Privacy policy
BASIC INFORMATION ON THE PERSONAL DATA PROTECTION REGIME FOR USERS AND STAFF
Controller: Ondara Capital, S.L. (GRUPO ONDARA), with registered office at C/Muntaner 354, 4º,2ª, 08012, Barcelona. Data Protection Officer contact details: dpo@prestamo.capital.
Purposes and legal basis: The main purpose is to process and manage your application and the actions and operations arising from it, which may include sending electronic commercial communications or contacting you using the contact details provided. The legal basis is your own application.
Recipients: data will not be disclosed to third parties except where legally required or where you have given your consent under a specific agreement with Prestamo Capital.
Source of the data: Provided by the data subject.
Rights: you may write to Prestamo Capital’s Data Protection Rights unit at its registered office or offices, or at the following email address: dpo@prestamo.capital, to exercise your rights of access, rectification, objection, erasure, restriction and portability, and the right to object to automated individual decisions that may significantly affect you or produce legal effects for you, in accordance with Article 22 of EU Regulation 2016/679.
To do so, you may send a written communication to:
Prestamo Capital
Ondara Capital, S.L. C/Muntaner 354, 4º,2ª
Postcode 08021 – Barcelona
Telephone: +34 932 20 22 63
solicitudes@prestamo.capital
Legal note
-Controller of your data: Identity: ONDARA CAPITAL, SL. (GRUPO ONDARA)
-Data Protection Officer contact details: dpo@prestamo.capital or by telephone on +34 932 20 22 63 / 611 677 119
-Purpose of processing your data: Commercial management, service improvement, purchase management and application management.
-The legal basis for processing the data will be the performance of a contract or the client’s consent.
-Recipients: data will not be disclosed, except with the data subject’s express authorisation and where required by law.
-Rights to access your personal data, request rectification, request erasure, request restriction of or object to its processing, withdraw consent and/or portability.
-Source: If the data are not obtained from the data subject, their origin and categories must be reported.
CONTROLLER OF YOUR DATA
-Identity: ONDARA CAPITAL, SL (GRUPO ONDARA)
-Tax ID (N.I.F.): B50300607
-Bank of Spain Financial Entity Code: D552
-Address: C/Muntaner 354, 4º,2ª, 08021, Barcelona
-Telephone: +34 932 20 22 63 / 611 677 119
-Email: contacto@prestamo.capital
-DPO contact: dpo@prestamo.capital
DATA PROTECTION OFFICER CONTACT DETAILS
For any questions or concerns about the protection of your data at GRUPO ONDARA, please contact: dpo@prestamo.capital or call +34 932 20 22 63 / 611 677 119.
PURPOSE OF PROCESSING YOUR DATA
All data provided through electronic forms and/or by email and/or by telephone, necessary for the correct identification of the sender and enabling us to carry out our commercial management tasks, will be processed with strict confidentiality in accordance with current law and will only be used by GRUPO ONDARA (ONDARA CAPITAL, S.L., VERN PROPERTIES, S.L., ANGELUM LEGAL, S.L) for the stated purpose and will not be disclosed to third parties.
WHY WE COLLECT YOUR PERSONAL INFORMATION:
The main reason we collect your personal information is to provide and improve the service that consumers and users expect from us. We collect your personal information to manage your purchases and the requests you make through our website, by telephone or on paper documents.
These are the purposes we have identified:
-Managing the contracting of products or services we offer through distance selling, and managing deliveries and returns.
-Channelling customers’ requests for information, suggestions and complaints for handling and resolution.
-Surveys to improve our services.
-Keeping our customers and users informed about our latest products, offers and opportunities by email, but only if you give us your consent.
-Compliance with legal obligations, including, without limitation, Law 10/2010 on the Prevention of Money Laundering.
Nevertheless, the User is informed that the security measures taken by GRUPO ONDARA are not infallible or invulnerable.
ACCESS TO ELECTRONIC OFFICES USING CL@VE PIN
In compliance with the Real Estate Credit Law and the Bank of Spain’s regulations, and in order to carry out a free study to ensure responsible lending, the lender, through a provider of access services to electronic offices and with the access service provider complying with current security and data protection regulations, will request authorisation from the borrower through the loan application form to access those electronic offices through the service provider.
Authorisation will be requested before the loan agreement is formalised and will allow the lender to access the electronic offices needed to obtain relevant and sufficient information on the borrower’s creditworthiness and ability to repay.
The borrower may revoke the authorisation at any time, without affecting the validity of the loan agreement. Revocation must be made in writing and addressed to the lender.
The authorisation request and access to the electronic offices will be carried out in accordance with the applicable personal data protection regulations, and respect for the borrower’s fundamental rights will be guaranteed at all times.
LEGAL BASIS
The legal basis for processing data may be the performance of a contract, compliance with a legal obligation, public interest or legitimate interest, protection of vital interests and the data subject’s consent. In the latter case, the user has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Providing personal data is a necessary requirement for entering into a contract, so you should provide it. If you do not, the contract could not be concluded, and we would therefore be unable to carry out any transaction.
HOW LONG WE WILL KEEP YOUR DATA
We only store your personal information to the extent that we need it in order to use it for the purpose for which it was collected, and according to the legal basis for its processing in accordance with applicable law. We will keep your personal information for as long as there is a contractual and/or commercial relationship with you, or as long as you do not exercise your right to erasure, cancellation and/or restriction of processing of your data. In these cases, we will keep the information duly blocked, without using it, for as long as it may be necessary for the exercise or defence of claims or as long as any judicial, legal or contractual liability may arise from its processing that must be addressed and for which its recovery is necessary.
LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA
The legal basis for processing the personal data provided through our website and/or through the various Customer Service channels is the express consent requested from the User through their agreement and acceptance of the checkbox for Privacy Policy in the sections for:
-Subscription to the monthly newsletter
-Contact form
-Order
-Acceptance of quote
The User may withdraw at any time their consent to the processing of the personal data provided for which they have given their agreement, without affecting the lawfulness of processing based on consent before its withdrawal.
The personal data requested are adequate and necessary for the performance of a contract and/or commercial relationship, compliance with various legal obligations, legitimate interest (for example, for fraud prevention or to manage requests, queries or possible complaints that may arise), and with your consent (for example, for sending special offers). The user is not obliged to provide them, but refusing to do so may limit the ability to respond to their queries and to formalise sales contracts.
DISCLOSURE OF YOUR PERSONAL DATA
In some cases we must communicate the information you have provided to third parties in order to provide the requested service, for example logistics, transport and delivery services, installers and/or fitters, etc. There are also companies that provide us with other types of services, such as information technology (storage and processing of information), financial services, audit services, etc. These third parties only have access to the personal information they need to carry out those services. They are required to keep your personal information confidential and may not use it in any way other than as we have requested. In all cases, ONDARA CAPITAL, SL takes responsibility for the personal information you provide, and we ask the companies with which we share your personal information to apply the same degree of information protection as we do. Your personal information will also be available to public authorities, judges and courts, to address any liabilities arising from the processing.
USER RIGHTS REGARDING THE PROCESSING OF THEIR PERSONAL DATA
Users may exercise the right to access their personal data, request the rectification of incorrect data and, where appropriate, request its erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
Users may request the restriction of the processing of their personal data, in which case GRUPO ONDARA will only keep them for compliance with legal and administrative obligations, the defence of our interests and rights, and the exercise or defence of claims, penalties and liabilities.
Users may object to the processing of their personal data. GRUPO ONDARA will stop processing their data, except for legitimate reasons or for the exercise or defence of possible claims, penalties and liabilities.
Users may also withdraw at any time their consent to any processing for which they have given consent, without affecting the lawfulness of processing based on consent before its withdrawal.
Users will likewise have the right to the portability of their personal data at any time.
Users may exercise all the rights listed above, under the terms and conditions provided for in current legislation, by written and signed request addressed to ONDARA CAPITAL, SL, at C/ Muntaner 354 4ª
Barcelona 08021, Spain, or by sending an email to legal@prestamo.capital
Requests made by email must be sent from the same email address registered by the applicant.
In both cases, to exercise these rights and to guarantee their identity, the User must attach to their request a copy of their valid National Identity Document or, where applicable, Foreigner Identification Number.
Likewise, if the User considers that their data have been processed inappropriately, they have the right to file a complaint or obtain further information about their rights with the Spanish Data Protection Agency (C/ Jorge Juan, 6. 28001 Madrid www.agpd.es).
SOURCE OF THE DATA
We collect personal data when you contact us through our website, by telephone or through paper documents. Below we explain the different ways in which we collect personal information about you and some examples of how we use that information.
Information you provide to us
We collect personal information you provide through our website, by email, by telephone, when you request a quote, contract a service, fill in a form, etc. For example, you are likely to provide us with information when you contact us to request a quote or place an order, complete a questionnaire, enter a competition, etc. The personal information we request from you is: first name and surname, address, DNI, email and contact telephone number. Under no circumstances, and for no purpose, will data on personal, academic or professional characteristics, employment details, or social or economic circumstances be collected.
Information we collect from your visits to our website
We collect and store limited personal information and anonymous aggregate statistics about all users who visit our website, whether because you actively provide that information or are simply browsing our website. The information we collect includes the Internet Protocol (IP) address of the device you are using, the browser you use, your operating system, the date and time of access, the internet address of the website from which you accessed our website and how you use our website, in order to know our website’s loading time, how it is used, the number of visits to the different sections and the type of information that most attracts visitors. It also helps identify whether the website is working properly and, if we detect faults or errors, to fix them and improve our website’s performance in order to offer a better service to all users. This information is collected through cookies; for more information see our cookie policy.
Social media
The use of social media is increasingly common. ONDARA CAPITAL, SL is present on most of them, and they are another way of contacting you. The information we collect through social media sometimes includes personal information that is available online and to the public. We always make sure that all the information we use is correctly attributed to its source or anonymised. These social networks are likely to have their own privacy policies explaining how they use and share your personal information. We recommend that you carefully review their privacy policies before using these social networks to make sure you are comfortable with the way your personal information is collected and shared.
Pursuant to Law 15/1999 of 13 December on the Protection of Personal Data, we inform you that by completing this form your personal data will be incorporated into and processed in files owned by GRUPO ONDARA, in order to manage, administer and maintain the Services provided and/or contracted, and to keep you informed, including by electronic means, about matters relating to the Company’s activity and services.
You may exercise, at any time, your rights of access, rectification, cancellation and objection regarding your personal data by sending an email to legal@prestamo.capital
Right of access, rectification, cancellation and objection
In accordance with current personal data protection legislation, you may contact ONDARA CAPITAL, SL as Data Controller to exercise your rights of Access, Cancellation, Rectification and Objection regarding the data included in the files for which it is responsible. These rights are strictly personal and will be exercised by the data subject, with no limitations other than those provided for in applicable legislation. However, the user’s legal representative may act when the user is incapacitated or a minor in a way that prevents them from exercising these rights personally, provided there is express representation authorised by the data subject.
The data cancellation procedure may be carried out by relatives in the case of deceased data subjects, as may the exercise of the right of access in the event of the data subject’s death.
You may exercise the right of access by means of a request addressed to ONDARA CAPITAL, SL as Data Controller, stating your identification and the file or files to be consulted. This right may be exercised once a year, unless a legitimate interest is proven. The Security Officer will decide on the access request within a maximum of thirty days from receipt of the request.
ONDARA CAPITAL, SL will only refuse access when the request is made by a person other than the data subject or when the exercise of the right is contrary to the terms established in current legislation.
If the decision is favourable, access will be provided within ten days following notification. The information, whatever the medium on which it is provided, will be given in a legible and intelligible form, after transcribing the data in the file in clear text, where applicable.
The information will include the data subject’s basic data and those resulting from any computer processing, as well as the origin of the data, the recipients to whom they have been disclosed and the specific uses and purposes for which the data were stored.
When access to the files reveals that the data subject’s data are inaccurate or incomplete, inadequate or excessive, you may request their rectification or, where appropriate, cancellation.
Rectification, cancellation and/or objection will be carried out by the file controller within ten days of receipt of the request. Such a request for rectification or cancellation will be made by email.
If the File Controller considers that the data subject’s request should not be granted, it will inform them, stating the reasons, within the period indicated in the previous section.
Where cancellation of the data is appropriate but their physical deletion is not possible, either for technical reasons or due to the computer medium used, ONDARA CAPITAL, SL will block the data to prevent their subsequent use until they are completely removed from the information systems.
Staff functions and obligations
Every user with access to GRUPO ONDARA’s information systems or services, and especially to personal data, is obliged to know and observe the measures, rules, procedures, regulations and standards affecting the functions they perform, as specified in this document.
Users are obliged to notify the Data Protection Officer (DPO), at dpo@prestamo.capital, of any security incidents they become aware of. A security incident is any anomaly that affects or may affect the security of data, such as loss or deterioration of data in any transmission, failure of computer systems, compromise of access credentials or loss of any physical or automated medium that may contain confidential or personal data.
User names and access passwords
Access to computer systems or services will require authentication by user name and password. This authentication must be sufficiently secure, with a password valid for no more than one year and of adequate complexity.
Disclosing the user ID and password is prohibited. If the user suspects that someone else knows their identification and access details, they must change their password or inform the DPO so that a new temporary password is assigned, which the user must change on first access. Responsibility for any action carried out with a user’s credentials will initially lie with that user, and may be of a criminal nature.
In the event of a user’s leave or temporary absence, the Head of their Department may ask the DPO to create new user IDs and passwords for the designated person.
Users are obliged to use GRUPO ONDARA’s corporate cloud and its data without engaging in activities that infringe the rights of the entity or third parties, or that may be contrary to morality or the etiquette of online networks.
Any user who copies to another medium or location any information that may contain personal data must request authorisation from the DPO, if this is provided for in their duties, and must report that such a copy has been made, the data it contains and its purpose.
The following activities are expressly prohibited:
– Sharing or providing the user IDs and passwords issued by GRUPO ONDARA with any other natural or legal person, including the entity’s own staff. In case of breach of this prohibition, the user is solely responsible for the acts carried out by the natural or legal person who makes unauthorised use of the user’s ID.
– Attempting to decipher passwords, encryption systems or algorithms and any other security element involved in GRUPO ONDARA’s online processes.
– Destroying, altering, disabling or in any other way damaging the data, programs or electronic documents of the Entity or third parties.
– Deliberately obstructing other users’ access to the network through massive consumption of the entity’s IT and telematic resources, and carrying out actions that damage, interrupt or cause errors in those systems.
– Sending mass emails or emails for commercial or advertising purposes without the consent of the recipient and the DPO.
– Attempting to read, delete, copy or modify other users’ emails or files.
– Using the system to attempt to access restricted areas of the computer systems of GRUPO ONDARA or third parties.
– Deliberately introducing programs, viruses, macros, applets, ActiveX controls or any other logical device or character sequence that causes or is likely to cause any kind of alteration in the computer systems of the entity or third parties.
– Introducing, downloading from the Internet, reproducing, using or distributing computer programs not expressly authorised by GRUPO ONDARA, or any other type of work or material whose intellectual or industrial property rights belong to third parties, without authorisation to do so.
– Installing illegal copies of any program and/or deleting any legally installed programs.
– Using GRUPO ONDARA’s telematic resources, including the Internet, in a way unrelated to the activities of the user’s job.
– Introducing obscene, immoral or offensive content and, in general, content of no use to the entity’s objectives into the entity’s corporate network.
Confidentiality of information
– Sending confidential GRUPO ONDARA information to third parties on physical media or through any means of communication, including simply viewing or accessing it, is not permitted. Third parties are any user, service or device outside GRUPO ONDARA’s corporate network (public and private cloud).
– Any information introduced into the corporate network through messages of any kind must comply with the requirements set out in these rules and, in particular, those relating to intellectual and industrial property, privacy and the control of viruses and other malicious code.
– Users of the corporate information systems must maintain the utmost discretion and must not disclose or use, directly or through third parties or entities, the data, documents, methodologies, passwords, analyses, programs and other information to which they have access during their contractual relationship with GRUPO ONDARA and related entities, whether on physical or electronic media. This obligation will remain in force after the termination of the contract, until such information ceases to be confidential or becomes public domain.
– If, for reasons directly related to their job, the user comes into possession of confidential information on any type of medium, such possession must be understood to be strictly temporary, subject to secrecy and without giving rise to any right of possession, ownership, copying or payment for such information. The user must also return such materials to the entity immediately after completing the tasks that gave rise to their temporary use and, in any case, at the end of the contractual relationship. Continued use of the information in any format or medium other than as agreed and without the entity’s knowledge does not in any case constitute an amendment to this section.
– Any file not generated by professional activity, especially containing personal information or suspected of malware or of infringing copyright, located in any storage owned by GRUPO ONDARA, will be blocked or deleted, with notification to the user and the corresponding incident being recorded.
Use of email and cloud applications
The computer system, corporate network, Internet access, terminals and services provided to the user are the property of GRUPO ONDARA. The use of these resources provided by the organisation is limited to matters directly related to the Entity’s activity and the duties of the job. They are for the exclusive use of their holder to facilitate their work and professional activity, and only for the duration of the relationship between the user and the Entity.
Personal services must not be used for professional purposes (personal email, Drive, Instagram, Facebook…), especially for uses involving confidential or personal data. Conversely, GRUPO ONDARA’s resources and services must not be used for personal purposes (corporate email, storage, PC, phone…).
Access from devices not belonging to GRUPO ONDARA, especially mobile devices, must be carried out with the highest level of security compatible with productive use:
If, for the sake of productivity, it suits the user to install an application client on a home PC, laptop or personal smartphone to access a service that handles confidential information, these devices must have, with greater rigour, sufficient security measures: up-to-date antivirus, a secure password, session lock after at most 5 minutes and, where necessary, data encryption.
If the device is lost or unauthorised access is suspected, the DPO must be informed immediately so that the password can be changed and, where appropriate, the security incident reported to the AEPD.
Data protection for staff
Prohibited acts:
– Creating personal data files without the DPO’s authorisation.
– Cross-referencing information from different files or services in order to establish personality profiles, consumption habits or any other type of preferences, without the DPO’s express authorisation.
– Any other activity expressly prohibited in this document or in the data protection rules and AEPD Instructions. personal data collected through the website are used solely for the purpose of providing the requested services and invoicing them. Your data will be stored in files owned by Prestamo Capital for invoicing purposes and will be archived for the legally required period. You may exercise your rights of access, rectification, cancellation and objection by writing to Prestamo Capital – Ondara Capital, S.L. at C/Muntaner 354, 4º,2ª 08021 Barcelona.
Information clause on Grupo Ondara’s right to consult the Bank of Spain CIR.
– The CIR or Central Credit Register of the Bank of Spain (CIRBE) is a public service that manages a database containing all the loans, credits, guarantees and risks assumed by financial institutions with their clients, whether natural or legal persons.
– Law 5/2019 of 15 March regulating real estate credit agreements contains transparency and conduct rules imposing obligations on lenders and credit intermediaries, as well as their appointed representatives, supplementing and improving the existing framework of Order EHA/2899/2011 of 28 October and Law 2/2009 of 31 March regulating the contracting with consumers of mortgage loans or credit and of intermediation services for the conclusion of loan or credit agreements. It also describes the use by real estate credit intermediaries and reporting entities, which may only process the information provided by the Bank of Spain to assess the risk related to the transactions justifying the request for the CIR report; they may not use the data for any other purpose.
– In compliance with regulations, and specifically paragraph 5 of section a) of the sixteenth rule of Bank of Spain Circular 1/2013 of 24 May on the Central Credit Register, Grupo Ondara hereby informs of the right of the Entity Grupo Ondara to request the data in the CIR report in order to assess the risk of the transaction, and of the obligation to adopt measures to guarantee the confidentiality and protection of the data consulted, and to inform users about the liability regime and the procedures for exercising their rights of access, rectification, cancellation or objection, in accordance with personal data protection regulations.
– Bank of Spain Financial Entity Registration Code: D552
