Privacy Policy

1. Who we are

Data controller: Albia Reformas S.L. ("Albia", "we"), Valencia, Spain. For privacy questions write to privacy@albiareformas.com.

2. What data we collect

• Identification & contact: name, email, phone, postal address.
• Project data you provide: property address, photos, briefs, messages.
• Billing data: VAT number, invoicing address, payment receipts.
• Partner/agency data: company, commission tier, payout method.
• Technical: a salted hash of your IP for abuse prevention, user-agent string, and minimal session cookies. We do not log raw IP addresses.

3. Why we use it (legal bases)

• Contract (Art. 6(1)(b) GDPR): to send quotes, run projects, issue invoices.
• Legal obligation (Art. 6(1)(c)): accounting and tax records (10-year retention).
• Consent (Art. 6(1)(a)): contact form, marketing emails, partner referrals.
• Legitimate interest (Art. 6(1)(f)): fraud prevention, service security.

4. Who receives it

• Our staff, on a need-to-know basis (access is audited).
• Sub-processors under DPA: hosting (Cloudflare / Supabase EU), email delivery, payments.
• Tax authorities and auditors, when legally required.
• We do not sell your data and do not transfer it outside the EU without SCCs.

5. How long we keep it

• Leads & quotes: up to 24 months from last contact, then deleted.
• Active projects: for the project lifetime + 5 years.
• Invoices & accounting: 10 years (Spanish Commercial Code).
• Audit log: 2 years, then archived.

6. Your rights

Under the GDPR you can access, rectify, erase, restrict or object to processing, and ask for portability. Signed-in users can do this from /account/privacy. You may also lodge a complaint with the Spanish data-protection authority (AEPD,www.aepd.es).

7. Security

Data is encrypted in transit (TLS 1.3) and at rest. Access is gated by role-based policies (RLS) at the database layer. Sensitive operations are logged in an immutable audit log.

8. Changes to this policy

We may update this policy. Material changes will be announced in-app and by email. The version history is kept in our records and available on request.