Privacy Policy

The data controller for voyaspain.com is Voya Spain S.L. (CIF [CIF / NIF]), [Registered address, City, Postcode, Spain]. For any data-protection matter, contact privacy@voyaspain.com.

Voya operates a property portal connecting buyers with licensed real estate agents in Spain.

Buyers — name, email, phone (if provided), saved property preferences, saved searches, and enquiry history.

Agents — agency name, contact details, logo, profile information, licence number, XML feed URLs, and credit transaction history.

Valuation requests — property address and details, contact name, email, and phone.

Usage & technical data — pages visited, search queries, and property views. To count property popularity we process a one-way pseudonymised token derived from your IP address; the token is keyed to the day and cannot be used to re-identify you or linked across days. Analytics cookies are only used with your consent.

• Operating the platform & connecting buyers with agents — performance of a contract (Art. 6(1)(b)).
• Sharing your enquiry with the listing agent so they can respond — performance of a contract / your request (Art. 6(1)(b)).
• Transactional emails (enquiry confirmations, lead notifications, credit alerts) — contract / legitimate interest (Art. 6(1)(f)).
• Property-alert emails matching your saved searches — consent (Art. 6(1)(a)); opt-in only.
• Agent onboarding emails — legitimate interest (Art. 6(1)(f)); you can unsubscribe from any such email.
• Payment processing — contract and legal obligation (Art. 6(1)(b),(c)).
• Fraud prevention & measuring listing popularity — legitimate interest (Art. 6(1)(f)).
• Analytics cookies — consent (Art. 6(1)(a)).

We use the following service providers, each under a data-processing agreement, only as needed to run the platform:

• Supabase — database & authentication (EU region).
• Vercel — website hosting and delivery (USA).
• Brevo (Sendinblue) — transactional & onboarding email delivery (France, EU).
• Stripe — payment processing; PCI-DSS compliant, we never store card data (EU/USA).
• Google (Analytics & Translate) — consented analytics, and machine translation of listing descriptions (USA).
• wsrv.nl — image resizing/optimisation CDN (EU).

When you send an enquiry, your details are also shared with the specific listing agent so they can respond to you; that agent is an independent controller of the data you send them.

We never sell your personal data.

Some providers (Vercel, Google, and Stripe for certain operations) process data in the United States. These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, with additional safeguards where required.

We keep account data while your account is active. When you delete your account we erase your personal data promptly, except:

• Invoicing & payment records — retained in anonymised form for the period required by Spanish tax and commercial law (generally 4–6 years under the Ley General Tributaria and Código de Comercio).
• Enquiry contact details from buyers who did not create an account are anonymised automatically 24 months after the enquiry.

You have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interests. You can also withdraw consent at any time without affecting prior processing.

• Download your data and delete your account directly from your account settings (Agents: Profile & Settings; Buyers: Account).
• Unsubscribe from onboarding emails via the link in any such email.
• Cookies — change your analytics choice via the cookie banner at any time.
• Or email privacy@voyaspain.com; we respond within one month (Art. 12 GDPR).

If you believe we have not handled your data lawfully, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es — or with the supervisory authority in your country of residence.

See our Cookie Policy for the full list. In short: essential authentication cookies are always active; analytics cookies (Google Analytics) load only after you accept them, and you can decline or change your choice at any time via the banner.

We use HTTPS encryption, database row-level security, hashed passwords, and access controls. Payment data is handled entirely by Stripe and never touches our servers.

We may update this policy from time to time and will notify registered users of material changes by email.