Privacy Policy
At Mapasubastas SL (hereinafter, "MapaSubastas" or "the Controller"), we are committed to protecting the privacy of our users. This Privacy Policy describes how we collect, use, retain and protect personal data, in compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
1. Data Controller
Company name: Mapasubastas SL
Tax ID (CIF): B56268931
Registered address: Calle Astronomía, 1, Esc. 2, Planta 9, Puerta 6, C.P. 41015 – Sevilla, Spain.
Contact email: [email protected]
Data protection contact: [email protected]
MapaSubastas is not required to appoint a Data Protection Officer (DPO) pursuant to Article 37 of the GDPR. However, you may direct any enquiry related to the processing of your personal data to the email address indicated above.
2. Data We Collect
The personal data we collect includes:
- Identification and contact data: name, email address, company (optional).
- Access and authentication data: login credentials, access logs.
- Preference data: user settings and preferences within the platform.
- Browsing data: IP address, browser type, pages visited, time spent, and data collected through cookies and similar technologies.
- Billing data: information necessary for payment and subscription management (processed through Stripe).
3. Purpose and Legal Basis for Processing
In accordance with Article 6 of the GDPR, the data collected is processed for the following purposes, with their corresponding legal basis:
| Purpose | Legal Basis |
|---|---|
| Management of the user account and access to the platform | Performance of a contract (Art. 6(1)(b) GDPR) |
| Provision of the contracted service and subscription management | Performance of a contract (Art. 6(1)(b) GDPR) |
| Sending service-related communications (notices, incidents, changes) | Performance of a contract (Art. 6(1)(b) GDPR) |
| Personalisation of the user experience | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Sending commercial and promotional communications | Consent of the data subject (Art. 6(1)(a) GDPR) |
| Platform security and fraud prevention | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Compliance with legal, tax and regulatory obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Statistical analysis and service improvement | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
Where the legal basis is consent, the user may withdraw it at any time without affecting the lawfulness of processing carried out prior to such withdrawal.
4. Data Retention
Personal data will be retained for the periods necessary to fulfil the purpose for which it was collected and to address any liabilities arising from the processing:
- Account and profile data: for the duration of the contractual relationship. After account closure, data will be retained in a blocked state for the statutory limitation period (3 years, pursuant to Art. 1964 of the Spanish Civil Code).
- Billing data: 5 years from the last transaction, in compliance with Art. 30 of the Spanish Commercial Code and the General Tax Law.
- Browsing data and cookies: a maximum of 13 months, in accordance with the guidelines of the Spanish Data Protection Agency (AEPD).
- Data processed on the basis of consent: until the user withdraws their consent.
Once the indicated periods have elapsed, data will be deleted or irreversibly anonymised.
5. Disclosure of Data to Third Parties
MapaSubastas may disclose personal data to the following recipients, always with appropriate safeguards:
- Technology service providers acting as data processors: Google LLC (Google Analytics, Google Maps), Stripe Inc. (payment processing) and Amazon Web Services – AWS (infrastructure and hosting). These providers only process data in accordance with our instructions and under data processing agreements.
- Public authorities and competent bodies where a legal obligation exists.
- Third parties with the user's consent, in cases where the user has given their explicit consent.
MapaSubastas does not sell, rent or transfer personal data to third parties for commercial purposes.
6. International Data Transfers
Some of the service providers referred to in the previous section are located in the United States, which involves international data transfers outside the European Economic Area (EEA). These transfers are carried out with the following safeguards:
- Google LLC (Google Analytics, Google Maps): participant in the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023).
- Stripe Inc.: participant in the EU-US Data Privacy Framework and subject to Standard Contractual Clauses (SCCs) approved by the European Commission.
- Amazon Web Services (AWS): data is hosted in AWS data centres within the European Union (eu-west region). For any processing involving transfers outside the EEA, AWS is subject to Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
You may obtain further information about these safeguards by writing to [email protected].
7. User Rights
In accordance with Articles 15 to 22 of the GDPR and Articles 12 to 18 of the LOPDGDD, the user may exercise the following rights at any time by sending a request to [email protected], accompanied by a copy of their identity document:
- Access (Art. 15 GDPR): to know whether their personal data is being processed and, if so, to obtain a copy thereof.
- Rectification (Art. 16 GDPR): to request the correction of inaccurate or incomplete data.
- Erasure (Art. 17 GDPR): to request the deletion of their data when, among other reasons, it is no longer necessary for the purpose for which it was collected.
- Restriction of processing (Art. 18 GDPR): to request the restriction of processing of their data in certain circumstances.
- Objection (Art. 21 GDPR): to object to the processing of their data, including profiling.
- Portability (Art. 20 GDPR): to receive their personal data in a structured, commonly used and machine-readable format.
MapaSubastas will respond to requests within a maximum period of one month from receipt, extendable by a further two months where the complexity or volume of requests so requires.
8. Automated Decisions and Profiling
MapaSubastas does not make decisions based solely on automated processing of data, including profiling, that produce legal effects concerning the user or similarly significantly affect them (Art. 22 GDPR).
9. Right to Lodge a Complaint with a Supervisory Authority
If the user considers that the processing of their personal data infringes the applicable legislation, they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Website: www.aepd.es
- Postal address: C/ Jorge Juan, 6, 28001 – Madrid, Spain.
10. Data Security
MapaSubastas implements appropriate technical and organisational measures to ensure the security of personal data, in accordance with Article 32 of the GDPR, including protection against unauthorised access, alteration, disclosure or accidental or unlawful destruction of data.
11. Cookie Policy
MapaSubastas uses its own and third-party cookies. For detailed information about the types of cookies used, their purpose and how to configure or disable them, please refer to our Cookie Notice.
12. Changes to this Privacy Policy
MapaSubastas reserves the right to amend this Privacy Policy to adapt it to legislative or case-law developments. Material changes will be notified to users through the platform or by email. We recommend that you review this page periodically.
13. Applicable Law and Jurisdiction
This Privacy Policy is governed by Spanish and European data protection legislation, in particular the GDPR and the LOPDGDD. In the event of a dispute, the courts of Seville, Spain shall have jurisdiction. However, where the user qualifies as a consumer pursuant to Royal Legislative Decree 1/2007, the courts of the user's domicile shall have jurisdiction.
Last updated: 30 March 2026.