Privacy statement for services

We care about your privacy

We are committed to protecting the privacy of our users. Your trust is important to us.

Users can rely on us to process personal data carefully and transparently, respecting their right to privacy. This privacy statement applies to the processing of personal data by KODIT IO ESPANA SL, together with its subsidiary K1 KT SPAIN SA, referred to under the trade name "Rive Spain". When processing personal data, we comply with the General Data Protection Regulation and the other applicable national and European data protection rules, always following privacy best practices.

We use this data protection statement to describe how we collect, process, and protect the personal data of our customers across all our businesses.

What kind of data is collected about me?

We collect users' personal data only for specifically determined purposes, as described in this privacy statement. The purpose of processing determines what type of data is collected in each situation.

Data provided by the user or data that identifies them

Contact information such as name, address, telephone number, and email addresses.

Data required for the digital account, such as login, password, and any other possible user identifier.

Demographic data such as age, gender, title or profession, and native language.

Customer data such as billing and payment data, product and order data, customer comments and contacts, responses to forms and contests, and cancellation data.

Profiling and interest data provided by the user.

Consents and permissions.

Push blocking data.

Recorded customer phone calls.

Data provided for surveys and reviews.

Other data collected with the user's consent.

Data collected during the use of services

Use and browsing data of service features, displayed ads, and ads that were clicked.

The page from which the user reached our website, device model, individual device and/or cookie identification, data collection channel such as web browser, mobile browser, or application, browser version, IP address, session ID, session time and duration, screen resolution, and operating system.

Identification of a user recognized through a digital account, such as the Rive Group price estimation tool, is usually a randomly created string of numbers.

Identification of an observed user who has not logged in is usually a cookie or another similar identifier.

Location data, such as coordinates calculated by GPS, WiFi contact points, or mobile network base station, if the user has given specific consent for this.

Other data collected with the user's consent.

Data inferred from the use of services

Inferred data means data deduced from analysis of observed service use and/or from data provided by the user themselves, for example any user interest or segmentation into a certain type of user group.

Data in our marketing registry

In our marketing registry we record data about the user's name, address, a piece of identification data traceable to the user, and contact information for possible contacts. We may flag user data in our marketing registry, for example when the user has provided contact information in the context of subscribing to a newsletter, a contest, or a price estimate.

How is my data collected and combined?

Personal data is collected mainly from the users themselves in the context of a price estimate, valuation request, or registration, and later during the customer relationship.

We process the data provided by the user that allows user identification, such as profile and contact information, and the observed and inferred data from service use in separate databases. We always store observed and inferred data from service use combined with identifiers that generally consist of randomly created number strings that cannot be used to personally identify the user.

If the user has logged in to the Rive Spain estimation tool, has requested a price estimate, or a valuation visit, we may use login data and observed data from service use for the purposes described in the next section. Combining the data for targeted advertising and marketing messages requires the user's consent.

The user may obtain additional information about the techniques and identifiers we use in our Cookie Policy. We collect some publicly available data for potential customers of apartment sales and brokerage services online. This data is not used for direct electronic marketing, such as emails or SMS, but may be used for telephone marketing. Potential customers are verbally asked for consent to market the service. In addition, we collect data from public or private registries with the aim of avoiding improper communications.

For what purposes are my personal data collected?

We only process personal data for predefined purposes of use, mainly the following:

Products, services, and personalization: we provide users with home price estimates, inspection visits, apartment purchases, and sales. In addition, we may personalize some of our services and recommend content that may interest the user.

Product development: we constantly develop product and service user interfaces and user experience. We conduct surveys, studies, and consumer reports to support business decisions.

Offers, purchases, and customer service: we help the user find interesting offers, provide the products or services they have acquired, and help Rive Group deliver the most personal customer service possible.

Targeted digital marketing: we show the user marketing that is likely to interest them.

What are the legal bases for this processing?

We process personal data only when it is lawful to do so. Processing is based on the following legal grounds:

Contract. Processing your personal data is necessary for the performance of a contract between the customer and Rive Group. We use your personal data to provide our services and to ensure their functionality and security. If you do not provide the necessary information, we may not be able to provide the service.

Legitimate interest. We process personal data when necessary for the purposes of the legitimate interests pursued by Rive Group. Legitimate interest refers to an interest that is lawful and relevant to us. In processing activities based on legitimate interest, your rights are taken into account and balanced with the interests of Rive Group. You may obtain more information about balancing tests by contacting us. You have the right to object to processing based on legitimate interest. Read more about your rights and how to contact us in the section "What are your rights?".

Consent. Processing of your personal data may be based on your consent. In these situations, we request your consent before processing your personal data. Giving consent is always voluntary and you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal. We keep records of your consents, preferences, and related settings, for example for marketing, location data, and sharing of personal data.

Legal obligation. Rive Spain may need to process your personal data to comply with legal requirements applicable to it. For example, we may have a legal obligation to disclose personal data to authorities when requested and to retain certain data and/or documents for the period required by law.

Do we share personal data?

We share your information internally within our organization, but only with those who need it to provide products and services or respond to your requests. Based on your consent, we share information with banks.

In addition, we disclose personal data to service providers and third parties in the following situations, and only to the extent necessary for the purposes described in this statement.

Rive Spain service providers and authorized third parties

We share your personal data with our service providers, whom we have carefully selected to provide services for us or on our behalf, such as companies that help us with customer service and support, customer data management and analysis, credit checks, and research, advertising, or similar services. We disclose data to our partners based on consent or where permitted by our legitimate interest.

We may share your personal data with our marketing partners, for example to manage marketing campaigns. If the user has given consent for electronic direct marketing by our partners, user data may be disclosed to carefully selected partners for marketing purposes.

We may disclose user personal data in the manner required by claims from competent authorities or other parties in accordance with legislation in force at the relevant time.

If we sell, buy, merge, or otherwise reorganize our business operations, user personal data may be disclosed to buyers and their advisers. The personal data collected is processed and stored in part outside the EU/EEA, for example when service providers are located outside the EU. Personal data may be transferred to the United States. Service providers used have contractually committed to ensuring an adequate level of data protection in all processing activities.

How are my personal data protected?

We use the necessary technical and organizational safeguards against unauthorized access, disclosure, deletion, or other unauthorized processing. Such means include, for example, firewalls, encryption techniques, secure device spaces, appropriate access control, supervised granting and monitoring of user rights, training of personnel who process personal data, and careful selection of subcontractors.

How do we use cookies?

We may collect data related to the user's device by using cookies and other similar techniques in order to operate and improve our websites and our offering. Cookies often contain an anonymous and individual identifier that allows us to identify and count the browsers visiting our website.

Our domains may include third-party elements that set cookies on behalf of a third party, for example in connection with third-party social network services.

For more information on how we use cookies, please see our Cookie Policy.

Does Rive Spain use automated decision-making?

Automated decision-making refers to a decision made fully automatically, for example based on an algorithm without human intervention. Processing of your personal data may use automated processing, but does not include cases in which a decision concerning you is based solely on automated processing.

How long will my data be stored?

We store user data only for as long as necessary for the purposes of data processing, unless the law or other national or international regulations require a longer retention time.

If the user has not logged into their digital account, such as the Rive Spain estimation tool, during the last usually eighteen (18) months, the user will be asked to renew the account. If the user does not renew the account or if the customer relationship or other grounds for processing personal data have ended, personal data is mostly deleted, transferred to a permanent marketing registry, or transformed in a way that no longer allows identification of the data subject. Communicative parts of certain services, such as public feedback, retain the visibility of the user's alias or the corresponding content produced by the user even after the end of the customer relationship.

What are my rights as a data subject?

Whenever Rive Spain processes your data, you have certain rights that allow you to control how your personal data is processed. This section provides information about each of those rights. If you have questions about your rights or would like to examine your personal data or exercise your rights, send your email to privacy@rive.es.

Right of access

You have the right to obtain confirmation of what personal data we process about you. This allows you to assess and confirm that data is processed lawfully. In addition, you have the right to request and receive a copy of the personal data we process.

Right to rectification

Our aim is to keep personal data current and accurate and to delete false, insufficient, or inaccurate personal data without delay. You have the right to demand rectification of inaccurate personal data concerning you and completion of insufficient personal data.

Right to withdraw consent

When your personal data is processed based on consent, you have the right to withdraw your consent at any time. If you withdraw your consent, personal data processing will not continue unless another legal ground, such as a legal obligation, requires processing to continue. You may withdraw your consent, for example by clicking the unsubscribe link at the end of a newsletter email.

Right to erasure and to be forgotten

In certain situations, you have the right to be forgotten or to have your personal data deleted completely. This right exists when, for example, the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, processing was based on consent and you withdraw consent, or personal data has been processed unlawfully.

Right to data portability

In certain situations, you have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format and, if you wish, to transmit that data to another controller. This right exists when we process your personal data on the basis of consent or contract and the data processing is digital in nature.

Right to object to data processing

You have the right to object to the processing of your personal data in certain circumstances. If we do not have compelling legitimate grounds to continue processing the personal data, we will no longer process it after receiving and verifying your objection. You also have the right to object to the processing of your personal data for direct marketing purposes at any time.

Right to restrict processing

You have the right to request that we restrict the processing of your personal data in certain circumstances. For example, if you contest the accuracy of your data, you may request that we do not process the data until we have verified its accuracy. In addition to the rights mentioned above, you have the right to lodge a complaint with a supervisory authority if you believe that our privacy practices do not follow the General Data Protection Regulation. If you wish to file a complaint with the supervisory authority, you can find more information on the websites of the Spanish Data Protection Agency and the relevant supervisory bodies.

Where can I contact the controller of my personal data?

The parent company of the Rive Group, KODIT IO ESPANA SL (2839027-4), is the controller of your personal data in the processing described in this policy. The preferred way to contact us is by email at privacy@rive.es.

You may also send any query regarding this privacy statement and the privacy practices of KODIT IO ESPANA SL (VAT number B88393350) to:

KODIT IO ESPANA SL

Paseo de la Habana, 44, entresuelo izquierda

28036, Madrid, Spain

Changes to this data protection statement

We constantly develop our services and reserve the right to change this privacy statement by notifying it in our services. Updates may be due to changes in legislation.

We recommend revisiting this page to stay informed about any possible changes. We seek to personally inform you of all significant changes to this policy by email or through other notification mechanisms.