Privacy policy

Sample text for the prototype. Pending legal review. This is a translation; in case of any discrepancy, the Spanish version prevails.

Data controller

Danilo Delizia (NIE Y0837263P), owner of Subastic (subastic.com). To exercise your rights, write to us through thecontact form.

What data we process and why

• Account:your email address (or the basic details of your Google account), your name and your list of favourites, to give you access and show your information. Legal basis: performance of the service you request (GDPR art. 6.1.b).
• Your activity in the account:your saved searches and the private notes you add to favourites, so we can show them to you. Same basis.
• Security:the IP address and browser of each session, to protect your account and detect abuse. Basis: legitimate interest (GDPR art. 6.1.f).
• Email notifications:alerts about your favourites are part of the service and are on by default; you can turn them off in Settings. Subastic news is only sent if you turn it on (consent, which you can withdraw in the same place).
• Messages to Subastic:the data from the contact form (email, optional phone number and message), to answer you. Basis: your request (GDPR art. 6.1.b).
• Enquiries to advisory firms:the data from the contact form (name, email, optional phone number and message). See below.

Service providers and international transfers

We use processors who only handle data on our behalf:Cloudflare(hosting, database, sending emails and Turnstile anti-bot protection) andGoogle(sign-in with Google, if you use it, plus Analytics and AdSense as described under Cookies). Cloudflare and Google may process data outside the EEA; they are certified under the EU-US Data Privacy Framework and also apply the European Commission's standard contractual clauses.

How long we keep your data

• Account, favourites and saved searches: until you delete your account.
• Sessions: 7 days from your last visit.
• Messages and enquiries: as long as needed to handle them and, afterwards, blocked for the statutory limitation periods.

Cookies

We use strictly necessary technical cookies to keep you signed in and remember your cookie preferences. Cloudflare Turnstile protects the forms against bots.

• better-auth.session_token(Subastic, technical): keeps you signed in. 7 days.
• FCCDCF, FCNEC(Google, technical): store your choice in the consent notice. Up to 13 months.
• _ga, _ga_*(Google Analytics, measurement, only with consent): distinguish visits. 2 years.
• __gads, __gpi, __eoi(Google AdSense, advertising, only with consent): ad frequency and personalisation. Up to 13 months.

Only if you accept them in Google's consent notice (a platform certified under IAB Europe's TCF framework):measurement(Google Analytics, aggregated usage statistics) andadvertising(Google AdSense, which may personalise ads). Until you accept, Google Analytics and AdSense run without cookies. You can change or withdraw your choice at any time from "Cookie settings", at the bottom of every page.

Optional consents (opt-in)

There is one optional consent, independent of the terms of service. It appears unticked when you sign up and in the contact form for an advisory firm.Not ticking it does not limit your access or your enquiry.It is only deemed given if you actively tick it yourself. We do not sell or transfer your email address to third parties for their marketing.

Commercial communications

• Checkbox text:"I want to receive commercial communications".
• What you authorise:Subastic to send you offers by email, its own or from partner firms (advisory and service firms related to auctions, real estate, financing and insurance); they are always sent by Subastic, without giving those firms your email. If you tick it when contacting an advisory firm, that firm may also send you its own offers.
• Legal basis:consent (GDPR art. 6.1.a; LSSI, Spain's Information Society Services Act, art. 21).
• Retention:until you withdraw it or delete your account; after that, blocked for the statutory limitation periods.

Contacting advisory firms directly

When you send the form on a listing, we share your details with the advertising firm for that province so it can handle your enquiry. This is necessary to process your request (GDPR art. 6.1.b) and does not require consent. The firm will process them as an independent controller under its own privacy policy. If you do not have an account, we keep your enquiry and the boxes you ticked, with their date, as proof.

How to manage or withdraw your consents (opt-out)

• In Settings, untick the relevant box and save. It takes effect immediately.
• Using the unsubscribe link included in every commercial communication.
• By writing to the owner. If you contacted us without an account, tell us the email address you used.

Withdrawing consent is as easy as giving it and has no consequences for your account. We record the date of your choices as proof.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and object to marketing at any time, by writing to the owner. You can delete your account yourself inSettings. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es).