Privacy policy
What data we process, why we may do so and what you can require of us.
Last updated: 21 September 2026.
1. Who the controller is
The controller for the data collected through finkua.es is:
- Name: Ismael M. Ezearouali (sole trader)
- Tax ID: X0851634J
- Address: Calle Vizcaya 6, 29640 Fuengirola, Málaga (Spain)
- Contact email: info@finkua.es
For anything to do with your data you can write to us at that address with «Data protection» in the subject line.
2. Two different roles: controller and processor
It is worth separating them from the outset, because who you should approach depends on it.
For the data of anyone who visits this site, requests a demonstration or takes out Finkua —normally the property manager and their team—, Finkua is the controller, and this policy is the one that applies.
For the data of owners and associations that each firm enters into its instance —names, ownership shares, statements, portal requests—, the controller is the firm that manages the association. Finkua acts as a processor under article 28 GDPR and the processing agreement signed with each firm: we process that data solely on its instructions, to provide it with the service, and we do not use it for our own purposes. If you are an owner and wish to exercise your rights, approach your building's manager.
3. What we process and on what legal basis
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Contact form and demonstration request | Name, company, email, phone and the content of the message | Pre-contractual steps at the data subject's request (art. 6.1.b GDPR) | One year from the last exchange, unless it turns into a contractual relationship |
| Sign-up and provision of the service | Identification, contact and billing data of the firm and its users | Performance of the contract (art. 6.1.b) and legal obligation in tax and accounting matters (art. 6.1.c) | For the term of the contract and, afterwards, the tax and commercial limitation periods |
| Legal copilot | Text of the query written by the manager, and the answer | Performance of the contract (art. 6.1.b) | It stays in the firm's instance for as long as the firm decides |
| Association portal | Name, email, role on the board and content of the requests | Processing on behalf of the firm, which is the controller (art. 28) | As set by the firm |
| Website analytics | Cookie identifiers, pages viewed, source of the visit | Consent (art. 6.1.a), given and withdrawn from the cookie notice | As stated in the cookie policy |
| Security and activity logs | IP address, date and time, browser, operations performed | Legitimate interest in the security and integrity of the service (art. 6.1.f) | Twelve months |
4. Who else sees this data
We do not sell personal data and we do not disclose it to third parties for advertising purposes. The suppliers needed to provide the service are involved, all of them under a processing agreement:
- OVH SAS (France): hosting of the servers and the backups. The data stays in the European Union.
- Anthropic PBC (United States): language model that drafts the legal copilot's answer.
- Google Ireland Limited: website analytics, only if you accept the corresponding cookies.
Data is also disclosed to public authorities and financial institutions where a legal rule requires it.
5. Transfers outside the European Union
The only routine international transfer is the legal copilot's: the text of the query is sent to Anthropic PBC, in the United States, to generate the answer. The transfer relies on the standard contractual clauses approved by the European Commission, and the terms of use of its API do not provide for queries to be used to train models.
The copilot is meant for questions of law, not for cases with names attached: we recommend not including owners' personal data in the text of the query. The corpus it answers from is the consolidated text of the Act published in the BOE, not the association's file.
Google analytics is only switched on with your consent and may involve processing outside the European Union under the safeguards that provider has published.
6. Automated decisions
We do not take automated decisions producing legal effects on individuals, and we do not build profiles. The legal copilot's answer is a draft that the chartered manager reviews, corrects and signs before it goes out: the professional judgement and the responsibility remain theirs.
7. Security
Each firm has its own database and its own domain, with no data shared with another client. Communications are encrypted (HTTPS), access is controlled by user and profile, and backups are taken regularly. No measure removes risk entirely, but we keep the technical and organisational measures required by article 32 GDPR and review them whenever the service changes.
8. Your rights
You may ask us for access to your data, its rectification or erasure, the restriction of processing, portability and to object to it, as well as withdrawing at any time the consent you have given, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to info@finkua.es stating the right you are exercising and attaching a document proving your identity. We will reply within one month.
If you consider that we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).
9. Cookies
This site uses first-party cookies necessary for it to work and, if you accept them, analytics cookies. The detail is in the cookie policy, and you can change your choice from the notice shown when you arrive.
10. Changes to this policy
If the service changes and with it the processing of data, we will update this text and change the date at the top of the page.