This privacy policy describes how La Dolce Vida S.L (hereinafter, "the company" or "the data controller") collects, uses and protects the personal data of users of our online real estate platform (hereinafter, "the platform").

Access to or use of the platform implies acceptance of this privacy policy, as well as the legal notice and cookie policy available in the page footer.

1. Data controller

2. Data we collect

We collect the following categories of personal data when users use the platform:

• Registration and profile data: nom, cognoms, correu electrònic, contrasenya (hashada), telèfon, avatar, idioma preferit i país.
• Authentication data: secrets TOTP per a la verificació en dos passos (2FA), dispositius de confiança i historial d'inicis de sessió.
• Property listing data: adreça de la propietat, coordenades geogràfiques, característiques (m², habitacions, etc.), fotografies i preu.
• Internal messaging data: missatges intercanviats entre usuaris i traduccions realitzades en dispositiu amb Bergamot WASM.
• Payment data: processades per Stripe, Coinbase, WeChat Pay i Bizum. Mai emmagatzemem números de targeta complets; només rebem confirmacions de transacció i identificadors de pagament.
• Virtual wallet data: saldo disponible, moviments (ingressos i despeses), sol·licituds de retirada i dades bancàries (IBAN, número Bizum o adreça Bitcoin) per rebre fons.
• Billing data: nom fiscal, NIF/CIF i adreça fiscal per a l'emissió de factures i documents legals.
• Homeowners' association data: coeficients de participació, metres quadrats, rebuts emesos, pagaments de veïns i dades de gestió comunitària.
• Agency CRM data: clients finals gestionats per les agències: nom, correu electrònic, telèfon, etiquetes de classificació i origen del contacte.
• Payment default and claims data: informació financera i d'incidències de tercers gestionats per l'agència immobiliària.
• Browsing and analytics data: adreça IP, user-agent del navegador, pàgines visitades, referer d'origen i durada de la sessió.
• Geolocation data: país detectat per IP per a la selecció automàtica de moneda i coordenades dels immobles publicats.
• Social media data: tokens OAuth per a la publicació automàtica de contingut a Facebook, Instagram, X (Twitter), Weibo, WeChat, TikTok, Douyin, Bilibili, KakaoTalk i Naver.
• External channel data: números de WhatsApp, identificadors de WeChat i Telegram utilitzats per a l'enviament de notificacions.
• Preference data: anuncis favorits, cerques guardades, alertes configurades, idioma seleccionat i moneda preferida.
• Security and anti-fraud data: puntuació de risc per transacció, registre d'esdeveniments de frau, intents de login fallits, IP i empremta de dispositiu.

3. Purpose of processing

The personal data collected is used for the following purposes:

• Allow registration and management of the user account on the platform.
• Allow publication, editing and management of real estate listings.
• Facilitate communication between users (buyers and sellers) through the internal messaging system.
• Process and manage payments for premium services (listing promotions, agency subscriptions, publishing add-ons).
• Generate and provide invoices for payments made by users.
• Send notifications about price alerts, received messages and account updates through multiple channels (email, WhatsApp, WeChat, Telegram).
• Prevent fraud through automatic risk scoring, payment structuring detection, rate limits and device verification.
• Automatically publish listing content to the social networks connected by the user.
• Offer AI-powered translations: content translation (listings, news, pages) processed on the server and chat translation processed on the device with Bergamot WASM.
• Manage residents' communities: coefficients, invoices, payments and community communications.
• Improve the operation, security and user experience of the platform through analytics.
• Send commercial communications about related services, provided the user has given their express consent.

4. Legal basis for processing

The processing of personal data is based on the following legal grounds, in accordance with Regulation (EU) 2016/679 (GDPR):

• Consent: per a l'enviament de comunicacions comercials, la creació de comptes, la publicació d'anuncis i la connexió de xarxes socials per a publicació automàtica.
• Performance of a contract: for payment management, billing and provision of the contracted services.
• Legitimate interest: per a la seguretat de la plataforma, la prevenció de fraus (puntuació de risc, detecció d'estructuració, límits de velocitat), l'anàlisi d'ús per millorar el servei i la protecció contra atacs de credential stuffing.
• Compliance with legal obligations: per al compliment de les obligacions fiscals i comptables derivades de la facturació i la normativa de prevenció de blanqueig de capitals.

5. Retention periods

Personal data will be kept for the following periods:

• Registration and account data: while the user keeps the account active. The user may request deletion of their account at any time.
• Listing data: while the listing is published. When the user withdraws or deletes it, the data is erased immediately and permanently, with no additional retention period, unless a legal obligation requires it to be kept.
• Messaging data: while the conversation is active. When the user deletes messages, they are erased immediately and permanently, with no subsequent retention period.
• Payment and billing data: for the periods required by current tax regulations (generally 6 years).
• Browsing and analytics data: maximum 24 months, unless there is a legal obligation to retain it.
• Anti-fraud events: 24 months from the event registration.
• 2FA secrets (TOTP): until the user disables two-step verification or deletes the account.
• Social media OAuth tokens: until the user revokes the connection from the integrations panel.
• Risk scores: during the useful life of the transaction or operation assessed.

6. Recipients and data processors

Personal data may be disclosed to the following third parties acting as data processors or recipients:

• Stripe Inc. — processament de pagaments amb targeta i transferències via Stripe Connect. EE.UU., adherit al Data Privacy Framework (DPF).
• Coinbase Commerce — pagaments amb criptomonedes (Bitcoin, Ethereum, etc.). EE.UU.
• WeChat Pay / Tenpay — processament de pagaments per a usuaris xinesos. Xina.
• AI providers for content translations — traducció automàtica d'anuncis, notícies i pàgines al servidor. El proveïdor varia segons la configuració de la plataforma.
• Xarxes socials per a publicació automàtica — Facebook/Meta, X (Twitter), TikTok, Weibo, Douyin, Bilibili, KakaoTalk, Naver and WeChat. The data published is that which the user expressly authorises.
• Telegram — enviament de notificacions via bot. EE.UU./Dubai.
• Hostinger International Ltd. — allotjament web, CDN i serveis de caché (LiteSpeed). Lituània/EE.UU.
• Google (Analytics, Fonts) — analítica web i tipografies. EE.UU., adherit al Data Privacy Framework (DPF).
• Tax and judicial authorities — quan sigui requerit legalment o per ordre judicial.

All service providers act as data processors and are subject to confidentiality and security agreements in accordance with the GDPR.

7. International transfers

Some of the data may be processed by providers located outside the European Economic Area (EEA). In these cases, it is guaranteed that the processing is carried out with appropriate safeguards:

• Providers adhering to the EU-US Data Privacy Framework (DPF): Stripe and Google. The DPF provides a level of protection equivalent to the European one.
• Providers in China (WeChat Pay, Weibo, Douyin, Bilibili): guaranteed through Standard Contractual Clauses (SCC) approved by the European Commission and complementary technical measures.
• Other providers: data processing agreements (DPA) with equivalent protection clauses and encryption measures in transit and at rest.

8. User rights

In accordance with the GDPR and Organic Law 3/2018 on the Protection of Personal Data (LOPDGDD), users have the following rights:

• Right of access: to know what personal data the company holds about the user.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of personal data ("right to be forgotten").
• Right to restriction of processing: to restrict data processing in certain circumstances.
• Right to portability: to receive the data in a structured format and transmit it to another controller.
• Right to object: oposar-se al tractament de dades basat en l'interès legítim o per al màrqueting directe.
• Right not to be subject to automated decisions: no ser objecte de decisions basades únicament en el tractament automatitzat que produeixin efectes jurídics.

To exercise these rights, the user may contact us through the platform's contact form, specifying the right they wish to exercise and attaching a copy of an identity document.

Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if they consider that any of their rights has been infringed.

9. Security measures

The company has implemented the necessary technical and organisational measures to guarantee the security of personal data and prevent loss, misuse, alteration or unauthorised access. Among others:

• Password encryption using irreversible hashing (bcrypt/Argon2).
• Two-step verification (2FA) with TOTP for accounts that enable it.
• Secure HTTPS connection with SSL/TLS certificate for all communications.
• Stripe Radar with AI-based risk scoring for payment fraud detection.
• Velocity limits for withdrawals and detection of payment structuring (smurfing).
• Risk-based authentication with trusted device verification (valid for 30 days).
• Login rate limiting: maximum 5 attempts per 15-minute window.
• Credential stuffing detection and automatic blocking of suspicious IPs.
• Xifrat de secrets emmagatzemats (tokens OAuth, claus API, secrets TOTP).
• Access control restricted to the administration panel with roles and capabilities.
• Periodic backups of the database.
• LiteSpeed Cache with CDN for protection against DDoS attacks and improved performance.
• Audit and activity logging for users with administrative access.

10. Use of cookies

The platform uses its own and third-party cookies for proper operation, usage analysis and improving the experience. For more information, see the cookie policy.

11. Minors

The platform is not aimed at persons under 18 years of age. The company does not knowingly collect data from minors. If you are a user and believe that a minor has provided personal data, you can contact us to proceed with its immediate deletion.

12. Artificial intelligence

The platform uses artificial intelligence technologies in two distinct areas:

• On-device translation (Bergamot WASM): les traduccions de xats i missatgeria es processen íntegrament al navegador de l'usuari mitjançant models lleugers Bergamot compilats a WebAssembly. Cap dada del missatge surt del dispositiu de l'usuari ni s'envia a servidors externs per a la traducció.
• Server-side content translation: per a la traducció d'anuncis immobiliaris, notícies del blog i pàgines estàtiques, el contingut textual s'envia a proveïdors de models de llenguatge (LLM) que actuen com a encarregats del tractament. Aquest procés es realitza únicament quan l'usuari o l'administrador sol·licita expressament la traducció del contingut.
• Anti-fraud risk score: algorismes automàtics analitzen patrons de transacció per assignar una puntuació de risc. Les decisions amb efectes significatius (bloqueig de retirades) sempre inclouen revisió humana.

Consent for data processing via AI is collected at the time of requesting content translation or on accepting this policy. The user may withdraw it at any time by requesting the deletion of the translated data.

13. Changes to the policy

The company reserves the right to modify this privacy policy in order to adapt it to changes in legislation, case law or platform practices. Any modification will be published on this page with the corresponding update date. Users are advised to review it periodically.

14. Contact

For any questions about the privacy policy or exercising your rights, you can contact us through our contact page.