Who is responsible
The controller for the processing activities described in this policy is María Teresa Mielgo Nicolás (VELA CIRCLE). You may exercise your rights by writing to contact@vela-circle.com or from the "Legal and privacy" section of the application.
This policy covers both this public Website (vela-circle.com) and the VELA professional Platform available to registered users.
Data we collect on this Website
Contact form. If you use the contact form, we process your name, email address, company or agency, subject and message, solely in order to respond to your enquiry. Navigation. The Website does not use analytics, advertising, profiling or third-party tracking technologies. See the Cookie Policy.
Data processed in the Platform
Account: name, email, password (stored as a hash), language, preferences, agency, role and settings. Agency: name, logo, photograph, work zones, languages, specialties, professional collaboration phone and WhatsApp, availability, professional profile and relationships with other agencies. Professionals: name, professional email and phone, agency, zones, languages, specialties and activity status. Properties: characteristics, price, size, rooms, location, photographs, documents, source and publication and collaboration information. Buyer requirements: sought characteristics, zone, budget, rooms, dates, urgency, client type, language and the professional information needed to manage them. Clients: the Platform allows private client-related data to be entered. We recommend NOT entering ID numbers, passports, full phone numbers, personal emails, home addresses, financial data or unnecessarily sensitive information. The optional "last 5 digits of the phone number" field is used only as an internal signal to detect possible matches between demands; it is never shared with other agencies and does not allow the automatic identification of individuals.
Who is responsible for each processing activity
1. VELA CIRCLE's own processing. Accounts and authentication, agencies, Premium subscriptions, billing, referral programme, support, security, fraud prevention, service communications, legal compliance and rights management. For these processing activities, VELA CIRCLE is the controller.
2. Data entered by agencies for their professional activity. Properties, requests, client information, professionals and collaborations. Each agency decides what data it enters and for what purpose: the agency is the controller of that data and VELA CIRCLE processes it as a processor, following its instructions under the Data Processing Agreement (DPA).
3. Information shared between agencies. The agency that decides to share information is responsible for having a legal basis and the necessary authority to share it. VELA CIRCLE provides the infrastructure and applies the permissions chosen by the user; it does not verify the legitimacy of each item of shared data. The visibility of shared information depends on the permissions and settings available in the product at any given time.
Buyer requirements
VELA is designed so that professionals can share buyer requirements as professional descriptions of what a client is looking for, without identifying client data. The Platform does not require, display or distribute the personal identification data of end clients. Each agency remains responsible for the data it decides to enter.
Purposes and legal basis
We process personal data in order to provide the service requested (performance of a contract), with the user's consent where required, on the basis of legitimate interest for security and fraud prevention, and in order to comply with legal obligations.
Recipients and international transfers
Providers and sub-processors are recorded in an internal, up-to-date registry. Updated information may be requested from the "Legal and privacy" section of the application. Data is not transferred for advertising purposes. International transfers, where they exist, are documented in that registry together with the safeguards applicable in each case.
Retention
Data is kept for as long as necessary for each purpose; the details are set out in the data retention and deletion policy available in the application.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent from the "Legal and privacy" section of the application or by writing to contact@vela-circle.com. You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).
Security
The security measures implemented include managed authentication with per-account roles, isolation by agency (no agency can see another agency's private data), server-side authorisation of sensitive actions, architectural separation between the private CRM and the information shared on the network, private storage of voice recordings and documents with temporary access links, and activity logging. No own certifications are issued: the actual measures are those described here.
Artificial intelligence
The Platform offers AI-assisted features. Their use is described in the Artificial Intelligence Policy available in the application; AI results always require human review before being saved or shared.