Privacy Policy

Data Controller

GRUPOTECA COMPANY LIMITED

Registered Address: UNIT2, 2 BRIDGE STREET, ATHLONE, N37F1W4, WESTMEATH, IRELAND

Business Type: Lead generation and connection platform for mortgage seekers

We are NOT a financial services provider, mortgage broker, or financial advisor.

Our Role as a Platform

GrupoTeca operates as a digital intermediation platform that connects mortgage seekers with financial institutions. We facilitate access to favorable financing conditions by grouping users with similar credit profiles.

We ARE: A lead generation platform • A connection service • A group coordination facilitator

We ARE NOT: A financial advisor • A mortgage broker • A lending institution • Involved in loan approval decisions

Data Collection

Personal Information: We collect your name, email address, and financial information necessary to process your mortgage application and group membership.

Financial Data: Income, expenses, employment information, and credit details required for mortgage assessment.

Technical Data: Device information, IP address, and usage analytics to improve our service and security.

Group Matching Algorithm

We use an automated matching system to group users with similar credit profiles. This system analyzes your financial information (income, debts, loan requirements) to find compatible group members.

Privacy Protection: Your personal identity remains anonymous to other group members. Only aggregated statistics are shared within groups.

Payment Data

Our service is free for users. We do not collect payment information from mortgage seekers. Banks are billed separately for our services.

Data Usage and Legal Basis

Legitimate Interest: We process your data to provide mortgage pooling services and match you with suitable groups based on your location and requirements.

Contract Performance: Processing your application and managing your group membership as outlined in our Terms of Service.

Legal Compliance: Meeting financial regulations and anti-money laundering requirements.

Consent: Marketing communications and optional features (you can withdraw consent at any time).

Data Sharing with Banks

⚠️ Your Explicit Consent is Required: Your financial data is shared anonymously to receive offers. Your personal identity is NEVER revealed without your explicit consent.

When We Reveal Your Identity: Only after you accept an offer and give your explicit consent. Before that, banks only see anonymized financial information.

What We Share: When you consent, we share your complete mortgage application data (personal information, financial details, employment information) with the specific banks you select.

Your Control: You choose which banks receive your information. You can withdraw from the process at any time before providing consent.

After Data is Shared:

Once your data is transferred to a bank, that bank becomes an independent data controller. They will process your data according to their own privacy policy and under their own responsibility.

We strongly recommend reviewing each bank's privacy policy before consenting to share your data.

We DO NOT share: Your personal information with other group members. Only anonymized statistics are shared for group formation.

We also share with:

Partner banks and lenders (only with your explicit consent as described above)

Legal authorities when required by law (court orders, regulatory compliance)

Cloud infrastructure providers (Supabase/AWS) under strict data processing agreements compliant with GDPR

Third-Party Data Controllers

It is important to understand the data controller relationships when using our platform:

GrupoTeca's Role: We are the data controller for your information while it is on our platform and during the group matching process.

Bank's Role: Once you consent to share your data, each bank becomes an independent data controller. They are responsible for their own data processing, security, and compliance with privacy laws.

Important: GrupoTeca is NOT responsible for how banks process, store, or use your data after transfer. Each bank has its own privacy policy that governs their handling of your information.

Your Rights (GDPR)

Right to Access: Request a copy of all your personal data

Data Portability: Export your data in a structured format

Right to Erasure: Request deletion of your personal data

Right to Rectification: Correct inaccurate personal data

Right to Restrict Processing: Limit how we use your data

Right to Object: Opt-out of processing based on legitimate interests

To exercise these rights, visit your Profile → Privacy and Data section or contact us at info@grupoteca.es

Data Security

We implement bank-grade security measures including:

End-to-end encryption for all data transmission

AES-256 encryption for data at rest

Multi-factor authentication and passkey support

Regular security audits and penetration testing

Data centers aligned with ISO 27001 practices

Data Retention

Active Accounts: Data retained while your account is active

Closed Accounts: Personal data deleted within 30 days of account closure

Legal Requirements: Some data may be retained longer for legal compliance (up to 7 years)

Anonymized Data: Aggregated statistics may be retained indefinitely for research purposes

International Data Transfers

Your data may be transferred outside the European Economic Area (EEA) as part of our cloud infrastructure services.

Safeguards in Place: We use cloud service providers (Supabase/AWS) that comply with GDPR requirements and have implemented Standard Contractual Clauses (SCCs) approved by the European Commission.

EU-US Transfers: Data may be processed in the United States under appropriate safeguards including SCCs and compliance with EU-US Data Privacy Framework principles where applicable.

Children's Privacy

Age Restriction: Our service is strictly for users aged 18 and over.

No Data from Minors: We do not knowingly collect or process personal data from anyone under the age of 18.

If Discovered: If we discover that we have inadvertently collected data from a minor, we will delete it immediately and notify the appropriate authorities if required by law.

Service Cost

Free for Users: Our mortgage matching service is completely free for users. There are no fees, subscriptions, or hidden costs.

How We Operate: GrupoTeca is funded through agreements with partner banks, not by charging users.

Cookies and Tracking

We use essential cookies for:

Authentication and security

User preferences (language, theme)

Session management

Optional cookies require your consent and include analytics and performance tracking.

Data Breach Notification

72-Hour Commitment: In the unlikely event of a data breach affecting your personal information, we are committed to notifying the Irish Data Protection Commission within 72 hours of becoming aware of the breach.

User Notification: If the breach poses a high risk to your rights and freedoms, we will notify you directly via email without undue delay, explaining the nature of the breach and steps you should take.

Our Response: We have comprehensive incident response procedures in place, including immediate containment, forensic investigation, and remediation measures to prevent future breaches.

Contact and Complaints

Data Protection Contact

For all data protection inquiries, requests, or complaints, contact us at: info@grupoteca.es

Supervisory Authority: You have the right to lodge a complaint with the Irish Data Protection Commission (www.dataprotection.ie) or your local EU data protection authority if you believe your data protection rights have been violated.

Response Time: We will acknowledge your request within 5 business days and provide a full response within 30 days as required by GDPR.

Updates to this Policy

We may update this privacy policy periodically. Material changes will be communicated via email and prominently displayed in the application. Continued use of our service after changes constitutes acceptance of the updated policy.