Privacy Policy: LeadROJO

Effective Date: May 12, 2026

Last Updated: May 12, 2026

1. Introduction & Ownership

This Privacy Policy describes how LeadROJO, a Spanish company (collectively, "the Company," "we," "us," or "our"), processes personal data through our AI-powered lead qualification platform.

By accessing our Service, you acknowledge the data practices described in this policy. In compliance with the Spanish Law on Information Society Services (LSSI), LeadROJO is the designated service provider for the LeadROJO platform.

2. Data Protection Roles & Representation

Under the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection (LOPDGDD):

Data Controller: The Real Estate Agency ("The Client") is the Controller for all "Lead Data" (prospective buyers/renters). The Agency determines the purpose and legal basis for contacting leads.
Data Processor: LeadROJO acts as the Processor for Lead Data, handling information only according to the Agency’s instructions and our Data Processing Agreement (DPA).
Independent Controller: LeadROJO is the Controller for "Account Data" (Agency admin details, billing, and platform usage analytics).
EU Establishment: LeadROJO is established in Spain. No Article 27 GDPR representative is required as the controller/processor is itself within the EU.

3. Information We Collect

Account Data: Names, business emails, and billing details of Agency staff.
Lead Data: Information ingested from third-party sources (e.g., Meta Lead Ads, Idealista, Fotocasa) including phone numbers and property preferences.
AI Interaction Data: Transcripts and metadata of automated WhatsApp interactions between our AI agents and Leads.
Technical Logs: IP addresses, browser types, and timestamps used for security monitoring.

4. AI Transparency & Human Oversight

In accordance with the EU AI Act (2026):

Interaction Notice: Our platform is designed to ensure that Leads are informed they are interacting with an AI system.
No Automated Legal Decisions: Our AI performs qualification only. It does not make automated decisions that produce legal effects. Final real estate brokerage decisions remain with the human agents of the Agency (Human-in-the-loop).
Transparency: Any text generated or manipulated by our AI for public interest matters is marked or detectable as artificially generated.

5. Data Residency & International Transfers

LeadROJO is established in Spain. Primary data residency is maintained in AWS Frankfurt (eu-central-1). Personal data of EU residents is processed within the EU/EEA whenever possible.

Sub-processors outside the EEA: When we rely on a sub-processor outside the EEA (e.g., certain AI API providers), we utilize the 2021 Standard Contractual Clauses (SCCs) and conduct Transfer Impact Assessments (TIAs) to ensure a level of protection equivalent to that in the EU.
Zero Data Retention with AI Vendors: Wherever supported, we configure AI providers in "Zero Data Retention" mode to prevent any persistence of Lead Data outside the EEA.

6. Data Subject Rights (ARCO-POL)

In compliance with Spanish and EU law, data subjects have the following rights:

Access: To know what data is being processed.
Rectification: To correct inaccurate data.
Cancellation (Erasure): To request the deletion of data ("Right to be Forgotten").
Opposition: To object to processing based on legitimate interest.
Portability: To receive data in a structured, machine-readable format.
Limitation: To restrict processing under specific legal conditions.

Note to Leads: Because we are a Data Processor, if you wish to exercise these rights regarding your lead info, please contact the Real Estate Agency directly.

7. Data Retention

We retain Account Data for the duration of the subscription. Lead Data is retained based on the "Data Retention Toggle" settings configured by the Agency. Upon termination, data is deleted or anonymized within 30 days.

8. Security

We implement TLS 1.3 encryption in transit and AES-256 encryption at rest. We utilize Zero Data Retention (ZDR) protocols where possible for AI API processing to ensure Lead Data is not used to train third-party LLMs.

9. Contact

For all privacy-related inquiries or to reach our Data Protection Officer:

LeadROJO
Email: contact@leadrojo.com
Address: [Insert registered office — Costa del Sol, Spain]