Privacy Policy

01 Data Controller

Costelan Inversiones S.L. operates the real estate customer service system Kostelan IA, which includes the conversational assistant VERA (accessible via WhatsApp), the web portal kostelan.com and the investor management panel at panel.kostelan.com.

Under agreements with partner real estate agencies, Kostelan IA acts as data processor (Art. 28 GDPR), with the agency being the data controller vis-à-vis the AEPD. For data collected directly on kostelan.com and its subdomains on its own behalf, Kostelan IA acts as data controller.

02 Purposes and Legal Basis

No automated decisions with significant legal effects are made without human intervention. Investor profiling is indicative only and is reviewed manually before any proposal is made.

03 Data We Collect

Depending on the channel and purpose, we process the following categories of data:

• Identifying data: full name, phone number, email address.
• Financial and asset data (only with explicit consent for mortgage pre-qualification): employment contract type, seniority, estimated net income, available savings, active debts.
• Investment preferences: budget, area of interest, risk profile, time horizon.
• Interaction data: conversation history with VERA, date and time of visits, properties viewed.
• Technical data: IP address, device type, session cookies (see section 8).

We do not process special categories of data (Art. 9 GDPR) or data relating to persons under 18. If we detect that a data subject is a minor, we terminate processing and delete the data.

04 Legitimacy

Processing carried out by Kostelan IA is based on:

• Consent: freely given when starting a conversation with VERA or registering on the investor portal. It can be withdrawn at any time without retroactive effect.
• Pre-contractual relationship: to manage visits and investment proposals requested by the data subject.
• Legitimate interest: for following up with leads who have shown active interest and for fraud prevention.
• Legal obligation: for compliance with Spanish tax and commercial regulations.

05 Recipients and Sub-processors

Data is not sold or transferred to third parties for their own commercial purposes. To provide the service, Kostelan IA works with the following sub-processors, with whom appropriate data processing agreements have been signed:

International transfers to the USA are covered by Standard Contractual Clauses adopted by the European Commission. When acting as data processor for a partner agency, we do not add sub-processors beyond those listed without prior authorisation from the responsible agency.

In the event of a mortgage referral consented to by the data subject, financial profile data is shared with the designated broker or lender. This communication requires explicit prior consent and is disclosed at the point of collection.

06 Data Retention

• Unconverted leads: 12 months from the last contact, unless the data subject requests deletion earlier.
• Registered investor data: for the duration of the commercial relationship and 5 additional years for commercial and tax obligations.
• VERA conversation history: 24 months for service improvement and GDPR traceability.
• Mortgage profile data: 6 months from collection, unless a transaction is formalised (in which case commercial timeframes apply).
• Access logs and technical logs: 12 months.

After the above periods, data is securely deleted or anonymised so that the data subject can no longer be re-identified.

07 Your Rights

Data subjects may exercise the following rights recognised under the GDPR at any time:

To exercise any of these rights, send an email to privacidad@kostelan.com stating the right you wish to exercise and attaching a copy of your ID or equivalent identifying document. We respond within a maximum of 30 calendar days.

If you believe that the processing of your data does not comply with applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

If you have interacted with the system through a partner real estate agency, you may address your request directly to that agency (data controller) or to Kostelan IA as processor. We will coordinate the response with the relevant agency.

08 Cookies

The site kostelan.com uses exclusively strictly necessary technical cookies for the operation of the portal: authenticated session management and basic language preferences. We do not use tracking, analytics or third-party advertising cookies.

No prior consent is required for technical cookies under Art. 22.2 LSSI. You can configure your browser to block or delete cookies at any time, although this may affect the functionality of the investor portal.

09 Security

Kostelan IA applies technical and organisational measures appropriate to the risk, including:

• Encryption in transit via TLS 1.2+ across all communications.
• Database access restricted via Row Level Security (RLS) in Supabase.
• Administrator authentication with secure credentials and IP-restricted access.
• Encrypted backups with a minimum retention of 30 days.
• Audit log of all operations on personal data.
• Notification of security breaches to the AEPD and affected individuals within 72 hours of detection.

10 Amendments

Kostelan IA may update this policy to reflect regulatory changes, new services or organisational decisions. When changes are substantial, we will notify registered data subjects by email at least 30 days in advance.

The current version is always available at kostelan.com/privacy. The date of the last update appears in the header of this document.

11 Contact