Privacy policy for Soleada AS and HKH Aftermarket and Sales SL
In short
- Soleada AS and HKH Aftermarket and Sales SL help you buy or sell a property in Spain, and are jointly responsible for your personal data.
- We only collect what we need to reply to you, run your user account if you create one, and carry out a purchase or sale.
- We only use analytics and advertising if you say yes in the cookie banner. Maps and videos from Google only load when you click on them.
- You only receive the newsletter if you have asked for it.
- We never sell your data.
- You can ask for access, correction or deletion at any time at post@soleada.no.
Below you can read what happens in each situation.
1. Who we are
Soleada AS and HKH Aftermarket and Sales SL (HKH), Soleada’s sales department in Spain, use the same website and customer database and are joint controllers. «We» means both companies.
Soleada AS, Norwegian org. no. 936629830, Kirkegata 54, 7600 Levanger, Norway. Responsible for the website, user accounts, the newsletter, cookies and marketing.
HKH Aftermarket and Sales SL, CIF B-54900642, Travesía Cami del Mahones 1, 03690 San Vicente del Raspeig, Spain. Responsible for sales follow-up, purchases and sales, and customer due diligence.
Soleada AS is the contact point for data protection, but you can contact either of us. You can ask for a summary of the arrangement between the two companies.
Contact: Roar Riseth Haug, post@soleada.no.
2. When you contact us
This covers the contact form, email, phone, Facebook and Instagram, inquiries through property portals, and contact details you give us at trade fairs.
What: Name, email address, phone number, what you write to us and which properties you are interested in. Both Soleada AS and HKH have access.
Why: To reply to you (steps prior to entering into a contract). We also keep your inquiry and follow up inquiries from portals and fairs (legitimate interest), because buying a property in Spain often takes time and many people get back in touch after several months. We follow up on what you asked about. We only send you other offers by email if you have given your consent.
How long: 24 months after the last contact, if you do not become a customer.
Without an email address or phone number, we cannot reply to you.
3. When you create a user account
Creating an account is voluntary. Soleada AS is responsible.
What: Email address, password, saved searches, favourites and property brochures you have downloaded.
Why: So you can log in, save searches and favourites, and get alerts about new properties (the user account agreement).
How long: Until you delete the account under «My profile» or ask us to delete it, and no later than 24 months after your last login or contact with us.
4. When you receive the newsletter
Soleada AS is responsible.
What: Your email address, when you gave consent, and whether you open the newsletter and click on links.
Why: To send you new properties, projects and market information that match your interests (consent, under section 15 of the Norwegian Marketing Control Act, markedsføringsloven).
How long: Until you unsubscribe using the link in every email. Data about opens and clicks is deleted together with your customer record in HubSpot.
5. When you buy or sell a property
HKH handles the transaction.
What: Name, address, date of birth, a copy of your passport or other ID, NIE number, details of the property and the payment, and our correspondence. We also receive information from the lawyer, notary and developer. You can hand in your ID in person, by email, or directly to the lawyer or notary.
Why:
- Carry out the transaction (contract).
- Verify your identity, which HKH is required to do under Spanish anti-money laundering law, Ley 10/2010 (legal obligation). Without ID and an NIE number, the transaction cannot go ahead.
- Accounting and bookkeeping (legal obligation).
- Help you with warranty claims, since Spanish building law gives a 10-year warranty against structural defects (legitimate interest).
Who we share with: The other party to the transaction, the developer, lawyer, notary, bank and Spanish authorities, only as far as the transaction or the law requires.
How long: Contracts and correspondence for 10 years after handover. Customer due diligence for 10 years after the customer relationship ends. Accounting records for 5 years at Soleada AS and 6 years at HKH.
6. When you visit the website
Soleada AS is responsible.
Server logs: Cloudflare and Kinsta record IP address, browser, time and which pages were requested, to detect attacks and keep the site running (legitimate interest). The logs are deleted within 30 days.
Cookies: Anything that is not necessary is only set once you say yes in the cookie banner (consent, under section 3-15 of the Norwegian Electronic Communications Act, ekomloven). Your consent lasts for 12 months, and you can change it under «Cookie settings» at the bottom of the page.
- Necessary: CookieHub, Cloudflare and WordPress make the site, login, language choice and your cookie choice work.
- Analytics: Google Analytics shows us in aggregate how the site is used. The data is deleted after 14 months.
- Marketing: HubSpot shows us which properties you have viewed and stores this on your customer record. Google Ads and the Meta pixel measure whether you came from an ad and are used to show ads to previous visitors. If you send us an inquiry, Google and Meta receive your email address and phone number in encrypted form. We are joint controllers with Meta for the collection through the pixel. We make no automated decisions with legal or similarly significant effects on you.
Maps and video: Google Maps and YouTube only load when you click «Activate map» or the video (consent). Google then receives your IP address and may set cookies. These cookies are therefore not listed in the cookie declaration, where you will find all the others.
7. Providers and transfers outside the EEA
These providers process data on our behalf under a data processing agreement: HubSpot (customer database, newsletter and tracking), Google (Google Analytics and email), CookieHub (consents), Cloudflare (security) and Kinsta (website hosting).
Google (Ads, Maps and YouTube) and Meta (the pixel) also use the data for their own purposes, under their own privacy policies. We disclose data to authorities when the law requires it, and we never sell it.
Facebook and Instagram: We are joint controllers with Meta, which has the main responsibility, for the statistics Meta gives us about our pages. We use the statistics to understand how the pages are used and to improve them (legitimate interest). Messages you send us there are handled like any other inquiry and are also stored by Meta.
Transfers: HubSpot, Google, Meta, Cloudflare and Kinsta have parent companies in the USA. Transfers there are based on the EU–US Data Privacy Framework, with the EU Standard Contractual Clauses as a fallback. You can ask for a copy of the clauses at post@soleada.no.
8. Your rights
You can object to what we do on the basis of legitimate interest (sections 2, 5, 6 and 7). We will then stop, unless we have compelling grounds or need the data for a legal claim. You can always object to marketing.
You also have the right to:
- access your data and get a copy
- have errors corrected
- have your data deleted when we no longer have a basis for keeping it
- ask us to restrict processing
- receive data you have given us in a machine-readable format, where the basis is consent or a contract
- withdraw your consent at any time, without affecting processing carried out before you withdrew it
Write to post@soleada.no. We reply within one month. You can complain to Datatilsynet, the Norwegian Data Protection Authority, or to the Agencia Española de Protección de Datos (AEPD) in Spain.
9. Changes
We update this policy when we change how we process personal data, and we let you know on the website or by email when the changes are significant.