Privacy policy
Version 2 · 2 September 2026
SolProp is the trading name of Thinktier OÜ. Here we set out what personal data we collect on solprop.es, what we use it for, who else sees it, how long we keep it and what you can require of us. This policy covers only what this website does: if we ever change how we handle your data, we will change this text and its date too.
Data protection at a glance
The short version. The full detail follows in the sections below.
- Controller
- Thinktier OÜ, owner of the SolProp brand.
- Purpose
- To answer your property enquiries, send you the alerts or the report you sign up for, and measure in aggregate how the site is used.
- Legal basis
- Your consent and, once a transaction is under way, the performance of pre-contractual measures. Technical logs rest on our legitimate interest in keeping the site secure.
- Recipients
- Technology providers acting as processors, some of them outside the European Economic Area. All of them are listed by name, with their transfer safeguard, in section 3.
- Your rights
- Access, rectification, erasure, objection, restriction, data portability and the right to withdraw consent, by writing to privacidad@solprop.es.
- More information
- The detail of each processing activity, with its legal basis and its retention period, is in section 2.
1. Who processes your data
The controller is the company that owns the SolProp brand:
- Identity: Thinktier OÜ
- Registry code: 17249293
- Registered office: Harju maakond, Tallinn, Lasnamäe linnaosa, Lõõtsa tn 5, 11415
- Office in Spain: Calle Miguel de Cervantes 24, 29640 Fuengirola, Málaga
- Email for privacy matters: privacidad@solprop.es
- Telephone: +34 602 533 731
Data protection officer
We have not appointed a data protection officer because none of the circumstances that make one mandatory apply (Art. 37 GDPR and Art. 34 LOPDGDD, the Spanish data protection act). The channel for anything to do with your data is privacidad@solprop.es, and it is handled directly by the company's management.
2. What data we process, what for and on what legal basis
This table covers every processing activity behind this website. None of the forms on the site asks for an ID number, a postal address or bank details: that information only comes into play later, if we get as far as formalising a transaction, and we will tell you about it separately at that point.
| Processing activity | Data | What for | Legal basis | How long we keep it |
|---|---|---|---|---|
| Contact form and enquiries about a property | Name, email, telephone (optional), type of enquiry, whatever you write and, if you write from a property page, the reference of that property. | To reply to you and suggest properties that match what you are looking for. | Your consent when you submit the form (Art. 6(1)(a) GDPR). If we are already discussing a specific transaction, pre-contractual measures (Art. 6(1)(b)). | For as long as the conversation lasts. If it comes to nothing, we close the thread 12 months after the last message. |
| Selling and valuation form | Name, email, telephone, town and details of the home you want to sell (type, floor area, condition, timescale). | To prepare an indicative valuation for you and talk to you about the sale. | Consent (Art. 6(1)(a)) and pre-contractual measures (Art. 6(1)(b)). | 12 months from the last contact if you do not instruct us to handle the sale. |
| Private Market (off-market portfolio) | Name, email, telephone, area, property type, value bracket, timescale and preferred contact channel. | To match what you are looking for against deals we do not publish on the website and let you know if something comes up. | Your consent (Art. 6(1)(a)). | Until you ask to be removed, or 12 months with no interaction at all. |
| Property alerts by email | Email, the town and maximum price you choose, language, the date you gave your consent and a random identifier used to unsubscribe you. | To email you when we publish a property that meets your criteria. | Your consent (Art. 6(1)(a)), which you tick expressly before submitting the form. | Until you unsubscribe. |
| SolProp Radar report | Name, email, language and the investment preferences you tell us about: budget, minimum yield, areas of interest and country of residence. | To send you the monthly investment report and decide which areas and deals are highlighted in your copy. | Your consent (Art. 6(1)(a)). | Until you ask to be removed. |
| Web analytics (Google Analytics 4) | The pages you visit, how you reached the site, device type, approximate country and city, and a cookie identifier. Google receives your IP address in order to work out that location, but does not store it in Google Analytics 4. | To know, in aggregate, which pages work and which do not. | Your consent in the cookie banner (Art. 6(1)(a) GDPR and Art. 22(2) LSSI, the Spanish e-commerce act). If you do not give it, analytics does not run. | The period configured in our Google Analytics property, capped at 14 months for user and event data. Aggregate reports do not expire. |
| Hosting, technical logs and abuse control | IP address, date and time, page requested and browser. | To serve the website, diagnose errors and stop abuse of the forms: we limit alert sign-ups to five per hour per IP address. | Our legitimate interest in keeping the site available and secure (Art. 6(1)(f)). It is not used to profile you or to advertise to you. | Server logs are kept by our hosting provider for the short period included in its plan (days, not months). The anti-abuse counter lives in memory and forgets after an hour. |
| Conversations by WhatsApp or telephone | Your number, your profile name and whatever you write or tell us. | To help you through the channel you prefer. | Your consent (Art. 6(1)(a)): you are the one who starts the conversation on that channel. | For as long as the conversation lasts and up to 12 months after the last message. |
If we get as far as formalising a transaction, the law requires us to collect and keep additional documentation (identification, anti-money laundering, tax and accounting obligations). That processing does not happen through this website: we will tell you about it separately when the time comes.
3. Who else sees your data, and transfers outside the EEA
To make the site work we use third-party services that process data on our behalf. Some are outside the European Economic Area (EEA), so we tell you which ones they are, what they receive and what safeguard covers that transfer.
| Provider | What it does for us | Where it processes the data | Transfer safeguard |
|---|---|---|---|
| Web3Forms | Collects submissions from the contact, selling and Private Market forms and forwards them to us by email. | United States | ⚠︎ Verification pending. We are moving these forms onto our own server so we no longer depend on this provider. |
| Google Ireland Ltd. / Google LLC | Google Analytics 4: aggregate usage statistics. It only runs if you accept analytics cookies. | Ireland, with access from the United States | EU-US Data Privacy Framework and standard contractual clauses. |
| Vercel Inc. | Hosts and serves solprop.es and runs the site's server functions (alert forms and the like). | United States | EU-US Data Privacy Framework and standard contractual clauses. |
| Resend Inc. | Emails the SolProp Radar report to subscribers. | United States | EU-US Data Privacy Framework and standard contractual clauses. |
| Hostinger International Ltd. | Hosts api.solprop.es, where the content, the property listings and the alerts register live. | European Union (Lithuania) | No international transfer takes place. |
| CARTO | Serves the map images on the site. It sets no cookies or identifiers: it receives your IP address like any other server your browser downloads an image from. | United States | ⚠︎ Verification pending. |
| WhatsApp Ireland Ltd. (Meta) | Only if you choose to message us on WhatsApp: the conversation goes through their platform. | Ireland, with transfers to Meta Platforms Inc. (United States) | EU-US Data Privacy Framework and standard contractual clauses. |
"Verification pending" means we have not yet signed and documented the data processing agreement with that provider. We are sorting it out, and we would rather tell you than keep quiet about it. If that worries you, write to privacidad@solprop.es and we will agree another way of getting in touch.
Away from the digital side, your data may be passed to public authorities where the law requires it, to notaries and registries in order to formalise a transaction, and to financial institutions if you ask us to arrange a mortgage. We never sell or pass on your data to third parties for advertising purposes.
4. Profiling and automated decisions
If you subscribe to the SolProp Radar report we use the preferences you give us - budget, minimum yield, areas of interest and country of residence - to decide which areas and which deals are highlighted in your copy of the report. That is profiling within the meaning of Article 4(4) GDPR, which is why we are telling you here rather than hiding it.
There is no automated decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR): no system decides on its own whether we deal with you, at what price, or whether you get access to a property.
You can object to that profiling at any time: unsubscribe from the report or write to privacidad@solprop.es. You can carry on receiving the generic report if you prefer.
5. How long we keep your data
The specific period for each processing activity is in the table in section 2. As a general rule: data from an enquiry that goes nowhere is closed 12 months after the last message; subscription data (alerts and Radar) lives until you ask to be removed; and technical server logs are kept by our hosting provider for a few days.
Where a legal obligation applies - tax, accounting or anti-money laundering - we keep only what that rule requires, for as long as it says, blocked and not used for any other purpose.
6. Your rights and how to exercise them
You have the following data subject rights over your data:
- Access: to know what data of yours we process and get a copy of it.
- Rectification: to correct anything wrong or incomplete.
- Erasure: to ask us to delete your data once it is no longer needed.
- Objection: to object to processing based on our legitimate interest, including the profiling behind the Radar report.
- Restriction: to ask us to keep your data but not use it while a disagreement is being resolved.
- Data portability: to receive the data you gave us in a structured, machine-readable format.
- Withdrawal of consent: to withdraw consent whenever you like, without affecting the lawfulness of what we did before.
To exercise them, write to privacidad@solprop.es from the address you contacted us with, or use any of the channels in section 1. You do not have to explain why, and it costs you nothing.
If what you send us is not enough to identify you with confidence, we will ask for something extra. We do not keep copies of identity documents for this.
We will reply within one month of receiving your request. If the request is particularly complex we may extend that by up to two further months, and we will tell you within that first month.
If you think we have got it wrong, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es). As the controller company is registered in Estonia, you can also go to the Estonian supervisory authority, Andmekaitse Inspektsioon (www.aki.ee).
7. Cookies and web analytics
This site uses a minimal number of cookies and browser local storage, and Google Analytics only runs if you accept it. The detail of each one - name, owner, purpose and duration - is in our cookie policy, where you can also change or withdraw your choice at any time.
8. Children
This site is aimed at adults and we neither ask for nor want data from children under 14 (Art. 7 LOPDGDD). If we find that someone below that age has left us their data without the consent of whoever has parental responsibility, we delete it. If you are a parent or guardian and think this has happened, write to privacidad@solprop.es and we will sort it out.
9. Security
The site is always served over HTTPS, with HSTS, a content security policy that restricts which third parties can run, and protection against the site being embedded in another. The content server credentials are server-side and never reach the browser. Even so, no system is infallible: if a breach occurred that posed a high risk to your rights, we would tell you and notify the supervisory authority, as Articles 33 and 34 GDPR require.
10. Changes to this policy
We update this text when what we do changes, not as a matter of routine. Every version carries its date. If a change genuinely affects you - a new purpose, a new recipient - we will tell you by email if you are subscribed, and we will ask for your consent again where the law requires it.
Last updated: 2 September 2026