Privacy Policy
Last updated: 22 October 2026
This policy explains which personal data we process when you visit this website or sign your agency up for the Yatoday Realty trial, why, for how long, and what you can ask of us. It is written in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE).
1. Controller
| Identity | Yatoday, S.L. |
| Tax ID (NIF) | PENDIENTE DE COMPLETAR |
| Address | PENDIENTE DE COMPLETAR |
| Companies Register | PENDIENTE DE COMPLETAR |
| dev@yatoday.es |
We have not appointed a Data Protection Officer because none of the cases of article 37.1 GDPR or article 34 LOPDGDD applies. For any privacy matter, write to dev@yatoday.es.
2. Summary
| Question | Short answer |
|---|---|
| Who processes my data? | Yatoday, S.L., as controller. |
| Which data? | What you write when signing up for the trial or in your message, and technical connection data. |
| What for? | To create your agency’s account and provide the trial, answer your messages and protect the site and the platform against abuse. |
| On what basis? | Pre-contractual steps at your request and our legitimate interest in the site’s security. |
| Who receives them? | The providers hosting the site and the platform, acting on our behalf. We do not sell them. |
| For how long? | See section 4. |
| What can I do? | Access, rectify, erase, object, restrict, port your data, withdraw consent and complain to the AEPD. |
3. Which data we process and where they come from
a) Signing up for the trial. The trial button of this site opens the sign-up page of the Yatoday Realty platform, where you give your agency’s name, your name, your email, a password (which we keep only as a hash) and the language, and we record the IP address and the date. Until you confirm your email with the link we send you, the sign-up is kept for 24 hours at most; once you confirm it, your user account and your agency’s trial account are created on the platform. During the trial we write to tell you when it ends.
b) Contact by email or WhatsApp. Your email address or phone number, your name or alias and the content of your message.
c) Technical data. When a page loads, our hosting provider logs the IP address, user agent, date and requested URL, to deliver the content and protect the site. The platform’s sign-up page loads Cloudflare Turnstile, which analyses browser signals to check that you are not a robot. This site does not load Turnstile.
This site uses no analytics or advertising and sets no cookies of its own.
We do not process special categories of data (article 9 GDPR). Please do not include them in your messages.
4. Purposes, legal bases and retention
| Purpose | Legal basis (art. 6 GDPR) | Retention |
|---|---|---|
| Creating your account and your agency’s, and providing the platform’s trial | Pre-contractual steps at the data subject’s request (art. 6.1.b) | Unconfirmed sign-up: 24 hours. Trial account: while it exists; if you do not subscribe, you can ask for its erasure at any time |
| Answering your messages and offering you the platform | Pre-contractual steps at the data subject’s request (art. 6.1.b) | 2 years from the last contact, if it does not lead to a contract |
| Providing and invoicing the service, if you subscribe | Performance of a contract (art. 6.1.b) and accounting and tax obligations (art. 6.1.c) | During the contract and then 6 years (art. 30 of the Spanish Commercial Code) |
| Protecting the site and the sign-up against attacks and automated sign-ups | Legitimate interest in keeping the service secure (art. 6.1.f) | Technical logs for 12 months at most |
| Handling requests to exercise rights and proving we have handled them | Legal obligation (art. 6.1.c) | 3 years from the answer |
After these periods the data are erased or anonymised. Meanwhile they may remain blocked, available only to courts and authorities, for the limitation periods of any liability (art. 32 LOPDGDD).
5. Contact by WhatsApp
If you choose to write to us on WhatsApp, the conversation takes place on the infrastructure of WhatsApp Ireland Limited, which processes your data as an independent controller under its privacy policy. We process your number and the conversation for the purposes and periods of section 4. Email is always an equivalent alternative.
6. Cookies
This site sets no cookies of its own and no analytics cookies. The technical cookies our hosting provider may set are described in the Cookie Policy.
7. Recipients and processors
We do not sell or share your data. To operate the site and the platform we use the following providers, acting as processors under a contract in accordance with article 28 GDPR:
| Provider | Purpose | Where processed | Safeguard for transfers |
|---|---|---|---|
| Cloudflare, Inc. / Cloudflare Ireland Ltd. | Hosting the site and the Turnstile of the sign-up page | EU, with access from the US | EU-US Data Privacy Framework (Decision 2023/1795) and Standard Contractual Clauses |
| Hetzner Online GmbH | Servers of the Yatoday Realty platform, where your sign-up and your account are kept | Germany and Finland (EU) | Processing within the EEA; not applicable |
We may also disclose data to courts, law enforcement and public authorities where the law requires it.
8. International transfers
The only transfer outside the EEA is possible access by Cloudflare, Inc. from the United States, covered by the EU-US Data Privacy Framework adequacy decision, to which it adheres, and additionally by the European Commission’s Standard Contractual Clauses. You can ask for a copy of the safeguards at dev@yatoday.es.
9. Automated decisions
We make no automated decisions producing legal effects concerning you or similarly significantly affecting you (art. 22 GDPR), and we do no profiling. Turnstile’s check only decides whether the sign-up is sent; if it fails, you can write to us by email.
10. Minors
This site is aimed at professionals and companies. We do not knowingly collect data from children under 14 (art. 7 LOPDGDD); if we find we have, we will erase them.
11. Security
We apply the appropriate technical and organisational measures required by article 32 GDPR, including TLS encryption, role-based access control and two-factor authentication on the platform, an activity log, regular backups and protection of the sign-up against automated sign-ups.
If a personal data breach is likely to result in a high risk to your rights, we will inform you without undue delay and notify the AEPD under articles 33 and 34 GDPR.
12. Your rights
You may at any time exercise your rights of access (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), portability (art. 20) and objection (art. 21), and withdraw your consent (art. 7.3) without affecting the lawfulness of prior processing.
How. Write to dev@yatoday.es stating the right you wish to exercise. If there is reasonable doubt about your identity we may ask for more information (art. 12.6 GDPR). It is free and we will answer within one month, extendable by two more months for complex requests.
Complaints. You may complain to the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).
13. Obligation to provide data
Providing your data is voluntary. Without your name, your agency’s name and an email we cannot answer your request.
14. Changes to this policy
We may update this policy to reflect changes in our processing, providers or the law. The version in force is always the one published on this page, dated at the top.
15. Language of this document
This document is published in Spanish, English and Russian, the languages of this site, so that you can read it in yours (art. 12.1 GDPR). The Spanish version is the only prevailing version; the others are translations provided for your understanding.