of each point, so that it can be reproduced in the certificate.
We tell you exactly what we do and do not do with it, because it is the most sensitive thing we process:
- We do not store the pressure of your stroke, even if the device provides it. We discard it before anything is sent, which is why it never reaches our servers.
- We do not use your signature to identify you, nor do we compare it with other signatures or treat it as biometric data. It is kept as evidence of a specific act that you had already authenticated with a personal link and a confirmation code.
- We do not disclose it to anyone unless it forms part of the document that you yourself sign.
Legal basis: performance of the contract (art. 6.1.b) and our legitimate interest in being able to prove the engagement (art. 6.1.f), which is also yours.
Telephone verification and email confirmation
If we ask you to confirm your mobile number or your email address, we process that data item to check that the channel is yours. Codes and links expire automatically. Legal basis: performance of the contract or steps prior to entering into it (art. 6.1.b) and our legitimate interest in not writing to a third party (art. 6.1.f).
When the mobile number check is done via WhatsApp, the message goes through Meta on the terms described in the earlier section. If you prefer another route, let us know and we will find one.
If you ask us for commercial communications by email
Only if you ask for them will we send you commercial communications from QuickConvey by email: news about the service, changes to our fees, practical guides on the purchase and sale of property in Spain and its taxation —also for those who are not resident here— and offers of our own services. Never about third-party products or services. We write sparingly: as a guide, no more than two a month, in Spanish or in English.
You ask for them with a separate tick box, which appears unticked and has nothing to do with reading this policy: not ticking it changes nothing about the quote, the engagement or the service. And it applies only to QuickConvey: it does not authorise any other business to write to you, and that includes the other services of Dalyko Partners, S.L., which ask for it separately.
Ticking the box is not enough, and that is deliberate. Anyone can type someone else's address into a form, so your request remains pending until you prove that the mailbox is yours, in one of these two ways:
- by clicking the link in the confirmation email for your engagement, which in that case tells you so; or, if that email is not sent (for example, because you write to us without having calculated a quote), the link in a separate email that only asks you to confirm the commercial communications: it carries neither your name nor any advertising, and its link expires after 72 hours and can be used only once. Neither of them is sent if the address you typed is not the one we have on record with your telephone number, or
- by activating them yourself from your private area, which can only be accessed with that email address.
Until then we do not send you any commercial communication. If you never prove it, the request goes no further.
Once it has been verified, we record your sign-up: the date and time, the route (the website or your private area) and the version of this policy you had in front of you, with a cryptographic hash of its text, which we keep archived exactly as it was published. That is what allows us to demonstrate exactly what you consented to (art. 7.1 GDPR). If you do it from your private area, our audit log also stores the IP address and the browser from which you did so.
Legal basis: your consent (art. 6.1.a GDPR and art. 21 LSSI). We do not write to you for commercial purposes just because you are a client: the law would allow it in some cases (art. 21.2 LSSI), and we have decided not to do so.
To decide who each communication is of interest to, we use data we already hold about you: your language, your country and your nationality; whether you are an individual or a company and, if a company, its sector, its country and its size; your relationship with us (client, former client, collaborator, or whether you only asked for a quote) and how you came to us; when you last contacted us and which channel you usually use; when we sent you the last communication and whether you replied to it; and, from your files with QuickConvey, whether you are buying or selling, the service, the stage, your tax residence and the dates of the deed and of the signing. We do not use your browsing on this site. Each communication may include your first name and surname, the name of your company, your file reference, the address of the property or the date of the deed.
That is profiling within the meaning of the GDPR (art. 4.4), and we call it by that name. It is simple: it is done by rules that we write ourselves, without artificial intelligence, and each mailing is recorded with the reasons why it reached you. It is used only to choose which commercial communications we send you, it is carried out only while you maintain your consent and it has no effect whatsoever on your file, the price or the service. Objecting to it is as simple as unsubscribing (art. 21.2 GDPR).
We do not know whether you open our emails or which links you click. They carry no tracking pixel, the links go where they say without passing through any redirect service, and open and click tracking is switched off. For each mailing we record only when it went out, whether our email provider informs us that it was delivered, bounced or was marked as spam, whether you replied, and a copy of what we sent you, which is internal: it does not appear in your private area.
Unsubscribing is as easy as signing up, or easier (art. 7.3 GDPR and art. 22.1 LSSI), and you can do it:
- using the “Unsubscribe in one click” link at the foot of every communication, which opens a page with a single button (opening the link does not unsubscribe you by itself, so that it is not triggered by the program that checks the links in your email);
- using the unsubscribe option that your own email program shows next to the sender, where it offers one;
- from your private area;
- or by writing to daly@icam.es, including by replying to any of those communications.
Unsubscribing does not affect the emails about your file, which you will continue to receive for as long as the service requires them, and we will not ask you for any explanation.
When you unsubscribe, we add your address to QuickConvey's suppression list, so that we do not write to you again even if the address reaches us again through another route. We keep only the address, the reason and the date. Legal basis: the processing that the law permits precisely in order to respect your refusal (art. 23.1 LOPDGDD, the Spanish Data Protection and Digital Rights Act). If you later ask for the communications again and prove it, we remove the address from that list. If a mailing bounces or we are aware that you marked it as spam, we also set the address aside, on the basis of our legitimate interest in not writing to a mailbox that does not exist or does not want our emails (art. 6.1.f); in that case we remove it from the list only if you ask us to.
The emails are sent through the Google infrastructure described in “Who else processes your data”, under the QuickConvey name; if we ever use SendGrid for these mailings, open and click tracking will likewise be switched off. No one else receives your address or your data for this purpose.
Security of the service and technical logs
Like any Internet service, our servers keep a technical log of every request: the date and time, the originating IP address, the address requested, the browser and the result. It is used to maintain the service, detect abuse and limit automated submissions.
Legal basis: our legitimate interest in network and information security (art. 6.1.f and recital 49 GDPR). These logs are not used for analytics or to profile anyone.
If you are the other party to a transaction and not our client
We may process your data even though you have not engaged us: in a purchase and sale we need the data of the seller or of the buyer in order to comply with the tax and land registration obligations of the transaction.
In that case we have obtained them from our client or from the notary's office involved, we process only identification data and transaction data, and the legal basis is compliance with legal obligations (art. 6.1.c) and the legitimate interest in carrying out the engagement (art. 6.1.f). You have exactly the same rights as described below, and you may exercise them by writing to daly@icam.es.
How long we keep your data
| What | How long | Why |
|---|---|---|
| Identification documentation (anti-money laundering) | 10 years from the end of the business relationship or the transaction | art. 25.1 Ley 10/2010 |
| Invoicing and accounting | 6 years from the last entry | art. 30 Código de Comercio (Spanish Commercial Code) |
| Ledger of money on account, and its receipts | 6 years from the last entry | art. 30 Código de Comercio (Spanish Commercial Code) |
| Tax documentation | 4 years from the end of the filing period | arts. 66 and 67 LGT (Ley General Tributaria, the Spanish General Taxation Act) |
| Case file | 5 years from its conclusion | art. 1964.2 CC (Código Civil, the Spanish Civil Code) |
| Request submitted with the address not verified —neither by the link nor by Google— | 6 months from submission, after which it is deleted | storage limitation (art. 5.1.e GDPR) |
| Enquiry or quote that does not lead to an engagement | 1 year from the last contact | storage limitation (art. 5.1.e GDPR) |
| Web analytics data | for as long as you maintain your consent, and for a maximum of 14 months | storage limitation (art. 5.1.e GDPR) |
| Proof of your consent to commercial communications —sign-ups, unsubscriptions, policy version— and a record of each mailing | for as long as you maintain it and, after you unsubscribe, 3 years, blocked | proving consent for as long as liability may still be enforced (arts. 72.1 LOPDGDD and 45 LSSI) |
| Suppression list for commercial communications | for as long as needed to respect your unsubscription; removed if you ask for them again | art. 23.1 LOPDGDD |
| Technical security logs | 90 days | security of the service |
From the fifth year onwards, the anti-money laundering documentation is blocked: only internal control and whoever conducts our legal defence may access it (art. 25.1 Ley 10/2010). Once the periods have expired, we delete or anonymise the data.
The proof of your consent to commercial communications is also blocked after you unsubscribe: it is not used to write to you, only to prove to an authority or a judge that, when we wrote to you, you had asked for it (art. 32 LOPDGDD).
And one thing that does not expire: professional secrecy does not end when the retention period ends or when the matter ends. The fact that we must delete a piece of data does not entitle us to disclose it beforehand.
Who else processes your data
Google Ireland Ltd., as processor, provides the infrastructure on which our systems run and where documents are kept: servers and database in the European Union (Belgium and Madrid), document storage in Google Drive, authentication for the private area and the delivery of the emails we send you.
Twilio Ireland Ltd. (SendGrid), as processor, solely as an alternative email delivery route when the former is unavailable.
Google Ireland Ltd., additionally and in a different role, only if you choose to access your private area with your Google account: it processes that identification as an independent controller, not as our processor.
Meta Platforms Ireland Ltd., only if you choose to write to us on WhatsApp, and as an independent controller, not as our processor.
No one else. We do not sell data, we do not disclose them for advertising purposes and we do not take automated decisions producing legal effects concerning you or similarly affecting you. The only profiling we carry out is for commercial communications, only if you ask for them, and it is explained above. We have signed the contract required by art. 28 GDPR with all our processors.
If your data leave Europe
Our systems and their database are in the European Union. The processors mentioned are European companies, but they belong to groups whose parent company is in the United States, so there may be transfers to that country, covered by the EU-US adequacy framework and, in the alternative, by the standard contractual clauses approved by the European Commission. You may ask us for a copy of the safeguards by writing to daly@icam.es.
If you write to us on WhatsApp, any transfers made by Meta are governed by its own terms, which we do not control.
How we protect your data
We apply the technical and organisational measures of art. 32 GDPR: encryption in transit and at rest, access control per person and per project, logging of who accesses what, backups and periodic review. Should a security breach ever occur that poses a risk to your rights, we will notify you on the terms of art. 34 GDPR.
Your rights
You may request access to your data, and ask us to rectify them, erase them, restrict their processing or object to it, and to receive them in a portable format. Where processing is based on your consent, you may withdraw it at any time, without affecting the processing carried out before.
And one right that admits no exceptions: you may object at any time to receiving commercial communications, including the profiling we carry out for them, and we will stop processing your data for that purpose (art. 21.2 and 21.3 GDPR). Unsubscribing by any of the routes described above is enough.
Write to daly@icam.es. We will reply within one month, which we may extend by two further months if the request is complex, informing you of this within that first month (art. 12.3 GDPR). Exercising your rights is free of charge.
Some rights are subject to limits imposed on us by law: we cannot erase documentation that we are legally required to retain —anti-money laundering, tax and accounting documentation— while its retention period is running, nor documentation protected by professional secrecy vis-à-vis third parties.
If you consider that we have not dealt with your request properly, you may lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Authority; C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), and you may also contact us first.
Changes
If we change this policy substantially, we will indicate this on the site and, where the change affects processing based on your consent, we will ask for your consent again.
The four policies on this site share the same version, which is the one archived when you give your consent. The version changes only when the substance changes (a new purpose, a new recipient, a different retention period or a different legal basis); correcting a typo does not create a new version.