Privacy policy

1. Data controller

Controller

COMPLETAR_RAZON_SOCIAL

NRT

COMPLETAR_NRT

Registered address

COMPLETAR_DOMICILIO_SOCIAL

Contact

ticand@gmail.com

2. Legal framework

Andorra is not part of the European Union. Data processing is governed by the Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals, and the competent supervisory authority is the Agència Andorrana de Protecció de Dades (APDA). Andorran law is aligned with the European standard, and the European Union recognises Andorra as a territory with an adequate level of protection.

3. What data we process

Browsing MercatImmo requires no account and asks for no identifying data. Looking at prices, maps, the market and listings works without an account and without identifying you.

Browsing without an account involves a single category of information:

• Technical connection data. The server records the IP address, the date and time, the path requested and the user agent, in the web service's own logs. They are necessary to provide the service and to detect abuse or security incidents.

If you decide to create an account to save searches and receive alerts, the following are also processed:

• Your email address. It is the only personal datum asked of you, and it is essential: it acts as the account identifier, it is the means of access —you sign in through a link sent by email, with no password— and it is the address the alerts are sent to.
• Session and sign-in data. Sign-up date, last sign-in date, and the browser and IP address from which each sign-in link was requested. They serve to sustain the session and to detect abusive requests.
• Sign-in attempts. Every link request records the email address and the IP it was requested from, including requests that are rejected. This is what makes it possible to stop anyone trying to use the sign-in form to send bulk mail to other people's addresses. They are deleted after 24 hours.
• Second factor, if you turn it on. The secret shared with your authenticator app and your recovery codes. The codes are stored hashed. The secret cannot be stored hashed —the original value is needed to check the codes your phone generates, as in any implementation of this mechanism— and it disappears as soon as you turn the second factor off.
• Your alerts. The name you give them, the saved search filters and the record of which listings you have already been notified about, needed so we don't send you the same one twice.

Neither sign-in links nor session identifiers are stored in a usable form: the database keeps only their cryptographic fingerprint, the same way it would with a password.

4. Analytics: none

This site has no analytics. There is no measurement tool installed, neither our own nor third-party: no Google Analytics, no self-hosted alternative, no social media pixels. The pages you visit are not counted in any dashboard.

What this means:

• No analytics cookies or persistent identifiers are set.
• Visitors are not tracked across different websites.
• No individual behavioural profiles are built.
• No browsing data is passed to analytics providers, because none is collected beyond the technical logs in the previous section.

5. Legal basis and purpose

For the technical logs of account-free browsing, and for the record of sign-in attempts, the basis is the controller's legitimate interest in keeping the site running and secure and in preventing abuse of the sign-in form. No profiles are built and visitors are not identified.

For the account and the alerts, the basis is the performance of the relationship you request: without your email it is not possible to give you access or to send you the notices you asked for. This processing exists only because you started it, and it ends when you delete the account.

The data is not used for advertising, and is neither sold nor shared with third parties for commercial purposes. Your email is not used to send you commercial communications: only sign-in links and the alerts you have set up.

6. Retention

The server's technical logs are kept for as long as is strictly necessary to guarantee the security of the service, and are rotated periodically. There are no analytics metrics to retain.

• Sign-in links: they expire after 15 minutes, can be used only once, and are deleted automatically on expiry.
• Sessions: 30 days if you tick the box to be remembered. If you don't, they expire after 12 hours and also disappear when you close the browser. In both cases they are deleted automatically, and signing out invalidates them immediately.
• Sign-in attempts: 24 hours.
• Account and alerts: kept for as long as the account exists. Deleting it also deletes its alerts and its notification history.

7. Processors

The site is hosted on a server contracted from an infrastructure provider, which acts as a processor and accesses the data only as far as is necessary to provide the hosting service.

If you have an account, the emails —sign-in links and alerts— are sent through Brevo (Sendinblue SAS, France), which acts as a processor. So that the message can be delivered to you, your email address and the content of the notice are passed to that provider. If you never create an account, this never happens.

The cartography on the pages with a map is provided by Google Maps (Google Ireland Limited). Google does not act here as our processor but as controller of its own processing: it defines the purposes of what it collects, and its terms and privacy policy are the ones that apply to that data.

That request exposes your IP address to this provider. So does part of the listing photos: those from portals that do not go through our resizing are requested by your browser straight from the agency's server. Both cases are set out in the cookie policy.

8. Listing data

The property information published comes from listings publicly circulated by agencies and portals. It refers to properties, not to individuals. When a listing includes an agency's contact details, those are professional data published by the agency itself for commercial purposes, and a link always points back to the original source.

If you believe personal information appears on the site that should not, write to us at ticand@gmail.com and we will remove it without undue delay.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to ticand@gmail.com, stating which right you wish to exercise.

If you have an account, write from the address you registered with: that is how you show the request is yours.

For account-free browsing, since no identifying data is collected it is not possible to link the information processed to a specific person, which may prevent certain requests from being met.

If you believe the processing does not comply with the rules, you can lodge a complaint with the Agència Andorrana de Protecció de Dades (APDA): https://www.apda.ad.