Privacy policy

The website www.realmaker.ai and the REALMAKER AI platform, with all its content and functionalities, belong to PLACE ANALYTICS, S.L. (hereinafter "REALMAKER AI"), registered in the Commercial Registry of Asturias on 04/17/2015, Volume 4133, Page 210, Registration 1st, AS-48126. This Privacy Policy regulates the processing of personal data collected through the REALMAKER AI platform, including interactions managed by the conversational assistant based on artificial intelligence (hereinafter, the "Bot") that operates in the Client's messaging channels. Its reading and understanding is complementary to the General Terms and Conditions of Service, of which this policy is an extension in matters of data protection. This policy is applied in compliance with Regulation (EU) 2016/679, of April 27, regarding the protection of natural persons with regard to the processing of personal data (GDPR), and Organic Law 3/2018, of December 5, on Protection of Personal Data and guarantee of digital rights (LOPDGDD).

1. DATA CONTROLLER

2. DUAL ROLE IN DATA PROCESSING: CONTROLLER AND PROCESSOR

Given the nature of the Service, PLACE ANALYTICS, S.L. acts in a dual capacity depending on the origin and context of the data processed. It is important to clearly distinguish both roles:

2.1 PLACE ANALYTICS, S.L. as Data Controller

PLACE ANALYTICS, S.L. acts as Data Controller with respect to the personal data of the Client (agency or real estate professional), that is, the data provided directly by the natural or legal person who contracts the REALMAKER AI Service. This includes registration data, platform usage, billing and commercial communications.

2.2 PLACE ANALYTICS, S.L. as Data Processor

When the Bot interacts with Third Party Interested Parties (buyers, sellers, tenants, landlords or other contacts) through the Client's messaging channels, the personal data collected in those conversations is processed on behalf of the Client. In this context, the Client acts as Data Controller of such data, and PLACE ANALYTICS, S.L. will act as Data Processor under the terms of Article 28 of the GDPR.

In its capacity as Processor, PLACE ANALYTICS, S.L. undertakes to:

• Process data only in accordance with the documented instructions of the Client.
• Not transfer or communicate data to third parties except by express instruction of the Client or legal requirement.
• Apply appropriate technical and organizational measures to ensure data security.
• Assist the Client in complying with their obligations in response to requests for the exercise of rights by Third Party Interested Parties.
• Delete or return data to the Client once the provision of the Service is completed, unless there is a legal obligation to retain it.

The Client, in its capacity as Data Controller, assumes the obligation to inform Third Party Interested Parties about the processing of their personal data prior to or simultaneously with the start of the conversation with the Bot, as well as to have a valid legal basis for such processing. PLACE ANALYTICS, S.L. will not be responsible for the Client's failure to comply with these obligations.

3. DATA COLLECTED

3.1 Client Data (processed by PLACE ANALYTICS, S.L. as Controller)

During registration and use of the REALMAKER AI platform, the following data is collected:

User data:

• Name and surname
• Email
• Phone
• Position in the company

Company data:

• Company name or business name
• Tax ID
• Tax and postal address
• Website
• Contact phone and email
• Logo and visual identity

Usage and configuration data:

• Instructions and prompts configured by the Client to customize the Bot's behavior.
• Parameters and conversational flows defined by the Client.
• Platform access logs (IP address, date and time, activity).
• Access credentials (stored in encrypted form).

Data linking with third-party platforms:

• Authorization tokens and access credentials to the Client's Meta accounts (WhatsApp Business, Instagram Direct), necessary for Bot operation. This data is processed exclusively for the provision of the Service and is not stored beyond what is strictly necessary.
• Email address synchronized with the Service.

Under no circumstances will credit card data or CVC be stored, which are managed exclusively through the payment gateway enabled at any time, which complies with PCI-DSS security standards.

3.2 Third Party Interested Party Data collected by the Bot (processed as Data Processor)

During conversations that the Bot maintains with Third Party Interested Parties through the Client's messaging channels, the following personal data may be collected, always depending on the flows configured by the Client:

Identification and contact data:

• Name and surname.
• Phone (messaging channel identifier).
• Email, if the Third Party Interested Party voluntarily provides it.

Real estate qualification data:

• Type of operation of interest (sale, rental, others).
• Budget or indicated price range.
• Geographic area or locality of interest.
• Characteristics of the property sought or to sell (area, rooms, type, etc.).
• Estimated operation time and urgency level.
• Financing situation declared by the interested party.
• Assessment of the level of interest or commercial qualification generated by the Bot.

Conversational data:

• Complete content of conversations held between the Bot and the Third Party Interested Party, to the extent that they are retained according to the Service configuration.
• Conversation metadata (date, time, channel, duration).

The exact scope of the data collected will depend on the conversational flows that the Client has configured. PLACE ANALYTICS, S.L., as Data Processor, does not determine what data the Bot requests or for what purpose, the Client being solely responsible for such decisions. PLACE ANALYTICS, S.L. recommends that the Client configure the Bot in accordance with the principle of data minimization, collecting only the information strictly necessary for their activity.

The data of Third Party Interested Parties will never be used by PLACE ANALYTICS, S.L. for its own purposes, nor transferred to third parties without express instruction from the Client, except by legal obligation.

4. PURPOSES OF PROCESSING

4.1 Regarding Client data

Client data is processed for the following purposes:

• 1. Management of the contractual relationship: provision of the Service, billing, customer service and compliance with obligations arising from the contract.
• 2. Creation and maintenance of the profile on the platform. This profile is private and only visible to the Client.
• 3. Service improvement through anonymized analysis of usage behavior, to adapt functionalities to user needs.
• 4. Commercial communications about new products, functionalities or Service improvements, provided that the Client has given their consent.
• 5. Prevention of fraud and abuse in the use of the platform.
• 6. Compliance with legal obligations and transfer to public authorities when required by applicable regulations.

4.2 Regarding Third Party Interested Party data

The data collected by the Bot in conversations with Third Party Interested Parties is processed exclusively on behalf of the Client and for the purposes that the Client determines in the exercise of their real estate activity. In general, such purposes will include contact qualification, lead management and commercial follow-up.

PLACE ANALYTICS, S.L., as Data Processor, does not determine or control the purposes for which the Client processes this data, and assumes no responsibility derived from the use that the Client makes of it.

5. LEGAL BASIS FOR PROCESSING

5.1 Client Data

• a) Performance of the contract: for the purposes described in section 4.1.1 above.
• b) User consent: for the purposes of sections 4.1.2 to 4.1.4.
• c) Legitimate interest of PLACE ANALYTICS, S.L.: for the purpose of fraud prevention (section 4.1.5).
• d) Compliance with legal obligations: for transfer to public authorities (section 4.1.6).

5.2 Third Party Interested Party Data

The legal basis for processing Third Party Interested Party data is for the Client to determine in their capacity as Data Controller. PLACE ANALYTICS, S.L. recommends that the Client ensure that they have a sufficient legal basis —typically the consent of the interested party or legitimate interest in the context of the pre-contractual relationship— before activating the Bot on their messaging channels.

6. DATA RETENTION

Client data will be retained during the term of the contractual relationship and, once it ends, during the limitation periods for applicable legal actions, unless the Client requests its deletion before such periods expire.

Third Party Interested Party data collected by the Bot will be retained for the time that the Client determines in accordance with their own data retention policy, in all cases respecting legal limits. PLACE ANALYTICS, S.L. will not retain this data beyond the time necessary for the provision of the Service, except by express instruction from the Client or legal requirement.

Conversation records will be retained during the period agreed in the particular conditions of the Service. Once this period expires, they will be securely deleted or returned to the Client, as agreed.

7. RECIPIENTS AND INTERNATIONAL TRANSFERS

Client data will not be transferred to third parties, except in the following cases:

• a) Legal obligation: when required by applicable regulations or requested by competent authorities.
• b) Technology service providers: PLACE ANALYTICS, S.L. may use sub-processors (cloud infrastructure providers, artificial intelligence models, messaging platforms) necessary for the provision of the Service. Corresponding data processing agreements will be signed with all of them to ensure GDPR compliance.
• c) Meta Platforms, Inc.: the operation of the Bot through WhatsApp Business and Instagram Direct involves the processing of data in the infrastructures of Meta Platforms, Inc., a company based in the USA. This processing is covered by standard contractual clauses and other guarantees provided in the GDPR for international data transfers. The Client, by authorizing the connection of their Meta accounts with the Service, declares to know and accept this circumstance.

International data transfers that may arise from the use of providers located outside the European Economic Area will always be carried out with the appropriate safeguards required by the GDPR (Article 46), and will be reported to the Client when required.

Payment data is not stored by PLACE ANALYTICS, S.L. and is managed exclusively through the payment gateway enabled at any time, in accordance with PCI-DSS standards.

8. RIGHTS OF DATA SUBJECTS

8.1 Client Rights

The Client may exercise at any time and free of charge the following rights over their personal data:

• Access: obtain confirmation as to whether PLACE ANALYTICS, S.L. processes data concerning them and access to it.
• Rectification: request correction of inaccurate or incomplete data.
• Deletion: request deletion of their data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
• Restriction of processing: request that their data be kept only for the exercise or defense of claims.
• Portability: receive their data in a structured format, commonly used and machine-readable.
• Objection: object to the processing of their data for reasons related to their particular situation.
• Withdrawal of consent: at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

To exercise any of these rights, the Client may contact:

Please attach to the request a copy of the document proving the identity of the applicant, and indicate the right to be exercised and the contact details used on the platform.

8.2 Rights of Third Party Interested Parties

Third Party Interested Parties whose data has been collected by the Bot through the Client's messaging channels must direct the exercise of their rights directly to the Client, in their capacity as Data Controller. The Client is solely obliged to attend to and resolve such requests.

However, if a Third Party Interested Party contacts PLACE ANALYTICS, S.L. to exercise their rights, it will inform them of the identity of the corresponding responsible Client, to the extent that such information is available and its communication is appropriate.

8.3 Complaints to the supervisory authority

Any person who considers that their rights in matters of data protection have been violated may file a complaint with the Spanish Data Protection Agency (AEPD):

9. INFORMATION SECURITY

PLACE ANALYTICS, S.L. applies the necessary technical and organizational measures to ensure the confidentiality, integrity and availability of the personal data processed, in accordance with the standards of the organization's information security management system, aligned with the requirements of the UNE-ISO/IEC 27001 standard.

Among the measures adopted are included, on an illustrative and non-exhaustive basis: encryption of access credentials, access control by roles, periodic security audits, incident management protocols and business continuity plans.

In the event that a personal data security breach occurs that could pose a risk to the rights and freedoms of natural persons, PLACE ANALYTICS, S.L. will notify it to the AEPD within the deadlines provided by the GDPR and, when required, to the affected interested parties.

The Client is advised to keep their access credentials in strict confidentiality, not share them with third parties and notify REALMAKER AI immediately in case of any unauthorized use or suspicion of compromise. Likewise, it is recommended to keep devices used to access the Service updated and protected with security software.

10. USE OF COOKIES AND BROWSING DATA

The platform www.realmaker.ai may use cookies and similar technologies for session maintenance, user preferences and analysis of platform usage. Detailed information on the use of cookies, their type and available configuration options is contained in the Cookie Policy accessible from the main page of the website.

PLACE ANALYTICS, S.L. records the IP address of each access to the platform for security purposes, access control and detection of unauthorized uses.

11. PRIVACY POLICY MODIFICATIONS

PLACE ANALYTICS, S.L. reserves the right to update this Privacy Policy to adapt it to regulatory, jurisprudential changes or modifications in the functionalities of the Service. Any relevant modification will be communicated to the Client with sufficient advance notice through the usual channels or by publication on www.realmaker.ai. It is recommended to periodically review this policy.