Privacy policy

Data controller

The controller of your personal data is María Claudia Vásquez Arias Schreiber, Spanish foreigner ID (NIE) Y7568049M and Peruvian ID (DNI) 10265905, with address at Calle Alonso de Ojeda 17, 6.º C, 30007 Murcia (España). You can reach the controller at hola@comunaris.com.

What data we process

• If you request a quote: name, email address, number of buildings and units, and the message you write.
• If you create an account: name, email address and password (stored encrypted). If you sign in with Google, the name, email and profile picture Google shares.
• The data of the buildings you manage: units, owners and contacts, dues, meter readings, bookings, vendors and announcements. They are entered by whoever manages the account, who is responsible for having obtained them lawfully; for that data, Comunaris acts as a processor.
• While you browse: the necessary cookies, the choice you make in the cookie notice and, only if you accept them, analytics usage data (see the Cookie policy).

Why we use it

• To answer your quote request.
• To provide the service and manage your account.
• To protect the service and keep the change log of each building.
• To keep proof of your cookie choice, so that we can demonstrate that you gave your consent.
• If you consent, to measure in aggregate how the public site is used.

Legal basis

• Quote request: steps taken at your request before entering into a contract (art. 6.1.b GDPR).
• Account and service: performance of the contract (art. 6.1.b GDPR).
• Security and change log: the legitimate interest in protecting the service and the data (art. 6.1.f GDPR).
• Proof of your cookie choice: compliance with a legal obligation (art. 6.1.c GDPR, in connection with art. 7.1 GDPR and art. 22.2 LSSI-CE).
• Analytics: your consent (art. 6.1.a GDPR), which you can withdraw at any time.

How long we keep it

Quote requests, up to one year after the last contact if they do not lead to a contract. Account and building data, while the account is active; afterwards, blocked for the legal limitation periods and then deleted. Proof of your cookie choice, three years from the choice (the limitation period for very serious infringements, art. 78 LOPDGDD); after that it is deleted automatically. Analytics data, as long as its cookies last according to the Cookie policy.

Recipients and processors

We do not share your data with third parties unless required by law. To provide the service we use providers that process it on our behalf:

• Supabase: database and authentication, with servers in the European Union (Ireland).
• Vercel: website hosting and a cookieless aggregate visit count (Vercel Web Analytics).
• Brevo: sending emails.
• Google: sign-in with Google and, only if you consent, Google Analytics.

When you choose in the cookie notice, we keep proof of that choice in our own database: a random identifier, the date, the notice version, the options selected, the language and the kind of action. It does not include your IP address, your browser details or your user account; on its own, it does not identify you.

If you buy a subscription, payment is processed by Paddle.com, which acts as reseller and Merchant of Record: it receives your payment and billing details and processes them as a controller, under its own privacy policy (paddle.com/legal/privacy).

International transfers

Some of these providers are based in the United States or may access the data from there. Those transfers rely on the EU-US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to hola@comunaris.com and stating which right you are exercising. If you believe they have not been properly handled, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

If you are in Peru

If you are in Peru, Law No. 29733, the Personal Data Protection Law, and its regulation, approved by Supreme Decree No. 016-2024-JUS, also apply.

• Basis for processing: your consent, which you can revoke at any time, except where the data is needed to prepare, enter into or perform a contractual relationship to which you are a party, in which case the law does not require it (article 14 of Law No. 29733).
• ARCO rights: you can exercise your rights of access, rectification (updating and inclusion), cancellation (erasure) and objection, as well as the right to information, by writing to hola@comunaris.com and stating which right you are exercising.
• Supervisory authority: if you believe your rights have not been properly handled, you can lodge a complaint with the National Authority for Personal Data Protection (Autoridad Nacional de Protección de Datos Personales), part of the Ministry of Justice and Human Rights.
• Cross-border flow: the providers listed under «Recipients and processors» host the data or may access it from outside Peru (European Union and United States). That cross-border flow (flujo transfronterizo) is necessary to provide the service you contract and takes place with providers that are contractually bound to give the data an adequate level of protection, in accordance with article 15 of Law No. 29733.

Security

We apply appropriate technical and organisational measures: encrypted connections, data access limited to each building and an audit log of every change.

Changes to this policy

If we change this policy, we will publish the new version on this page with its update date.