Cookie Policy

1. Purpose, controller and scope

1.1 This policy explains what information Realty Investor stores on the User's device, or reads from it, when the User uses the website www.realtyinvestor.eu or the beta version of the ‘Realty Investor’ mobile application (together, the App), for what purpose it does so and how the User can accept or reject it.

1.2 The controller is REALTY INVESTOR HUB, SOCIEDAD LIMITADA, CIF B-21948260, with registered office at Carrer Jardí, 11, 08800 Vilanova i la Geltrú (Barcelona), Spain, and contact email contacto@realtyinvestor.eu. This policy supplements the Privacy Policy, which describes in detail what personal data is processed, on what legal basis and for how long; both must be read together.

1.3 A cookie is a small file that a website stores on the User's device and can read again later, for example to recognise that the User has already logged in. The applicable legal regime — Article 22.2 of Law 34/2002 (LSSI) — is not limited to browser cookies: it covers any form of storage of, or access to, information on the User's terminal equipment, so this policy also covers the browser's local storage, technical identifiers, device identifiers used for push notifications and the tracking images included in emails.

1.4 The App is a hybrid application: its interface is built with web technology and runs inside a component of the operating system. In practice, the same cookies and the same storage as on the website are used within the App, and the rules in this policy apply equally in both environments.

2. Categories we use

2.1 Technical or necessary. They allow the service to work: keeping the User logged in, protecting access to the account, remembering the interface settings and language, retaining the consent options chosen and delivering the notifications the User has enabled. They do not require consent because the service cannot be provided without them, and they cannot be disabled from the settings panel.

2.2 Analytics or measurement. They make it possible to understand, in aggregate, how the service is used: which screens are visited, how long is spent on them, which elements are clicked and which paths users follow. This includes both the counting of visits and events (Google Analytics 4) and heatmaps and session replays (Microsoft Clarity). They require consent.

2.3 Third-party. They are activated when content served by third parties is loaded: the location maps of projects and issuers, web fonts, and the libraries and icons served from content delivery networks. They require consent.

2.4 Neither the website nor the App uses advertising cookies or profiling cookies for advertising purposes, collects the device's advertising identifier or shares data with advertising networks.

3. List of cookies and technologies used

3.1 Technical or necessary — consent not required

3.2 Analytics or measurement — consent required

These cookies are only set if the User accepts the analytics category in the cookie panel. Consent can be withdrawn at any time from the settings panel, and from that moment they are no longer used.

3.3 Third-party — consent required

3.4 This list may change for technical reasons or as the service evolves. The updated version is always available at this same address and in the cookie settings panel.

4. Analytics, location maps and international transfers

4.1 Google Analytics. Usage is measured with Google Analytics 4, by means of Google's website tag, both on the website and inside the App. The website uses the property G-CKV1KSPE78; the App also uses the properties G-LV4H65E3LH, G-6670MKJ4C7 and G-83SM9H38K3, the latter associated with Firebase. Google Ireland Ltd. acts as a processor on behalf of RI; the information collected is technical in nature and relates to browsing behaviour, and RI uses it in aggregate to understand how the product is used and to improve it.

4.2 Within the App, the interface elements the User clicks are also recorded, in aggregate: the type of element, the visible text of the button or link and the screen on which it is located. The content the User enters in form fields is not recorded under any circumstances.

4.3 The retention period for user and event data in Google Analytics is the one configured in the property, currently two (2) months. Analytics is not activated until the User gives their consent; RI uses Google's consent mode, which adjusts the behaviour of the tags according to the User's choice. Independently of the settings panel, the User can install the Google Analytics opt-out browser add-on, available on Google's website.

4.4 Microsoft Clarity: session recording and heatmaps. In addition to counting visits, RI uses Microsoft Clarity to record, in pseudonymised form, how the service is navigated: mouse movements, clicks, scrolling on the page and pages visited during the session. This generates heatmaps and session replays that make it possible to detect usability problems and malfunctions. The legal basis for this processing is the User's consent (Article 22.2 of Law 34/2002 (LSSI) and Article 6(1)(a) of Regulation (EU) 2016/679).

4.5 What is not recorded. RI applies masking to private areas and to form fields, so that the content entered by the User and the personal data shown in their private area — for example, their name or the amounts in their portfolio — are hidden in the replays. This functionality is only activated if the User accepts the analytics category: if they reject it, the Clarity code is not even downloaded to their browser. Session data is retained for the limited period defined by the provider. Further information about this processing can be found in Microsoft's privacy statement.

4.6 Location maps. Project and Issuer pages may include a map, served by Google, showing the location of the property or of the head office: when it is loaded, the browser or the App establishes a connection with Google's servers, which receive the User's IP address and may store cookies on their device. The map shows the location of the project, not that of the User — RI does not access or request the device's geolocation — and is only loaded if the User has accepted third-party cookies; otherwise, the page will show the location as text.

4.7 International transfers. Google services are contracted with Google Ireland Ltd. and Clarity services with Microsoft Ireland Operations Ltd., both entities established in the European Economic Area. However, the provision of these services may involve access to data, or transfers of data to the United States, by companies in their respective groups. Both providers state that they participate in the EU–US Data Privacy Framework and offer standard contractual clauses as an additional safeguard. The regime applicable to these transfers is set out in the Privacy Policy.

5. Website translation and sign-in with Google

5.1 The service offers automatic translation of its content into English, French and Chinese using Google's translation service. When a language other than Spanish is selected, the cookie googtrans is stored, with a duration of one year, to retain the chosen language, and the translation component is loaded from Google's servers, which receive the User's IP address. If the User keeps Spanish, this cookie is not stored.

5.2 If the User chooses to identify themselves via ‘Sign in with Google’, Google's identity component may store the cookie g_state to remember the state of the sign-in box. This processing only takes place if the User uses that sign-in method.

6. Notifications and tracking of our emails

6.1 Notifications. If the User enables notifications, the App generates and stores on their device a technical identifier provided by Firebase Cloud Messaging (Google), which is essential in order to deliver the notifications to them. The User can revoke it at any time by disabling notifications in the operating system settings or by logging out.

6.2 Commercial emails. RI's commercial communications are sent through Brevo (Sendinblue SAS, France) and include a tracking image and links that make it possible to know whether the message has been opened and whether the User has clicked on any of them. This technique involves accessing information on the recipient's device and is therefore subject to the same rules as cookies.

6.3 This measurement is carried out only on commercial communications and with the User's prior consent, obtained at the time of registration together with their agreement to receive them. It does not apply to emails necessary for the provision of the service, such as account verification or password reset emails, which are sent through a different channel and do not include any tracking.

6.4 The User can prevent this measurement by disabling the automatic downloading of images in their email client, or by withdrawing their consent to commercial communications in accordance with the Commercial Communications Policy.

7. Consent: how to decide and what happens if you reject

7.1 The first time the User accesses the website or opens the App, a panel is shown that informs them of the categories used and allows them to accept them all, reject them all or configure them one by one. Rejecting is as easy as accepting: both options are available on the first screen, with the same format and the same visibility. Until the User decides, no cookie that is not technically necessary is activated.

7.2 The User can change or withdraw their decision at any time from the cookie settings panel, accessible from the website footer and from the App settings; withdrawal does not affect the lawfulness of processing carried out beforehand. Once twenty-four (24) months have passed since the decision, RI will request consent again.

7.3 In addition, the User can block or delete cookies from the settings of their browser or of their device's operating system; each browser has its own procedure, described in its help section.

7.4 Rejecting analytics and third-party cookies does not prevent the User from creating an account or using the Beta normally: the only effects are that RI will not have data on the use of the product and that the location maps will not be loaded. Technical cookies, on the other hand, cannot be disabled from the panel because without them it is not possible to keep the session active or remember the User's preferences; if the User blocks them from their browser, the service may stop working properly.

8. Changes and contact

8.1 RI may update this policy for legal or technical reasons or as the service evolves. Where a change affects the categories or the purposes for which consent is obtained, consent will be requested again.

8.2 For any queries relating to this policy, the User can write to contacto@realtyinvestor.eu or contact REALTY INVESTOR HUB, SOCIEDAD LIMITADA, Carrer Jardí, 11, 08800 Vilanova i la Geltrú (Barcelona), Spain.