The essentials, in plain words
- The Beta works exclusively with simulated money: there is no real investment, no movement of funds and no opening of an investor account.
- We do not ask for your national identity document (DNI), biometric data, bank details, cards or credentials for investment platforms.
- The Beta Account is temporary and will be deleted when the Beta closes, except where data must be retained in blocked form due to a legal obligation or for the defence of claims.
- Product analytics, commercial communications and their personalisation are based on separate, voluntary and revocable consents.
- We do not sell personal data or disclose it to third parties for commercial purposes.
- You can exercise your rights at contacto@realtyinvestor.eu and lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
1. Controller
The controller is REALTY INVESTOR HUB, SOCIEDAD LIMITADA (Realty Investor or RI), CIF B-21948260, Carrer Jardí, 11, 08800 Vilanova i la Geltrú (Barcelona), Spain, email contacto@realtyinvestor.eu, owner of the Realty Investor mobile application and of the website www.realtyinvestor.eu (together, the App).
RI has not appointed a Data Protection Officer, as the circumstances in which the law requires one do not apply to this Beta. Any privacy question may be sent to the email address above.
2. Scope of the Beta
This Policy applies to the processing carried out through the beta version of the App, the website and the support channels. The Beta is a simulation environment with no financial or legal effects for the User.
In this version RI does not open or link investor accounts on crowdfunding platforms, does not verify identity, does not process identity documents or biometric data, does not access real balances, portfolios or credentials, and does not handle investment orders, deposits, withdrawals of funds or payments.
The Beta Account will not automatically become an account for the final service. If the User wishes to use a future version with real transactions, they must register again and accept the corresponding contractual and privacy documentation.
When the Beta closes, RI will securely erase the data of the Beta Accounts, except data that must be retained in blocked form due to a legal obligation, for the defence of claims or on the basis of a valid consent to commercial communications, or after prior irreversible anonymisation.
3. Data processed
- Registration data: email address, username and password, stored as an irreversible cryptographic hash.
- Sign-in with Google: if the User chooses Google Sign-In, RI receives the email address, the associated name and a unique identifier; RI does not receive the Google password.
- Simulated activity: fictitious transactions, simulated portfolio, filters, favourites and usage preferences.
- Technical and usage data: device model, operating system, language, App version, technical identifiers, IP address and activity logs.
- Notifications: device token, if the User enables push notifications.
- Communications: opens and clicks in commercial emails, with date and time, where consent has been given.
- Support and accountability: communications with RI and records of acceptances and consents, including the date, time and version of the text accepted.
The data comes from the User, from their use of the App or from Google when the User chooses to sign in with Google Sign-In. The data needed to create the Beta Account is mandatory; processing based on consent is voluntary.
4. Purposes, legal bases and retention
RI will process the data exclusively for the purposes set out below:
| Purpose | Main data | Legal basis | Retention |
|---|---|---|---|
| Registration, management of the Beta Account and features | Registration, usage and simulated activity | Contract, Art. 6(1)(b) GDPR | While the account is active and until the Beta closes; thereafter, blocking where applicable |
| Google Sign-In | Email address, name and Google identifier | Contract, Art. 6(1)(b) | Same period as the Beta Account |
| Investment simulation and fictitious portfolio | Fictitious transactions, filters, favourites and preferences | Contract, Art. 6(1)(b) | Lifetime of the Beta Account |
| Push notifications | Device token | Consent, Art. 6(1)(a) | Until deactivation, uninstallation or the close of the Beta |
| Product analytics and improvement | Technical data, usage and simulated activity | Consent, Art. 6(1)(a) | Until withdrawal, for a maximum of 24 months; then erasure or anonymisation |
| Commercial communications and launch notices | Email address, username and preferences | Consent, Art. 6(1)(a) | Until consent is withdrawn |
| Personalisation of communications | Simulated activity, preferences and contact details | Consent, Art. 6(1)(a) | Until consent is withdrawn |
| Measurement of opens and clicks | Email address, open, click, date and time | Consent, Art. 6(1)(a) | Until withdrawal, for a maximum of 12 months from sending |
| Support and complaints | Identification and content of communications | Contract and legitimate interest, Arts. 6(1)(b) and 6(1)(f) | Until resolution, plus limitation periods |
| Security, abuse prevention and stability | Logs, IP address and technical identifiers | Legitimate interest, Art. 6(1)(f) | 90 days, except in the case of an incident investigation or a legal requirement |
| Proof of consents and acceptances | Date, time, version and evidence of acceptance | Legal obligation and accountability, Arts. 6(1)(c) and 5(2) | While the account is active, plus the applicable limitation period |
| Legal compliance | Only the data strictly necessary | Legal obligation, Art. 6(1)(c) | Applicable statutory period |
Where RI relies on legitimate interest, the User may request information about the balancing test carried out. Consents may be withdrawn at any time without affecting the lawfulness of prior processing.
5. Consents, analytics and communications
During registration, RI requests separately, by means of unticked boxes, consent for: (i) product analytics; and (ii) commercial communications, including their personalisation and the measurement of opens and clicks. Accepting the Terms of Use or reading this Policy does not imply those consents.
Consent to push notifications is requested through the operating system's permission prompt. Cookies and similar technologies are managed from the settings panel available in the App and on the website.
The User may withdraw their consents free of charge: via the unsubscribe link in each commercial email, by writing to contacto@realtyinvestor.eu, from the device's notification settings or from the cookie panel.
6. Profiling and automated decisions
RI does not take decisions based solely on automated processing that produce legal effects concerning the User or similarly significantly affect them. The Beta does not offer financial advice or personalised investment recommendations.
The segmentation of communications, where the User consents to it, is limited to adapting content and frequency on the basis of preferences and simulated activity; it does not produce legal effects or limit the use of the Beta.
The order of the projects follows objective criteria and the filters set by the User, in accordance with the Terms of Use.
7. Recipients and providers
RI does not sell personal data or disclose it to third parties for commercial purposes. Nor does it disclose Users' data to crowdfunding platforms in this Beta.
| Provider | Service | Location | Data processed |
|---|---|---|---|
| AWS Europe | Hosting, database, operations, security and technical logs | Ireland / EEA; possible occasional access for support purposes | Data hosted in the App, as technically required |
| Google Ireland Ltd. | Google Sign-In, email, push notifications and Google Analytics | Ireland / EEA; possible access from the US | Identification, email, tokens, technical and usage data |
| Mailsuite, S.L. | Measurement of opens and clicks in commercial emails | Spain / EEA | Email address, open, click, date and time |
All providers acting on behalf of RI must do so under data processing agreements that comply with Article 28 GDPR. Google acts as an independent controller with regard to the Google account itself when the User uses Google Sign-In.
RI may disclose data to public administrations, judges, courts or competent authorities where there is a legal obligation to do so, particularly in security investigations or in response to official requests.
8. International transfers
The main infrastructure is located in Ireland, within the European Economic Area. Some Google services and support access by providers may involve transfers to, or access from, the United States or other third countries.
Where there is an international transfer, RI will require appropriate safeguards, including standard contractual clauses, supplementary technical and organisational measures and, where applicable, the recipient's current participation in the EU-US Data Privacy Framework. The User may request information about these safeguards at contacto@realtyinvestor.eu.
9. Rights of the User
The User may exercise the rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to contacto@realtyinvestor.eu or to the postal address given in section 1, providing sufficient information to verify their identity.
RI will respond within a maximum of one month, which may be extended in accordance with the GDPR in particularly complex cases. The User may request the deletion of their Beta Account from the App or through the channels above.
If the User considers that the processing does not comply with the applicable regulations, they may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es), without prejudice to contacting RI beforehand.
10. Security
RI applies technical and organisational measures appropriate to the risk, in accordance with the principles of data protection by design and by default. These include: encryption of communications using TLS 1.2 or higher, encryption of data at rest, irreversible cryptographic functions for passwords, centralised secrets management, access control based on least privilege, activity logging, encrypted backups, recovery procedures and incident response protocols.
Minimisation is an essential security measure in the Beta: as no identity documents, biometric data, bank details or real balances are processed, the potential impact of an incident is significantly reduced.
In the event of a security breach that poses a risk to the rights and freedoms of the User, RI will notify it to the supervisory authority and, where applicable, to the User, under the terms of Articles 33 and 34 GDPR.
11. Territorial scope and minors
The Beta is aimed at persons resident in Spain, although the rights recognised in this Policy apply equally to Users in the European Economic Area. RI does not verify the country of residence during registration.
The App is intended exclusively for persons over 18 years of age. If RI detects, or is informed of, the registration of a minor, it will cancel the account and erase the associated data.
12. Changes and contact
RI may update this Policy for legal or technical reasons or as the service evolves. Substantial changes will be communicated through a durable medium before they take effect. If they affect processing based on consent, consent will be requested again.
The transition from the Beta to a final service with real transactions will require a new privacy policy and a separate registration by the User.
For any queries: REALTY INVESTOR HUB, SOCIEDAD LIMITADA, Carrer Jardí, 11, 08800 Vilanova i la Geltrú (Barcelona), Spain, or contacto@realtyinvestor.eu.
Realty Investor Privacy Policy — beta version. Version 1.1 · Effective date: 29 July 2026. Also available in PDF format (Spanish original).