Privacy Policy
At Mapasubastas SL (hereinafter, "MapaSubastas" or "the Controller"), we are committed to protecting the privacy of our users. This Privacy Policy describes how we collect, use, retain and protect personal data, in compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
This Policy is addressed to users of the platform and the website. In addition, section 5 provides information to individuals who are not users but who appear in the documentation of the public auctions we analyse.
1. Data Controller
Company name: Mapasubastas SL
Tax ID (CIF): B56268931
Registered address: Calle Astronomía, 1, Esc. 2, Planta 9, Puerta 6, C.P. 41015 – Sevilla, Spain.
Contact email: [email protected]
Data protection contact: [email protected]
MapaSubastas is not required to appoint a Data Protection Officer (DPO) pursuant to Article 37 of the GDPR. However, you may direct any enquiry related to the processing of your personal data to the email address indicated above.
2. Data We Collect
The personal data we collect includes:
- Identification and contact data: first and last name, email address, telephone number (when requesting a service, booking an appointment or signing a confidentiality agreement) and company (optional).
- Access and authentication data: login credentials, access logs.
- Preference and usage data: user settings, favourite auctions, saved alerts and areas, personal notes and searches carried out within the platform.
- Browsing data: IP address, browser type, pages visited, time spent, and data collected through cookies and similar technologies.
- Application usage data: actions the user performs with their account within the platform (pages and listings viewed, filters applied, reports requested, features not included in their plan that they attempt to use), linked to their user identifier and plan. This data does not include the IP address or device data, and is not obtained through cookies or third parties.
- Location data: device location, only if the user authorises it in their browser, in order to centre the map on their position. It is not stored.
- Billing data: information necessary for payment and subscription management (processed through Stripe).
- Identity verification and investor profile data (only for those who access assignment transfers (cesiones de remate) or investment opportunities, or who submit offers): identity document (DNI/NIE), address, marital status and matrimonial property regime, details of the company represented where applicable, IBAN and bank account ownership certificate, as well as the data relating to the electronic signature of the confidentiality agreement (mobile telephone number, IP address, date and time of signature).
- TOPsubastas academy student status: an indicator of whether the user is a student of the academy, obtained as described in section 6, in order to apply the discounts and special conditions available to students.
3. Purpose and Legal Basis for Processing
In accordance with Article 6 of the GDPR, the data collected is processed for the following purposes, with their corresponding legal basis:
| Purpose | Legal Basis |
|---|---|
| Management of the user account and access to the platform | Performance of a contract (Art. 6(1)(b) GDPR) |
| Provision of the contracted service and subscription management | Performance of a contract (Art. 6(1)(b) GDPR) |
| Sending service-related communications (notices, incidents, changes) | Performance of a contract (Art. 6(1)(b) GDPR) |
| Handling requests for services, consultancy, mentoring and appointment booking | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) |
| Checking TOPsubastas academy student status in order to apply the discounts and special conditions available to students (see section 6) | At the user's request: pre-contractual measures (Art. 6(1)(b) GDPR). Periodic matching using pseudonymised identifiers: legitimate interest of the controller and the user (Art. 6(1)(f) GDPR) |
| Electronic signature of confidentiality agreements, identity verification and processing of offers on assignment transfers or investment opportunities | Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) |
| Personalisation of the user experience | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Sending commercial and promotional communications | Consent of the data subject (Art. 6(1)(a) GDPR) |
| Platform security and fraud prevention | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Compliance with legal, tax and regulatory obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Statistical analysis and service improvement: measurement of how registered users use the application (usage data described in section 2) and cookieless measurement of website audience | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Analysis of public auction documentation, which includes data of non-users (see section 5) | Legitimate interest of the controller and its users (Art. 6(1)(f) GDPR) |
Where the legal basis is consent, the user may withdraw it at any time without affecting the lawfulness of processing carried out prior to such withdrawal.
4. Data Retention
Personal data will be retained for the periods necessary to fulfil the purpose for which it was collected and to address any liabilities arising from the processing:
- Account and profile data: for the duration of the contractual relationship. After account closure, data will be retained in a blocked state for the statutory limitation period (3 years, pursuant to Art. 1964 of the Spanish Civil Code).
- Billing data: 5 years from the last transaction, in compliance with Art. 30 of the Spanish Commercial Code and the General Tax Law.
- Browsing data and cookies: a maximum of 13 months, in accordance with the guidelines of the Spanish Data Protection Agency (AEPD).
- Application usage data: 90 days linked to the user identifier; thereafter only daily aggregated statistics that do not identify anyone are kept. Deleted when the account is closed.
- Data processed on the basis of consent: until the user withdraws their consent.
- Identity verification documentation and signed confidentiality agreements: for the duration of the relationship and, thereafter, for the limitation period of any legal actions that may arise. The user may request earlier erasure.
- Third-party data from the Auction Portal: as set out in section 5.
Once the indicated periods have elapsed, data will be deleted or irreversibly anonymised.
5. Third-Party Data from the Auction Portal
In addition to the data of its users, MapaSubastas processes personal data of individuals who are not users of the platform and who appear in the documentation of public auctions: judgment debtors, debtors, registered owners and creditors.
Source of the data. The data comes from the Auction Portal of the Spanish State Agency for the Official State Gazette (Portal de Subastas de la Agencia Estatal Boletín Oficial del Estado): notices and edicts, and the documentation associated with each auction, such as the certificate of charges, including documentation accessible to registered users of the Portal. For the assignment transfers (cesiones de remate) that we market, the data also comes from the documentation provided by the foreclosing entity or its servicer. In addition, users may provide their own documentation on an auctioned property (such as a land registry extract or a certificate of charges) for analysis.
Categories of data. Identification data (first and last name or company name), data on the enforcement proceedings, amount claimed, charges and encumbrances affecting the property, and data on the property itself.
Purposes.
- To produce legal and economic risk analyses of auctioned properties, such as the breakdown of charges, for users of the platform.
- To market assignment transfers on behalf of the foreclosing entities.
Legal basis. Legitimate interest of MapaSubastas and its users in knowing the legal status of auctioned properties, which contributes to transparency and competition in public auctions (Art. 6(1)(f) GDPR). MapaSubastas has carried out a balancing test of this interest against the rights of the data subjects, which may be requested at [email protected].
Safeguards applied.
- The identification data of natural persons is removed by automated means before any information is shown to users and is replaced with generic references. Auction listings contain information about the property, not about individuals. Creditors are only identified where they are legal entities or public bodies (for example, financial institutions or public administrations).
- Certificates of charges and other original documentation of the Portal's auctions are not made available for download.
- Auction listings are not indexed by search engines.
- The full analysis of charges is only accessible to registered users. Without registration, only general indicators about the property are shown (for example, a risk level or the number of charges), with no identification data.
- Documentation on assignment transfers is only shared, with personal data removed, with interested parties who have previously signed a confidentiality agreement.
- The analysis is carried out using artificial intelligence systems hosted on AWS infrastructure within the European Union. No decisions are made about the individuals concerned.
Recipients. Users only access derived information, with no identification data. Data processors are listed in section 6.
Retention. Original documents are retained while the auction is active and for the 12 months following its conclusion, and are then deleted. For concluded auctions, only information about the property and of an economic nature is retained, with no identification data of natural persons, for 10 years for the purposes of historical market analysis.
Rights. The individuals concerned may exercise their rights of access, rectification, erasure, restriction and, in particular, objection (Art. 21 GDPR) by writing to [email protected]. Objections will be handled by erasing the data of the person making the request unless there are compelling legitimate grounds. If, despite the safeguards described, an individual finds personal data relating to them on the platform, they may report it to the same address and it will be removed without delay. They also have the right to lodge a complaint with the supervisory authority (section 10).
This information is published pursuant to Art. 14(5)(b) GDPR, given that informing each individual concerned would prove impossible or would involve a disproportionate effort.
6. Disclosure of Data to Third Parties
MapaSubastas may disclose personal data to the following recipients, always with appropriate safeguards:
- Technology service providers acting as data processors. These providers only process data in accordance with our instructions and under data processing agreements:
- Amazon Web Services – AWS: infrastructure and hosting, document storage, transactional email delivery (SES), text extraction from documents (Textract) and artificial intelligence models for document analysis (Bedrock). European Union regions.
- Google LLC: Firebase (user authentication and database of accounts and preferences), Google Analytics (web analytics) and Google Maps and Street View (mapping and street-level imagery).
- Stripe Inc.: payment processing and subscription management.
- Sendinblue SAS – Brevo: delivery of commercial communications and newsletters by email. France, EU.
- Tecalis: electronic signature of confidentiality agreements and delivery of verification codes by SMS. Spain, EU.
- Mapbox Inc.: base mapping. United States.
- Calendly LLC: appointment booking. United States.
- Cloudflare, Inc.: content delivery network, protection against attacks and cookieless website audience measurement that does not identify visitors (Cloudflare Web Analytics). United States.
- TOPsubastas academy: when the user asks to verify their student status in order to access special conditions, their email address is disclosed to the academy for the sole purpose of carrying out that check. MapaSubastas and the academy may also periodically match their records to identify students who are already registered on the platform.
- Public authorities and competent bodies where a legal obligation exists.
- Third parties with the user's consent, in cases where the user has given their explicit consent.
MapaSubastas does not sell, rent or transfer personal data to third parties for commercial purposes.
7. International Data Transfers
Some of the service providers referred to in the previous section are located in the United States, which involves international data transfers outside the European Economic Area (EEA). These transfers are carried out with the following safeguards:
- Google LLC (Firebase, Google Analytics, Google Maps): participant in the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023).
- Stripe Inc.: participant in the EU-US Data Privacy Framework and subject to Standard Contractual Clauses (SCCs) approved by the European Commission.
- Amazon Web Services (AWS): data is hosted and processed in AWS data centres located within the European Union, including processing by means of artificial intelligence. For any processing involving transfers outside the EEA, AWS is subject to Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
- Cloudflare, Inc.: participant in the EU-US Data Privacy Framework. Its audience measurement does not use cookies or identify visitors.
- Mapbox Inc. and Calendly LLC: transfers covered by the EU-US Data Privacy Framework or, failing that, by Standard Contractual Clauses (SCCs) approved by the European Commission.
Sendinblue SAS (Brevo) and Tecalis process data within the European Economic Area.
You may obtain further information about these safeguards by writing to [email protected].
8. User Rights
In accordance with Articles 15 to 22 of the GDPR and Articles 12 to 18 of the LOPDGDD, the user may exercise the following rights at any time by sending a request to [email protected], accompanied by a copy of their identity document:
- Access (Art. 15 GDPR): to know whether their personal data is being processed and, if so, to obtain a copy thereof.
- Rectification (Art. 16 GDPR): to request the correction of inaccurate or incomplete data.
- Erasure (Art. 17 GDPR): to request the deletion of their data when, among other reasons, it is no longer necessary for the purpose for which it was collected.
- Restriction of processing (Art. 18 GDPR): to request the restriction of processing of their data in certain circumstances.
- Objection (Art. 21 GDPR): to object to the processing of their data, including profiling.
- Portability (Art. 20 GDPR): to receive their personal data in a structured, commonly used and machine-readable format.
MapaSubastas will respond to requests within a maximum period of one month from receipt, extendable by a further two months where the complexity or volume of requests so requires.
9. Automated Decisions and Profiling
MapaSubastas does not make decisions based solely on automated processing of data, including profiling, that produce legal effects concerning the user or similarly significantly affect them (Art. 22 GDPR).
The analyses produced by means of artificial intelligence described in section 5 concern the properties and are for information purposes only. They do not involve decisions about users or about the individuals who appear in the auction documentation.
10. Right to Lodge a Complaint with a Supervisory Authority
If the user considers that the processing of their personal data infringes the applicable legislation, they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Website: www.aepd.es
- Postal address: C/ Jorge Juan, 6, 28001 – Madrid, Spain.
11. Data Security
MapaSubastas implements appropriate technical and organisational measures to ensure the security of personal data, in accordance with Article 32 of the GDPR, including protection against unauthorised access, alteration, disclosure or accidental or unlawful destruction of data.
12. Cookie Policy
MapaSubastas uses its own and third-party cookies. For detailed information about the types of cookies used, their purpose and how to configure or disable them, please refer to our Cookie Notice.
13. Changes to this Privacy Policy
MapaSubastas reserves the right to amend this Privacy Policy to adapt it to legislative or case-law developments. Material changes will be notified to users through the platform or by email. We recommend that you review this page periodically.
14. Applicable Law and Jurisdiction
This Privacy Policy is governed by Spanish and European data protection legislation, in particular the GDPR and the LOPDGDD. In the event of a dispute, the courts of Seville, Spain shall have jurisdiction. However, where the user qualifies as a consumer pursuant to Royal Legislative Decree 1/2007, the courts of the user's domicile shall have jurisdiction.
Last updated: 23 September 2026.