Privacy policy
Last updated: 12 November 2026
This policy explains how Alveo Finance processes the personal data collected on the finance.alveo.co website, in French, English and Spanish. It applies the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Spanish Organic Law 3/2018 on data protection (LOPDGDD) and Spanish Law 34/2002 on information society services (LSSI-CE).
1. Data controller
- Company
- Alveo Finance Management, S.L. (trade name: Alveo Finance)
- Tax ID (NIF)
- B27611433
- Registered office
- Calle de la Purísima 5, 33, 46001 Valencia (España)
- Contact about your data
- rgpd@alveo.co
Further details about the company are given in the legal notice.
2. Processing carried out on this website
For each processing activity: its purpose, the data processed, its legal basis, its recipients and how long the data are kept.
2.1 Request for the mortgage guide
- Purpose
- To give you the guide to property financing in Spain (a download link appears once the form is sent) and to contact you again about your financing project.
- Data
- First name, surname, email address, phone number (optional), page language and address, and the information on where your visit came from described in the Cookies section (campaign parameters, referring site, first page viewed, session identifier and date).
- Legal basis
- Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
- Recipients
- Our processors n8n (receipt of the form), Pipedrive (contact record) and Brevo (email tool: contact record and list of guide requests).
- Retention
- As long as needed to handle your request, then 3 years after the last exchange if no contract is concluded.
2.2 Messages and complaints sent by email
- Purpose
- To answer your questions and to handle your complaints and requests to exercise your rights.
- Data
- Email address, name, content of the message and attachments.
- Legal basis
- Pre-contractual steps or performance of the contract (Art. 6(1)(b) GDPR) for questions about our services. Legal obligation (Art. 6(1)(c) GDPR) for complaints (Law 5/2019, Art. 35) and for exercising your rights (Art. 12 GDPR).
- Recipients
- Google (Google Workspace email). The Banco de España, if you refer a complaint to it.
- Retention
- As long as needed to handle your message, then 3 years after the last exchange.
2.3 Simulator, client area and mortgage application
The simulator, the client area and the preparation of your application are in the Alveo Finance app, at finance-app.alveo.co. The data controller is the same. This processing is described in the app's privacy policy. In short:
- Purpose
- To calculate an estimate, review your application, present it to lenders and comply with our obligations as a mortgage credit intermediary.
- Legal basis
- Pre-contractual steps and performance of the contract (Art. 6(1)(b) GDPR); legal obligation (Art. 6(1)(c) GDPR, Law 5/2019).
- Recipients
- The lenders to which your application is presented, on your instructions.
- Retention
- The length of the relationship, then at least 6 years for the pre-contractual information provided (Law 5/2019, fourth additional provision) and 6 years for accounting records (Spanish Commercial Code, Art. 30).
When you open the simulator from this website, the link passes on to the app the information on where your visit came from described in the Cookies section.
2.4 Browsing and website security
- Purpose
- To display the pages and keep the website secure and working properly.
- Data
- IP address, browser and device type, pages requested, date and time.
- Legal basis
- Legitimate interest (Art. 6(1)(f) GDPR): providing an available and secure website.
- Recipients
- Vercel Inc., the website host.
- Retention
- The limited period for which the host keeps its technical logs.
2.5 Content loaded from other websites
Some pages ask your browser to load public data from third parties. They then receive your IP address and the address of the page, as with any content loaded on the internet. Our survey found no cookies set by these services.
- Banco de España (public statistics, app.bde.es): average rate on new mortgage loans, on the home page.
- Wikimedia Foundation (Wikipedia, en.wikipedia.org): photos and summaries of towns, on the Regions pages in English and Spanish.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR), displaying up-to-date public data.
Audience measurement and advertising are described in the Cookies and other trackers section.
3. Whistleblowing channel
The whistleblowing channel of this website applies Spanish Law 2/2023 of 20 February on the protection of persons who report regulatory breaches and on the fight against corruption.
- Data controller
- Alveo Finance Management, S.L., NIF B27611433.
- Purpose
- To receive and investigate reports made through this website's whistleblowing channel, and to decide what action to take.
- Legal basis
- Legal obligation (Art. 6(1)(c) GDPR, in connection with Article 30 of Law 2/2023). For a company that is not required to have a channel, a task carried out in the public interest (Art. 6(1)(e) GDPR) within the meaning of the same law.
- Data
- Whatever you choose to provide. You may report anonymously. If a report contains special category data that are not necessary, they are deleted without delay (Art. 32 of Law 2/2023). The channel page loads no audience measurement or advertising tool, and the form sends no browsing data.
- Confidentiality
- Your identity is not disclosed to the person concerned by the report or to third parties, except to the judicial authority, the public prosecutor or the competent administrative authority in the course of an investigation (Art. 33).
- Access
- Limited to the person in charge of the internal reporting system and, where necessary, to the persons conducting the investigation (Art. 32).
- Recipients and processors
- The n8n automation tool, which receives the form and forwards it by email to the channel's address (calidad@alveo.co, Google Workspace email). No transfer to a sales tool (CRM).
- Retention
- The data stay in the system for as long as needed to decide whether to open an investigation. If no investigation is opened, they are deleted 3 months after the report is received; only an anonymised record may be kept to show that the system works (Art. 32). If an investigation is opened, they are kept for the duration of the investigation and of any resulting proceedings. The register of reports received is not public and keeps no data for more than 10 years (Art. 26).
- Rights
- Those set out in the Your rights section. The person concerned by a report cannot obtain the reporting person's identity by exercising the right of access.
4. Recipients and processors
Our processors (encargados del tratamiento) process data on our behalf and only on our instructions. Those involved on this website:
| Provider | Service | Data concerned |
|---|---|---|
| Vercel Inc. | Website hosting | Browsing data (technical logs) |
| n8n, served through the Cloudflare, Inc. network | Receipt of forms (guide, whistleblowing channel) | Data entered in those forms |
| Pipedrive | Contact management (CRM) | Guide requests |
| Brevo | Email tool | Guide requests |
| Google (Google Workspace) | Emails received, reports forwarded by the channel | |
| Google Ireland Limited | Google Tag Manager, Google Analytics and Google advertising services | Browsing data (see Cookies) |
| Meta Platforms Ireland Limited | Meta pixel, with your consent | Browsing data (see Cookies) |
The following also receive data, as controllers of their own processing: the lenders that review your application, on your instructions; the authorities (Banco de España, tax authorities, courts) where the law requires it.
5. Transfers outside the European Economic Area
Some providers are based in the United States or belong to US groups: Vercel, Cloudflare, Google, Meta and, for Wikipedia content, the Wikimedia Foundation. These transfers rely on the European Commission's adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) for certified companies and, failing that, on the standard contractual clauses adopted by the European Commission (Art. 46 GDPR).
6. Your rights
You may at any time:
- access your data and obtain a copy;
- have them rectified or erased;
- object to their processing or ask for it to be restricted;
- ask for data portability;
- withdraw your consent, without affecting processing carried out before the withdrawal;
- not be subject to a decision based solely on automated processing.
Write to rgpd@alveo.co or by post to the registered office given above. We reply within one month, which may be extended by two months for complex requests, in which case we will tell you (Art. 12(3) GDPR). We only ask for proof of identity if we have reasonable doubts about who you are.
You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD): Edificio Cuzco IV, Paseo de la Castellana 141, planta 9, 28046 Madrid; www.aepd.es; electronic office sedeaepd.gob.es. You may also contact the data protection authority of the EU country where you live (Art. 77 GDPR).
7. Cookies and other trackers
The details (names, providers, durations) and the tool to manage your choices are on the Cookie policy page. In short, according to our survey of 12 November 2026:
- Before you make a choice, and if you refuse, no cookies are set. The website does, however, store in your browser (local storage) where your visit came from, and Google Tag Manager loads: Google Analytics then receives, for each page viewed, a cookieless signal stating that you have not given your consent (Google consent mode).
- If you accept audience measurement, Google Analytics sets its cookies.
- If you accept advertising and social media, the Meta pixel loads and Google Analytics data are also used by Google's advertising services.
Audience measurement and advertising are based on your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). You can withdraw it at any time with the "Manage my cookies" button at the bottom left of the pages, or on the Cookie policy page.
8. Other information
Required data
In the guide form, your first name, surname and email address are needed to handle your request; the phone number is optional. In the whistleblowing channel, the questions marked with an asterisk are required, but you may remain anonymous.
Simulations and decisions
The simulator's result is an indicative estimate. It is neither an offer nor a refusal of credit: the decision to grant a loan lies with the lender, after reviewing your application.
Minors
This website is intended for adults. A person under 14 cannot consent alone to the processing of their data (Art. 7 LOPDGDD).
Data about other people
If you give us data about another person (co-borrower, spouse), you must inform them and make this policy known to them.
Security
Exchanges with the website are encrypted (HTTPS). We apply appropriate technical and organisational measures, and access to data is restricted to the people who need it.
Changes
We may change this policy, in particular if the website or the law changes. The date of the last update is shown at the top of the page.