Privacy Policy
Privacy Policy
Last updated: 23 July 2026
1. Data Controller
| Name | Comunidad de Propietarios Lomas 2 del Higuerón |
| Representative | President of the Comunidad de Vecinos Lomas 2 del Higuerón |
| comunidad@higueronlomas2.com |
2. Personal Data We Process
2.1. Identity and residence data
| Data | Source |
|---|---|
| Email address | Provided by the resident when requesting access, or your Google account if you use "Sign in with Google" |
| Full name | Provided by the resident at registration or assigned by the community administration |
| Phone number | Provided by the resident (optional) or confirmed by the administration |
| Home(s) (Block, Entrance, Floor, Door) | Provided by the resident at registration or assigned by the administration. A single resident may be linked to several homes |
| Relationship to each home (owner / tenant / family or close relation) | Provided by the resident or assigned by the administration |
| Role and status within the portal (user, management, pending, active…) | Assigned by the community administration |
When you register, the data you enter (home, phone, name) is first stored as a request pending review and is not treated as verified until a member of the management team approves it.
2.2. Content you create in the portal
The portal is a community-management tool, so by using it you may create content that is linked to your identity and visible to other residents (or to the management team, depending on the section):
- Incidents you report (including the location you specify), roadmap ideas, comments, survey votes, facility bookings, guest-stay notices and their comments.
- Files and images you attach (for example, to incidents, tasks or announcements).
2.3. Activity log (internal audit)
To secure the private portal, keep an audit trail and support community management, the portal records the activity of authenticated users in an internal event log. This log may include: the action performed (for example, creating an incident or voting on an idea), the portal page visited, the language, the approximate device type (mobile / tablet / desktop, inferred from the window size), a temporary session identifier, the date and time, and a snapshot of your name and email at the time of the event.
This log is strictly for the community's internal use (accessible only to the administration) and is used for security, auditing and service improvement. We do not use third-party analytics, advertising, commercial profiling, or cross-site tracking.
2.4. Data we do NOT process
We do not store your IP address in the activity log (the IP is only used transiently at the infrastructure level to prevent abuse and rate-limit requests), nor precise geolocation, nor payment details, nor special-category data (health, beliefs, etc.).
3. Purposes of Processing
Data is processed to:
- Verify your identity as an authorised resident of the community.
- Control access to the private portal (finances, profile, documents, etc.).
- Send you the access code or link (magic link) when you request to sign in, as well as notifications about your registration request (received, approved or rejected).
- Manage community life: incidents, bookings, surveys, announcements, works tracking, etc.
- Ensure the security and integrity of the portal through the activity log described in section 2.3.
- Provide the AI assistant when you use it voluntarily (see section 6).
- Upon approving your registration, enrol you in the community's resources in Google Workspace (residents group and contact record), where this integration is enabled.
4. Legal Basis
- Article 6(1)(b) GDPR — performance of the relationship that binds you as a resident to the homeowners' association, and provision of the portal's services.
- Article 6(1)(f) GDPR — the legitimate interest of the community in ensuring that only residents access internal information, and in keeping a security and audit record of portal use.
- Article 6(1)(a) GDPR — your consent, for voluntary processing such as using the AI assistant.
5. Retention Periods
- Resident data (name, email, phone, home): retained while you are a resident of the community. Once you cease to be a resident, your data will be deleted or anonymised within a reasonable timeframe.
- Content and files you have created: retained while relevant to the community; attachments are deleted together with the record they belong to.
- Activity log: retained for a limited period for security and audit purposes.
- Access session: expires automatically after 30 days from your last sign-in. No action is required on your part.
6. The AI Assistant
When you use the portal's AI assistant, the text of your question (together with public portal content needed to answer you) is sent to the AI provider configured by the community to generate the response. Depending on the configuration, this provider may be OpenAI, Anthropic or Google, with servers that may be located outside the EEA (see section 7). We recommend you do not include third-party personal data or sensitive information in your questions to the assistant.
7. Disclosures and Data Processors
We do not sell or share your data with third parties for commercial or advertising purposes. To provide the service we work with the following data processors, under GDPR safeguards (data-processing agreements and, where applicable, Standard Contractual Clauses or the EU–US Data Privacy Framework):
| Processor | Service | Data involved | Location |
|---|---|---|---|
| Supabase Inc. | Database and authentication | All portal data and session credentials | European Union (Ireland) |
| Vercel Inc. | Portal hosting | Processes requests in transit (including the IP transiently for abuse prevention) | US / EU |
| Resend | Transactional email delivery | Your email address and the content of access/registration notifications | US |
| OpenAI / Anthropic / Google (per configuration) | AI assistant | The text of your questions to the assistant (if you use it) | US or others |
| Google LLC — Workspace (Admin SDK and People API) | Enrolling the approved resident in the community's group and contacts directory | Name, email, phone and home identifier of the approved resident | US / global |
| Google LLC — Sheets and Drive | Finance data source (read-only) and downloadable files | No resident personal data is sent | US / global |
| Cloudflare, Inc. — R2 | Storage of the files and images you attach | Attachments (which may contain personal data) | Depends on bucket configuration |
The main database (Supabase) is located within the European Union (Ireland). Some of the processors above (AI providers, email, hosting and Google services) may process data outside the EEA; such transfers are covered by the safeguards provided under the GDPR (EU–US Data Privacy Framework and/or Standard Contractual Clauses).
8. Your Rights
Under GDPR you have the right to:
- Access: request what personal data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure (right to be forgotten): request deletion of your data.
- Restriction of processing: request that we suspend the use of your data in certain circumstances.
- Data portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest.
To exercise any of these rights, send an email to comunidad@higueronlomas2.com stating the right you wish to exercise and enclosing a copy of your identity document. We will respond within a maximum of 30 days.
9. Supervisory Authority
If you believe that the processing of your data infringes data-protection law, you have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD):
- Website: www.aepd.es
- Electronic portal: sedeagpd.gob.es
10. Changes to this Policy
Any material changes to this policy will be communicated by updating the revision date at the top of this document. We recommend reviewing it periodically.